X-Git-Url: https://git.proxmox.com/?a=blobdiff_plain;f=src%2FPVE%2FFirewallSimulator.pm;h=2e9bc38a84f43275159f5c5a4b17e4cee3f16a7c;hb=7a33215176202a1f4304843cff598b2206619876;hp=22ddee47c95c1d3463931dd75ea16bd37b41a882;hpb=e76a9f539565cad56781f3c72ff9aae9f5e60639;p=pve-firewall.git

diff --git a/src/PVE/FirewallSimulator.pm b/src/PVE/FirewallSimulator.pm
index 22ddee4..2e9bc38 100644
--- a/src/PVE/FirewallSimulator.pm
+++ b/src/PVE/FirewallSimulator.pm
@@ -6,6 +6,8 @@ use Data::Dumper;
 use PVE::Firewall;
 use File::Basename;
 use Net::IP;
+use PVE::LXC;
+use PVE::QemuServer;
 
 my $mark;
 my $trace;
@@ -37,6 +39,14 @@ sub add_trace {
     }
 }
 
+$SIG{'__WARN__'} = sub {
+    my $err = $@;
+    my $t = $_[0];
+    chomp $t;
+    add_trace("$t\n");
+    $@ = $err;
+};
+
 sub nf_dev_match {
     my ($devre, $dev) = @_;
 
@@ -45,21 +55,40 @@ sub nf_dev_match {
 }
 
 sub ipset_match {
-    my ($ipsetname, $ipset, $ipaddr) = @_;
+    my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
+
+    my $ipset = $ipset_ruleset->{$ipsetname};
+    die "no such ipset '$ipsetname'" if !$ipset;
 
     my $ip = Net::IP->new($ipaddr);
 
-    foreach my $entry (@$ipset) {
-	next if $entry =~ m/^create/; # simply ignore
-	if ($entry =~ m/add \S+ (\S+)$/) {
-	    my $test = Net::IP->new($1);
-	    if ($test->overlaps($ip)) {
-		add_trace("IPSET $ipsetname match $ipaddr\n");
-		return 1;
+    my $first = $ipset->[0];
+    if ($first =~ m/^create\s+\S+\s+list:/) {
+	foreach my $entry (@$ipset) {
+	    next if $entry =~ m/^create/; # simply ignore
+	    if ($entry =~ m/add \S+ (\S+)$/) {
+		return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
+	    } else {
+		die "implement me";
+	    }
+	}
+	return 0;
+    } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
+	foreach my $entry (@$ipset) {
+	    next if $entry =~ m/^create/; # simply ignore
+	    if ($entry =~ m/add \S+ (\S+)$/) {
+		my $test = Net::IP->new($1);
+		if ($test->overlaps($ip)) {
+		    add_trace("IPSET $ipsetname match $ipaddr\n");
+		    return 1;
+		}
+	    } else {
+		die "implement me";
 	    }
-	} else {
-	    die "implement me";
 	}
+	return 0;
+    } else {
+	die "unknown ipset type '$first' - not implemented\n";
     }
 
     return 0;
@@ -111,7 +140,7 @@ sub rule_match {
 	    next;
 	}
 
-	if ($rule =~ s/^-p (tcp|udp)\s*//) {
+	if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
 	    die "missing proto" if !$pkg->{proto};
 	    return undef if $pkg->{proto} ne $1; # no match
 	    next;
@@ -143,19 +172,22 @@ sub rule_match {
 	    next;
 	}
 
-	if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
+	if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
 	    die "missing source" if !$pkg->{source};
-	    my $ipset = $ipset_ruleset->{$1};
-	    die "no such ip set '$1'" if !$ipset;
-	    return undef if !ipset_match($1, $ipset, $pkg->{source});
+	    my $neg = $1;
+	    my $ipset_name = $2;
+	    if ($neg) {
+		return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
+	    } else {
+		return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
+	    }
 	    next;
 	}
 
 	if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
 	    die "missing destination" if !$pkg->{dest};
-	    my $ipset = $ipset_ruleset->{$1};
-	    die "no such ip set '$1'" if !$ipset;
-	    return undef if !ipset_match($1, $ipset, $pkg->{dest});
+	    my $ipset_name = $1;
+	    return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
 	    next;
 	}
 
@@ -288,6 +320,8 @@ sub copy_packet {
 sub route_packet {
     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 
+    $pkg->{ipversion} = 4; # fixme: allow ipv6
+
     my $route_state = $start_state;
 
     my $physdev_in;
@@ -314,12 +348,7 @@ sub route_packet {
 		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
 		$chain = 'PVEFW-OUTPUT';
 		$next_route_state = $target->{iface} || die 'internal error';
-	    } elsif ($target->{type} eq 'ct') {
-		$pkg->{iface_in} = 'lo';
-		$pkg->{iface_out} = 'venet0';
-		$chain = 'PVEFW-OUTPUT';
-		$next_route_state = 'venet-in';
-	    } elsif ($target->{type} eq 'vm') {
+	    } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 		$pkg->{iface_in} = 'lo';
 		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
 		$chain = 'PVEFW-OUTPUT';
@@ -328,40 +357,6 @@ sub route_packet {
 		die "implement me";
 	    }
 
-	} elsif ($route_state eq 'venet-out') {
-
-	    if ($target->{type} eq 'host') {
-
-		$chain = 'PVEFW-INPUT';
-		$pkg->{iface_in} = 'venet0';
-		$pkg->{iface_out} = 'lo';
-		$next_route_state = 'host';
-
-	    } elsif ($target->{type} eq 'bport') {
-		
-		$chain = 'PVEFW-FORWARD';
-		$pkg->{iface_in} = 'venet0';
-		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
-		$next_route_state = $target->{iface} || die 'internal error';
-
-	    } elsif ($target->{type} eq 'vm') {
-
-		$chain = 'PVEFW-FORWARD';
-		$pkg->{iface_in} = 'venet0';
-		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
-		$next_route_state = 'fwbr-in';
-
-	    } elsif ($target->{type} eq 'ct') {
-
-		$chain = 'PVEFW-FORWARD';
-		$pkg->{iface_in} = 'venet0';
-		$pkg->{iface_out} = 'venet0';
-		$next_route_state = 'venet-in';
-
-	    } else {
-		die "implement me";
-	    }
-
 	} elsif ($route_state eq 'fwbr-out') {
 
 	    $chain = 'PVEFW-FORWARD';
@@ -404,14 +399,7 @@ sub route_packet {
 		}
 		$next_route_state = $target->{iface};
 
-	    } elsif ($target->{type} eq 'ct') {
-
-		$chain = 'PVEFW-FORWARD';
-		$pkg->{iface_in} = $route_state;
-		$pkg->{iface_out} = 'venet0';
-		$next_route_state = 'venet-in';
-
-	    } elsif ($target->{type} eq 'vm') {
+	    } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 
 		$chain = 'PVEFW-FORWARD';
 		$pkg->{iface_in} = $route_state;
@@ -450,32 +438,36 @@ sub route_packet {
 }
 
 sub extract_ct_info {
-    my ($vmdata, $vmid) = @_;
+    my ($vmdata, $vmid, $netnum) = @_;
 
     my $info = { type => 'ct', vmid => $vmid };
 
-    my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
-    if ($conf->{ip_address}) {
-	$info->{ip_address} = $conf->{ip_address}->{value};
-    } else {
-	die "implement me";
-    }
+    my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
+    my $net = PVE::LXC::Config->parse_lxc_network($conf->{"net$netnum"});
+    $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
+    $info->{bridge} = $net->{bridge} || die "unable to get bridge";
+    $info->{fwbr} = "fwbr${vmid}i$netnum";
+    $info->{tapdev} = "veth${vmid}i$netnum";
+    $info->{fwln} = "fwln${vmid}i$netnum";
+    $info->{fwpr} = "fwpr${vmid}p$netnum";
+    $info->{ip_address} = $net->{ip} || die "unable to get ip address";
+
     return $info;
 }
 
 sub extract_vm_info {
-    my ($vmdata, $vmid) = @_;
+    my ($vmdata, $vmid, $netnum) = @_;
 
     my $info = { type => 'vm', vmid => $vmid };
 
     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
-    my $net = PVE::QemuServer::parse_net($conf->{net0});
+    my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
-    $info->{fwbr} = "fwbr${vmid}i0";
-    $info->{tapdev} = "tap${vmid}i0";
-    $info->{fwln} = "fwln${vmid}i0";
-    $info->{fwpr} = "fwpr${vmid}p0";
+    $info->{fwbr} = "fwbr${vmid}i$netnum";
+    $info->{tapdev} = "tap${vmid}i$netnum";
+    $info->{fwln} = "fwln${vmid}i$netnum";
+    $info->{fwpr} = "fwpr${vmid}p$netnum";
 
     return $info;
 }
@@ -535,16 +527,13 @@ sub simulate_firewall {
 	$start_state = 'from-bport';
     } elsif ($from =~ m/^ct(\d+)$/) {
 	my $vmid = $1;
-	$from_info = extract_ct_info($vmdata, $vmid);
-	if ($from_info->{ip_address}) {
-	    $pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
-	    $start_state = 'venet-out';
-	} else {
-	    die "implement me";
-	}
-    } elsif ($from =~ m/^vm(\d+)$/) {
+	$from_info = extract_ct_info($vmdata, $vmid, 0);
+	$start_state = 'fwbr-out'; 
+	$pkg->{mac_source} = $from_info->{macaddr};
+    } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
 	my $vmid = $1;
-	$from_info = extract_vm_info($vmdata, $vmid);
+	my $netnum = $3 || 0;
+	$from_info = extract_vm_info($vmdata, $vmid, $netnum);
 	$start_state = 'fwbr-out'; 
 	$pkg->{mac_source} = $from_info->{macaddr};
     } else {
@@ -571,17 +560,11 @@ sub simulate_firewall {
 	$target->{iface} = 'tapXYZ';
     } elsif ($to =~ m/^ct(\d+)$/) {
 	my $vmid = $1;
-	$target = extract_ct_info($vmdata, $vmid);
-	$target->{iface} = 'venet-in';
-
-	if ($target->{ip_address}) {
-	    $pkg->{dest} = $target->{ip_address};
-	} else {
-	    die "implement me";
-	}
+	$target = extract_ct_info($vmdata, $vmid, 0);
+	$target->{iface} = $target->{tapdev};
    } elsif ($to =~ m/^vm(\d+)$/) {
 	my $vmid = $1;
-	$target = extract_vm_info($vmdata, $vmid);
+	$target = extract_vm_info($vmdata, $vmid, 0);
 	$target->{iface} = $target->{tapdev};
     } else {
 	die "unable to parse \"to => '$to'\"\n";