]>
git.proxmox.com Git - pve-firewall.git/blob - test/fwtester.pl
8faee3f977ce1ed83e99095a92d6e127cbb9a9a0
17 sub print_usage_and_exit
{
18 die "usage: $0 [--debug] [testfile [testid]]\n";
21 if (!GetOptions
('debug' => \
$debug)) {
22 print_usage_and_exit
();
25 my $testfilename = shift;
39 my ($devre, $dev) = @_;
41 $devre =~ s/\+$/\.\*/;
42 return ($dev =~ m/^${devre}$/) ?
1 : 0;
46 my ($ipsetname, $ipset, $ipaddr) = @_;
48 my $ip = Net
::IP-
>new($ipaddr);
50 foreach my $entry (@$ipset) {
51 next if $entry =~ m/^create/; # simply ignore
52 if ($entry =~ m/add \S+ (\S+)$/) {
53 my $test = Net
::IP-
>new($1);
54 if ($test->overlaps($ip)) {
55 add_trace
("IPSET $ipsetname match $ipaddr\n");
67 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
69 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
71 while (length($rule)) {
73 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
76 return undef if $cstate eq 'INVALID'; # no match
77 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
79 next if $cstate =~ m/NEW/;
81 die "please implement cstate test '$cstate'";
84 if ($rule =~ s/^-m addrtype\s*//) {
85 return undef; # simply ignore
88 if ($rule =~ s/^-i (\S+)\s*//) {
90 die "missing iface_in" if !$pkg->{iface_in
};
91 return undef if !nf_dev_match
($devre, $pkg->{iface_in
});
95 if ($rule =~ s/^-o (\S+)\s*//) {
97 die "missing iface_out" if !$pkg->{iface_out
};
98 return undef if !nf_dev_match
($devre, $pkg->{iface_out
});
102 if ($rule =~ s/^-p (tcp|udp)\s*//) {
103 die "missing proto" if !$pkg->{proto
};
104 return undef if $pkg->{proto
} ne $1; # no match
108 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
109 die "missing dport" if !$pkg->{dport
};
110 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
114 if ($rule =~ s/^--dport (\d+)\s*//) {
115 die "missing dport" if !$pkg->{dport
};
116 return undef if $pkg->{dport
} != $1; # no match
120 if ($rule =~ s/^-s (\S+)\s*//) {
121 die "missing source" if !$pkg->{source
};
122 my $ip = Net
::IP-
>new($1);
123 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{source
})); # no match
127 if ($rule =~ s/^-d (\S+)\s*//) {
128 die "missing destination" if !$pkg->{dest
};
129 my $ip = Net
::IP-
>new($1);
130 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{dest
})); # no match
134 if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
135 die "missing source" if !$pkg->{source
};
136 my $ipset = $ipset_ruleset->{$1};
137 die "no such ip set '$1'" if !$ipset;
138 return undef if !ipset_match
($1, $ipset, $pkg->{source
});
142 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
143 die "missing destination" if !$pkg->{dest
};
144 my $ipset = $ipset_ruleset->{$1};
145 die "no such ip set '$1'" if !$ipset;
146 return undef if !ipset_match
($1, $ipset, $pkg->{dest
});
150 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
151 die "missing source mac" if !$pkg->{mac_source
};
152 return undef if $pkg->{mac_source
} eq $1; # no match
156 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
158 return undef if !$pkg->{physdev_in
};
159 return undef if !nf_dev_match
($devre, $pkg->{physdev_in
});
163 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
165 return undef if !$pkg->{physdev_out
};
166 return undef if !nf_dev_match
($devre, $pkg->{physdev_out
});
170 if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
171 return undef if !defined($mark) || $mark != $1;
177 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
182 if ($rule =~ s/^-j (\S+)\s*$//) {
186 if ($rule =~ s/^-g (\S+)\s*$//) {
190 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
197 die "unable to parse rule: $rule";
200 sub ruleset_simulate_chain
{
201 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
203 add_trace
("ENTER chain $chain\n");
207 if ($chain eq 'PVEFW-Drop') {
208 add_trace
("LEAVE chain $chain\n");
209 return ('DROP', $counter);
211 if ($chain eq 'PVEFW-reject') {
212 add_trace
("LEAVE chain $chain\n");
213 return ('REJECT', $counter);
216 if ($chain eq 'PVEFW-tcpflags') {
217 add_trace
("LEAVE chain $chain\n");
218 return (undef, $counter);
221 my $rules = $ruleset->{$chain} ||
222 die "no such chain '$chain'";
224 foreach my $rule (@$rules) {
226 my ($goto, $action) = rule_match
($ipset_ruleset, $chain, $rule, $pkg);
227 if (!defined($action)) {
228 add_trace
("SKIP: $rule\n");
231 add_trace
("MATCH: $rule\n");
233 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
234 add_trace
("TERMINATE chain $chain: $action\n");
235 return ($action, $counter);
236 } elsif ($action eq 'RETURN') {
237 add_trace
("RETURN FROM chain $chain\n");
241 add_trace
("LEAVE chain $chain - goto $action\n");
242 return ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg)
244 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
246 my ($act, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg);
248 return ($act, $counter) if $act;
249 add_trace
("CONTINUE chain $chain\n");
254 add_trace
("LEAVE chain $chain\n");
255 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
256 return ('ACCEPT', $counter); # default policy
259 return (undef, $counter);
267 while (my ($k,$v) = each %$pkg) {
274 # Try to simulate packet traversal inside kernel. This invokes iptable
275 # checks several times.
277 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
279 my $route_state = $start_state;
283 my $ipt_invocation_counter = 0;
284 my $rule_check_counter = 0;
286 while ($route_state ne $target->{iface
}) {
289 my $next_route_state;
292 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
293 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
295 if ($route_state eq 'from-bport') {
296 $next_route_state = $from_info->{bridge
} || die 'internal error';
297 $next_physdev_in = $from_info->{iface
} || die 'internal error';
298 } elsif ($route_state eq 'host') {
300 if ($target->{type
} eq 'bport') {
301 $pkg->{iface_in
} = 'lo';
302 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
303 $chain = 'PVEFW-OUTPUT';
304 $next_route_state = $target->{iface
} || die 'internal error';
305 } elsif ($target->{type
} eq 'ct') {
306 $pkg->{iface_in
} = 'lo';
307 $pkg->{iface_out
} = 'venet0';
308 $chain = 'PVEFW-OUTPUT';
309 $next_route_state = 'venet-in';
310 } elsif ($target->{type
} eq 'vm') {
311 $pkg->{iface_in
} = 'lo';
312 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
313 $chain = 'PVEFW-OUTPUT';
314 $next_route_state = 'fwbr-in';
319 } elsif ($route_state eq 'venet-out') {
321 if ($target->{type
} eq 'host') {
323 $chain = 'PVEFW-INPUT';
324 $pkg->{iface_in
} = 'venet0';
325 $pkg->{iface_out
} = 'lo';
326 $next_route_state = 'host';
328 } elsif ($target->{type
} eq 'bport') {
330 $chain = 'PVEFW-FORWARD';
331 $pkg->{iface_in
} = 'venet0';
332 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
333 $next_route_state = $target->{iface
} || die 'internal error';
335 } elsif ($target->{type
} eq 'vm') {
337 $chain = 'PVEFW-FORWARD';
338 $pkg->{iface_in
} = 'venet0';
339 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
340 $next_route_state = 'fwbr-in';
342 } elsif ($target->{type
} eq 'ct') {
344 $chain = 'PVEFW-FORWARD';
345 $pkg->{iface_in
} = 'venet0';
346 $pkg->{iface_out
} = 'venet0';
347 $next_route_state = 'venet-in';
353 } elsif ($route_state eq 'fwbr-out') {
355 $chain = 'PVEFW-FORWARD';
356 $next_route_state = $from_info->{bridge
} || die 'internal error';
357 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
358 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
359 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
360 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
361 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
363 } elsif ($route_state eq 'fwbr-in') {
365 $chain = 'PVEFW-FORWARD';
366 $next_route_state = $target->{tapdev
};
367 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
368 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
369 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
370 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
372 } elsif ($route_state =~ m/^vmbr\d+$/) {
374 die "missing physdev_in - internal error?" if !$physdev_in;
375 $pkg->{physdev_in
} = $physdev_in;
377 if ($target->{type
} eq 'host') {
379 $chain = 'PVEFW-INPUT';
380 $pkg->{iface_in
} = $route_state;
381 $pkg->{iface_out
} = 'lo';
382 $next_route_state = 'host';
384 } elsif ($target->{type
} eq 'bport') {
386 $chain = 'PVEFW-FORWARD';
387 $pkg->{iface_in
} = $route_state;
388 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
389 # conditionally set physdev_out (same behavior as kernel)
390 if ($route_state eq $target->{bridge
}) {
391 $pkg->{physdev_out
} = $target->{iface
} || die 'internal error';
393 $next_route_state = $target->{iface
};
395 } elsif ($target->{type
} eq 'ct') {
397 $chain = 'PVEFW-FORWARD';
398 $pkg->{iface_in
} = $route_state;
399 $pkg->{iface_out
} = 'venet0';
400 $next_route_state = 'venet-in';
402 } elsif ($target->{type
} eq 'vm') {
404 $chain = 'PVEFW-FORWARD';
405 $pkg->{iface_in
} = $route_state;
406 $pkg->{iface_out
} = $target->{bridge
};
407 # conditionally set physdev_out (same behavior as kernel)
408 if ($route_state eq $target->{bridge
}) {
409 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
411 $next_route_state = 'fwbr-in';
418 die "implement me $route_state";
421 die "internal error" if !defined($next_route_state);
424 add_trace
("IPT check at $route_state (chain $chain)\n");
425 add_trace
(Dumper
($pkg));
426 $ipt_invocation_counter++;
427 my ($res, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $chain, $pkg);
428 $rule_check_counter += $ctr;
429 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
432 $route_state = $next_route_state;
434 $physdev_in = $next_physdev_in;
437 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
440 sub extract_ct_info
{
441 my ($vmdata, $vmid) = @_;
443 my $info = { type
=> 'ct', vmid
=> $vmid };
445 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
446 if ($conf->{ip_address
}) {
447 $info->{ip_address
} = $conf->{ip_address
}->{value
};
454 sub extract_vm_info
{
455 my ($vmdata, $vmid) = @_;
457 my $info = { type
=> 'vm', vmid
=> $vmid };
459 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
460 my $net = PVE
::QemuServer
::parse_net
($conf->{net0
});
461 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
462 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
463 $info->{fwbr
} = "fwbr${vmid}i0";
464 $info->{tapdev
} = "tap${vmid}i0";
465 $info->{fwln
} = "fwln${vmid}i0";
466 $info->{fwpr
} = "fwpr${vmid}p0";
471 sub simulate_firewall
{
472 my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
474 my $from = $test->{from
} || die "missing 'from' field";
475 my $to = $test->{to
} || die "missing 'to' field";
476 my $action = $test->{action
} || die "missing 'action'";
478 my $testid = $test->{id
};
480 die "from/to needs to be different" if $from eq $to;
490 while (my ($k,$v) = each %$test) {
491 next if $k eq 'from';
493 next if $k eq 'action';
495 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
503 my $host_ip = '10.11.12.13';
505 if ($from eq 'host') {
506 $from_info->{type
} = 'host';
507 $start_state = 'host';
508 $pkg->{source
} = $host_ip if !defined($pkg->{source
});
509 } elsif ($from =~ m
|^(vmbr\d
+)/(\S
+)$|) {
510 $from_info->{type
} = 'bport';
511 $from_info->{bridge
} = $1;
512 $from_info->{iface
} = $2;
513 $start_state = 'from-bport';
514 } elsif ($from eq 'outside') {
515 $from_info->{type
} = 'bport';
516 $from_info->{bridge
} = 'vmbr0';
517 $from_info->{iface
} = 'eth0';
518 $start_state = 'from-bport';
519 } elsif ($from eq 'nfvm') {
520 $from_info->{type
} = 'bport';
521 $from_info->{bridge
} = 'vmbr0';
522 $from_info->{iface
} = 'tapXYZ';
523 $start_state = 'from-bport';
524 } elsif ($from =~ m/^ct(\d+)$/) {
526 $from_info = extract_ct_info
($vmdata, $vmid);
527 if ($from_info->{ip_address
}) {
528 $pkg->{source
} = $from_info->{ip_address
} if !defined($pkg->{source
});
529 $start_state = 'venet-out';
533 } elsif ($from =~ m/^vm(\d+)$/) {
535 $from_info = extract_vm_info
($vmdata, $vmid);
536 $start_state = 'fwbr-out';
537 $pkg->{mac_source
} = $from_info->{macaddr
};
539 die "unable to parse \"from => '$from'\"\n";
545 $target->{type
} = 'host';
546 $target->{iface
} = 'host';
547 $pkg->{dest
} = $host_ip if !defined($pkg->{dest
});
548 } elsif ($to =~ m
|^(vmbr\d
+)/(\S
+)$|) {
549 $target->{type
} = 'bport';
550 $target->{bridge
} = $1;
551 $target->{iface
} = $2;
552 } elsif ($to eq 'outside') {
553 $target->{type
} = 'bport';
554 $target->{bridge
} = 'vmbr0';
555 $target->{iface
} = 'eth0';
556 } elsif ($to eq 'nfvm') {
557 $target->{type
} = 'bport';
558 $target->{bridge
} = 'vmbr0';
559 $target->{iface
} = 'tapXYZ';
560 } elsif ($to =~ m/^ct(\d+)$/) {
562 $target = extract_ct_info
($vmdata, $vmid);
563 $target->{iface
} = 'venet-in';
565 if ($target->{ip_address
}) {
566 $pkg->{dest
} = $target->{ip_address
};
570 } elsif ($to =~ m/^vm(\d+)$/) {
572 $target = extract_vm_info
($vmdata, $vmid);
573 $target->{iface
} = $target->{tapdev
};
575 die "unable to parse \"to => '$to'\"\n";
578 $pkg->{source
} = '100.100.1.2' if !defined($pkg->{source
});
579 $pkg->{dest
} = '100.200.3.4' if !defined($pkg->{dest
});
581 my ($res, $ic, $rc) = route_packet
($ruleset, $ipset_ruleset, $pkg,
582 $from_info, $target, $start_state);
584 add_trace
("IPT statistics: invocation = $ic, checks = $rc\n");
586 die "test failed ($res != $action)\n" if $action ne $res;
592 my ($vmdata, $testdir, $testfile, $testid) = @_;
594 $testfile = 'tests' if !$testfile;
596 $vmdata->{testdir
} = $testdir;
598 my ($ruleset, $ipset_ruleset) =
599 PVE
::Firewall
::compile
(undef, undef, $vmdata);
601 my $filename = "$testdir/$testfile";
602 my $fh = IO
::File-
>new($filename) ||
603 die "unable to open '$filename' - $!\n";
606 while (defined(my $line = <$fh>)) {
607 next if $line =~ m/^\s*$/;
608 next if $line =~ m/^#.*$/;
609 if ($line =~ m/^\{.*\}\s*$/) {
610 my $test = eval $line;
612 next if defined($testid) && (!defined($test->{id
}) || ($testid ne $test->{id
}));
614 print Dumper
($ruleset) if $debug;
617 my @test_zones = qw(host outside nfvm vm100 ct200);
618 if (!defined($test->{from
}) && !defined($test->{to
})) {
619 die "missing zone speification (from, to)\n";
620 } elsif (!defined($test->{to
})) {
621 foreach my $zone (@test_zones) {
622 next if $zone eq $test->{from
};
624 add_trace
("Set Zone: to => '$zone'\n");
625 simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test);
627 } elsif (!defined($test->{from
})) {
628 foreach my $zone (@test_zones) {
629 next if $zone eq $test->{to
};
630 $test->{from
} = $zone;
631 add_trace
("Set Zone: from => '$zone'\n");
632 simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test);
635 simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test);
640 print Dumper
($ruleset) if !$debug;
642 print "$trace\n" if !$debug;
644 print "$filename line $.: $line";
646 print "test failed: $err\n";
655 die "no tests found\n" if $testcount <= 0;
657 print "PASS: $filename\n";
665 net0
=> "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
668 net0
=> "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
672 net0
=> "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
677 ip_address
=> { value
=> '10.0.200.1' },
680 ip_address
=> { value
=> '10.0.200.2' },
689 if (-d
$testfilename) {
690 $dir = $testfilename;
691 } elsif (-f
$testfilename) {
692 $dir = dirname
($testfilename);
693 $testfile = basename
($testfilename);
695 die "no such file/dir '$testfilename'\n";
698 run_tests
($vmdata, $dir, $testfile, $testid);
701 foreach my $dir (<test-
*>) {
703 run_tests
($vmdata, $dir);
707 print "OK - all tests passed\n";