[pve-firewall.git] / PVE / Firewall.pm

package PVE::Firewall;

use warnings;
use strict;
use Data::Dumper;
use PVE::Tools;
use PVE::QemuServer;
use File::Path;
use IO::File;
use Net::IP;

use Data::Dumper;

my $macros;
sub get_shorewall_macros {

    return $macros if $macros;

    foreach my $path (</usr/share/shorewall/macro.*>) {
	if ($path =~ m|/macro\.(\S+)$|) {
	    $macros->{$1} = 1;
	}
    }
    return $macros;
}

sub parse_address_list {
    my ($str) = @_;

    foreach my $aor (split(/,/, $str)) {
	if (!Net::IP->new($aor)) {
	    my $err = Net::IP::Error();
	    die "invalid IP address: $err\n";
	}
    }
}

my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";

my $generate_input_rule = sub {
    my ($zoneinfo, $rule, $net, $netid) = @_;

    my $zone = $net->{zone} || die "internal error";
    my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
    my $tap = $net->{tap} || die "internal error";

    my $dest = "$zid:$tap";

    if ($rule->{dest}) {
	$dest .= ":$rule->{dest}";
    }

    my $action = $rule->{service} ? 
	"$rule->{service}($rule->{action})" : $rule->{action};

    my $sources = [];

    if (!$rule->{source}) {
	push @$sources, 'all'; 
    } elsif ($zoneinfo->{$zone}->{type} eq 'bport') {
	my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error";
	my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";

	# using 'all' does not work, so we create one rule for
	# each related zone on the same bridge
	push @$sources, "${zoneref}:$rule->{source}";
	foreach my $z (keys %$zoneinfo) {
	    next if $z eq $zone;
	    next if !$zoneinfo->{$z}->{bridge_zone};
	    next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone;
	    $zoneref = $zoneinfo->{$z}->{zoneref} || die "internal error";
	    push @$sources, "${zoneref}:$rule->{source}";
	}
    } else {
	push @$sources, "all:$rule->{source}";
    }

    my $out = '';

    foreach my $source (@$sources) {
	$out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-', 
			$rule->{dport} || '-', $rule->{sport} || '-');
    }

    return $out;
};

my $generate_output_rule = sub {
    my ($zoneinfo, $rule, $net, $netid) = @_;

    my $zone = $net->{zone} || die "internal error";
    my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
    my $tap = $net->{tap} || die "internal error";

    my $action = $rule->{service} ? 
	"$rule->{service}($rule->{action})" : $rule->{action};
    
    my $dest;

    if (!$rule->{dest}) {
	$dest = 'all';
    } else {
	$dest = "all:$rule->{dest}";
    }

    return sprintf($rule_format, $action, "$zid:$tap", $dest, 
		   $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
};

# we need complete VM configuration of all VMs (openvz/qemu)
# in vmdata

my $compile_shorewall = sub {
    my ($targetdir, $vmdata, $rules) = @_;

    # remove existing data ?
    foreach my $file (qw(params zones rules interfaces  maclist  policy)) {
	unlink "$targetdir/$file";
    }

    my $netinfo;

    my $zoneinfo = {
	fw => { type => 'firewall' },
    };

    my $maclist = {};

    my $register_bridge;

    $register_bridge = sub {
	my ($bridge, $vlan) = @_;

	my $zone =  'z' . $bridge;

	return $zone if $zoneinfo->{$zone};

	my $ext_zone = "z${bridge}ext";

	$zoneinfo->{$zone} = {
	    type => 'bridge',
	    bridge => $bridge,
	    bridge_ext_zone => $ext_zone,
	};

	# physical input devices
	my $dir = "/sys/class/net/$bridge/brif";
	my $physical = {};
	PVE::Tools::dir_glob_foreach($dir, '((eth|bond).+)', sub {
	    my ($slave) = @_;
	    $physical->{$slave} = 1;
	});

	$zoneinfo->{$ext_zone} = {
	    type => 'bport',
	    bridge_zone => $zone,
	    ifaces => $physical,
	};

	return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
	
	return $zone;
    };

    my $register_bridge_port = sub {
	my ($bridge, $vlan, $vmzone, $tap) = @_;

	my $bridge_zone = &$register_bridge($bridge, $vlan);
	my $zone = $bridge_zone . $vmzone;

	if (!$zoneinfo->{$zone}) {
	    $zoneinfo->{$zone} = {
		type => 'bport',
		bridge_zone => $bridge_zone,
		ifaces => {},
	    };
	}

	$zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
	
	return $zone;
    };

    foreach my $vmid (keys %{$vmdata->{qemu}}) {
	$netinfo->{$vmid} = {};
	my $conf = $vmdata->{qemu}->{$vmid};
	foreach my $opt (keys %$conf) {
	    next if $opt !~ m/^net(\d+)$/;
	    my $netnum = $1;
	    my $net = PVE::QemuServer::parse_net($conf->{$opt});
	    next if !$net;
	    die "implement me" if !$net->{bridge};

	    my $vmzone = $conf->{zone} || "vm$vmid";
	    $net->{tap} = "tap${vmid}i${netnum}";
	    $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error";
	    $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
	    $netinfo->{$vmid}->{$opt} = $net;
	}
    }

    #print Dumper($netinfo);

    # NOTE: zone names have length limit, so we need to
    # translate them into shorter names 

    my $zoneid = 0;
    my $zonemap = { fw => 'fw' };

    my $lookup_zonename = sub {
	my ($zone) = @_;

	return $zonemap->{$zone} if defined($zonemap->{$zone});
	$zonemap->{$zone} = 'z' . $zoneid++;

	return $zonemap->{$zone};
    };

    foreach my $z (sort keys %$zoneinfo) {
	$zoneinfo->{$z}->{id} = &$lookup_zonename($z);
	$zoneinfo->{$z}->{zonevar} = uc($z);
 	$zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
    }

    my $out;

    # dump params file
    $out = "# PVE zones\n";
    foreach my $z (sort keys %$zoneinfo) {
	$out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
    }
    PVE::Tools::file_set_contents("$targetdir/params", $out);

    # dump zone file

    my $format = "%-30s %-10s %-15s\n";
    $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
    
    foreach my $z (sort keys %$zoneinfo) {
	my $zid = $zoneinfo->{$z}->{zoneref};
	if ($zoneinfo->{$z}->{type} eq 'firewall') {
	    $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
	    $out .= sprintf($format, $zid, 'ipv4', '');
	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
	    my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
	    my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
	    $out .= sprintf($format, "$zid:$bzid", 'bport', '');
	} else {
	    die "internal error";
	}
    }

    $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");

    PVE::Tools::file_set_contents("$targetdir/zones", $out);

    # dump interfaces

    $format = "%-25s %-20s %-10s %-15s\n";
    $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');

    my $maclist_format = "%-15s %-15s %-15s\n";
    my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');

    foreach my $z (sort keys %$zoneinfo) {
	my $zid = $zoneinfo->{$z}->{zoneref};
	if ($zoneinfo->{$z}->{type} eq 'firewall') {
	    # do nothing;
	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
	    my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error";
	    $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
	    my $ifaces = $zoneinfo->{$z}->{ifaces};
	    foreach my $iface (sort keys %$ifaces) {
		my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
		my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error";
		my $iftxt = "$bridge:$iface";

		if ($maclist->{$iface}) {
		    $out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
		    $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
		} else {
		    $out .= sprintf($format, $zid, $iftxt, '-', '');
		}
	    }
	} else {
	    die "internal error";
	}
    }

    $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");

    PVE::Tools::file_set_contents("$targetdir/interfaces", $out);

    # dump maclist
    PVE::Tools::file_set_contents("$targetdir/maclist", $macs);

    # dump policy

    $format = "%-15s %-15s %-15s %s\n";
    $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
    $out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');

    # we need to disable intra-zone traffic on bridges. Else traffic
    # from untracked interfaces simply pass the firewall
    foreach my $z (sort keys %$zoneinfo) {
	my $zid = $zoneinfo->{$z}->{zoneref};
	if ($zoneinfo->{$z}->{type} eq 'bridge') {
	    $out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
	}
    }
    $out .= sprintf($format, 'all', 'all', 'REJECT', 'info');

    PVE::Tools::file_set_contents("$targetdir/policy", $out);

    # dump rules
    $out = '';

    $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
    foreach my $vmid (sort keys %$rules) {
	my $inrules = $rules->{$vmid}->{in};
	my $outrules = $rules->{$vmid}->{out};

	if (scalar(@$inrules)) {
	    $out .= "# IN to VM $vmid\n";
	    foreach my $rule (@$inrules) {
		foreach my $netid (keys %{$netinfo->{$vmid}}) {
		    my $net = $netinfo->{$vmid}->{$netid};
		    next if $rule->{iface} && $rule->{iface} ne $netid;
		    $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
		}
	    }
	}

	if (scalar(@$outrules)) {
	    $out .= "# OUT from VM $vmid\n";
	    foreach my $rule (@$outrules) {
		foreach my $netid (keys %{$netinfo->{$vmid}}) {
		    my $net = $netinfo->{$vmid}->{$netid};
		    next if $rule->{iface} && $rule->{iface} ne $netid;
		    $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
		}
	    }
	}
    }

    PVE::Tools::file_set_contents("$targetdir/rules", $out);
};


sub parse_fw_rules {
    my ($filename, $fh) = @_;

    my $section;

    my $res = { in => [], out => [] };

    my $macros = PVE::Firewall::get_shorewall_macros();

    while (defined(my $line = <$fh>)) {
	next if $line =~ m/^#/;
	next if $line =~ m/^\s*$/;

	if ($line =~ m/^\[(in|out)\]\s*$/i) {
	    $section = lc($1);
	    next;
	}
	next if !$section;

	my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
	    split(/\s+/, $line);

	if (!$action) {
	    warn "skip incomplete line\n";
	    next;
	}

	my $service;
	if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) {
	    # OK
	} elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
	    ($service, $action) = ($1, $2);
	    if (!$macros->{$service}) {
		warn "unknown service '$service'\n";
		next;
	    }
	} else {
	    warn "unknown action '$action'\n";
	    next;
	}

	$iface = undef if $iface && $iface eq '-';
	if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
	    warn "unknown interface '$iface'\n";
	    next;
	}

	$proto = undef if $proto && $proto eq '-';
	if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) {
	    warn "unknown protokol '$proto'\n";
	    next;
	}

	$source = undef if $source && $source eq '-';
	$dest = undef if $dest && $dest eq '-';

	$dport = undef if $dport && $dport eq '-';
	$sport = undef if $sport && $sport eq '-';

	eval {
	    parse_address_list($source) if $source;
	    parse_address_list($dest) if $dest;

	};
	if (my $err = $@) {
	    warn $err;
	    next;

	}


	my $rule = {
	    action => $action,
	    service => $service,
	    iface => $iface,
	    source => $source,
	    dest => $dest,
	    proto => $proto,
	    dport => $dport,
	    sport => $sport,
	};

	push @{$res->{$section}}, $rule;
    }

    return $res;
}

sub read_local_vm_config {

    my $openvz = {};

    my $qemu = {};

    my $list = PVE::QemuServer::config_list();

    foreach my $vmid (keys %$list) {
	#next if !($vmid eq '100' || $vmid eq '102');
	my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
	if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
	    $qemu->{$vmid} = $conf;
	}
    }

    my $vmdata = { openvz => $openvz, qemu => $qemu };

    return $vmdata;
};

sub read_vm_firewall_rules {
    my ($vmdata) = @_;
    my $rules = {};
    foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
	my $filename = "/etc/pve/firewall/$vmid.fw";
	my $fh = IO::File->new($filename, O_RDONLY);
	next if !$fh;

	$rules->{$vmid} = parse_fw_rules($filename, $fh);
    }

    return $rules;
}

sub compile {

    my $vmdata = read_local_vm_config();
    my $rules = read_vm_firewall_rules($vmdata);

    # print Dumper($vmdata);

    my $swdir = '/etc/shorewall';
    mkdir $swdir;

    &$compile_shorewall($swdir, $vmdata, $rules);

    PVE::Tools::run_command(['shorewall', 'compile']);
}

sub compile_and_start {
    my ($restart) = @_;

    compile();

    PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']);
}


1;
Commit	Line	Data
b6360c3f DM	1	package PVE::Firewall;
	2
	3	use warnings;
	4	use strict;
	5	use Data::Dumper;
f789653a	6	use PVE::Tools;
b6360c3f	7	use PVE::QemuServer;
5e1267a5 DM	8	use File::Path;
5e1267a5 DM	9	use IO::File;
ecbea048 DM	10	use Net::IP;
ecbea048 DM	11
5e1267a5	12	use Data::Dumper;
b6360c3f	13
9aab3127 DM	14	my $macros;
	15	sub get_shorewall_macros {
	16
	17	return $macros if $macros;
	18
	19	foreach my $path (</usr/share/shorewall/macro.*>) {
	20	if ($path =~ m\|/macro\.(\S+)$\|) {
	21	$macros->{$1} = 1;
	22	}
	23	}
	24	return $macros;
	25	}
	26
ecbea048 DM	27	sub parse_address_list {
	28	my ($str) = @_;
	29
	30	foreach my $aor (split(/,/, $str)) {
	31	if (!Net::IP->new($aor)) {
	32	my $err = Net::IP::Error();
	33	die "invalid IP address: $err\n";
	34	}
	35	}
	36	}
dddd9413	37
8cebfa6f	38	my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
dddd9413 DM	39
	40	my $generate_input_rule = sub {
	41	my ($zoneinfo, $rule, $net, $netid) = @_;
	42
dddd9413	43	my $zone = $net->{zone} \|\| die "internal error";
a8195f4f	44	my $zid = $zoneinfo->{$zone}->{zoneref} \|\| die "internal error";
dddd9413	45	my $tap = $net->{tap} \|\| die "internal error";
9aab3127	46
8cebfa6f DM	47	my $dest = "$zid:$tap";
	48
	49	if ($rule->{dest}) {
	50	$dest .= ":$rule->{dest}";
	51	}
	52
9aab3127 DM	53	my $action = $rule->{service} ?
	54	"$rule->{service}($rule->{action})" : $rule->{action};
	55
b9b06789	56	my $sources = [];
8cebfa6f	57
b9b06789 DM	58	if (!$rule->{source}) {
	59	push @$sources, 'all';
	60	} elsif ($zoneinfo->{$zone}->{type} eq 'bport') {
8cebfa6f	61	my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} \|\| die "internal error";
b9b06789 DM	62	my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} \|\| die "internal error";
	63
	64	# using 'all' does not work, so we create one rule for
	65	# each related zone on the same bridge
	66	push @$sources, "${zoneref}:$rule->{source}";
	67	foreach my $z (keys %$zoneinfo) {
	68	next if $z eq $zone;
	69	next if !$zoneinfo->{$z}->{bridge_zone};
	70	next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone;
	71	$zoneref = $zoneinfo->{$z}->{zoneref} \|\| die "internal error";
	72	push @$sources, "${zoneref}:$rule->{source}";
8cebfa6f DM	73	}
8cebfa6f DM	74	} else {
b9b06789 DM	75	push @$sources, "all:$rule->{source}";
	76	}
	77
	78	my $out = '';
	79
	80	foreach my $source (@$sources) {
	81	$out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} \|\| '-',
	82	$rule->{dport} \|\| '-', $rule->{sport} \|\| '-');
8cebfa6f DM	83	}
8cebfa6f DM	84
b9b06789	85	return $out;
dddd9413 DM	86	};
	87
	88	my $generate_output_rule = sub {
	89	my ($zoneinfo, $rule, $net, $netid) = @_;
	90
dddd9413	91	my $zone = $net->{zone} \|\| die "internal error";
a8195f4f	92	my $zid = $zoneinfo->{$zone}->{zoneref} \|\| die "internal error";
dddd9413	93	my $tap = $net->{tap} \|\| die "internal error";
9aab3127 DM	94
	95	my $action = $rule->{service} ?
	96	"$rule->{service}($rule->{action})" : $rule->{action};
dddd9413	97
8cebfa6f DM	98	my $dest;
	99
	100	if (!$rule->{dest}) {
9a4644fa	101	$dest = 'all';
8cebfa6f	102	} else {
9a4644fa	103	$dest = "all:$rule->{dest}";
8cebfa6f DM	104	}
	105
	106	return sprintf($rule_format, $action, "$zid:$tap", $dest,
dddd9413 DM	107	$rule->{proto} \|\| '-', $rule->{dport} \|\| '-', $rule->{sport} \|\| '-');
	108	};
	109
b6360c3f DM	110	# we need complete VM configuration of all VMs (openvz/qemu)
	111	# in vmdata
	112
5e1267a5	113	my $compile_shorewall = sub {
dddd9413	114	my ($targetdir, $vmdata, $rules) = @_;
b6360c3f	115
80bfe1ff	116	# remove existing data ?
a8195f4f	117	foreach my $file (qw(params zones rules interfaces maclist policy)) {
80bfe1ff DM	118	unlink "$targetdir/$file";
	119	}
	120
b6360c3f DM	121	my $netinfo;
b6360c3f DM	122
886aba9c DM	123	my $zoneinfo = {
	124	fw => { type => 'firewall' },
	125	};
	126
026a6466 DM	127	my $maclist = {};
026a6466 DM	128
35081236 DM	129	my $register_bridge;
	130
	131	$register_bridge = sub {
	132	my ($bridge, $vlan) = @_;
f789653a DM	133
	134	my $zone = 'z' . $bridge;
	135
	136	return $zone if $zoneinfo->{$zone};
	137
8cebfa6f DM	138	my $ext_zone = "z${bridge}ext";
8cebfa6f DM	139
f789653a DM	140	$zoneinfo->{$zone} = {
	141	type => 'bridge',
	142	bridge => $bridge,
8cebfa6f DM	143	bridge_ext_zone => $ext_zone,
	144	};
	145
	146	# physical input devices
	147	my $dir = "/sys/class/net/$bridge/brif";
	148	my $physical = {};
	149	PVE::Tools::dir_glob_foreach($dir, '((eth\|bond).+)', sub {
	150	my ($slave) = @_;
	151	$physical->{$slave} = 1;
	152	});
	153
	154	$zoneinfo->{$ext_zone} = {
	155	type => 'bport',
	156	bridge_zone => $zone,
	157	ifaces => $physical,
f789653a	158	};
35081236 DM	159
	160	return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
	161
	162	return $zone;
	163	};
	164
	165	my $register_bridge_port = sub {
	166	my ($bridge, $vlan, $vmzone, $tap) = @_;
	167
	168	my $bridge_zone = &$register_bridge($bridge, $vlan);
	169	my $zone = $bridge_zone . $vmzone;
	170
	171	if (!$zoneinfo->{$zone}) {
	172	$zoneinfo->{$zone} = {
	173	type => 'bport',
	174	bridge_zone => $bridge_zone,
	175	ifaces => {},
	176	};
	177	}
	178
	179	$zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
f789653a DM	180
	181	return $zone;
	182	};
	183
b6360c3f DM	184	foreach my $vmid (keys %{$vmdata->{qemu}}) {
	185	$netinfo->{$vmid} = {};
	186	my $conf = $vmdata->{qemu}->{$vmid};
	187	foreach my $opt (keys %$conf) {
	188	next if $opt !~ m/^net(\d+)$/;
dddd9413	189	my $netnum = $1;
b6360c3f DM	190	my $net = PVE::QemuServer::parse_net($conf->{$opt});
b6360c3f DM	191	next if !$net;
886aba9c	192	die "implement me" if !$net->{bridge};
886aba9c	193
f789653a	194	my $vmzone = $conf->{zone} \|\| "vm$vmid";
dddd9413	195	$net->{tap} = "tap${vmid}i${netnum}";
026a6466	196	$maclist->{$net->{tap}} = $net->{macaddr} \|\| die "internal error";
dddd9413 DM	197	$net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
dddd9413 DM	198	$netinfo->{$vmid}->{$opt} = $net;
886aba9c DM	199	}
	200	}
	201
	202	#print Dumper($netinfo);
	203
f789653a	204	# NOTE: zone names have length limit, so we need to
886aba9c DM	205	# translate them into shorter names
886aba9c DM	206
f789653a DM	207	my $zoneid = 0;
	208	my $zonemap = { fw => 'fw' };
	209
	210	my $lookup_zonename = sub {
	211	my ($zone) = @_;
	212
	213	return $zonemap->{$zone} if defined($zonemap->{$zone});
	214	$zonemap->{$zone} = 'z' . $zoneid++;
	215
	216	return $zonemap->{$zone};
	217	};
	218
dddd9413 DM	219	foreach my $z (sort keys %$zoneinfo) {
dddd9413 DM	220	$zoneinfo->{$z}->{id} = &$lookup_zonename($z);
a8195f4f DM	221	$zoneinfo->{$z}->{zonevar} = uc($z);
a8195f4f DM	222	$zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
dddd9413 DM	223	}
dddd9413 DM	224
f789653a	225	my $out;
886aba9c	226
a8195f4f DM	227	# dump params file
	228	$out = "# PVE zones\n";
	229	foreach my $z (sort keys %$zoneinfo) {
	230	$out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
	231	}
	232	PVE::Tools::file_set_contents("$targetdir/params", $out);
	233
	234	# dump zone file
	235
	236	my $format = "%-30s %-10s %-15s\n";
	237	$out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
f789653a	238
886aba9c	239	foreach my $z (sort keys %$zoneinfo) {
a8195f4f	240	my $zid = $zoneinfo->{$z}->{zoneref};
f789653a	241	if ($zoneinfo->{$z}->{type} eq 'firewall') {
a8195f4f	242	$out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
f789653a	243	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
a8195f4f	244	$out .= sprintf($format, $zid, 'ipv4', '');
f789653a DM	245	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
f789653a DM	246	my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} \|\| die "internal error";
a8195f4f DM	247	my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} \|\| die "internal error";
a8195f4f DM	248	$out .= sprintf($format, "$zid:$bzid", 'bport', '');
f789653a DM	249	} else {
	250	die "internal error";
	251	}
886aba9c DM	252	}
886aba9c DM	253
f789653a DM	254	$out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
	255
	256	PVE::Tools::file_set_contents("$targetdir/zones", $out);
886aba9c	257
f789653a	258	# dump interfaces
886aba9c	259
a8195f4f DM	260	$format = "%-25s %-20s %-10s %-15s\n";
a8195f4f DM	261	$out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');
f789653a	262
026a6466 DM	263	my $maclist_format = "%-15s %-15s %-15s\n";
	264	my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');
	265
886aba9c	266	foreach my $z (sort keys %$zoneinfo) {
a8195f4f	267	my $zid = $zoneinfo->{$z}->{zoneref};
f789653a DM	268	if ($zoneinfo->{$z}->{type} eq 'firewall') {
	269	# do nothing;
	270	} elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
	271	my $bridge = $zoneinfo->{$z}->{bridge} \|\| die "internal error";
a8195f4f	272	$out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
f789653a DM	273	} elsif ($zoneinfo->{$z}->{type} eq 'bport') {
	274	my $ifaces = $zoneinfo->{$z}->{ifaces};
	275	foreach my $iface (sort keys %$ifaces) {
	276	my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} \|\| die "internal error";
	277	my $bridge = $zoneinfo->{$bridge_zone}->{bridge} \|\| die "internal error";
	278	my $iftxt = "$bridge:$iface";
8cebfa6f DM	279
	280	if ($maclist->{$iface}) {
	281	$out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
	282	$macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
	283	} else {
	284	$out .= sprintf($format, $zid, $iftxt, '-', '');
	285	}
f789653a DM	286	}
	287	} else {
	288	die "internal error";
b6360c3f DM	289	}
	290	}
	291
f789653a DM	292	$out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
	293
	294	PVE::Tools::file_set_contents("$targetdir/interfaces", $out);
	295
026a6466 DM	296	# dump maclist
	297	PVE::Tools::file_set_contents("$targetdir/maclist", $macs);
	298
f789653a DM	299	# dump policy
	300
	301	$format = "%-15s %-15s %-15s %s\n";
	302	$out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
8cebfa6f DM	303	$out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');
	304
	305	# we need to disable intra-zone traffic on bridges. Else traffic
	306	# from untracked interfaces simply pass the firewall
	307	foreach my $z (sort keys %$zoneinfo) {
	308	my $zid = $zoneinfo->{$z}->{zoneref};
	309	if ($zoneinfo->{$z}->{type} eq 'bridge') {
	310	$out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
	311	}
	312	}
f789653a	313	$out .= sprintf($format, 'all', 'all', 'REJECT', 'info');
886aba9c	314
f789653a	315	PVE::Tools::file_set_contents("$targetdir/policy", $out);
886aba9c	316
dddd9413 DM	317	# dump rules
	318	$out = '';
	319
	320	$out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
	321	foreach my $vmid (sort keys %$rules) {
78db5872 DM	322	my $inrules = $rules->{$vmid}->{in};
	323	my $outrules = $rules->{$vmid}->{out};
	324
	325	if (scalar(@$inrules)) {
	326	$out .= "# IN to VM $vmid\n";
dddd9413 DM	327	foreach my $rule (@$inrules) {
	328	foreach my $netid (keys %{$netinfo->{$vmid}}) {
	329	my $net = $netinfo->{$vmid}->{$netid};
9a4644fa	330	next if $rule->{iface} && $rule->{iface} ne $netid;
dddd9413 DM	331	$out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
	332	}
	333	}
	334	}
	335
78db5872 DM	336	if (scalar(@$outrules)) {
78db5872 DM	337	$out .= "# OUT from VM $vmid\n";
dddd9413 DM	338	foreach my $rule (@$outrules) {
	339	foreach my $netid (keys %{$netinfo->{$vmid}}) {
	340	my $net = $netinfo->{$vmid}->{$netid};
9a4644fa	341	next if $rule->{iface} && $rule->{iface} ne $netid;
dddd9413 DM	342	$out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
	343	}
	344	}
	345	}
	346	}
	347
	348	PVE::Tools::file_set_contents("$targetdir/rules", $out);
5e1267a5 DM	349	};
	350
	351
	352	sub parse_fw_rules {
	353	my ($filename, $fh) = @_;
	354
	355	my $section;
	356
	357	my $res = { in => [], out => [] };
	358
	359	my $macros = PVE::Firewall::get_shorewall_macros();
	360
	361	while (defined(my $line = <$fh>)) {
	362	next if $line =~ m/^#/;
	363	next if $line =~ m/^\s*$/;
	364
	365	if ($line =~ m/^\[(in\|out)\]\s*$/i) {
	366	$section = lc($1);
	367	next;
	368	}
	369	next if !$section;
	370
	371	my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
	372	split(/\s+/, $line);
	373
	374	if (!$action) {
	375	warn "skip incomplete line\n";
	376	next;
	377	}
	378
	379	my $service;
	380	if ($action =~ m/^(ACCEPT\|DROP\|REJECT)$/) {
	381	# OK
	382	} elsif ($action =~ m/^(\S+)\((ACCEPT\|DROP\|REJECT)\)$/) {
	383	($service, $action) = ($1, $2);
	384	if (!$macros->{$service}) {
	385	warn "unknown service '$service'\n";
	386	next;
	387	}
	388	} else {
	389	warn "unknown action '$action'\n";
	390	next;
	391	}
	392
	393	$iface = undef if $iface && $iface eq '-';
	394	if ($iface && $iface !~ m/^(net0\|net1\|net2\|net3\|net4\|net5)$/) {
	395	warn "unknown interface '$iface'\n";
	396	next;
	397	}
	398
	399	$proto = undef if $proto && $proto eq '-';
	400	if ($proto && $proto !~ m/^(icmp\|tcp\|udp)$/) {
	401	warn "unknown protokol '$proto'\n";
	402	next;
	403	}
	404
	405	$source = undef if $source && $source eq '-';
5e1267a5	406	$dest = undef if $dest && $dest eq '-';
5e1267a5 DM	407
	408	$dport = undef if $dport && $dport eq '-';
	409	$sport = undef if $sport && $sport eq '-';
	410
ecbea048 DM	411	eval {
	412	parse_address_list($source) if $source;
	413	parse_address_list($dest) if $dest;
	414
	415	};
	416	if (my $err = $@) {
	417	warn $err;
	418	next;
	419
	420	}
	421
	422
5e1267a5 DM	423	my $rule = {
	424	action => $action,
	425	service => $service,
	426	iface => $iface,
	427	source => $source,
	428	dest => $dest,
	429	proto => $proto,
	430	dport => $dport,
	431	sport => $sport,
	432	};
	433
	434	push @{$res->{$section}}, $rule;
	435	}
	436
	437	return $res;
	438	}
	439
	440	sub read_local_vm_config {
	441
	442	my $openvz = {};
	443
	444	my $qemu = {};
	445
	446	my $list = PVE::QemuServer::config_list();
	447
	448	foreach my $vmid (keys %$list) {
b9b06789	449	#next if !($vmid eq '100' \|\| $vmid eq '102');
5e1267a5 DM	450	my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
	451	if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
	452	$qemu->{$vmid} = $conf;
	453	}
	454	}
	455
	456	my $vmdata = { openvz => $openvz, qemu => $qemu };
	457
	458	return $vmdata;
	459	};
	460
	461	sub read_vm_firewall_rules {
	462	my ($vmdata) = @_;
	463	my $rules = {};
	464	foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
	465	my $filename = "/etc/pve/firewall/$vmid.fw";
	466	my $fh = IO::File->new($filename, O_RDONLY);
	467	next if !$fh;
	468
	469	$rules->{$vmid} = parse_fw_rules($filename, $fh);
	470	}
	471
	472	return $rules;
	473	}
	474
	475	sub compile {
	476
	477	my $vmdata = read_local_vm_config();
	478	my $rules = read_vm_firewall_rules($vmdata);
	479
	480	# print Dumper($vmdata);
	481
	482	my $swdir = '/etc/shorewall';
	483	mkdir $swdir;
	484
	485	&$compile_shorewall($swdir, $vmdata, $rules);
b6360c3f	486
5e1267a5	487	PVE::Tools::run_command(['shorewall', 'compile']);
b6360c3f DM	488	}
b6360c3f DM	489
5e1267a5 DM	490	sub compile_and_start {
5e1267a5 DM	491	my ($restart) = @_;
886aba9c	492
5e1267a5	493	compile();
b6360c3f	494
5e1267a5	495	PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']);
b6360c3f DM	496	}
	497
	498
	499	1;