Proxmox/pve-firewall
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-firewall.git synced 2025-01-04 09:17:58 +03:00
Code Releases Activity

simulator: use new bridge naming scheme

Browse Source 
We now allow bridges without the vmbr prefix, so we need to allow them
here in the simulator as well.

Reviewed-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
This commit is contained in:
Stefan Hanreich 2024-04-12 10:07:36 +02:00 committed by Thomas Lamprecht
parent 50af7e0970
commit b5c4c33632
2 changed files with 22 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/PVE/FirewallSimulator.pm
View File

@ -7,6 +7,12 @@ use PVE::Firewall;
use File::Basename;
use Net::IP;
use base 'Exporter';
our @EXPORT_OK = qw(
$bridge_name_pattern
$bridge_interface_pattern
);
# dynamically include PVE::QemuServer and PVE::LXC
# to avoid dependency problems
my $have_qemu_server;
@ -27,6 +33,9 @@ my $debug = 0;
my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
our $bridge_name_pattern = '[a-zA-Z][a-zA-Z0-9]{0,9}';
our $bridge_interface_pattern = "($bridge_name_pattern)/(\\S+)";
sub debug {
my $new_value = shift;
$debug = $new_value if defined($new_value);
@ -397,7 +406,7 @@ sub route_packet {
$pkg->{physdev_in} = $target->{fwln} || die 'internal error';
$pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
} elsif ($route_state =~ m/^vmbr\d+$/) {
} elsif ($route_state =~ m/^$bridge_name_pattern$/) {
die "missing physdev_in - internal error?" if !$physdev_in;
$pkg->{physdev_in} = $physdev_in;
@ -531,11 +540,6 @@ sub simulate_firewall {
$from_info->{type} = 'host';
$start_state = 'host';
$pkg->{source} = $host_ip if !defined($pkg->{source});
} elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
$from_info->{type} = 'bport';
$from_info->{bridge} = $1;
$from_info->{iface} = $2;
$start_state = 'from-bport';
} elsif ($from eq 'outside') {
$from_info->{type} = 'bport';
$from_info->{bridge} = 'vmbr0';
@ -559,6 +563,11 @@ sub simulate_firewall {
$from_info = extract_vm_info($vmdata, $vmid, $netnum);
$start_state = 'fwbr-out';
$pkg->{mac_source} = $from_info->{macaddr};
} elsif ($from =~ m|^$bridge_interface_pattern$|) {
$from_info->{type} = 'bport';
$from_info->{bridge} = $1;
$from_info->{iface} = $2;
$start_state = 'from-bport';
} else {
die "unable to parse \"from => '$from'\"\n";
}
@ -569,10 +578,6 @@ sub simulate_firewall {
$target->{type} = 'host';
$target->{iface} = 'host';
$pkg->{dest} = $host_ip if !defined($pkg->{dest});
} elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
$target->{type} = 'bport';
$target->{bridge} = $1;
$target->{iface} = $2;
} elsif ($to eq 'outside') {
$target->{type} = 'bport';
$target->{bridge} = 'vmbr0';
@ -591,6 +596,10 @@ sub simulate_firewall {
my $vmid = $1;
$target = extract_vm_info($vmdata, $vmid, 0);
$target->{iface} = $target->{tapdev};
} elsif ($to =~ m|^$bridge_interface_pattern$|) {
$target->{type} = 'bport';
$target->{bridge} = $1;
$target->{iface} = $2;
} else {
die "unable to parse \"to => '$to'\"\n";
}

5
src/PVE/Service/pve_firewall.pm
View File

@ -18,6 +18,7 @@ use PVE::Tools qw(dir_glob_foreach file_read_firstline);
use PVE::Firewall;
use PVE::FirewallSimulator;
use PVE::FirewallSimulator qw($bridge_interface_pattern);
use base qw(PVE::Daemon);
@ -312,14 +313,14 @@ __PACKAGE__->register_method ({
from => {
description => "Source zone.",
type => 'string',
pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
pattern => "(host|outside|vm\\d+|ct\\d+|$bridge_interface_pattern)",
optional => 1,
default => 'outside',
},
to => {
description => "Destination zone.",
type => 'string',
pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
pattern => "(host|outside|vm\\d+|ct\\d+|$bridge_interface_pattern)",
optional => 1,
default => 'host',
},