So it behaves the same way the 'old' firewall did. Since currently ct state invalid are always dropped on the guest table, regardless of the option. The host behaviour is not changed as it would require `forward` to match the 'old' behaviour.
Signed-off-by: Hannes Laimer <h.lai...@proxmox.com> --- based on what @Stefan suggested in response to [1]. This matches what the old fw did with this option on vms. [1] https://lore.proxmox.com/pve-devel/918ffc4c-c371-4d43-8c2c-849e61827...@proxmox.com/T/#t .../resources/proxmox-firewall.nft | 4 +++- proxmox-firewall/src/firewall.rs | 10 ++++++++ .../integration_tests__firewall.snap | 23 +++++++++++++++++++ 3 files changed, 36 insertions(+), 1 deletion(-) diff --git a/proxmox-firewall/resources/proxmox-firewall.nft b/proxmox-firewall/resources/proxmox-firewall.nft index f42255c..f823a60 100644 --- a/proxmox-firewall/resources/proxmox-firewall.nft +++ b/proxmox-firewall/resources/proxmox-firewall.nft @@ -325,8 +325,10 @@ table bridge proxmox-firewall-guests { iifname vmap @vm-map-out } + chain invalid-conntrack { } + chain pre-vm-in { - meta protocol != arp ct state vmap { established : accept, related : accept, invalid : drop } + meta protocol != arp ct state vmap { established : accept, related : accept, invalid : jump invalid-conntrack } meta protocol arp accept } diff --git a/proxmox-firewall/src/firewall.rs b/proxmox-firewall/src/firewall.rs index 941aa20..4ced6a8 100644 --- a/proxmox-firewall/src/firewall.rs +++ b/proxmox-firewall/src/firewall.rs @@ -92,6 +92,10 @@ impl Firewall { ChainPart::new(table, format!("group-{name}-{dir}")) } + fn guest_invalid_conntrack_chain() -> ChainPart { + ChainPart::new(Self::guest_table(), format!("invalid-conntrack")) + } + fn host_conntrack_chain() -> ChainPart { ChainPart::new(Self::host_table(), "ct-in".to_string()) } @@ -126,6 +130,7 @@ impl Firewall { Add::chain(Self::host_chain(Direction::Out)), Flush::chain(Self::host_chain(Direction::Out)), Flush::chain(Self::host_option_chain(Direction::Out)), + Flush::chain(Self::guest_invalid_conntrack_chain()), Flush::map(Self::guest_vmap(Direction::In)), Flush::map(Self::guest_vmap(Direction::Out)), Flush::chain(Self::host_conntrack_chain()), @@ -398,6 +403,11 @@ impl Firewall { chain_in, Statement::jump("block-conntrack-invalid"), ))); + + commands.push(Add::rule(AddRule::from_statement( + Self::guest_invalid_conntrack_chain(), + Statement::make_drop(), + ))); } if let Some(value) = self.config.host().nf_conntrack_max() { diff --git a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap index 40d4405..155b999 100644 --- a/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap +++ b/proxmox-firewall/tests/snapshots/integration_tests__firewall.snap @@ -76,6 +76,15 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "flush": { + "chain": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "name": "invalid-conntrack" + } + } + }, { "flush": { "map": { @@ -1927,6 +1936,20 @@ expression: "firewall.full_host_fw().expect(\"firewall can be generated\")" } } }, + { + "add": { + "rule": { + "family": "bridge", + "table": "proxmox-firewall-guests", + "chain": "invalid-conntrack", + "expr": [ + { + "drop": null + } + ] + } + } + }, { "add": { "rule": { -- 2.39.5 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
