Joseph.Rawlings/Virtnet.bond
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: refine matching logic in firewall to ensure source IP consistency and enhance flexibility in destination port checks

Browse Source
This commit is contained in:
Joseph.Rawlings
2025-12-04 22:49:06 -05:00
parent 27c8a8ebfd
commit d2fe9fe6cf
1 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
extensions/Servers/Proxmox/Livewire/Firewall.php
View File

@@ -1677,11 +1677,21 @@ class Firewall extends Component
$normalizedStateDestIP = strtolower(trim($stateDestIP)); $normalizedStateDestIP = strtolower(trim($stateDestIP));
$normalizedProtocol = strtoupper(trim($protocol)); $normalizedProtocol = strtoupper(trim($protocol));
// Flexible matching logic - multiple levels of matching // Matching logic - Source IP from log MUST always match
// The source IP can appear as either source or destination in the state (for return traffic)
$ipMatch = false; $ipMatch = false;
$matchType = ''; $matchType = '';
// Level 1: Exact bidirectional match (both IPs match in either direction) // Check if the log's source IP appears in the state
$sourceInState = ($normalizedStateSourceIP === $normalizedSourceIP || $normalizedStateDestIP === $normalizedSourceIP);
if (!$sourceInState) {
// Source IP not found in this state - skip it
continue;
}
// Source IP matches, now check destination
// Level 1: Exact match - both IPs match (in either direction)
if ($normalizedStateSourceIP === $normalizedSourceIP && $normalizedStateDestIP === $normalizedDestIP) { if ($normalizedStateSourceIP === $normalizedSourceIP && $normalizedStateDestIP === $normalizedDestIP) {
$ipMatch = true; $ipMatch = true;
$matchType = 'exact'; $matchType = 'exact';
@@ -1690,22 +1700,16 @@ class Firewall extends Component
$ipMatch = true; $ipMatch = true;
$matchType = 'exact-reversed'; $matchType = 'exact-reversed';
} }
// Level 2: Destination IP match (log dest matches either state IP) - catches related traffic // Level 2: Source IP matches, destination is flexible (shows all traffic from this source)
elseif ($normalizedStateSourceIP === $normalizedDestIP || $normalizedStateDestIP === $normalizedDestIP) { elseif ($sourceInState) {
$ipMatch = true; $ipMatch = true;
$matchType = 'dest-partial'; $matchType = 'source-match';
}
// Level 3: Source IP match (log source matches either state IP) - catches related traffic
elseif ($normalizedStateSourceIP === $normalizedSourceIP || $normalizedStateDestIP === $normalizedSourceIP) {
$ipMatch = true;
$matchType = 'source-partial';
} }
// Protocol match - be flexible // Protocol match - be flexible
$protocolMatch = (empty($protocol) || $protocol === '-' || $normalizedProtocol === $stateProtocol); $protocolMatch = (empty($protocol) || $protocol === '-' || $normalizedProtocol === $stateProtocol);
// Port match - check if destination port from log matches any port in state // Port match - check if destination port from log matches any port in state
// Also allow match if no port specified or if it's a partial IP match
$portMatch = false; $portMatch = false;
if (empty($destPort) || $destPort === '-') { if (empty($destPort) || $destPort === '-') {
$portMatch = true; // No port specified, match all $portMatch = true; // No port specified, match all
@@ -1714,8 +1718,8 @@ class Firewall extends Component
if ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum) { if ($stateDestPort === $destPortNum || $stateSourcePort === $destPortNum) {
$portMatch = true; $portMatch = true;
} }
// For partial matches, also accept if protocol matches even if port doesn't // For source-match type, be more flexible on ports if protocol matches
if (!$portMatch && str_contains($matchType, 'partial') && $protocolMatch) { if (!$portMatch && $matchType === 'source-match' && $protocolMatch) {
$portMatch = true; $portMatch = true;
} }
} }