- my $wcount = 0;
- while ((time() < $next_update) &&
- ($wcount < $updatetime) && # protect against time wrap
- !$restart_request) { $wcount++; sleep (1); };
-
- restart_server() if $restart_request;
- };
-
- my $err = $@;
-
- if ($err) {
- syslog ('err', "ERROR: $err");
- restart_server(5);
- exit (0);
- }
- }
-}
-
-__PACKAGE__->register_method ({
- name => 'start',
- path => 'start',
- method => 'POST',
- description => "Start the Proxmox VE firewall service.",
- parameters => {
- additionalProperties => 0,
- properties => {
- debug => {
- description => "Debug mode - stay in foreground",
- type => "boolean",
- optional => 1,
- default => 0,
- },
- },
- },
- returns => { type => 'null' },
-
- code => sub {
- my ($param) = @_;
-
- run_server($param);
-
- return undef;
- }});
-
-__PACKAGE__->register_method ({
- name => 'stop',
- path => 'stop',
- method => 'POST',
- description => "Stop firewall. This removes all Proxmox VE related iptable rules. The host is unprotected afterwards.",
- parameters => {
- additionalProperties => 0,
- properties => {},
- },
- returns => { type => 'null' },
-
- code => sub {
- my ($param) = @_;
-
- my $pid = int(PVE::Tools::file_read_firstline($pve_firewall_pidfile) || 0);
-
- if ($pid) {
- if (PVE::ProcFSTools::check_process_running($pid)) {
- kill(15, $pid); # send TERM signal
- # give max 5 seconds to shut down
- for (my $i = 0; $i < 5; $i++) {
- last if !PVE::ProcFSTools::check_process_running($pid);
- sleep (1);
- }
-
- # to be sure
- kill(9, $pid);
- waitpid($pid, 0);
- }
- if (-f $pve_firewall_pidfile) {
- # try to get the lock
- lockpidfile($pve_firewall_pidfile);
- cleanup();
- }
- }
-
- return undef;
- }});
-
-__PACKAGE__->register_method ({
- name => 'status',
- path => 'status',
- method => 'GET',
- description => "Get firewall status.",
- parameters => {
- additionalProperties => 0,
- properties => {},
- },
- returns => {
- type => 'object',
- additionalProperties => 0,
- properties => {
- status => {
- type => 'string',
- enum => ['unknown', 'stopped', 'active'],
- },
- changes => {
- description => "Set when there are pending changes.",
- type => 'boolean',
- optional => 1,
- }
- },
- },
- code => sub {
- my ($param) = @_;
-
- local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
-
- my $code = sub {
-
- my $pid = int(PVE::Tools::file_read_firstline($pve_firewall_pidfile) || 0);
- my $running = PVE::ProcFSTools::check_process_running($pid);
-
- my $status = $running ? 'active' : 'stopped';
-
- my $res = { status => $status };
- if ($status eq 'active') {
- my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
-
- my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
- my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset);
-
- $res->{changes} = ($ipset_changes || $ruleset_changes) ? 1 : 0;
- }
-
- return $res;
- };
-
- return PVE::Firewall::run_locked($code);
- }});
-
-__PACKAGE__->register_method ({
- name => 'compile',
- path => 'compile',
- method => 'POST',
- description => "Compile and print firewall rules. This is useful for testing.",
- parameters => {
- additionalProperties => 0,
- properties => {},
- },
- returns => { type => 'null' },
-
- code => sub {
- my ($param) = @_;
-
- local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
-
- my $code = sub {
- my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
-
- my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, 1);
- my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, 1);
- if ($ipset_changes || $ruleset_changes) {
- print "detected changes\n";
- } else {
- print "no changes\n";
- }
- };
-
- PVE::Firewall::run_locked($code);
-
- return undef;
- }});
-
-__PACKAGE__->register_method ({
- name => 'simulate',
- path => 'simulate',
- method => 'POST',
- description => "Simulate firewall rules. This does not simulate kernel 'routing' table. Instead, this simply assumes that routing from source zone to destination zone is possible.",
- parameters => {
- additionalProperties => 0,
- properties => {
- verbose => {
- description => "Verbose output.",
- type => 'boolean',
- optional => 1,
- default => 0,
- },
- from => {
- description => "Source zone.",
- type => 'string',
- pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
- optional => 1,
- default => 'outside',
- },
- to => {
- description => "Destination zone.",
- type => 'string',
- pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
- optional => 1,
- default => 'host',
- },
- protocol => {
- description => "Protocol.",
- type => 'string',
- pattern => '(tcp|udp)',
- optional => 1,
- default => 'tcp',
- },
- dport => {
- description => "Destination port.",
- type => 'integer',
- minValue => 1,
- maxValue => 65535,
- optional => 1,
- },
- sport => {
- description => "Source port.",
- type => 'integer',
- minValue => 1,
- maxValue => 65535,
- optional => 1,
- },
- source => {
- description => "Source IP address.",
- type => 'string', format => 'ipv4',
- optional => 1,
- },
- dest => {
- description => "Destination IP address.",
- type => 'string', format => 'ipv4',
- optional => 1,
- },
- },
- },
- returns => { type => 'null' },
- code => sub {
- my ($param) = @_;
-
- local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
-
- my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
-
- PVE::FirewallSimulator::debug($param->{verbose} || 0);
-
- my $host_ip = PVE::Cluster::remote_node_ip($nodename);
-
- PVE::FirewallSimulator::reset_trace();
- print Dumper($ruleset) if $param->{verbose};
-
- my $test = {
- from => $param->{from},
- to => $param->{to},
- proto => $param->{protocol} || 'tcp',
- source => $param->{source},
- dest => $param->{dest},
- dport => $param->{dport},
- sport => $param->{sport},
- };
-
- if (!defined($test->{to})) {
- $test->{to} = 'host';
- PVE::FirewallSimulator::add_trace("Set Zone: to => '$test->{to}'\n");
- }
- if (!defined($test->{from})) {
- $test->{from} = 'outside',
- PVE::FirewallSimulator::add_trace("Set Zone: from => '$test->{from}'\n");
- }
-
- my $vmdata = PVE::Firewall::read_local_vm_config();
-
- print "Test packet:\n";
-
- foreach my $k (qw(from to proto source dest dport sport)) {
- printf(" %-8s: %s\n", $k, $test->{$k}) if defined($test->{$k});
- }
-
- $test->{action} = 'QUERY';
-
- my $res = PVE::FirewallSimulator::simulate_firewall($ruleset, $ipset_ruleset,
- $host_ip, $vmdata, $test);
-
- print "ACTION: $res\n";
-
- return undef;
- }});
-
-my $cmddef = {
- start => [ __PACKAGE__, 'start', []],
- stop => [ __PACKAGE__, 'stop', []],
- compile => [ __PACKAGE__, 'compile', []],
- simulate => [ __PACKAGE__, 'simulate', []],
- status => [ __PACKAGE__, 'status', [], undef, sub {
- my $res = shift;
- if ($res->{changes}) {
- print "Status: $res->{status} (pending changes)\n";
- } else {
- print "Status: $res->{status}\n";
- }
- }],
- };
-
-my $cmd = shift;
-
-PVE::CLIHandler::handle_cmd($cmddef, $0, $cmd, \@ARGV, undef, $0);
-
-exit (0);
-
-__END__
-
-=head1 NAME
-
-pve-firewall - PVE Firewall Daemon
-
-=head1 SYNOPSIS
-
-=include synopsis
-
-=head1 DESCRIPTION
-
-This service updates iptables rules periodically.