[pve-devel] [PATCH 4/4] move nosmurfs, tcpflags and conntrack established outside tap chains

[Alexandre Derumier]

theses should be done fast,

conntrack established can be done in PVE-FORWARD now

smurf and tcpflags can be done in PVEFW-BRIDGE-IN (don't make sense to test them in OUT direction)

-A PVEFW-FORWARD ! -i fwbr+ -j ACCEPT
-A PVEFW-FORWARD -m conntrack --ctstate INVALID -j DROP
-A PVEFW-FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PVEFW-FORWARD -m physdev --physdev-in link+ -j PVEFW-FWBR-IN
      -A PVEFW-FWBR-IN -p tcp -j PVEFW-tcpflags
      -A PVEFW-FWBR-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs
      -A PVEFW-FWBR-IN -m physdev --physdev-out tap123i0 --physdev-is-bridged -j tap123i0-IN
      -A PVEFW-FWBR-IN -m physdev --physdev-out veth0.0 --physdev-is-bridged -j veth0.0-IN
-A PVEFW-FORWARD -m physdev --physdev-is-bridged --physdev-out link+ -j PVEFW-FWBR-OUT
      -A PVEFW-FWBR-OUT -m physdev --physdev-in tap123i0 -j tap123i0-OUT
      -A PVEFW-FWBR-OUT -m physdev --physdev-in veth0.0  -j veth0.0-OUT

Signed-off-by: Alexandre Derumier <aderumier at odiso.com>
---
 src/PVE/Firewall.pm |   33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index a285baa..bae80fa 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1434,10 +1434,6 @@ sub ruleset_create_vm_chain {
     ruleset_create_chain($ruleset, $chain);
     my $accept = generate_nfqueue($options);
 
-    if (!(defined($host_options->{nosmurfs}) && $host_options->{nosmurfs} == 0)) {
-	ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs");
-    }
-
     if (!(defined($options->{dhcp}) && $options->{dhcp} == 0)) {
 	if ($direction eq 'OUT') {
 	    ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT',
@@ -1448,17 +1444,6 @@ sub ruleset_create_vm_chain {
 	}
     }
 
-    if ($host_options->{tcpflags}) {
-	ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags");
-    }
-
-    ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP");
-    if ($direction eq 'OUT') {
-	ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
-    } else {
-	ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
-    }
-
     if ($direction eq 'OUT') {
 	if (defined($macaddr) && !(defined($options->{macfilter}) && $options->{macfilter} == 0)) {
 	    ruleset_addrule($ruleset, $chain, "-m mac ! --mac-source $macaddr -j DROP");
@@ -2570,12 +2555,9 @@ sub compile {
     # fixme: what log level should we use here?
     my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
 
-    if($hostfw_options->{optimize}){
-
-	my $accept = ruleset_chain_exist($ruleset, "PVEFW-IPS") ? "PVEFW-IPS" : "ACCEPT";
-	ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate INVALID -j DROP");
-	ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
-    }
+    my $accept = ruleset_chain_exist($ruleset, "PVEFW-IPS") ? "PVEFW-IPS" : "ACCEPT";
+    ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate INVALID -j DROP");
+    ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
 
     if ($cluster_conf->{ipset}->{blacklist}){
 	ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-m set --match-set PVEFW-blacklist src");
@@ -2584,6 +2566,15 @@ sub compile {
 
     if (!ruleset_chain_exist($ruleset, "PVEFW-FWBR-IN")) {
 	ruleset_create_chain($ruleset, "PVEFW-FWBR-IN");
+
+	if (!(defined($hostfw_options->{nosmurfs}) && $hostfw_options->{nosmurfs} == 0)) {
+	    ruleset_addrule($ruleset, "PVEFW-FWBR-IN", "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs");
+	}
+
+	if ($hostfw_options->{tcpflags}) {
+	    ruleset_addrule($ruleset, "PVEFW-FWBR-IN", "-p tcp -j PVEFW-tcpflags");
+	}
+
 	ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-in link+ -j PVEFW-FWBR-IN");
     }
 
-- 
1.7.10.4