]>
git.proxmox.com Git - pve-firewall.git/blob - src/PVE/FirewallSimulator.pm
1 package PVE
::FirewallSimulator
;
15 my $new_value = shift;
17 $debug = $new_value if defined($new_value);
40 $SIG{'__WARN__'} = sub {
49 my ($devre, $dev) = @_;
51 $devre =~ s/\+$/\.\*/;
52 return ($dev =~ m/^${devre}$/) ?
1 : 0;
56 my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
58 my $ipset = $ipset_ruleset->{$ipsetname};
59 die "no such ipset '$ipsetname'" if !$ipset;
61 my $ip = Net
::IP-
>new($ipaddr);
63 my $first = $ipset->[0];
64 if ($first =~ m/^create\s+\S+\s+list:/) {
65 foreach my $entry (@$ipset) {
66 next if $entry =~ m/^create/; # simply ignore
67 if ($entry =~ m/add \S+ (\S+)$/) {
68 return 1 if ipset_match
($ipset_ruleset, $1, $ipaddr);
74 } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
75 foreach my $entry (@$ipset) {
76 next if $entry =~ m/^create/; # simply ignore
77 if ($entry =~ m/add \S+ (\S+)$/) {
78 my $test = Net
::IP-
>new($1);
79 if ($test->overlaps($ip)) {
80 add_trace
("IPSET $ipsetname match $ipaddr\n");
89 die "unknown ipset type '$first' - not implemented\n";
96 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
98 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
100 while (length($rule)) {
102 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
105 return undef if $cstate eq 'INVALID'; # no match
106 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
108 next if $cstate =~ m/NEW/;
110 die "cstate test '$cstate' not implemented\n";
113 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
115 die "missing source address type (srctype)\n"
117 return undef if $atype ne $pkg->{srctype
};
120 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
122 die "missing destination address type (dsttype)\n"
124 return undef if $atype ne $pkg->{dsttype
};
127 if ($rule =~ s/^-i (\S+)\s*//) {
129 die "missing interface (iface_in)\n" if !$pkg->{iface_in
};
130 return undef if !nf_dev_match
($devre, $pkg->{iface_in
});
134 if ($rule =~ s/^-o (\S+)\s*//) {
136 die "missing interface (iface_out)\n" if !$pkg->{iface_out
};
137 return undef if !nf_dev_match
($devre, $pkg->{iface_out
});
141 if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
142 die "missing proto" if !$pkg->{proto
};
143 return undef if $pkg->{proto
} ne $1; # no match
147 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
148 die "missing dport" if !$pkg->{dport
};
149 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
153 if ($rule =~ s/^--dport (\d+)\s*//) {
154 die "missing dport" if !$pkg->{dport
};
155 return undef if $pkg->{dport
} != $1; # no match
159 if ($rule =~ s/^-s (\S+)\s*//) {
160 die "missing source" if !$pkg->{source
};
161 my $ip = Net
::IP-
>new($1);
162 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{source
})); # no match
166 if ($rule =~ s/^-d (\S+)\s*//) {
167 die "missing destination" if !$pkg->{dest
};
168 my $ip = Net
::IP-
>new($1);
169 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{dest
})); # no match
173 if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
174 die "missing source" if !$pkg->{source
};
178 return undef if ipset_match
($ipset_ruleset, $ipset_name, $pkg->{source
});
180 return undef if !ipset_match
($ipset_ruleset, $ipset_name, $pkg->{source
});
185 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
186 die "missing destination" if !$pkg->{dest
};
188 return undef if !ipset_match
($ipset_ruleset, $ipset_name, $pkg->{dest
});
192 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
193 die "missing source mac" if !$pkg->{mac_source
};
194 return undef if $pkg->{mac_source
} eq $1; # no match
198 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
200 return undef if !$pkg->{physdev_in
};
201 return undef if !nf_dev_match
($devre, $pkg->{physdev_in
});
205 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
207 return undef if !$pkg->{physdev_out
};
208 return undef if !nf_dev_match
($devre, $pkg->{physdev_out
});
212 if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
213 return undef if !defined($mark) || $mark != $1;
219 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
224 if ($rule =~ s/^-j (\S+)\s*$//) {
228 if ($rule =~ s/^-g (\S+)\s*$//) {
232 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
239 die "unable to parse rule: $rule";
242 sub ruleset_simulate_chain
{
243 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
245 add_trace
("ENTER chain $chain\n");
249 if ($chain eq 'PVEFW-Drop') {
250 add_trace
("LEAVE chain $chain\n");
251 return ('DROP', $counter);
253 if ($chain eq 'PVEFW-reject') {
254 add_trace
("LEAVE chain $chain\n");
255 return ('REJECT', $counter);
258 if ($chain eq 'PVEFW-tcpflags') {
259 add_trace
("LEAVE chain $chain\n");
260 return (undef, $counter);
263 my $rules = $ruleset->{$chain} ||
264 die "no such chain '$chain'";
266 foreach my $rule (@$rules) {
268 my ($goto, $action) = rule_match
($ipset_ruleset, $chain, $rule, $pkg);
269 if (!defined($action)) {
270 add_trace
("SKIP: $rule\n");
273 add_trace
("MATCH: $rule\n");
275 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
276 add_trace
("TERMINATE chain $chain: $action\n");
277 return ($action, $counter);
278 } elsif ($action eq 'RETURN') {
279 add_trace
("RETURN FROM chain $chain\n");
283 add_trace
("LEAVE chain $chain - goto $action\n");
284 return ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg)
286 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
288 my ($act, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg);
290 return ($act, $counter) if $act;
291 add_trace
("CONTINUE chain $chain\n");
296 add_trace
("LEAVE chain $chain\n");
297 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
298 return ('ACCEPT', $counter); # default policy
301 return (undef, $counter);
309 while (my ($k,$v) = each %$pkg) {
316 # Try to simulate packet traversal inside kernel. This invokes iptable
317 # checks several times.
319 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
321 $pkg->{ipversion
} = 4; # fixme: allow ipv6
323 my $route_state = $start_state;
327 my $ipt_invocation_counter = 0;
328 my $rule_check_counter = 0;
330 while ($route_state ne $target->{iface
}) {
333 my $next_route_state;
336 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
337 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
339 if ($route_state eq 'from-bport') {
340 $next_route_state = $from_info->{bridge
} || die 'internal error';
341 $next_physdev_in = $from_info->{iface
} || die 'internal error';
342 } elsif ($route_state eq 'host') {
344 if ($target->{type
} eq 'bport') {
345 $pkg->{iface_in
} = 'lo';
346 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
347 $chain = 'PVEFW-OUTPUT';
348 $next_route_state = $target->{iface
} || die 'internal error';
349 } elsif ($target->{type
} eq 'ct') {
350 $pkg->{iface_in
} = 'lo';
351 $pkg->{iface_out
} = 'venet0';
352 $chain = 'PVEFW-OUTPUT';
353 $next_route_state = 'venet-in';
354 } elsif ($target->{type
} eq 'vm') {
355 $pkg->{iface_in
} = 'lo';
356 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
357 $chain = 'PVEFW-OUTPUT';
358 $next_route_state = 'fwbr-in';
363 } elsif ($route_state eq 'venet-out') {
365 if ($target->{type
} eq 'host') {
367 $chain = 'PVEFW-INPUT';
368 $pkg->{iface_in
} = 'venet0';
369 $pkg->{iface_out
} = 'lo';
370 $next_route_state = 'host';
372 } elsif ($target->{type
} eq 'bport') {
374 $chain = 'PVEFW-FORWARD';
375 $pkg->{iface_in
} = 'venet0';
376 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
377 $next_route_state = $target->{iface
} || die 'internal error';
379 } elsif ($target->{type
} eq 'vm') {
381 $chain = 'PVEFW-FORWARD';
382 $pkg->{iface_in
} = 'venet0';
383 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
384 $next_route_state = 'fwbr-in';
386 } elsif ($target->{type
} eq 'ct') {
388 $chain = 'PVEFW-FORWARD';
389 $pkg->{iface_in
} = 'venet0';
390 $pkg->{iface_out
} = 'venet0';
391 $next_route_state = 'venet-in';
397 } elsif ($route_state eq 'fwbr-out') {
399 $chain = 'PVEFW-FORWARD';
400 $next_route_state = $from_info->{bridge
} || die 'internal error';
401 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
402 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
403 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
404 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
405 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
407 } elsif ($route_state eq 'fwbr-in') {
409 $chain = 'PVEFW-FORWARD';
410 $next_route_state = $target->{tapdev
};
411 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
412 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
413 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
414 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
416 } elsif ($route_state =~ m/^vmbr\d+$/) {
418 die "missing physdev_in - internal error?" if !$physdev_in;
419 $pkg->{physdev_in
} = $physdev_in;
421 if ($target->{type
} eq 'host') {
423 $chain = 'PVEFW-INPUT';
424 $pkg->{iface_in
} = $route_state;
425 $pkg->{iface_out
} = 'lo';
426 $next_route_state = 'host';
428 } elsif ($target->{type
} eq 'bport') {
430 $chain = 'PVEFW-FORWARD';
431 $pkg->{iface_in
} = $route_state;
432 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
433 # conditionally set physdev_out (same behavior as kernel)
434 if ($route_state eq $target->{bridge
}) {
435 $pkg->{physdev_out
} = $target->{iface
} || die 'internal error';
437 $next_route_state = $target->{iface
};
439 } elsif ($target->{type
} eq 'ct') {
441 $chain = 'PVEFW-FORWARD';
442 $pkg->{iface_in
} = $route_state;
443 $pkg->{iface_out
} = 'venet0';
444 $next_route_state = 'venet-in';
446 } elsif ($target->{type
} eq 'vm') {
448 $chain = 'PVEFW-FORWARD';
449 $pkg->{iface_in
} = $route_state;
450 $pkg->{iface_out
} = $target->{bridge
};
451 # conditionally set physdev_out (same behavior as kernel)
452 if ($route_state eq $target->{bridge
}) {
453 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
455 $next_route_state = 'fwbr-in';
462 die "implement me $route_state";
465 die "internal error" if !defined($next_route_state);
468 add_trace
("IPT check at $route_state (chain $chain)\n");
469 add_trace
(Dumper
($pkg));
470 $ipt_invocation_counter++;
471 my ($res, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $chain, $pkg);
472 $rule_check_counter += $ctr;
473 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
476 $route_state = $next_route_state;
478 $physdev_in = $next_physdev_in;
481 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
484 sub extract_ct_info
{
485 my ($vmdata, $vmid) = @_;
487 my $info = { type
=> 'ct', vmid
=> $vmid };
489 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
490 if ($conf->{ip_address
}) {
491 $info->{ip_address
} = $conf->{ip_address
}->{value
};
498 sub extract_vm_info
{
499 my ($vmdata, $vmid, $netnum) = @_;
501 my $info = { type
=> 'vm', vmid
=> $vmid };
503 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
504 my $net = PVE
::QemuServer
::parse_net
($conf->{"net$netnum"});
505 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
506 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
507 $info->{fwbr
} = "fwbr${vmid}i$netnum";
508 $info->{tapdev
} = "tap${vmid}i$netnum";
509 $info->{fwln
} = "fwln${vmid}i$netnum";
510 $info->{fwpr
} = "fwpr${vmid}p$netnum";
515 sub simulate_firewall
{
516 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
518 my $from = $test->{from
} || die "missing 'from' field";
519 my $to = $test->{to
} || die "missing 'to' field";
520 my $action = $test->{action
} || die "missing 'action'";
522 my $testid = $test->{id
};
524 die "from/to needs to be different" if $from eq $to;
532 srctype
=> 'UNICAST',
533 dsttype
=> 'UNICAST',
536 while (my ($k,$v) = each %$test) {
537 next if $k eq 'from';
539 next if $k eq 'action';
541 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
549 if ($from eq 'host') {
550 $from_info->{type
} = 'host';
551 $start_state = 'host';
552 $pkg->{source
} = $host_ip if !defined($pkg->{source
});
553 } elsif ($from =~ m
|^(vmbr\d
+)/(\S
+)$|) {
554 $from_info->{type
} = 'bport';
555 $from_info->{bridge
} = $1;
556 $from_info->{iface
} = $2;
557 $start_state = 'from-bport';
558 } elsif ($from eq 'outside') {
559 $from_info->{type
} = 'bport';
560 $from_info->{bridge
} = 'vmbr0';
561 $from_info->{iface
} = 'eth0';
562 $start_state = 'from-bport';
563 } elsif ($from eq 'nfvm') {
564 $from_info->{type
} = 'bport';
565 $from_info->{bridge
} = 'vmbr0';
566 $from_info->{iface
} = 'tapXYZ';
567 $start_state = 'from-bport';
568 } elsif ($from =~ m/^ct(\d+)$/) {
570 $from_info = extract_ct_info
($vmdata, $vmid);
571 if ($from_info->{ip_address
}) {
572 $pkg->{source
} = $from_info->{ip_address
} if !defined($pkg->{source
});
573 $start_state = 'venet-out';
577 } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
579 my $netnum = $3 || 0;
580 $from_info = extract_vm_info
($vmdata, $vmid, $netnum);
581 $start_state = 'fwbr-out';
582 $pkg->{mac_source
} = $from_info->{macaddr
};
584 die "unable to parse \"from => '$from'\"\n";
590 $target->{type
} = 'host';
591 $target->{iface
} = 'host';
592 $pkg->{dest
} = $host_ip if !defined($pkg->{dest
});
593 } elsif ($to =~ m
|^(vmbr\d
+)/(\S
+)$|) {
594 $target->{type
} = 'bport';
595 $target->{bridge
} = $1;
596 $target->{iface
} = $2;
597 } elsif ($to eq 'outside') {
598 $target->{type
} = 'bport';
599 $target->{bridge
} = 'vmbr0';
600 $target->{iface
} = 'eth0';
601 } elsif ($to eq 'nfvm') {
602 $target->{type
} = 'bport';
603 $target->{bridge
} = 'vmbr0';
604 $target->{iface
} = 'tapXYZ';
605 } elsif ($to =~ m/^ct(\d+)$/) {
607 $target = extract_ct_info
($vmdata, $vmid);
608 $target->{iface
} = 'venet-in';
610 if ($target->{ip_address
}) {
611 $pkg->{dest
} = $target->{ip_address
};
615 } elsif ($to =~ m/^vm(\d+)$/) {
617 $target = extract_vm_info
($vmdata, $vmid, 0);
618 $target->{iface
} = $target->{tapdev
};
620 die "unable to parse \"to => '$to'\"\n";
623 $pkg->{source
} = '100.100.1.2' if !defined($pkg->{source
});
624 $pkg->{dest
} = '100.200.3.4' if !defined($pkg->{dest
});
626 my ($res, $ic, $rc) = route_packet
($ruleset, $ipset_ruleset, $pkg,
627 $from_info, $target, $start_state);
629 add_trace
("IPT statistics: invocation = $ic, checks = $rc\n");
631 return $res if $action eq 'QUERY';
633 die "test failed ($res != $action)\n" if $action ne $res;