]>
git.proxmox.com Git - pve-firewall.git/blob - src/PVE/FirewallSimulator.pm
1 package PVE
::FirewallSimulator
;
13 $bridge_interface_pattern
16 # dynamically include PVE::QemuServer and PVE::LXC
17 # to avoid dependency problems
20 require PVE
::QemuServer
;
21 $have_qemu_server = 1;
34 my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
36 our $bridge_name_pattern = '[a-zA-Z][a-zA-Z0-9]{0,9}';
37 our $bridge_interface_pattern = "($bridge_name_pattern)/(\\S+)";
40 my $new_value = shift;
41 $debug = $new_value if defined($new_value);
63 $SIG{'__WARN__'} = sub {
72 my ($devre, $dev) = @_;
74 $devre =~ s/\+$/\.\*/;
75 return ($dev =~ m/^${devre}$/) ?
1 : 0;
79 my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
81 my $ipset = $ipset_ruleset->{$ipsetname};
82 die "no such ipset '$ipsetname'" if !$ipset;
84 my $ip = Net
::IP-
>new($ipaddr);
86 my $first = $ipset->[0];
87 if ($first =~ m/^create\s+\S+\s+list:/) {
88 foreach my $entry (@$ipset) {
89 next if $entry =~ m/^create/; # simply ignore
90 if ($entry =~ m/add \S+ (\S+)$/) {
91 return 1 if ipset_match
($ipset_ruleset, $1, $ipaddr);
97 } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
98 foreach my $entry (@$ipset) {
99 next if $entry =~ m/^create/; # simply ignore
100 if ($entry =~ m/add \S+ (\S+)$/) {
101 my $test = Net
::IP-
>new($1);
102 if ($test->overlaps($ip)) {
103 add_trace
("IPSET $ipsetname match $ipaddr\n");
112 die "unknown ipset type '$first' - not implemented\n";
119 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
121 $rule =~ s/^-A $chain +// || die "got strange rule: $rule";
123 while (length($rule)) {
125 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
128 return undef if $cstate eq 'INVALID'; # no match
129 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
131 next if $cstate =~ m/NEW/;
133 die "cstate test '$cstate' not implemented\n";
136 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
138 die "missing source address type (srctype)\n"
140 return undef if $atype ne $pkg->{srctype
};
143 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
145 die "missing destination address type (dsttype)\n"
147 return undef if $atype ne $pkg->{dsttype
};
150 if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
153 die "missing destination address type (dsttype)\n" if !defined($pkg->{dport
});
154 return undef if $icmptype ne $pkg->{dport
};
157 if ($rule =~ s/^-i (\S+)\s*//) {
159 die "missing interface (iface_in)\n" if !$pkg->{iface_in
};
160 return undef if !nf_dev_match
($devre, $pkg->{iface_in
});
164 if ($rule =~ s/^-o (\S+)\s*//) {
166 die "missing interface (iface_out)\n" if !$pkg->{iface_out
};
167 return undef if !nf_dev_match
($devre, $pkg->{iface_out
});
171 if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
172 die "missing proto" if !$pkg->{proto
};
173 return undef if $pkg->{proto
} ne $1; # no match
177 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
178 die "missing dport" if !$pkg->{dport
};
179 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
183 if ($rule =~ s/^--dport (\d+)\s*//) {
184 die "missing dport" if !$pkg->{dport
};
185 return undef if $pkg->{dport
} != $1; # no match
189 if ($rule =~ s/^-s (\S+)\s*//) {
190 die "missing source" if !$pkg->{source
};
191 my $ip = Net
::IP-
>new($1);
192 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{source
})); # no match
196 if ($rule =~ s/^-d (\S+)\s*//) {
197 die "missing destination" if !$pkg->{dest
};
198 my $ip = Net
::IP-
>new($1);
199 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{dest
})); # no match
203 if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
204 die "missing source" if !$pkg->{source
};
208 return undef if ipset_match
($ipset_ruleset, $ipset_name, $pkg->{source
});
210 return undef if !ipset_match
($ipset_ruleset, $ipset_name, $pkg->{source
});
215 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
216 die "missing destination" if !$pkg->{dest
};
218 return undef if !ipset_match
($ipset_ruleset, $ipset_name, $pkg->{dest
});
222 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
223 die "missing source mac" if !$pkg->{mac_source
};
224 return undef if $pkg->{mac_source
} eq $1; # no match
228 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
230 return undef if !$pkg->{physdev_in
};
231 return undef if !nf_dev_match
($devre, $pkg->{physdev_in
});
235 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
237 return undef if !$pkg->{physdev_out
};
238 return undef if !nf_dev_match
($devre, $pkg->{physdev_out
});
242 if ($rule =~ s
@^-m mark
--mark
($NUMBER_RE)(?
:/($NUMBER_RE))?\s
*@@) {
243 my ($value, $mask) = PVE
::Firewall
::get_mark_values
($1, $2);
244 return undef if ($mark & $mask) != $value;
250 if ($rule =~ s
@^-j MARK
--set-mark
($NUMBER_RE)(?
:/($NUMBER_RE))?\s
*$@@) {
251 my ($value, $mask) = PVE
::Firewall
::get_mark_values
($1, $2);
252 $mark = ($mark & ~$mask) | $value;
256 if ($rule =~ s/^-j (\S+)\s*$//) {
260 if ($rule =~ s/^-g (\S+)\s*$//) {
264 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
271 die "unable to parse rule: $rule";
274 sub ruleset_simulate_chain
{
275 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
277 add_trace
("ENTER chain $chain\n");
281 if ($chain eq 'PVEFW-Drop') {
282 add_trace
("LEAVE chain $chain\n");
283 return ('DROP', $counter);
285 if ($chain eq 'PVEFW-reject') {
286 add_trace
("LEAVE chain $chain\n");
287 return ('REJECT', $counter);
290 if ($chain eq 'PVEFW-tcpflags') {
291 add_trace
("LEAVE chain $chain\n");
292 return (undef, $counter);
295 my $rules = $ruleset->{$chain} ||
296 die "no such chain '$chain'";
298 foreach my $rule (@$rules) {
300 my ($goto, $action) = rule_match
($ipset_ruleset, $chain, $rule, $pkg);
301 if (!defined($action)) {
302 add_trace
("SKIP: $rule\n");
305 add_trace
("MATCH: $rule\n");
307 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
308 add_trace
("TERMINATE chain $chain: $action\n");
309 return ($action, $counter);
310 } elsif ($action eq 'RETURN') {
311 add_trace
("RETURN FROM chain $chain\n");
315 add_trace
("LEAVE chain $chain - goto $action\n");
316 return ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg)
318 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
320 my ($act, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg);
322 return ($act, $counter) if $act;
323 add_trace
("CONTINUE chain $chain\n");
328 add_trace
("LEAVE chain $chain\n");
329 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
330 return ('ACCEPT', $counter); # default policy
333 return (undef, $counter);
341 while (my ($k,$v) = each %$pkg) {
348 # Try to simulate packet traversal inside kernel. This invokes iptable
349 # checks several times.
351 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
353 $pkg->{ipversion
} = 4; # fixme: allow ipv6
355 my $route_state = $start_state;
359 my $ipt_invocation_counter = 0;
360 my $rule_check_counter = 0;
362 while ($route_state ne $target->{iface
}) {
365 my $next_route_state;
368 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
369 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
371 if ($route_state eq 'from-bport') {
372 $next_route_state = $from_info->{bridge
} || die 'internal error';
373 $next_physdev_in = $from_info->{iface
} || die 'internal error';
374 } elsif ($route_state eq 'host') {
376 if ($target->{type
} eq 'bport') {
377 $pkg->{iface_in
} = 'lo';
378 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
379 $chain = 'PVEFW-OUTPUT';
380 $next_route_state = $target->{iface
} || die 'internal error';
381 } elsif ($target->{type
} eq 'vm' || $target->{type
} eq 'ct') {
382 $pkg->{iface_in
} = 'lo';
383 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
384 $chain = 'PVEFW-OUTPUT';
385 $next_route_state = 'fwbr-in';
390 } elsif ($route_state eq 'fwbr-out') {
392 $chain = 'PVEFW-FORWARD';
393 $next_route_state = $from_info->{bridge
} || die 'internal error';
394 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
395 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
396 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
397 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
398 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
400 } elsif ($route_state eq 'fwbr-in') {
402 $chain = 'PVEFW-FORWARD';
403 $next_route_state = $target->{tapdev
};
404 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
405 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
406 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
407 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
409 } elsif ($route_state =~ m/^$bridge_name_pattern$/) {
411 die "missing physdev_in - internal error?" if !$physdev_in;
412 $pkg->{physdev_in
} = $physdev_in;
414 if ($target->{type
} eq 'host') {
416 $chain = 'PVEFW-INPUT';
417 $pkg->{iface_in
} = $route_state;
418 $pkg->{iface_out
} = 'lo';
419 $next_route_state = 'host';
421 } elsif ($target->{type
} eq 'bport') {
423 $chain = 'PVEFW-FORWARD';
424 $pkg->{iface_in
} = $route_state;
425 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
426 # conditionally set physdev_out (same behavior as kernel)
427 if ($route_state eq $target->{bridge
}) {
428 $pkg->{physdev_out
} = $target->{iface
} || die 'internal error';
430 $next_route_state = $target->{iface
};
432 } elsif ($target->{type
} eq 'vm' || $target->{type
} eq 'ct') {
434 $chain = 'PVEFW-FORWARD';
435 $pkg->{iface_in
} = $route_state;
436 $pkg->{iface_out
} = $target->{bridge
};
437 # conditionally set physdev_out (same behavior as kernel)
438 if ($route_state eq $target->{bridge
}) {
439 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
441 $next_route_state = 'fwbr-in';
448 die "implement me $route_state";
451 die "internal error" if !defined($next_route_state);
454 add_trace
("IPT check at $route_state (chain $chain)\n");
455 add_trace
(Dumper
($pkg));
456 $ipt_invocation_counter++;
457 my ($res, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $chain, $pkg);
458 $rule_check_counter += $ctr;
459 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
462 $route_state = $next_route_state;
464 $physdev_in = $next_physdev_in;
467 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
470 sub extract_ct_info
{
471 my ($vmdata, $vmid, $netnum) = @_;
473 my $info = { type
=> 'ct', vmid
=> $vmid };
475 my $conf = $vmdata->{lxc
}->{$vmid} || die "no such CT '$vmid'";
476 my $net = PVE
::LXC
::Config-
>parse_lxc_network($conf->{"net$netnum"});
477 $info->{macaddr
} = $net->{hwaddr
} || die "unable to get mac address";
478 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
479 $info->{fwbr
} = "fwbr${vmid}i$netnum";
480 $info->{tapdev
} = "veth${vmid}i$netnum";
481 $info->{fwln
} = "fwln${vmid}i$netnum";
482 $info->{fwpr
} = "fwpr${vmid}p$netnum";
483 $info->{ip_address
} = $net->{ip
} || die "unable to get ip address";
488 sub extract_vm_info
{
489 my ($vmdata, $vmid, $netnum) = @_;
491 my $info = { type
=> 'vm', vmid
=> $vmid };
493 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
494 my $net = PVE
::QemuServer
::parse_net
($conf->{"net$netnum"});
495 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
496 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
497 $info->{fwbr
} = "fwbr${vmid}i$netnum";
498 $info->{tapdev
} = "tap${vmid}i$netnum";
499 $info->{fwln
} = "fwln${vmid}i$netnum";
500 $info->{fwpr
} = "fwpr${vmid}p$netnum";
505 sub simulate_firewall
{
506 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
508 my $from = $test->{from
} || die "missing 'from' field";
509 my $to = $test->{to
} || die "missing 'to' field";
510 my $action = $test->{action
} || die "missing 'action'";
512 my $testid = $test->{id
};
514 die "from/to needs to be different" if $from eq $to;
522 srctype
=> 'UNICAST',
523 dsttype
=> 'UNICAST',
526 while (my ($k,$v) = each %$test) {
527 next if $k eq 'from';
529 next if $k eq 'action';
531 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
539 if ($from eq 'host') {
540 $from_info->{type
} = 'host';
541 $start_state = 'host';
542 $pkg->{source
} = $host_ip if !defined($pkg->{source
});
543 } elsif ($from eq 'outside') {
544 $from_info->{type
} = 'bport';
545 $from_info->{bridge
} = 'vmbr0';
546 $from_info->{iface
} = 'eth0';
547 $start_state = 'from-bport';
548 } elsif ($from eq 'nfvm') {
549 $from_info->{type
} = 'bport';
550 $from_info->{bridge
} = 'vmbr0';
551 $from_info->{iface
} = 'tapXYZ';
552 $start_state = 'from-bport';
553 } elsif ($from =~ m/^ct(\d+)$/) {
554 return 'SKIPPED' if !$have_lxc;
556 $from_info = extract_ct_info
($vmdata, $vmid, 0);
557 $start_state = 'fwbr-out';
558 $pkg->{mac_source
} = $from_info->{macaddr
};
559 } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
560 return 'SKIPPED' if !$have_qemu_server;
562 my $netnum = $3 || 0;
563 $from_info = extract_vm_info
($vmdata, $vmid, $netnum);
564 $start_state = 'fwbr-out';
565 $pkg->{mac_source
} = $from_info->{macaddr
};
566 } elsif ($from =~ m
|^$bridge_interface_pattern$|) {
567 $from_info->{type
} = 'bport';
568 $from_info->{bridge
} = $1;
569 $from_info->{iface
} = $2;
570 $start_state = 'from-bport';
572 die "unable to parse \"from => '$from'\"\n";
578 $target->{type
} = 'host';
579 $target->{iface
} = 'host';
580 $pkg->{dest
} = $host_ip if !defined($pkg->{dest
});
581 } elsif ($to eq 'outside') {
582 $target->{type
} = 'bport';
583 $target->{bridge
} = 'vmbr0';
584 $target->{iface
} = 'eth0';
585 } elsif ($to eq 'nfvm') {
586 $target->{type
} = 'bport';
587 $target->{bridge
} = 'vmbr0';
588 $target->{iface
} = 'tapXYZ';
589 } elsif ($to =~ m/^ct(\d+)$/) {
590 return 'SKIPPED' if !$have_lxc;
592 $target = extract_ct_info
($vmdata, $vmid, 0);
593 $target->{iface
} = $target->{tapdev
};
594 } elsif ($to =~ m/^vm(\d+)$/) {
595 return 'SKIPPED' if !$have_qemu_server;
597 $target = extract_vm_info
($vmdata, $vmid, 0);
598 $target->{iface
} = $target->{tapdev
};
599 } elsif ($to =~ m
|^$bridge_interface_pattern$|) {
600 $target->{type
} = 'bport';
601 $target->{bridge
} = $1;
602 $target->{iface
} = $2;
604 die "unable to parse \"to => '$to'\"\n";
607 $pkg->{source
} = '100.100.1.2' if !defined($pkg->{source
});
608 $pkg->{dest
} = '100.200.3.4' if !defined($pkg->{dest
});
610 my ($res, $ic, $rc) = route_packet
($ruleset, $ipset_ruleset, $pkg,
611 $from_info, $target, $start_state);
613 add_trace
("IPT statistics: invocation = $ic, checks = $rc\n");
615 return $res if $action eq 'QUERY';
617 die "test failed ($res != $action)\n" if $action ne $res;