[pve-devel] [PATCH proxmox-ve-rs 1/1] partial fix #6226: macros: add LDAP_UDP macro

[Stefan Hanreich]

On 3/19/25 09:50, Christoph Heiss wrote:
> On Tue Mar 18, 2025 at 4:38 PM CET, Stefan Hanreich wrote:
>> Add LDAP_UDP macro to the firewall to support LDAP implementations
>> that use UDP as well, such as Windows AD [1]
>>
>> [1] https://learn.microsoft.com/de-de/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts
>> [..]
>> --- a/proxmox-ve-config/resources/macros.json
>> +++ b/proxmox-ve-config/resources/macros.json
>> @@ -377,6 +377,15 @@
>>      ],
>>      "desc": "Lightweight Directory Access Protocol traffic"
>>    },
>> +  "LDAP_UDP": {
> 
> What about naming it "AD" instead and including both the TCP and UDP
> rule instead? I.e. making it completely separate from the "normal" LDAP
> rule.

The idea was to not suddenly open up a port for users that are using
that macro currently (and it works fine for them).

> Naming it "LDAP_UDP" could be confusing to users, in that it might be
> required for actual, compliant LDAP servers as well, not just AD.

Agreed, that the name might not be optimal, I'm open to suggestions.

>> +    "code": [
>> +      {
>> +        "dport": "389",
>> +        "proto": "udp"
>> +      }
>> +    ],
>> +    "desc": "Lightweight Directory Access Protocol traffic via UDP"
>> +  },
>>    "LDAPS": {
>>      "code": [
>>        {
>