[pve-firewall.git] / PVE / Firewall.pm

package PVE::Firewall;

use warnings;
use strict;
use Data::Dumper;
use PVE::Tools;
use PVE::QemuServer;
use File::Path;
use IO::File;
use Data::Dumper;

my $macros;
sub get_shorewall_macros {

    return $macros if $macros;

    foreach my $path (</usr/share/shorewall/macro.*>) {
	if ($path =~ m|/macro\.(\S+)$|) {
	    $macros->{$1} = 1;
	}
    }
    return $macros;
}


my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";

my $generate_input_rule = sub {
    my ($zoneinfo, $rule, $net, $netid) = @_;

    my $zone = $net->{zone} || die "internal error";
    my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
    my $tap = $net->{tap} || die "internal error";

    my $dest = "$zid:$tap";

    if ($rule->{dest}) {
	$dest .= ":$rule->{dest}";
    }

    my $action = $rule->{service} ? 
	"$rule->{service}($rule->{action})" : $rule->{action};

    my $sources = [];

    if (!$rule->{source}) {
	push @$sources, 'all'; 
    } elsif ($zoneinfo->{$zone}->{type} eq 'bport') {
	my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error";
	my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";

	# using 'all' does not work, so we create one rule for
	# each related zone on the same bridge
	push @$sources, "${zoneref}:$rule->{source}";
	foreach my $z (keys %$zoneinfo) {
	    next if $z eq $zone;
	    next if !$zoneinfo->{$z}->{bridge_zone};
	    next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone;
	    $zoneref = $zoneinfo->{$z}->{zoneref} || die "internal error";
	    push @$sources, "${zoneref}:$rule->{source}";
	}
    } else {
	push @$sources, "all:$rule->{source}";
    }

    my $out = '';

    foreach my $source (@$sources) {
	$out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-', 
			$rule->{dport} || '-', $rule->{sport} || '-');
    }

    return $out;
};

my $generate_output_rule = sub {
    my ($zoneinfo, $rule, $net, $netid) = @_;

    my $zone = $net->{zone} || die "internal error";
    my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
    my $tap = $net->{tap} || die "internal error";

    my $action = $rule->{service} ? 
	"$rule->{service}($rule->{action})" : $rule->{action};
    
    my $dest;

    if (!$rule->{dest}) {
	$dest = 'all';
    } else {
	$dest = "all:$rule->{dest}";
    }

    return sprintf($rule_format, $action, "$zid:$tap", $dest, 
		   $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
};

# we need complete VM configuration of all VMs (openvz/qemu)
# in vmdata

my $compile_shorewall = sub {
    my ($targetdir, $vmdata, $rules) = @_;

    # remove existing data ?
    foreach my $file (qw(params zones rules interfaces  maclist  policy)) {
	unlink "$targetdir/$file";
    }

    my $netinfo;

    my $zoneinfo = {
	fw => { type => 'firewall' },
    };

    my $maclist = {};

    my $register_bridge;

    $register_bridge = sub {
	my ($bridge, $vlan) = @_;

	my $zone =  'z' . $bridge;

	return $zone if $zoneinfo->{$zone};

	my $ext_zone = "z${bridge}ext";

	$zoneinfo->{$zone} = {
	    type => 'bridge',
	    bridge => $bridge,
	    bridge_ext_zone => $ext_zone,
	};

	# physical input devices
	my $dir = "/sys/class/net/$bridge/brif";
	my $physical = {};
	PVE::Tools::dir_glob_foreach($dir, '((eth|bond).+)', sub {
	    my ($slave) = @_;
	    $physical->{$slave} = 1;
	});

	$zoneinfo->{$ext_zone} = {
	    type => 'bport',
	    bridge_zone => $zone,
	    ifaces => $physical,
	};

	return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
	
	return $zone;
    };

    my $register_bridge_port = sub {
	my ($bridge, $vlan, $vmzone, $tap) = @_;

	my $bridge_zone = &$register_bridge($bridge, $vlan);
	my $zone = $bridge_zone . $vmzone;

	if (!$zoneinfo->{$zone}) {
	    $zoneinfo->{$zone} = {
		type => 'bport',
		bridge_zone => $bridge_zone,
		ifaces => {},
	    };
	}

	$zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
	
	return $zone;
    };

    foreach my $vmid (keys %{$vmdata->{qemu}}) {
	$netinfo->{$vmid} = {};
	my $conf = $vmdata->{qemu}->{$vmid};
	foreach my $opt (keys %$conf) {
	    next if $opt !~ m/^net(\d+)$/;
	    my $netnum = $1;
	    my $net = PVE::QemuServer::parse_net($conf->{$opt});
	    next if !$net;
	    die "implement me" if !$net->{bridge};

	    my $vmzone = $conf->{zone} || "vm$vmid";
	    $net->{tap} = "tap${vmid}i${netnum}";
	    $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error";
	    $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
	    $netinfo->{$vmid}->{$opt} = $net;
	}
    }

    #print Dumper($netinfo);

    # NOTE: zone names have length limit, so we need to
    # translate them into shorter names 

    my $zoneid = 0;
    my $zonemap = { fw => 'fw' };

    my $lookup_zonename = sub {
	my ($zone) = @_;

	return $zonemap->{$zone} if defined($zonemap->{$zone});
	$zonemap->{$zone} = 'z' . $zoneid++;

	return $zonemap->{$zone};
    };

    foreach my $z (sort keys %$zoneinfo) {
	$zoneinfo->{$z}->{id} = &$lookup_zonename($z);
	$zoneinfo->{$z}->{zonevar} = uc($z);
 	$zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
    }

    my $out;

    # dump params file
    $out = "# PVE zones\n";
    foreach my $z (sort keys %$zoneinfo) {
	$out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
    }
    PVE::Tools::file_set_contents("$targetdir/params", $out);

    # dump zone file

    my $format = "%-30s %-10s %-15s\n";
    $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
    
    foreach my $z (sort keys %$zoneinfo) {
	my $zid = $zoneinfo->{$z}->{zoneref};
	if ($zoneinfo->{$z}->{type} eq 'firewall') {
	    $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
	    $out .= sprintf($format, $zid, 'ipv4', '');
	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
	    my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
	    my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
	    $out .= sprintf($format, "$zid:$bzid", 'bport', '');
	} else {
	    die "internal error";
	}
    }

    $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");

    PVE::Tools::file_set_contents("$targetdir/zones", $out);

    # dump interfaces

    $format = "%-25s %-20s %-10s %-15s\n";
    $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');

    my $maclist_format = "%-15s %-15s %-15s\n";
    my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');

    foreach my $z (sort keys %$zoneinfo) {
	my $zid = $zoneinfo->{$z}->{zoneref};
	if ($zoneinfo->{$z}->{type} eq 'firewall') {
	    # do nothing;
	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
	    my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error";
	    $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
	    my $ifaces = $zoneinfo->{$z}->{ifaces};
	    foreach my $iface (sort keys %$ifaces) {
		my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
		my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error";
		my $iftxt = "$bridge:$iface";

		if ($maclist->{$iface}) {
		    $out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
		    $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
		} else {
		    $out .= sprintf($format, $zid, $iftxt, '-', '');
		}
	    }
	} else {
	    die "internal error";
	}
    }

    $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");

    PVE::Tools::file_set_contents("$targetdir/interfaces", $out);

    # dump maclist
    PVE::Tools::file_set_contents("$targetdir/maclist", $macs);

    # dump policy

    $format = "%-15s %-15s %-15s %s\n";
    $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
    $out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');

    # we need to disable intra-zone traffic on bridges. Else traffic
    # from untracked interfaces simply pass the firewall
    foreach my $z (sort keys %$zoneinfo) {
	my $zid = $zoneinfo->{$z}->{zoneref};
	if ($zoneinfo->{$z}->{type} eq 'bridge') {
	    $out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
	}
    }
    $out .= sprintf($format, 'all', 'all', 'REJECT', 'info');

    PVE::Tools::file_set_contents("$targetdir/policy", $out);

    # dump rules
    $out = '';

    $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
    foreach my $vmid (sort keys %$rules) {
	my $inrules = $rules->{$vmid}->{in};
	my $outrules = $rules->{$vmid}->{out};

	if (scalar(@$inrules)) {
	    $out .= "# IN to VM $vmid\n";
	    foreach my $rule (@$inrules) {
		foreach my $netid (keys %{$netinfo->{$vmid}}) {
		    my $net = $netinfo->{$vmid}->{$netid};
		    next if $rule->{iface} && $rule->{iface} ne $netid;
		    $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
		}
	    }
	}

	if (scalar(@$outrules)) {
	    $out .= "# OUT from VM $vmid\n";
	    foreach my $rule (@$outrules) {
		foreach my $netid (keys %{$netinfo->{$vmid}}) {
		    my $net = $netinfo->{$vmid}->{$netid};
		    next if $rule->{iface} && $rule->{iface} ne $netid;
		    $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
		}
	    }
	}
    }

    PVE::Tools::file_set_contents("$targetdir/rules", $out);
};


sub parse_fw_rules {
    my ($filename, $fh) = @_;

    my $section;

    my $res = { in => [], out => [] };

    my $macros = PVE::Firewall::get_shorewall_macros();

    while (defined(my $line = <$fh>)) {
	next if $line =~ m/^#/;
	next if $line =~ m/^\s*$/;

	if ($line =~ m/^\[(in|out)\]\s*$/i) {
	    $section = lc($1);
	    next;
	}
	next if !$section;

	my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
	    split(/\s+/, $line);

	if (!$action) {
	    warn "skip incomplete line\n";
	    next;
	}

	my $service;
	if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) {
	    # OK
	} elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
	    ($service, $action) = ($1, $2);
	    if (!$macros->{$service}) {
		warn "unknown service '$service'\n";
		next;
	    }
	} else {
	    warn "unknown action '$action'\n";
	    next;
	}

	$iface = undef if $iface && $iface eq '-';
	if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
	    warn "unknown interface '$iface'\n";
	    next;
	}

	$proto = undef if $proto && $proto eq '-';
	if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) {
	    warn "unknown protokol '$proto'\n";
	    next;
	}

	$source = undef if $source && $source eq '-';

#	if ($source !~ m/^(XYZ)$/) {
#	    warn "unknown source '$source'\n";
#	    next;
#	}

	$dest = undef if $dest && $dest eq '-';
#	if ($dest !~ m/^XYZ)$/) {
#	    warn "unknown destination '$dest'\n";
#	    next;
#	}

	$dport = undef if $dport && $dport eq '-';
	$sport = undef if $sport && $sport eq '-';

	my $rule = {
	    action => $action,
	    service => $service,
	    iface => $iface,
	    source => $source,
	    dest => $dest,
	    proto => $proto,
	    dport => $dport,
	    sport => $sport,
	};

	push @{$res->{$section}}, $rule;
    }

    return $res;
}

sub read_local_vm_config {

    my $openvz = {};

    my $qemu = {};

    my $list = PVE::QemuServer::config_list();

    foreach my $vmid (keys %$list) {
	#next if !($vmid eq '100' || $vmid eq '102');
	my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
	if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
	    $qemu->{$vmid} = $conf;
	}
    }

    my $vmdata = { openvz => $openvz, qemu => $qemu };

    return $vmdata;
};

sub read_vm_firewall_rules {
    my ($vmdata) = @_;
    my $rules = {};
    foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
	my $filename = "/etc/pve/firewall/$vmid.fw";
	my $fh = IO::File->new($filename, O_RDONLY);
	next if !$fh;

	$rules->{$vmid} = parse_fw_rules($filename, $fh);
    }

    return $rules;
}

sub compile {

    my $vmdata = read_local_vm_config();
    my $rules = read_vm_firewall_rules($vmdata);

    # print Dumper($vmdata);

    my $swdir = '/etc/shorewall';
    mkdir $swdir;

    &$compile_shorewall($swdir, $vmdata, $rules);

    PVE::Tools::run_command(['shorewall', 'compile']);
}

sub compile_and_start {
    my ($restart) = @_;

    compile();

    PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']);
}


1;
Commit	Line	Data
b6360c3f DM	1	package PVE::Firewall;
	2
	3	use warnings;
	4	use strict;
	5	use Data::Dumper;
f789653a	6	use PVE::Tools;
b6360c3f	7	use PVE::QemuServer;
5e1267a5 DM	8	use File::Path;
	9	use IO::File;
	10	use Data::Dumper;
b6360c3f	11
9aab3127 DM	12	my $macros;
	13	sub get_shorewall_macros {
	14
	15	return $macros if $macros;
	16
	17	foreach my $path (</usr/share/shorewall/macro.*>) {
	18	if ($path =~ m\|/macro\.(\S+)$\|) {
	19	$macros->{$1} = 1;
	20	}
	21	}
	22	return $macros;
	23	}
	24
dddd9413	25
8cebfa6f	26	my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
dddd9413 DM	27
	28	my $generate_input_rule = sub {
	29	my ($zoneinfo, $rule, $net, $netid) = @_;
	30
dddd9413	31	my $zone = $net->{zone} \|\| die "internal error";
a8195f4f	32	my $zid = $zoneinfo->{$zone}->{zoneref} \|\| die "internal error";
dddd9413	33	my $tap = $net->{tap} \|\| die "internal error";
9aab3127	34
8cebfa6f DM	35	my $dest = "$zid:$tap";
	36
	37	if ($rule->{dest}) {
	38	$dest .= ":$rule->{dest}";
	39	}
	40
9aab3127 DM	41	my $action = $rule->{service} ?
	42	"$rule->{service}($rule->{action})" : $rule->{action};
	43
b9b06789	44	my $sources = [];
8cebfa6f	45
b9b06789 DM	46	if (!$rule->{source}) {
	47	push @$sources, 'all';
	48	} elsif ($zoneinfo->{$zone}->{type} eq 'bport') {
8cebfa6f	49	my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} \|\| die "internal error";
b9b06789 DM	50	my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} \|\| die "internal error";
	51
	52	# using 'all' does not work, so we create one rule for
	53	# each related zone on the same bridge
	54	push @$sources, "${zoneref}:$rule->{source}";
	55	foreach my $z (keys %$zoneinfo) {
	56	next if $z eq $zone;
	57	next if !$zoneinfo->{$z}->{bridge_zone};
	58	next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone;
	59	$zoneref = $zoneinfo->{$z}->{zoneref} \|\| die "internal error";
	60	push @$sources, "${zoneref}:$rule->{source}";
8cebfa6f DM	61	}
8cebfa6f DM	62	} else {
b9b06789 DM	63	push @$sources, "all:$rule->{source}";
	64	}
	65
	66	my $out = '';
	67
	68	foreach my $source (@$sources) {
	69	$out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} \|\| '-',
	70	$rule->{dport} \|\| '-', $rule->{sport} \|\| '-');
8cebfa6f DM	71	}
8cebfa6f DM	72
b9b06789	73	return $out;
dddd9413 DM	74	};
	75
	76	my $generate_output_rule = sub {
	77	my ($zoneinfo, $rule, $net, $netid) = @_;
	78
dddd9413	79	my $zone = $net->{zone} \|\| die "internal error";
a8195f4f	80	my $zid = $zoneinfo->{$zone}->{zoneref} \|\| die "internal error";
dddd9413	81	my $tap = $net->{tap} \|\| die "internal error";
9aab3127 DM	82
	83	my $action = $rule->{service} ?
	84	"$rule->{service}($rule->{action})" : $rule->{action};
dddd9413	85
8cebfa6f DM	86	my $dest;
	87
	88	if (!$rule->{dest}) {
9a4644fa	89	$dest = 'all';
8cebfa6f	90	} else {
9a4644fa	91	$dest = "all:$rule->{dest}";
8cebfa6f DM	92	}
	93
	94	return sprintf($rule_format, $action, "$zid:$tap", $dest,
dddd9413 DM	95	$rule->{proto} \|\| '-', $rule->{dport} \|\| '-', $rule->{sport} \|\| '-');
	96	};
	97
b6360c3f DM	98	# we need complete VM configuration of all VMs (openvz/qemu)
	99	# in vmdata
	100
5e1267a5	101	my $compile_shorewall = sub {
dddd9413	102	my ($targetdir, $vmdata, $rules) = @_;
b6360c3f	103
80bfe1ff	104	# remove existing data ?
a8195f4f	105	foreach my $file (qw(params zones rules interfaces maclist policy)) {
80bfe1ff DM	106	unlink "$targetdir/$file";
	107	}
	108
b6360c3f DM	109	my $netinfo;
b6360c3f DM	110
886aba9c DM	111	my $zoneinfo = {
	112	fw => { type => 'firewall' },
	113	};
	114
026a6466 DM	115	my $maclist = {};
026a6466 DM	116
35081236 DM	117	my $register_bridge;
	118
	119	$register_bridge = sub {
	120	my ($bridge, $vlan) = @_;
f789653a DM	121
	122	my $zone = 'z' . $bridge;
	123
	124	return $zone if $zoneinfo->{$zone};
	125
8cebfa6f DM	126	my $ext_zone = "z${bridge}ext";
8cebfa6f DM	127
f789653a DM	128	$zoneinfo->{$zone} = {
	129	type => 'bridge',
	130	bridge => $bridge,
8cebfa6f DM	131	bridge_ext_zone => $ext_zone,
	132	};
	133
	134	# physical input devices
	135	my $dir = "/sys/class/net/$bridge/brif";
	136	my $physical = {};
	137	PVE::Tools::dir_glob_foreach($dir, '((eth\|bond).+)', sub {
	138	my ($slave) = @_;
	139	$physical->{$slave} = 1;
	140	});
	141
	142	$zoneinfo->{$ext_zone} = {
	143	type => 'bport',
	144	bridge_zone => $zone,
	145	ifaces => $physical,
f789653a	146	};
35081236 DM	147
	148	return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
	149
	150	return $zone;
	151	};
	152
	153	my $register_bridge_port = sub {
	154	my ($bridge, $vlan, $vmzone, $tap) = @_;
	155
	156	my $bridge_zone = &$register_bridge($bridge, $vlan);
	157	my $zone = $bridge_zone . $vmzone;
	158
	159	if (!$zoneinfo->{$zone}) {
	160	$zoneinfo->{$zone} = {
	161	type => 'bport',
	162	bridge_zone => $bridge_zone,
	163	ifaces => {},
	164	};
	165	}
	166
	167	$zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
f789653a DM	168
	169	return $zone;
	170	};
	171
b6360c3f DM	172	foreach my $vmid (keys %{$vmdata->{qemu}}) {
	173	$netinfo->{$vmid} = {};
	174	my $conf = $vmdata->{qemu}->{$vmid};
	175	foreach my $opt (keys %$conf) {
	176	next if $opt !~ m/^net(\d+)$/;
dddd9413	177	my $netnum = $1;
b6360c3f DM	178	my $net = PVE::QemuServer::parse_net($conf->{$opt});
b6360c3f DM	179	next if !$net;
886aba9c	180	die "implement me" if !$net->{bridge};
886aba9c	181
f789653a	182	my $vmzone = $conf->{zone} \|\| "vm$vmid";
dddd9413	183	$net->{tap} = "tap${vmid}i${netnum}";
026a6466	184	$maclist->{$net->{tap}} = $net->{macaddr} \|\| die "internal error";
dddd9413 DM	185	$net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
dddd9413 DM	186	$netinfo->{$vmid}->{$opt} = $net;
886aba9c DM	187	}
	188	}
	189
	190	#print Dumper($netinfo);
	191
f789653a	192	# NOTE: zone names have length limit, so we need to
886aba9c DM	193	# translate them into shorter names
886aba9c DM	194
f789653a DM	195	my $zoneid = 0;
	196	my $zonemap = { fw => 'fw' };
	197
	198	my $lookup_zonename = sub {
	199	my ($zone) = @_;
	200
	201	return $zonemap->{$zone} if defined($zonemap->{$zone});
	202	$zonemap->{$zone} = 'z' . $zoneid++;
	203
	204	return $zonemap->{$zone};
	205	};
	206
dddd9413 DM	207	foreach my $z (sort keys %$zoneinfo) {
dddd9413 DM	208	$zoneinfo->{$z}->{id} = &$lookup_zonename($z);
a8195f4f DM	209	$zoneinfo->{$z}->{zonevar} = uc($z);
a8195f4f DM	210	$zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
dddd9413 DM	211	}
dddd9413 DM	212
f789653a	213	my $out;
886aba9c	214
a8195f4f DM	215	# dump params file
	216	$out = "# PVE zones\n";
	217	foreach my $z (sort keys %$zoneinfo) {
	218	$out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
	219	}
	220	PVE::Tools::file_set_contents("$targetdir/params", $out);
	221
	222	# dump zone file
	223
	224	my $format = "%-30s %-10s %-15s\n";
	225	$out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
f789653a	226
886aba9c	227	foreach my $z (sort keys %$zoneinfo) {
a8195f4f	228	my $zid = $zoneinfo->{$z}->{zoneref};
f789653a	229	if ($zoneinfo->{$z}->{type} eq 'firewall') {
a8195f4f	230	$out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
f789653a	231	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
a8195f4f	232	$out .= sprintf($format, $zid, 'ipv4', '');
f789653a DM	233	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
f789653a DM	234	my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} \|\| die "internal error";
a8195f4f DM	235	my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} \|\| die "internal error";
a8195f4f DM	236	$out .= sprintf($format, "$zid:$bzid", 'bport', '');
f789653a DM	237	} else {
	238	die "internal error";
	239	}
886aba9c DM	240	}
886aba9c DM	241
f789653a DM	242	$out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
	243
	244	PVE::Tools::file_set_contents("$targetdir/zones", $out);
886aba9c	245
f789653a	246	# dump interfaces
886aba9c	247
a8195f4f DM	248	$format = "%-25s %-20s %-10s %-15s\n";
a8195f4f DM	249	$out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');
f789653a	250
026a6466 DM	251	my $maclist_format = "%-15s %-15s %-15s\n";
	252	my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');
	253
886aba9c	254	foreach my $z (sort keys %$zoneinfo) {
a8195f4f	255	my $zid = $zoneinfo->{$z}->{zoneref};
f789653a DM	256	if ($zoneinfo->{$z}->{type} eq 'firewall') {
	257	# do nothing;
	258	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
	259	my $bridge = $zoneinfo->{$z}->{bridge} \|\| die "internal error";
a8195f4f	260	$out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
f789653a DM	261	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
	262	my $ifaces = $zoneinfo->{$z}->{ifaces};
	263	foreach my $iface (sort keys %$ifaces) {
	264	my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} \|\| die "internal error";
	265	my $bridge = $zoneinfo->{$bridge_zone}->{bridge} \|\| die "internal error";
	266	my $iftxt = "$bridge:$iface";
8cebfa6f DM	267
	268	if ($maclist->{$iface}) {
	269	$out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
	270	$macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
	271	} else {
	272	$out .= sprintf($format, $zid, $iftxt, '-', '');
	273	}
f789653a DM	274	}
	275	} else {
	276	die "internal error";
b6360c3f DM	277	}
	278	}
	279
f789653a DM	280	$out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
	281
	282	PVE::Tools::file_set_contents("$targetdir/interfaces", $out);
	283
026a6466 DM	284	# dump maclist
	285	PVE::Tools::file_set_contents("$targetdir/maclist", $macs);
	286
f789653a DM	287	# dump policy
	288
	289	$format = "%-15s %-15s %-15s %s\n";
	290	$out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
8cebfa6f DM	291	$out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');
	292
	293	# we need to disable intra-zone traffic on bridges. Else traffic
	294	# from untracked interfaces simply pass the firewall
	295	foreach my $z (sort keys %$zoneinfo) {
	296	my $zid = $zoneinfo->{$z}->{zoneref};
	297	if ($zoneinfo->{$z}->{type} eq 'bridge') {
	298	$out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
	299	}
	300	}
f789653a	301	$out .= sprintf($format, 'all', 'all', 'REJECT', 'info');
886aba9c	302
f789653a	303	PVE::Tools::file_set_contents("$targetdir/policy", $out);
886aba9c	304
dddd9413 DM	305	# dump rules
	306	$out = '';
	307
	308	$out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
	309	foreach my $vmid (sort keys %$rules) {
78db5872 DM	310	my $inrules = $rules->{$vmid}->{in};
	311	my $outrules = $rules->{$vmid}->{out};
	312
	313	if (scalar(@$inrules)) {
	314	$out .= "# IN to VM $vmid\n";
dddd9413 DM	315	foreach my $rule (@$inrules) {
	316	foreach my $netid (keys %{$netinfo->{$vmid}}) {
	317	my $net = $netinfo->{$vmid}->{$netid};
9a4644fa	318	next if $rule->{iface} && $rule->{iface} ne $netid;
dddd9413 DM	319	$out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
	320	}
	321	}
	322	}
	323
78db5872 DM	324	if (scalar(@$outrules)) {
78db5872 DM	325	$out .= "# OUT from VM $vmid\n";
dddd9413 DM	326	foreach my $rule (@$outrules) {
	327	foreach my $netid (keys %{$netinfo->{$vmid}}) {
	328	my $net = $netinfo->{$vmid}->{$netid};
9a4644fa	329	next if $rule->{iface} && $rule->{iface} ne $netid;
dddd9413 DM	330	$out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
	331	}
	332	}
	333	}
	334	}
	335
	336	PVE::Tools::file_set_contents("$targetdir/rules", $out);
5e1267a5 DM	337	};
	338
	339
	340	sub parse_fw_rules {
	341	my ($filename, $fh) = @_;
	342
	343	my $section;
	344
	345	my $res = { in => [], out => [] };
	346
	347	my $macros = PVE::Firewall::get_shorewall_macros();
	348
	349	while (defined(my $line = <$fh>)) {
	350	next if $line =~ m/^#/;
	351	next if $line =~ m/^\s*$/;
	352
	353	if ($line =~ m/^\[(in\|out)\]\s*$/i) {
	354	$section = lc($1);
	355	next;
	356	}
	357	next if !$section;
	358
	359	my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
	360	split(/\s+/, $line);
	361
	362	if (!$action) {
	363	warn "skip incomplete line\n";
	364	next;
	365	}
	366
	367	my $service;
	368	if ($action =~ m/^(ACCEPT\|DROP\|REJECT)$/) {
	369	# OK
	370	} elsif ($action =~ m/^(\S+)\((ACCEPT\|DROP\|REJECT)\)$/) {
	371	($service, $action) = ($1, $2);
	372	if (!$macros->{$service}) {
	373	warn "unknown service '$service'\n";
	374	next;
	375	}
	376	} else {
	377	warn "unknown action '$action'\n";
	378	next;
	379	}
	380
	381	$iface = undef if $iface && $iface eq '-';
	382	if ($iface && $iface !~ m/^(net0\|net1\|net2\|net3\|net4\|net5)$/) {
	383	warn "unknown interface '$iface'\n";
	384	next;
	385	}
	386
	387	$proto = undef if $proto && $proto eq '-';
	388	if ($proto && $proto !~ m/^(icmp\|tcp\|udp)$/) {
	389	warn "unknown protokol '$proto'\n";
	390	next;
	391	}
	392
	393	$source = undef if $source && $source eq '-';
	394
	395	# if ($source !~ m/^(XYZ)$/) {
	396	# warn "unknown source '$source'\n";
	397	# next;
	398	# }
	399
	400	$dest = undef if $dest && $dest eq '-';
401	# if ($dest !~ m/^XYZ)$/) {
402	# warn "unknown destination '$dest'\n";
403	# next;
404	# }
405
406	$dport = undef if $dport && $dport eq '-';
407	$sport = undef if $sport && $sport eq '-';
408
409	my $rule = {
410	action => $action,
411	service => $service,
412	iface => $iface,
413	source => $source,
414	dest => $dest,
415	proto => $proto,
416	dport => $dport,
417	sport => $sport,
418	};
419
420	push @{$res->{$section}}, $rule;
421	}
422
423	return $res;
424	}
425
426	sub read_local_vm_config {
427
428	my $openvz = {};
429
430	my $qemu = {};
431
432	my $list = PVE::QemuServer::config_list();
433
434	foreach my $vmid (keys %$list) {
b9b06789	435	#next if !($vmid eq '100' \|\| $vmid eq '102');
5e1267a5 DM	436	my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
	437	if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
	438	$qemu->{$vmid} = $conf;
	439	}
	440	}
	441
	442	my $vmdata = { openvz => $openvz, qemu => $qemu };
	443
	444	return $vmdata;
	445	};
	446
	447	sub read_vm_firewall_rules {
	448	my ($vmdata) = @_;
	449	my $rules = {};
	450	foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
	451	my $filename = "/etc/pve/firewall/$vmid.fw";
	452	my $fh = IO::File->new($filename, O_RDONLY);
	453	next if !$fh;
	454
	455	$rules->{$vmid} = parse_fw_rules($filename, $fh);
	456	}
	457
	458	return $rules;
	459	}
	460
	461	sub compile {
	462
	463	my $vmdata = read_local_vm_config();
	464	my $rules = read_vm_firewall_rules($vmdata);
	465
	466	# print Dumper($vmdata);
	467
	468	my $swdir = '/etc/shorewall';
	469	mkdir $swdir;
	470
	471	&$compile_shorewall($swdir, $vmdata, $rules);
b6360c3f	472
5e1267a5	473	PVE::Tools::run_command(['shorewall', 'compile']);
b6360c3f DM	474	}
b6360c3f DM	475
5e1267a5 DM	476	sub compile_and_start {
5e1267a5 DM	477	my ($restart) = @_;
886aba9c	478
5e1267a5	479	compile();
b6360c3f	480
5e1267a5	481	PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']);
b6360c3f DM	482	}
	483
	484
	485	1;