peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
3224f49b65f7bc7fdea8170b5d3e1788e05956bc
infix/doc/TODO.org
T
Joachim Wiberg 3224f49b65 confd: initial zone-based firewall support, based on firewalld 
Add supoprt for infix-firewall.yang, modeled on the zone-based firewalld
The terminology is a mix of firewalld, classic netfilter and inspired by
Ubiquity.  E.g., zone 'policy' -> 'action', and the zone matrix overview.

 - Port forwarding allows forwarding a range of ports
 - Operational data comes from firewalld active rules
 - Firewall logging goes to /var/log/firewall.log
 - Show implicit/built-in rules and zones (HOST) in firewall matrix,
   includes "locked" policy for the default-drop behavior
 - The zone services field in admin-exec 'show firewall' shows ANY when
   the zone default action is set to 'accept'
 - Zone 'forwarding' and 'masquerade' settings live in Infix in the
   policys instead, meaning users need to explicitly add a policy
   to allow both intra-zone and inter-zone forwarding
 - Support for emergency lockdown (kill switch)
 - Pre-defined services (xml+enums) are filtered and included as a
   separate YANG model, extensions added for netconf and restconf
 - Includes initial support for firewalld rich rules

firewalld policy rules, including rich rules, have an obnoxious priority
field which is extremely hard to get right, so in Infix we use the far
superior YANG construct 'ordered-by user;'.  This ensure all rules are
generated in that order by setting the priority field, on read-back from
firewalld (operational) the priority field is used to sort the output
of rules in the CLI.

Fixes #448

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2025-10-10 15:14:12 +02:00

4.1 KiB
Raw Blame History

TODO Add support for firewall

  • All "implicit" policies in zones are now policies: intra- and inter-zone policies
  • Add locked rules for implicit drop/reject policy as last rule in policy (ANY, ANY)
  • Firewall logs should show IN=iface (IIF) before SOURCE
  • Interfaces are not defaulting to the default zone, must handle bridge ports and changes to enslavement, so regenerate every time is a must!
  • firewalld helpers – possibly for conntrack, e.g., ftp
  • With modprobe br_netfilter firewalld would see all traffic, but there are issues, <https://github.com/firewalld/firewalld/issues/1236>, and limits to what seem to be possible atm. You may also need to enable these callbacks: echo 1 | sudo tee /proc/sys/net/bridge/bridge-nf-call-iptables echo 1 | sudo tee /proc/sys/net/bridge/bridge-nf-call-ip6tables echo 1 | sudo tee /proc/sys/net/bridge/bridge-nf-call-arptables
  • Add missing upper to port forward since port ranges are supported, see services!
  • [do] show firewall not available yet
  • Add RPC to pause firewall using firewall-cmd --panic-on and restart firewall again with firewall-cmd --panic-off. The current state can be queried using firewall-cmd --query-panic, which returns yes
  • Remove debug log messages!
  • Add "Log Messages" section to show firewall when LogDenied ≠ off
  • Investigate filtering out firewall log messages from other log files
  • [1/2] Rename policy->policy to policy->action, and replace allow->forward
  • Rename zone->sources to networks
  • A zone's action is for ingress, clarify this if missing!
  • Any services/ports listed in a zone with policy:accept are a NO-OP
  • firwall-cmd --reload takes fooooorever! :-(
  • If forwarding is disabled in a zone then the zone matrix should show deny for the same zone-to-zone communication
  • We should show the implicit rules for communicating with the HOST
  • Investigate "padlock" on built-in policys (and zones?) and expose more?
  • Document established,related somewhere, fixed/padlocked policy? Also, document why this is a good idea to always have enabled. See RH docs.
  • Podman published ports, <https://firewalld.org/2024/11/strict-forward-ports>
  • Software fastpath <https://firewalld.org/2023/05/nftables-flowtable>
  • Allow overriding/editing immutable policies and zones+
  • Add tests: basic (end device), wan-lan, wan-lan-dmz, hammer (stress)

  • Add documentation

  • Fix inference so we can remove defaults from factory-config!
  • Add iperf service
  • Add nftables ownership=yes setting, introduced in later firewalld versions
  • Investigate fail2ban integration with firewalld, for more info, see: https://github.com/firewalld/firewalld/issues/1466#issuecomment-2773130569
  • Update screenshots for documentation
  • Review both cli-pretty and yanger code
  • Review default-zone handling (needed?)
  • Clean up INFER_POLICY ifdefs
  • Revisit built-in fallback zones (public, block, drop)

TODO doc: User Guide

  • Feature set and scope, e.g.

    • Device discovery: LLDP, mDNS-SD how do they work, interfacing with Windows/macOS/Linux
    • Network redundancy protocols: STP/RSTP, MRP
  • Configuring the system; using ifupdown2, enabling/disabling services
  • Diagnosing the system; using rmon, port mirroring, debugging services, searching logs
  • Limitations, e.g., PRP/HSR or IEEE 802.1CB will not be possible to support
  • Tips & Trix

TODO document how to set up passwordless SSH

TODO add setup wizard, based on pdmenu

  • setup-port script to tweak ethtool settings
  • setup-iface script to configure a layer-3 interface
  • setup-bridge script that creates a new bridge with config from cmdline
  • setup-firewall script that can do basic firewall rules and masquerading

TODO split out qemu Config.in to a "make run-menuconfing"

TODO rename qemu/ to run/, perhaps?

TODO ship qemu/* with output/images/ for stand-alone runs of older builds

Reference in New Issue View Git Blame Copy Permalink