Introduce stateful "in TARGET" and "out TARGET" rules - #188
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c2df74a993
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| None => { | ||
| self.admit_with_tracking_if_stateful(pending, ipv4_pkt.src_addr(), Direction::Out) |
There was a problem hiding this comment.
When any directional rule enables flow inspection, an inbound TCP or UDP packet from an unmatched private peer reaches this None branch but is committed only if an explicit outbound rule also matches. The initial packet is therefore allowed, but the VM's reply has no flow entry and is rejected by the normal egress fallback because the peer is neither global, the gateway, nor an approved DNS server; for example, adding an unrelated in @host rule makes otherwise default-allowed connections from LAN addresses unable to complete. Track the pending flow when the reverse packet would otherwise be denied by the built-in egress policy as well.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
This is intended to preserve legacy behavior, where inbound packets are accepted by default, but replies to unmatched private peers (for example, 192.168.0.0/16) remain subject to the built-in egress policy and are denied unless explicitly allowed.
2 participants
This allows us to have more granular network filtering policies, improving the security offered by
--allowand--block.For example, under a default-deny policy,
@hostpreviously allowed a VM to initiate connections to the host; nowin @hostcan prevent that, and the same applies to CIDR targets.This PR opts not to implement a full-fledged connection tracker, favoring security and simplicity over availability.