]> git.proxmox.com Git - pve-firewall.git/blame - src/PVE/Firewall.pm
projects / pve-firewall.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
implement ipset ip/net groups
[pve-firewall.git] / src / PVE / Firewall.pm
CommitLineData
b6360c3f
DM		 1package PVE::Firewall;
2
3use warnings;
4use strict;
5use Data::Dumper;
09d5f68e 6use Digest::SHA;
c8301d63 7use PVE::INotify;
54cd19a8 8use PVE::JSONSchema qw(get_standard_option);
c8301d63 9use PVE::Cluster;
5f0a912c 10use PVE::ProcFSTools;
f789653a 11use PVE::Tools;
6b9f68a2 12use File::Basename;
5e1267a5
DM		 13use File::Path;
14use IO::File;
ecbea048 15use Net::IP;
06320eb0 16use PVE::Tools qw(run_command lock_file);
30c1ae52 17use Encode;
ecbea048 18
d9fee004
DM		 19# dynamically include PVE::QemuServer and PVE::OpenVZ
20# to avoid dependency problems
21my $have_qemu_server;
22eval {
23 require PVE::QemuServer;
24 $have_qemu_server = 1;
25};
26
27my $have_pve_manager;
28eval {
29 require PVE::OpenVZ;
30 $have_pve_manager = 1;
31};
32
5e1267a5 33use Data::Dumper;
b6360c3f 34
c8301d63
DM		 35my $nodename = PVE::INotify::nodename();
36
06320eb0 37my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
6b9f68a2 38my $pve_fw_status_filename = "/var/lib/pve-firewall/pvefw.status";
06320eb0 39
2d404ffc
DM		 40my $default_log_level = 'info';
41
42my $log_level_hash = {
43 debug => 7,
44 info => 6,
45 notice => 5,
46 warning => 4,
47 err => 3,
48 crit => 2,
49 alert => 1,
50 emerg => 0,
51};
52
857f62c8 53# imported/converted from: /usr/share/shorewall/macro.*
961b4928 54my $pve_fw_macros = {
857f62c8
DM		 55 'Amanda' => [
56 { action => 'PARAM', proto => 'udp', dport => '10080' },
57 { action => 'PARAM', proto => 'tcp', dport => '10080' },
58 ],
59 'Auth' => [
60 { action => 'PARAM', proto => 'tcp', dport => '113' },
61 ],
62 'BGP' => [
63 { action => 'PARAM', proto => 'tcp', dport => '179' },
64 ],
65 'BitTorrent' => [
961b4928 66 { action => 'PARAM', proto => 'tcp', dport => '6881:6889' },
857f62c8
DM		 67 { action => 'PARAM', proto => 'udp', dport => '6881' },
68 ],
69 'BitTorrent32' => [
70 { action => 'PARAM', proto => 'tcp', dport => '6881:6999' },
71 { action => 'PARAM', proto => 'udp', dport => '6881' },
72 ],
73 'CVS' => [
74 { action => 'PARAM', proto => 'tcp', dport => '2401' },
75 ],
76 'Citrix' => [
77 { action => 'PARAM', proto => 'tcp', dport => '1494' },
78 { action => 'PARAM', proto => 'udp', dport => '1604' },
79 { action => 'PARAM', proto => 'tcp', dport => '2598' },
80 ],
81 'DAAP' => [
82 { action => 'PARAM', proto => 'tcp', dport => '3689' },
83 { action => 'PARAM', proto => 'udp', dport => '3689' },
84 ],
85 'DCC' => [
86 { action => 'PARAM', proto => 'tcp', dport => '6277' },
87 ],
88 'DHCPfwd' => [
89 { action => 'PARAM', proto => 'udp', dport => '67:68', sport => '67:68' },
90 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '67:68', sport => '67:68' },
91 ],
92 'DNS' => [
93 { action => 'PARAM', proto => 'udp', dport => '53' },
94 { action => 'PARAM', proto => 'tcp', dport => '53' },
95 ],
96 'Distcc' => [
97 { action => 'PARAM', proto => 'tcp', dport => '3632' },
98 ],
99 'Edonkey' => [
100 { action => 'PARAM', proto => 'tcp', dport => '4662' },
101 { action => 'PARAM', proto => 'udp', dport => '4665' },
961b4928 102 ],
857f62c8
DM		 103 'FTP' => [
104 { action => 'PARAM', proto => 'tcp', dport => '21' },
105 ],
106 'Finger' => [
107 { action => 'PARAM', proto => 'tcp', dport => '79' },
108 ],
109 'GNUnet' => [
110 { action => 'PARAM', proto => 'tcp', dport => '2086' },
111 { action => 'PARAM', proto => 'udp', dport => '2086' },
112 { action => 'PARAM', proto => 'tcp', dport => '1080' },
113 { action => 'PARAM', proto => 'udp', dport => '1080' },
114 ],
115 'GRE' => [
116 { action => 'PARAM', proto => '47' },
117 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '47' },
118 ],
119 'Git' => [
120 { action => 'PARAM', proto => 'tcp', dport => '9418' },
121 ],
122 'Gnutella' => [
123 { action => 'PARAM', proto => 'tcp', dport => '6346' },
124 { action => 'PARAM', proto => 'udp', dport => '6346' },
125 ],
126 'HKP' => [
127 { action => 'PARAM', proto => 'tcp', dport => '11371' },
128 ],
129 'HTTP' => [
961b4928
DM		 130 { action => 'PARAM', proto => 'tcp', dport => '80' },
131 ],
857f62c8
DM		 132 'HTTPS' => [
133 { action => 'PARAM', proto => 'tcp', dport => '443' },
134 ],
135 'ICPV2' => [
136 { action => 'PARAM', proto => 'udp', dport => '3130' },
137 ],
138 'ICQ' => [
139 { action => 'PARAM', proto => 'tcp', dport => '5190' },
140 ],
141 'IMAP' => [
142 { action => 'PARAM', proto => 'tcp', dport => '143' },
143 ],
144 'IMAPS' => [
145 { action => 'PARAM', proto => 'tcp', dport => '993' },
146 ],
147 'IPIP' => [
148 { action => 'PARAM', proto => '94' },
149 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '94' },
150 ],
151 'IPP' => [
152 { action => 'PARAM', proto => 'tcp', dport => '631' },
153 ],
154 'IPPbrd' => [
155 { action => 'PARAM', proto => 'udp', dport => '631' },
156 ],
157 'IPPserver' => [
158 { action => 'PARAM', source => 'SOURCE', dest => 'DEST', proto => 'tcp', dport => '631' },
159 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '631' },
160 ],
161 'IPsec' => [
162 { action => 'PARAM', proto => 'udp', dport => '500', sport => '500' },
163 { action => 'PARAM', proto => '50' },
164 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500', sport => '500' },
165 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '50' },
166 ],
167 'IPsecah' => [
168 { action => 'PARAM', proto => 'udp', dport => '500', sport => '500' },
169 { action => 'PARAM', proto => '51' },
170 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500', sport => '500' },
171 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '51' },
172 ],
173 'IPsecnat' => [
174 { action => 'PARAM', proto => 'udp', dport => '500' },
175 { action => 'PARAM', proto => 'udp', dport => '4500' },
176 { action => 'PARAM', proto => '50' },
177 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500' },
178 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '4500' },
179 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '50' },
180 ],
181 'IRC' => [
182 { action => 'PARAM', proto => 'tcp', dport => '6667' },
183 ],
184 'JabberPlain' => [
185 { action => 'PARAM', proto => 'tcp', dport => '5222' },
186 ],
187 'JabberSecure' => [
188 { action => 'PARAM', proto => 'tcp', dport => '5223' },
189 ],
190 'Jabberd' => [
191 { action => 'PARAM', proto => 'tcp', dport => '5269' },
192 ],
193 'Jetdirect' => [
194 { action => 'PARAM', proto => 'tcp', dport => '9100' },
195 ],
196 'L2TP' => [
197 { action => 'PARAM', proto => 'udp', dport => '1701' },
198 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '1701' },
199 ],
200 'LDAP' => [
201 { action => 'PARAM', proto => 'tcp', dport => '389' },
202 ],
203 'LDAPS' => [
204 { action => 'PARAM', proto => 'tcp', dport => '636' },
205 ],
206 'MSNP' => [
207 { action => 'PARAM', proto => 'tcp', dport => '1863' },
208 ],
209 'MSSQL' => [
210 { action => 'PARAM', proto => 'tcp', dport => '1433' },
211 ],
212 'Mail' => [
213 { action => 'PARAM', proto => 'tcp', dport => '25' },
214 { action => 'PARAM', proto => 'tcp', dport => '465' },
215 { action => 'PARAM', proto => 'tcp', dport => '587' },
216 ],
217 'Munin' => [
218 { action => 'PARAM', proto => 'tcp', dport => '4949' },
219 ],
220 'MySQL' => [
221 { action => 'PARAM', proto => 'tcp', dport => '3306' },
222 ],
223 'NNTP' => [
224 { action => 'PARAM', proto => 'tcp', dport => '119' },
225 ],
226 'NNTPS' => [
227 { action => 'PARAM', proto => 'tcp', dport => '563' },
228 ],
229 'NTP' => [
230 { action => 'PARAM', proto => 'udp', dport => '123' },
231 ],
232 'NTPbi' => [
233 { action => 'PARAM', proto => 'udp', dport => '123' },
234 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '123' },
235 ],
236 'NTPbrd' => [
237 { action => 'PARAM', proto => 'udp', dport => '123' },
238 { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '123' },
239 ],
240 'OSPF' => [
241 { action => 'PARAM', proto => '89' },
242 ],
243 'OpenVPN' => [
244 { action => 'PARAM', proto => 'udp', dport => '1194' },
245 ],
246 'PCA' => [
247 { action => 'PARAM', proto => 'udp', dport => '5632' },
248 { action => 'PARAM', proto => 'tcp', dport => '5631' },
249 ],
250 'POP3' => [
251 { action => 'PARAM', proto => 'tcp', dport => '110' },
252 ],
253 'POP3S' => [
254 { action => 'PARAM', proto => 'tcp', dport => '995' },
255 ],
256 'PPtP' => [
257 { action => 'PARAM', proto => '47' },
258 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '47' },
259 { action => 'PARAM', proto => 'tcp', dport => '1723' },
260 ],
261 'Ping' => [
269d4f13 262 { action => 'PARAM', proto => 'icmp', dport => 'echo-request' },
857f62c8
DM		 263 ],
264 'PostgreSQL' => [
265 { action => 'PARAM', proto => 'tcp', dport => '5432' },
266 ],
267 'Printer' => [
268 { action => 'PARAM', proto => 'tcp', dport => '515' },
269 ],
270 'RDP' => [
271 { action => 'PARAM', proto => 'tcp', dport => '3389' },
272 ],
273 'RIPbi' => [
274 { action => 'PARAM', proto => 'udp', dport => '520' },
275 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '520' },
276 ],
277 'RNDC' => [
278 { action => 'PARAM', proto => 'tcp', dport => '953' },
279 ],
280 'Razor' => [
281 { action => 'ACCEPT', proto => 'tcp', dport => '2703' },
282 ],
283 'Rdate' => [
284 { action => 'PARAM', proto => 'tcp', dport => '37' },
285 ],
286 'Rsync' => [
287 { action => 'PARAM', proto => 'tcp', dport => '873' },
288 ],
289 'SANE' => [
290 { action => 'PARAM', proto => 'tcp', dport => '6566' },
291 ],
292 'SMB' => [
293 { action => 'PARAM', proto => 'udp', dport => '135,445' },
294 { action => 'PARAM', proto => 'udp', dport => '137:139' },
295 { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '137' },
296 { action => 'PARAM', proto => 'tcp', dport => '135,139,445' },
297 ],
298 'SMBBI' => [
299 { action => 'PARAM', proto => 'udp', dport => '135,445' },
300 { action => 'PARAM', proto => 'udp', dport => '137:139' },
301 { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '137' },
302 { action => 'PARAM', proto => 'tcp', dport => '135,139,445' },
303 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '135,445' },
304 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '137:139' },
305 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '1024:65535', sport => '137' },
306 { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'tcp', dport => '135,139,445' },
307 ],
308 'SMBswat' => [
309 { action => 'PARAM', proto => 'tcp', dport => '901' },
310 ],
311 'SMTP' => [
312 { action => 'PARAM', proto => 'tcp', dport => '25' },
313 ],
314 'SMTPS' => [
315 { action => 'PARAM', proto => 'tcp', dport => '465' },
316 ],
317 'SNMP' => [
318 { action => 'PARAM', proto => 'udp', dport => '161:162' },
319 { action => 'PARAM', proto => 'tcp', dport => '161' },
320 ],
321 'SPAMD' => [
322 { action => 'PARAM', proto => 'tcp', dport => '783' },
323 ],
324 'SSH' => [
325 { action => 'PARAM', proto => 'tcp', dport => '22' },
326 ],
327 'SVN' => [
328 { action => 'PARAM', proto => 'tcp', dport => '3690' },
329 ],
330 'SixXS' => [
331 { action => 'PARAM', proto => 'tcp', dport => '3874' },
332 { action => 'PARAM', proto => 'udp', dport => '3740' },
333 { action => 'PARAM', proto => '41' },
334 { action => 'PARAM', proto => 'udp', dport => '5072,8374' },
335 ],
336 'Squid' => [
337 { action => 'PARAM', proto => 'tcp', dport => '3128' },
338 ],
339 'Submission' => [
340 { action => 'PARAM', proto => 'tcp', dport => '587' },
341 ],
342 'Syslog' => [
343 { action => 'PARAM', proto => 'udp', dport => '514' },
344 { action => 'PARAM', proto => 'tcp', dport => '514' },
345 ],
346 'TFTP' => [
347 { action => 'PARAM', proto => 'udp', dport => '69' },
348 ],
349 'Telnet' => [
350 { action => 'PARAM', proto => 'tcp', dport => '23' },
351 ],
352 'Telnets' => [
353 { action => 'PARAM', proto => 'tcp', dport => '992' },
354 ],
355 'Time' => [
356 { action => 'PARAM', proto => 'tcp', dport => '37' },
357 ],
358 'Trcrt' => [
359 { action => 'PARAM', proto => 'udp', dport => '33434:33524' },
269d4f13 360 { action => 'PARAM', proto => 'icmp', dport => 'echo-request' },
857f62c8
DM		 361 ],
362 'VNC' => [
363 { action => 'PARAM', proto => 'tcp', dport => '5900:5909' },
364 ],
365 'VNCL' => [
366 { action => 'PARAM', proto => 'tcp', dport => '5500' },
367 ],
368 'Web' => [
369 { action => 'PARAM', proto => 'tcp', dport => '80' },
961b4928
DM		 370 { action => 'PARAM', proto => 'tcp', dport => '443' },
371 ],
857f62c8
DM		 372 'Webcache' => [
373 { action => 'PARAM', proto => 'tcp', dport => '8080' },
374 ],
375 'Webmin' => [
376 { action => 'PARAM', proto => 'tcp', dport => '10000' },
377 ],
378 'Whois' => [
379 { action => 'PARAM', proto => 'tcp', dport => '43' },
380 ],
961b4928
DM		 381};
382
383my $pve_fw_parsed_macros;
384my $pve_fw_preferred_macro_names = {};
3a616aa0 385
d8f2505e
DM		 386my $pve_std_chains = {
387 'PVEFW-SET-ACCEPT-MARK' => [
388 "-j MARK --set-mark 1",
389 ],
79929d9c
DM		 390 'PVEFW-DropBroadcast' => [
391 # same as shorewall 'Broadcast'
392 # simply DROP BROADCAST/MULTICAST/ANYCAST
393 # we can use this to reduce logging
394 { action => 'DROP', dsttype => 'BROADCAST' },
395 { action => 'DROP', dsttype => 'MULTICAST' },
396 { action => 'DROP', dsttype => 'ANYCAST' },
397 { action => 'DROP', dest => '224.0.0.0/4' },
398 ],
399 'PVEFW-reject' => [
400 # same as shorewall 'reject'
401 { action => 'DROP', dsttype => 'BROADCAST' },
402 { action => 'DROP', source => '224.0.0.0/4' },
403 { action => 'DROP', proto => 'icmp' },
404 "-p tcp -j REJECT --reject-with tcp-reset",
405 "-p udp -j REJECT --reject-with icmp-port-unreachable",
406 "-p icmp -j REJECT --reject-with icmp-host-unreachable",
407 "-j REJECT --reject-with icmp-host-prohibited",
408 ],
409 'PVEFW-Drop' => [
410 # same as shorewall 'Drop', which is equal to DROP,
411 # but REJECT/DROP some packages to reduce logging,
412 # and ACCEPT critical ICMP types
413 { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, # REJECT 'auth'
414 # we are not interested in BROADCAST/MULTICAST/ANYCAST
415 { action => 'PVEFW-DropBroadcast' },
416 # ACCEPT critical ICMP types
417 { action => 'ACCEPT', proto => 'icmp', dport => 'fragmentation-needed' },
418 { action => 'ACCEPT', proto => 'icmp', dport => 'time-exceeded' },
419 # Drop packets with INVALID state
420 "-m conntrack --ctstate INVALID -j DROP",
421 # Drop Microsoft SMB noise
422 { action => 'DROP', proto => 'udp', dport => '135,445', nbdport => 2 },
423 { action => 'DROP', proto => 'udp', dport => '137:139'},
424 { action => 'DROP', proto => 'udp', dport => '1024:65535', sport => 137 },
425 { action => 'DROP', proto => 'tcp', dport => '135,139,445', nbdport => 3 },
426 { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP
427 # Drop new/NotSyn traffic so that it doesn't get logged
428 "-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP",
429 # Drop DNS replies
430 { action => 'DROP', proto => 'udp', sport => 53 },
431 ],
432 'PVEFW-Reject' => [
433 # same as shorewall 'Reject', which is equal to Reject,
434 # but REJECT/DROP some packages to reduce logging,
435 # and ACCEPT critical ICMP types
436 { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, # REJECT 'auth'
437 # we are not interested in BROADCAST/MULTICAST/ANYCAST
438 { action => 'PVEFW-DropBroadcast' },
439 # ACCEPT critical ICMP types
440 { action => 'ACCEPT', proto => 'icmp', dport => 'fragmentation-needed' },
441 { action => 'ACCEPT', proto => 'icmp', dport => 'time-exceeded' },
442 # Drop packets with INVALID state
443 "-m conntrack --ctstate INVALID -j DROP",
444 # Drop Microsoft SMB noise
445 { action => 'PVEFW-reject', proto => 'udp', dport => '135,445', nbdport => 2 },
446 { action => 'PVEFW-reject', proto => 'udp', dport => '137:139'},
447 { action => 'PVEFW-reject', proto => 'udp', dport => '1024:65535', sport => 137 },
448 { action => 'PVEFW-reject', proto => 'tcp', dport => '135,139,445', nbdport => 3 },
449 { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP
450 # Drop new/NotSyn traffic so that it doesn't get logged
451 "-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP",
452 # Drop DNS replies
453 { action => 'DROP', proto => 'udp', sport => 53 },
454 ],
d86659ef
DM		 455 'PVEFW-tcpflags' => [
456 # same as shorewall tcpflags action.
457 # Packets arriving on this interface are checked for som illegal combinations of TCP flags
458 "-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g PVEFW-logflags",
459 "-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g PVEFW-logflags",
460 "-p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g PVEFW-logflags",
461 "-p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g PVEFW-logflags",
462 "-p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g PVEFW-logflags",
463 ],
bee633ab
DM		 464 'PVEFW-smurfs' => [
465 # same as shorewall smurfs action
466 # Filter packets for smurfs (packets with a broadcast address as the source).
467 "-s 0.0.0.0/32 -j RETURN",
468 "-m addrtype --src-type BROADCAST -g PVEFW-smurflog",
469 "-s 224.0.0.0/4 -g PVEFW-smurflog",
470 ],
d8f2505e
DM		 471};
472
4b586518
DM		 473# iptables -p icmp -h
474my $icmp_type_names = {
475 any => 1,
476 'echo-reply' => 1,
477 'destination-unreachable' => 1,
478 'network-unreachable' => 1,
479 'host-unreachable' => 1,
480 'protocol-unreachable' => 1,
481 'port-unreachable' => 1,
482 'fragmentation-needed' => 1,
483 'source-route-failed' => 1,
484 'network-unknown' => 1,
485 'host-unknown' => 1,
486 'network-prohibited' => 1,
487 'host-prohibited' => 1,
488 'TOS-network-unreachable' => 1,
489 'TOS-host-unreachable' => 1,
490 'communication-prohibited' => 1,
491 'host-precedence-violation' => 1,
492 'precedence-cutoff' => 1,
493 'source-quench' => 1,
494 'redirect' => 1,
495 'network-redirect' => 1,
496 'host-redirect' => 1,
497 'TOS-network-redirect' => 1,
498 'TOS-host-redirect' => 1,
499 'echo-request' => 1,
500 'router-advertisement' => 1,
501 'router-solicitation' => 1,
502 'time-exceeded' => 1,
503 'ttl-zero-during-transit' => 1,
504 'ttl-zero-during-reassembly' => 1,
505 'parameter-problem' => 1,
506 'ip-header-bad' => 1,
507 'required-option-missing' => 1,
508 'timestamp-request' => 1,
509 'timestamp-reply' => 1,
510 'address-mask-request' => 1,
511 'address-mask-reply' => 1,
512};
513
54cd19a8 514sub init_firewall_macros {
6158271d 515
961b4928 516 $pve_fw_parsed_macros = {};
9aab3127 517
961b4928 518 foreach my $k (keys %$pve_fw_macros) {
e5076eee
DM		 519 my $lc_name = lc($k);
520 my $macro = $pve_fw_macros->{$k};
521 $pve_fw_preferred_macro_names->{$lc_name} = $k;
522 $pve_fw_parsed_macros->{$k} = $macro;
961b4928 523 }
9aab3127
DM		 524}
525
54cd19a8
DM		 526init_firewall_macros();
527
fcba0beb
DM		 528my $etc_services;
529
530sub get_etc_services {
531
532 return $etc_services if $etc_services;
533
534 my $filename = "/etc/services";
535
536 my $fh = IO::File->new($filename, O_RDONLY);
537 if (!$fh) {
538 warn "unable to read '$filename' - $!\n";
539 return {};
540 }
541
542 my $services = {};
543
544 while (my $line = <$fh>) {
545 chomp ($line);
546 next if $line =~m/^#/;
547 next if ($line =~m/^\s*$/);
548
549 if ($line =~ m!^(\S+)\s+(\S+)/(tcp|udp).*$!) {
550 $services->{byid}->{$2}->{name} = $1;
35b66e9d 551 $services->{byid}->{$2}->{port} = $2;
fcba0beb
DM		 552 $services->{byid}->{$2}->{$3} = 1;
553 $services->{byname}->{$1} = $services->{byid}->{$2};
554 }
555 }
556
557 close($fh);
558
6158271d
DM		 559 $etc_services = $services;
560
3a616aa0 561
fcba0beb
DM		 562 return $etc_services;
563}
564
565my $etc_protocols;
566
567sub get_etc_protocols {
568 return $etc_protocols if $etc_protocols;
569
570 my $filename = "/etc/protocols";
571
572 my $fh = IO::File->new($filename, O_RDONLY);
573 if (!$fh) {
574 warn "unable to read '$filename' - $!\n";
575 return {};
576 }
577
578 my $protocols = {};
579
580 while (my $line = <$fh>) {
581 chomp ($line);
582 next if $line =~m/^#/;
583 next if ($line =~m/^\s*$/);
584
585 if ($line =~ m!^(\S+)\s+(\d+)\s+.*$!) {
586 $protocols->{byid}->{$2}->{name} = $1;
587 $protocols->{byname}->{$1} = $protocols->{byid}->{$2};
588 }
589 }
590
591 close($fh);
592
593 $etc_protocols = $protocols;
594
595 return $etc_protocols;
596}
597
ecbea048
DM		 598sub parse_address_list {
599 my ($str) = @_;
600
d6de1dc2 601 my $nbaor = 0;
ecbea048
DM		 602 foreach my $aor (split(/,/, $str)) {
603 if (!Net::IP->new($aor)) {
604 my $err = Net::IP::Error();
605 die "invalid IP address: $err\n";
d6de1dc2
AD		 606 }else{
607 $nbaor++;
ecbea048
DM		 608 }
609 }
d6de1dc2 610 return $nbaor;
ecbea048 611}
dddd9413 612
fcba0beb
DM		 613sub parse_port_name_number_or_range {
614 my ($str) = @_;
615
616 my $services = PVE::Firewall::get_etc_services();
4cdbb3b7 617 my $nbports = 0;
fcba0beb 618 foreach my $item (split(/,/, $str)) {
4cdbb3b7 619 my $portlist = "";
35b66e9d 620 my $oldpon = undef;
4b586518 621 $nbports++;
fcba0beb 622 foreach my $pon (split(':', $item, 2)) {
35b66e9d 623 $pon = $services->{byname}->{$pon}->{port} if $services->{byname}->{$pon}->{port};
4cdbb3b7 624 if ($pon =~ m/^\d+$/){
857f62c8 625 die "invalid port '$pon'\n" if $pon < 0 && $pon > 65535;
35b66e9d
AD		 626 die "port '$pon' must be bigger than port '$oldpon' \n" if $oldpon && ($pon < $oldpon);
627 $oldpon = $pon;
4cdbb3b7
AD		 628 }else{
629 die "invalid port $services->{byname}->{$pon}\n" if !$services->{byname}->{$pon};
630 }
fcba0beb
DM		 631 }
632 }
633
4cdbb3b7 634 return ($nbports);
fcba0beb
DM		 635}
636
54cd19a8
DM		 637PVE::JSONSchema::register_format('pve-fw-port-spec', \&pve_fw_verify_port_spec);
638sub pve_fw_verify_port_spec {
639 my ($portstr) = @_;
640
641 parse_port_name_number_or_range($portstr);
642
643 return $portstr;
644}
645
646PVE::JSONSchema::register_format('pve-fw-v4addr-spec', \&pve_fw_verify_v4addr_spec);
647sub pve_fw_verify_v4addr_spec {
648 my ($list) = @_;
649
650 parse_address_list($list);
651
652 return $list;
653}
654
655PVE::JSONSchema::register_format('pve-fw-protocol-spec', \&pve_fw_verify_protocol_spec);
656sub pve_fw_verify_protocol_spec {
657 my ($proto) = @_;
658
659 my $protocols = get_etc_protocols();
660
661 die "unknown protocol '$proto'\n" if $proto &&
662 !(defined($protocols->{byname}->{$proto}) ||
663 defined($protocols->{byid}->{$proto}));
664
665 return $proto;
666}
667
668
d1c53b3e 669# helper function for API
d1c53b3e 670
9c7e0858
DM		 671my $rule_properties = {
672 pos => {
673 description => "Update rule at position <pos>.",
674 type => 'integer',
675 minimum => 0,
676 optional => 1,
677 },
678 digest => {
679 type => 'string',
680 optional => 1,
54cd19a8
DM		 681 maxLength => 27,
682 minLength => 27,
9c7e0858
DM		 683 },
684 type => {
685 type => 'string',
686 optional => 1,
687 enum => ['in', 'out', 'group'],
688 },
689 action => {
690 type => 'string',
691 optional => 1,
54cd19a8 692 enum => ['ACCEPT', 'DROP', 'REJECT'],
9c7e0858 693 },
e5076eee
DM		 694 macro => {
695 type => 'string',
696 optional => 1,
54cd19a8 697 maxLength => 128,
e5076eee 698 },
54cd19a8 699 iface => get_standard_option('pve-iface', { optional => 1 }),
9c7e0858 700 source => {
54cd19a8 701 type => 'string', format => 'pve-fw-v4addr-spec',
9c7e0858
DM		 702 optional => 1,
703 },
704 dest => {
54cd19a8 705 type => 'string', format => 'pve-fw-v4addr-spec',
9c7e0858
DM		 706 optional => 1,
707 },
708 proto => {
54cd19a8 709 type => 'string', format => 'pve-fw-protocol-spec',
9c7e0858
DM		 710 optional => 1,
711 },
712 enable => {
713 type => 'boolean',
714 optional => 1,
715 },
716 sport => {
54cd19a8 717 type => 'string', format => 'pve-fw-port-spec',
9c7e0858
DM		 718 optional => 1,
719 },
720 dport => {
54cd19a8 721 type => 'string', format => 'pve-fw-port-spec',
9c7e0858
DM		 722 optional => 1,
723 },
724 comment => {
725 type => 'string',
726 optional => 1,
727 },
728};
729
ce36326d
DM		 730sub cleanup_fw_rule {
731 my ($rule, $digest, $pos) = @_;
732
733 my $r = {};
734
735 foreach my $k (keys %$rule) {
736 next if !$rule_properties->{$k};
737 my $v = $rule->{$k};
738 next if !defined($v);
739 $r->{$k} = $v;
740 $r->{digest} = $digest;
741 $r->{pos} = $pos;
742 }
743
744 return $r;
745}
746
9c7e0858
DM		 747sub add_rule_properties {
748 my ($properties) = @_;
749
750 foreach my $k (keys %$rule_properties) {
751 $properties->{$k} = $rule_properties->{$k};
752 }
753
754 return $properties;
755}
756
757sub copy_rule_data {
758 my ($rule, $param) = @_;
759
760 foreach my $k (keys %$rule_properties) {
761 if (defined(my $v = $param->{$k})) {
762 if ($v eq '' || $v eq '-') {
763 delete $rule->{$k};
764 } else {
765 $rule->{$k} = $v;
766 }
767 } else {
768 delete $rule->{$k};
769 }
770 }
771 return $rule;
772}
773
774# core functions
780bcc0f
DM		 775my $bridge_firewall_enabled = 0;
776
777sub enable_bridge_firewall {
778
779 return if $bridge_firewall_enabled; # only once
780
5f0a912c
DM		 781 PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-iptables", "1");
782 PVE::ProcFSTools::write_proc_entry("/proc/sys/net/bridge/bridge-nf-call-ip6tables", "1");
780bcc0f 783
6a8a75db
DM		 784 # make sure syncookies are enabled (which is default on newer 3.X kernels anyways)
785 PVE::ProcFSTools::write_proc_entry("/proc/sys/net/ipv4/tcp_syncookies", "1");
786
780bcc0f
DM		 787 $bridge_firewall_enabled = 1;
788}
789
8cebfa6f 790my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
dddd9413 791
3a616aa0
AD		 792sub iptables {
793 my ($cmd) = @_;
794
795 run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {});
796}
797
b16e818e
DM		 798sub iptables_restore_cmdlist {
799 my ($cmdlist) = @_;
3a616aa0 800
3fa83edf 801 run_command("/sbin/iptables-restore -n", input => $cmdlist);
3a616aa0
AD		 802}
803
34cdedfa
AD		 804sub ipset_restore_cmdlist {
805 my ($cmdlist) = @_;
806
807 run_command(" /usr/sbin/ipset restore", input => $cmdlist);
808}
809
de2a57cd
DM		 810sub iptables_get_chains {
811
812 my $res = {};
813
814 # check what chains we want to track
815 my $is_pvefw_chain = sub {
816 my $name = shift;
817
dec84fcd
DM		 818 return 1 if $name =~ m/^PVEFW-\S+$/;
819
de2a57cd 820 return 1 if $name =~ m/^tap\d+i\d+-(:?IN|OUT)$/;
954f24b1
DM		 821
822 return 1 if $name =~ m/^veth\d+.\d+-(:?IN|OUT)$/; # fixme: dev name is configurable
823
9e15114a
DM		 824 return 1 if $name =~ m/^venet0-\d+-(:?IN|OUT)$/;
825
da6fc60b 826 return 1 if $name =~ m/^vmbr\d+-(:?FW|IN|OUT|IPS)$/;
f50656c2 827 return 1 if $name =~ m/^GROUP-(:?[^\s\-]+)-(:?IN|OUT)$/;
de2a57cd
DM		 828
829 return undef;
830 };
831
832 my $table = '';
833
de2a57cd
DM		 834 my $parser = sub {
835 my $line = shift;
836
837 return if $line =~ m/^#/;
838 return if $line =~ m/^\s*$/;
839
840 if ($line =~ m/^\*(\S+)$/) {
841 $table = $1;
842 return;
843 }
844
845 return if $table ne 'filter';
846
847 if ($line =~ m/^:(\S+)\s/) {
848 my $chain = $1;
849 return if !&$is_pvefw_chain($chain);
3fa83edf 850 $res->{$chain} = "unknown";
09d5f68e 851 } elsif ($line =~ m/^-A\s+(\S+)\s.*--comment\s+\"PVESIG:(\S+)\"/) {
3fa83edf 852 my ($chain, $sig) = ($1, $2);
de2a57cd 853 return if !&$is_pvefw_chain($chain);
3fa83edf 854 $res->{$chain} = $sig;
de2a57cd
DM		 855 } else {
856 # simply ignore the rest
857 return;
858 }
859 };
860
861 run_command("/sbin/iptables-save", outfunc => $parser);
862
de2a57cd
DM		 863 return $res;
864}
865
34cdedfa
AD		 866sub ipset_get_chains {
867
868 my $res = {};
869 my $chains = {};
870
871 my $parser = sub {
872 my $line = shift;
873
874 return if $line =~ m/^#/;
875 return if $line =~ m/^\s*$/;
876 if ($line =~ m/^(\S+)\s(\S+)\s(\S+)/) {
877 push @{$chains->{$2}}, $line;
878 } else {
879 # simply ignore the rest
880 return;
881 }
882 };
883
884 run_command(" /usr/sbin/ipset save", outfunc => $parser);
885
886 #comptute sig for each chain
887 foreach my $chain (keys %$chains){
888 my $digest = Digest::SHA->new('sha1');
889 foreach my $rule (@{$chains->{$chain}}) {
890 $digest->add($rule);
891 }
892 $res->{$chain} = $digest->b64digest;
893 }
894
895 return $res;
896}
897
3a616aa0
AD		 898sub iptables_chain_exist {
899 my ($chain) = @_;
900
901 eval{
902 iptables("-n --list $chain");
903 };
904 return undef if $@;
905
906 return 1;
907}
908
909sub iptables_rule_exist {
910 my ($rule) = @_;
911
912 eval{
913 iptables("-C $rule");
914 };
915 return undef if $@;
916
917 return 1;
918}
919
eba0fb64 920sub ruleset_generate_cmdstr {
2f906466 921 my ($ruleset, $chain, $rule, $actions, $goto) = @_;
3a616aa0 922
00bb4391 923 return if defined($rule->{enable}) && !$rule->{enable};
11bac5c2 924
e5076eee
DM		 925 die "unable to emit macro - internal error" if $rule->{macro}; # should not happen
926
927 my $nbdport = defined($rule->{dport}) ? parse_port_name_number_or_range($rule->{dport}) : 0;
928 my $nbsport = defined($rule->{sport}) ? parse_port_name_number_or_range($rule->{sport}) : 0;
929 my $nbsource = $rule->{source} ? parse_address_list( $rule->{source}) : 0;
930 my $nbdest = $rule->{dest} ? parse_address_list($rule->{dest}) : 0;
931
41524a58 932 my @cmd = ();
3a616aa0 933
eba0fb64
DM		 934 push @cmd, "-i $rule->{iface_in}" if $rule->{iface_in};
935 push @cmd, "-o $rule->{iface_out}" if $rule->{iface_out};
936
e5076eee 937 push @cmd, "-m iprange --src-range" if $nbsource > 1;
41524a58 938 push @cmd, "-s $rule->{source}" if $rule->{source};
e5076eee 939 push @cmd, "-m iprange --dst-range" if $nbdest > 1;
41524a58 940 push @cmd, "-d $rule->{dest}" if $rule->{dest};
4b586518 941
181390b0 942 if ($rule->{proto}) {
41524a58 943 push @cmd, "-p $rule->{proto}";
e3a1d391 944
181390b0 945 my $multiport = 0;
e5076eee
DM		 946 $multiport++ if $nbdport > 1;
947 $multiport++ if $nbsport > 1;
e3a1d391 948
41524a58 949 push @cmd, "--match multiport" if $multiport;
4b586518 950
181390b0
DM		 951 die "multiport: option '--sports' cannot be used together with '--dports'\n"
952 if ($multiport == 2) && ($rule->{dport} ne $rule->{sport});
953
954 if ($rule->{dport}) {
955 if ($rule->{proto} && $rule->{proto} eq 'icmp') {
956 # Note: we use dport to store --icmp-type
957 die "unknown icmp-type '$rule->{dport}'\n" if !defined($icmp_type_names->{$rule->{dport}});
41524a58 958 push @cmd, "-m icmp --icmp-type $rule->{dport}";
181390b0 959 } else {
e5076eee 960 if ($nbdport > 1) {
181390b0 961 if ($multiport == 2) {
41524a58 962 push @cmd, "--ports $rule->{dport}";
181390b0 963 } else {
41524a58 964 push @cmd, "--dports $rule->{dport}";
181390b0 965 }
e3a1d391 966 } else {
41524a58 967 push @cmd, "--dport $rule->{dport}";
e3a1d391 968 }
4b586518
DM		 969 }
970 }
4b586518 971
181390b0 972 if ($rule->{sport}) {
e5076eee 973 if ($nbsport > 1) {
41524a58 974 push @cmd, "--sports $rule->{sport}" if $multiport != 2;
181390b0 975 } else {
41524a58 976 push @cmd, "--sport $rule->{sport}";
181390b0 977 }
4b586518 978 }
181390b0
DM		 979 } elsif ($rule->{dport} || $rule->{sport}) {
980 warn "ignoring destination port '$rule->{dport}' - no protocol specified\n" if $rule->{dport};
981 warn "ignoring source port '$rule->{sport}' - no protocol specified\n" if $rule->{sport};
4b586518
DM		 982 }
983
41524a58 984 push @cmd, "-m addrtype --dst-type $rule->{dsttype}" if $rule->{dsttype};
4e6112f9
DM		 985
986 if (my $action = $rule->{action}) {
2f906466 987 $action = $actions->{$action} if defined($actions->{$action});
4e6112f9 988 $goto = 1 if !defined($goto) && $action eq 'PVEFW-SET-ACCEPT-MARK';
41524a58 989 push @cmd, $goto ? "-g $action" : "-j $action";
181390b0 990 }
3a616aa0 991
eba0fb64
DM		 992 return scalar(@cmd) ? join(' ', @cmd) : undef;
993}
994
e5076eee
DM		 995my $apply_macro = sub {
996 my ($macro_name, $param) = @_;
997
998 my $macro_rules = $pve_fw_parsed_macros->{$macro_name};
999 die "unknown macro '$macro_name'\n" if !$macro_rules; # should not happen
1000
1001 my $rules = [];
1002
1003 foreach my $templ (@$macro_rules) {
1004 my $rule = {};
1005 my $param_used = {};
1006 foreach my $k (keys %$templ) {
1007 my $v = $templ->{$k};
1008 if ($v eq 'PARAM') {
1009 $v = $param->{$k};
1010 $param_used->{$k} = 1;
1011 } elsif ($v eq 'DEST') {
1012 $v = $param->{dest};
1013 $param_used->{dest} = 1;
1014 } elsif ($v eq 'SOURCE') {
1015 $v = $param->{source};
1016 $param_used->{source} = 1;
1017 }
1018
1019 die "missing parameter '$k' in macro '$macro_name'\n" if !defined($v);
1020 $rule->{$k} = $v;
1021 }
1022 foreach my $k (keys %$param) {
1023 next if $k eq 'macro';
1024 next if !defined($param->{$k});
1025 next if $param_used->{$k};
1026 if (defined($rule->{$k})) {
1027 die "parameter '$k' already define in macro (value = '$rule->{$k}')\n"
1028 if $rule->{$k} ne $param->{$k};
1029 } else {
1030 $rule->{$k} = $param->{$k};
1031 }
1032 }
1033 push @$rules, $rule;
1034 }
1035
1036 return $rules;
1037};
1038
eba0fb64
DM		 1039sub ruleset_generate_rule {
1040 my ($ruleset, $chain, $rule, $actions, $goto) = @_;
1041
e5076eee
DM		 1042 my $rules;
1043
1044 if ($rule->{macro}) {
1045 $rules = &$apply_macro($rule->{macro}, $rule);
1046 } else {
1047 $rules = [ $rule ];
1048 }
1049
1050 foreach my $tmp (@$rules) {
1051 if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $tmp, $actions, $goto)) {
1052 ruleset_addrule($ruleset, $chain, $cmdstr);
1053 }
41524a58 1054 }
3fa83edf 1055}
0f168d7b 1056
eba0fb64
DM		 1057sub ruleset_generate_rule_insert {
1058 my ($ruleset, $chain, $rule, $actions, $goto) = @_;
1059
e5076eee
DM		 1060 die "implement me" if $rule->{macro}; # not implemented, because not needed so far
1061
eba0fb64
DM		 1062 if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $rule, $actions, $goto)) {
1063 ruleset_insertrule($ruleset, $chain, $cmdstr);
1064 }
1065}
3fa83edf
DM		 1066
1067sub ruleset_create_chain {
1068 my ($ruleset, $chain) = @_;
3a616aa0 1069
d050c724 1070 die "Invalid chain name '$chain' (28 char max)\n" if length($chain) > 28;
782c4cde 1071 die "chain name may not contain collons\n" if $chain =~ m/:/; # because of log format
d050c724 1072
3fa83edf
DM		 1073 die "chain '$chain' already exists\n" if $ruleset->{$chain};
1074
1075 $ruleset->{$chain} = [];
3a616aa0
AD		 1076}
1077
3fa83edf
DM		 1078sub ruleset_chain_exist {
1079 my ($ruleset, $chain) = @_;
3a616aa0 1080
3fa83edf
DM		 1081 return $ruleset->{$chain} ? 1 : undef;
1082}
3a616aa0 1083
3fa83edf
DM		 1084sub ruleset_addrule {
1085 my ($ruleset, $chain, $rule) = @_;
3a616aa0 1086
3fa83edf 1087 die "no such chain '$chain'\n" if !$ruleset->{$chain};
3a616aa0 1088
3fa83edf
DM		 1089 push @{$ruleset->{$chain}}, "-A $chain $rule";
1090}
3a616aa0 1091
3fa83edf
DM		 1092sub ruleset_insertrule {
1093 my ($ruleset, $chain, $rule) = @_;
3a616aa0 1094
3fa83edf 1095 die "no such chain '$chain'\n" if !$ruleset->{$chain};
3a616aa0 1096
3fa83edf
DM		 1097 unshift @{$ruleset->{$chain}}, "-A $chain $rule";
1098}
3a616aa0 1099
782c4cde
DM		 1100sub get_log_rule_base {
1101 my ($chain, $vmid, $msg, $loglevel) = @_;
1102
1103 die "internal error - no log level" if !defined($loglevel);
1104
1105 $vmid = 0 if !defined($vmid);
1106
1107 # Note: we use special format for prefix to pass further
1108 # info to log daemon (VMID, LOGVELEL and CHAIN)
1109
1110 return "-j NFLOG --nflog-prefix \":$vmid:$loglevel:$chain: $msg\"";
1111}
1112
1113sub ruleset_addlog {
1114 my ($ruleset, $chain, $vmid, $msg, $loglevel, $rule) = @_;
1115
1116 return if !defined($loglevel);
1117
1118 my $logrule = get_log_rule_base($chain, $vmid, $msg, $loglevel);
1119
1120 $logrule = "$rule $logrule" if defined($rule);
1121
1122 ruleset_addrule($ruleset, $chain, $logrule)
1123}
1124
3fa83edf 1125sub generate_bridge_chains {
530c005e
DM		 1126 my ($ruleset, $hostfw_conf, $bridge, $routing_table) = @_;
1127
1128 my $options = $hostfw_conf->{options} || {};
1129
1130 die "error: detected direct route to bridge '$bridge'\n"
1131 if !$options->{allow_bridge_route} && $routing_table->{$bridge};
2f3d8d76 1132
5927497d
DM		 1133 if (!ruleset_chain_exist($ruleset, "$bridge-FW")) {
1134 ruleset_create_chain($ruleset, "$bridge-FW");
3cc81077
DM		 1135 ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-out -j $bridge-FW");
1136 ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-in -j $bridge-FW");
3fa83edf 1137 }
3a616aa0 1138
3fa83edf
DM		 1139 if (!ruleset_chain_exist($ruleset, "$bridge-OUT")) {
1140 ruleset_create_chain($ruleset, "$bridge-OUT");
3cc81077
DM		 1141 ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-in -j $bridge-OUT");
1142 ruleset_insertrule($ruleset, "PVEFW-INPUT", "-i $bridge -m physdev --physdev-is-in -j $bridge-OUT");
9fcad984
AD		 1143 }
1144
1145 if (!ruleset_chain_exist($ruleset, "$bridge-IN")) {
1146 ruleset_create_chain($ruleset, "$bridge-IN");
3cc81077 1147 ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j $bridge-IN");
fdb0bf20 1148 ruleset_addrule($ruleset, "$bridge-FW", "-m mark --mark 1 -j ACCEPT");
7323008d 1149 # accept traffic to unmanaged bridge ports
3cc81077 1150 ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j ACCEPT ");
3fa83edf
DM		 1151 }
1152}
3a616aa0 1153
ead850e8 1154sub ruleset_add_chain_policy {
782c4cde 1155 my ($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action) = @_;
ead850e8
DM		 1156
1157 if ($policy eq 'ACCEPT') {
1158
1159 ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT' },
1160 { ACCEPT => $accept_action});
1161
1162 } elsif ($policy eq 'DROP') {
1163
1164 ruleset_addrule($ruleset, $chain, "-j PVEFW-Drop");
1165
782c4cde 1166 ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel);
ead850e8
DM		 1167
1168 ruleset_addrule($ruleset, $chain, "-j DROP");
1169 } elsif ($policy eq 'REJECT') {
1170 ruleset_addrule($ruleset, $chain, "-j PVEFW-Reject");
1171
782c4cde 1172 ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel);
ead850e8
DM		 1173
1174 ruleset_addrule($ruleset, $chain, "-g PVEFW-reject");
1175 } else {
1176 # should not happen
1177 die "internal error: unknown policy '$policy'";
1178 }
1179}
1180
9e15114a
DM		 1181sub ruleset_create_vm_chain {
1182 my ($ruleset, $chain, $options, $macaddr, $direction) = @_;
3a616aa0 1183
9e15114a 1184 ruleset_create_chain($ruleset, $chain);
b47ecc88 1185 my $accept = generate_nfqueue($options);
3a616aa0 1186
bee633ab 1187 if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) {
9e15114a 1188 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs");
bee633ab
DM		 1189 }
1190
ce15d90b 1191 if (!(defined($options->{dhcp}) && $options->{dhcp} == 0)) {
76a2d1e7 1192 if ($direction eq 'OUT') {
0f168d7b
DM		 1193 ruleset_generate_rule($ruleset, $chain, { action => 'PVEFW-SET-ACCEPT-MARK',
1194 proto => 'udp', sport => 68, dport => 67 });
76a2d1e7 1195 } else {
0f168d7b
DM		 1196 ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT',
1197 proto => 'udp', sport => 67, dport => 68 });
76a2d1e7 1198 }
ce15d90b
DM		 1199 }
1200
bee633ab 1201 if ($options->{tcpflags}) {
9e15114a 1202 ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags");
bee633ab
DM		 1203 }
1204
9e15114a 1205 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP");
b47ecc88
AD		 1206 if($direction eq 'OUT'){
1207 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -g PVEFW-SET-ACCEPT-MARK");
3a616aa0 1208
b47ecc88
AD		 1209 }else{
1210 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
1211 }
b21aca2c
DM		 1212 if ($direction eq 'OUT') {
1213 if (defined($macaddr) && !(defined($options->{macfilter}) && $options->{macfilter} == 0)) {
9e15114a 1214 ruleset_addrule($ruleset, $chain, "-m mac ! --mac-source $macaddr -j DROP");
b21aca2c 1215 }
9e15114a 1216 ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark
c29f55c9 1217 }
b47ecc88
AD		 1218
1219
9e15114a
DM		 1220}
1221
1222sub ruleset_generate_vm_rules {
b47ecc88 1223 my ($ruleset, $rules, $groups_conf, $chain, $netid, $direction, $options) = @_;
9e15114a
DM		 1224
1225 my $lc_direction = lc($direction);
c29f55c9 1226
92e976b3
DM		 1227 foreach my $rule (@$rules) {
1228 next if $rule->{iface} && $rule->{iface} ne $netid;
ea9e5116 1229 next if !$rule->{enable};
92e976b3
DM		 1230 if ($rule->{type} eq 'group') {
1231 my $group_chain = "GROUP-$rule->{action}-$direction";
1232 if(!ruleset_chain_exist($ruleset, $group_chain)){
1233 generate_group_rules($ruleset, $groups_conf, $rule->{action});
1234 }
9e15114a 1235 ruleset_addrule($ruleset, $chain, "-j $group_chain");
b47ecc88
AD		 1236 if ($direction eq 'OUT'){
1237 ruleset_addrule($ruleset, $chain, "-m mark --mark 1 -j RETURN");
1238 }else{
1239 my $accept = generate_nfqueue($options);
1240 ruleset_addrule($ruleset, $chain, "-m mark --mark 1 -j $accept");
1241 }
1242
92e976b3
DM		 1243 } else {
1244 next if $rule->{type} ne $lc_direction;
1245 if ($direction eq 'OUT') {
9e15114a 1246 ruleset_generate_rule($ruleset, $chain, $rule,
92e976b3 1247 { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" });
4e6112f9 1248 } else {
b47ecc88
AD		 1249 my $accept = generate_nfqueue($options);
1250 ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept , REJECT => "PVEFW-reject" });
3a616aa0 1251 }
4e6112f9 1252 }
3a616aa0 1253 }
9e15114a
DM		 1254}
1255
b47ecc88
AD		 1256sub generate_nfqueue {
1257 my ($options) = @_;
1258
1259 my $action = "";
1260 if($options->{ips}){
1261 $action = "NFQUEUE";
1262 if($options->{ips_queues} && $options->{ips_queues} =~ m/^(\d+)(:(\d+))?$/) {
1263 if(defined($3) && defined($1)) {
1264 $action .= " --queue-balance $1:$3";
1265 }elsif (defined($1)) {
1266 $action .= " --queue-num $1";
1267 }
1268 }
1269 $action .= " --queue-bypass";
1270 }else{
1271 $action = "ACCEPT";
1272 }
1273
1274 return $action;
1275}
1276
da6fc60b
AD		 1277sub ruleset_generate_vm_ipsrules {
1278 my ($ruleset, $options, $direction, $iface, $bridge) = @_;
1279
1280 if ($options->{ips} && $direction eq 'IN') {
1281 my $nfqueue = generate_nfqueue($options);
1282
1283 if (!ruleset_chain_exist($ruleset, "$bridge-IPS")) {
1284 ruleset_create_chain($ruleset, "PVEFW-IPS");
1285 }
1286
1287 if (!ruleset_chain_exist($ruleset, "$bridge-IPS")) {
1288 ruleset_create_chain($ruleset, "$bridge-IPS");
1289 ruleset_insertrule($ruleset, "PVEFW-IPS", "-o $bridge -m physdev --physdev-is-out -j $bridge-IPS");
1290 }
1291
1292 ruleset_addrule($ruleset, "$bridge-IPS", "-m physdev --physdev-out $iface --physdev-is-bridged -j $nfqueue");
1293 }
1294}
1295
9e15114a
DM		 1296sub generate_venet_rules_direction {
1297 my ($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, $direction) = @_;
1298
5176619e 1299 parse_address_list($ip); # make sure we have a valid $ip list
9e15114a
DM		 1300
1301 my $lc_direction = lc($direction);
1302
1303 my $rules = $vmfw_conf->{rules};
1304
1305 my $options = $vmfw_conf->{options};
1306 my $loglevel = get_option_log_level($options, "log_level_${lc_direction}");
1307
1308 my $chain = "venet0-$vmid-$direction";
1309
1310 ruleset_create_vm_chain($ruleset, $chain, $options, undef, $direction);
1311
1312 ruleset_generate_vm_rules($ruleset, $rules, $groups_conf, $chain, 'venet', $direction);
1313
1314 # implement policy
1315 my $policy;
1316
1317 if ($direction eq 'OUT') {
1318 $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default
1319 } else {
1320 $policy = $options->{policy_in} || 'DROP'; # allow nothing by default
1321 }
1322
b47ecc88
AD		 1323 my $accept = generate_nfqueue($options);
1324 my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : $accept;
782c4cde 1325 ruleset_add_chain_policy($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action);
9e15114a 1326
38485daa 1327 # plug into FORWARD, INPUT and OUTPUT chain
eba0fb64
DM		 1328 if ($direction eq 'OUT') {
1329 ruleset_generate_rule_insert($ruleset, "PVEFW-FORWARD", {
1330 action => $chain,
1331 source => $ip,
1332 iface_in => 'venet0'});
38485daa
DM		 1333
1334 ruleset_generate_rule_insert($ruleset, "PVEFW-INPUT", {
1335 action => $chain,
1336 source => $ip,
1337 iface_in => 'venet0'});
eba0fb64
DM		 1338 } else {
1339 ruleset_generate_rule($ruleset, "PVEFW-FORWARD", {
1340 action => $chain,
1341 dest => $ip,
1342 iface_out => 'venet0'});
38485daa
DM		 1343
1344 ruleset_generate_rule($ruleset, "PVEFW-OUTPUT", {
1345 action => $chain,
1346 dest => $ip,
1347 iface_out => 'venet0'});
eba0fb64 1348 }
9e15114a
DM		 1349}
1350
1351sub generate_tap_rules_direction {
782c4cde 1352 my ($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $bridge, $direction) = @_;
9e15114a
DM		 1353
1354 my $lc_direction = lc($direction);
1355
1356 my $rules = $vmfw_conf->{rules};
1357
1358 my $options = $vmfw_conf->{options};
1359 my $loglevel = get_option_log_level($options, "log_level_${lc_direction}");
1360
1361 my $tapchain = "$iface-$direction";
1362
1363 ruleset_create_vm_chain($ruleset, $tapchain, $options, $macaddr, $direction);
1364
b47ecc88 1365 ruleset_generate_vm_rules($ruleset, $rules, $groups_conf, $tapchain, $netid, $direction, $options);
3a616aa0 1366
da6fc60b
AD		 1367 ruleset_generate_vm_ipsrules($ruleset, $options, $direction, $iface, $bridge);
1368
ccae0b50
DM		 1369 # implement policy
1370 my $policy;
1371
1372 if ($direction eq 'OUT') {
72f63fde 1373 $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default
ccae0b50 1374 } else {
72f63fde 1375 $policy = $options->{policy_in} || 'DROP'; # allow nothing by default
ccae0b50
DM		 1376 }
1377
b47ecc88
AD		 1378 my $accept = generate_nfqueue($options);
1379 my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : $accept;
782c4cde 1380 ruleset_add_chain_policy($ruleset, $tapchain, $vmid, $policy, $loglevel, $accept_action);
3a616aa0 1381
3fa83edf 1382 # plug the tap chain to bridge chain
3cc81077
DM		 1383 if ($direction eq 'IN') {
1384 ruleset_insertrule($ruleset, "$bridge-IN",
1385 "-m physdev --physdev-is-bridged --physdev-out $iface -j $tapchain");
1386 } else {
1387 ruleset_insertrule($ruleset, "$bridge-OUT",
1388 "-m physdev --physdev-in $iface -j $tapchain");
1389 }
3a616aa0
AD		 1390}
1391
d18c1e2b 1392sub enable_host_firewall {
92e976b3 1393 my ($ruleset, $hostfw_conf, $groups_conf) = @_;
0bd5f137 1394
51bae274 1395 # fixme: allow security groups
0bd5f137 1396
92e976b3
DM		 1397 my $options = $hostfw_conf->{options};
1398 my $rules = $hostfw_conf->{rules};
178a63be 1399
3fa83edf 1400 # host inbound firewall
dec84fcd
DM		 1401 my $chain = "PVEFW-HOST-IN";
1402 ruleset_create_chain($ruleset, $chain);
0bd5f137 1403
178a63be
DM		 1404 my $loglevel = get_option_log_level($options, "log_level_in");
1405
4ac863a6
DM		 1406 if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) {
1407 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs");
1408 }
1409
fb424a00
DM		 1410 if ($options->{tcpflags}) {
1411 ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags");
1412 }
1413
7fab95bc
DM		 1414 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP");
1415 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
dec84fcd
DM		 1416 ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT");
1417 ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT");
97156ecc 1418 ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j ACCEPT");
dec84fcd 1419 ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync
0bd5f137 1420
23e888f8
DM		 1421 # we use RETURN because we need to check also tap rules
1422 my $accept_action = 'RETURN';
1423
92e976b3
DM		 1424 foreach my $rule (@$rules) {
1425 next if $rule->{type} ne 'in';
23e888f8 1426 ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" });
0bd5f137
AD		 1427 }
1428
23e888f8 1429 # implement input policy
72f63fde 1430 my $policy = $options->{policy_in} || 'DROP'; # allow nothing by default
782c4cde 1431 ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action);
0bd5f137 1432
3fa83edf 1433 # host outbound firewall
aadd745e 1434 $chain = "PVEFW-HOST-OUT";
dec84fcd
DM		 1435 ruleset_create_chain($ruleset, $chain);
1436
178a63be
DM		 1437 $loglevel = get_option_log_level($options, "log_level_out");
1438
7fab95bc
DM		 1439 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP");
1440 ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
dec84fcd
DM		 1441 ruleset_addrule($ruleset, $chain, "-o lo -j ACCEPT");
1442 ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT");
97156ecc 1443 ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j ACCEPT");
dec84fcd 1444 ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync
0bd5f137 1445
23e888f8
DM		 1446 # we use RETURN because we may want to check other thigs later
1447 $accept_action = 'RETURN';
1448
92e976b3
DM		 1449 foreach my $rule (@$rules) {
1450 next if $rule->{type} ne 'out';
23e888f8 1451 ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" });
0bd5f137
AD		 1452 }
1453
23e888f8 1454 # implement output policy
72f63fde 1455 $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default
782c4cde 1456 ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action);
6158271d 1457
dec84fcd
DM		 1458 ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-j PVEFW-HOST-OUT");
1459 ruleset_addrule($ruleset, "PVEFW-INPUT", "-j PVEFW-HOST-IN");
9d31b418
AD		 1460}
1461
1462sub generate_group_rules {
92e976b3 1463 my ($ruleset, $groups_conf, $group) = @_;
ac7648e0 1464 die "no such security group '$group'\n" if !$groups_conf->{rules}->{$group};
9d31b418 1465
8f119284 1466 my $rules = $groups_conf->{rules}->{$group};
6158271d 1467
3fa83edf 1468 my $chain = "GROUP-${group}-IN";
9d31b418 1469
3fa83edf 1470 ruleset_create_chain($ruleset, $chain);
b47ecc88 1471 ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark
9d31b418 1472
92e976b3
DM		 1473 foreach my $rule (@$rules) {
1474 next if $rule->{type} ne 'in';
b47ecc88 1475 ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" });
9d31b418
AD		 1476 }
1477
3fa83edf 1478 $chain = "GROUP-${group}-OUT";
9d31b418 1479
3fa83edf 1480 ruleset_create_chain($ruleset, $chain);
4e6112f9 1481 ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark
9d31b418 1482
92e976b3
DM		 1483 foreach my $rule (@$rules) {
1484 next if $rule->{type} ne 'out';
1485 # we use PVEFW-SET-ACCEPT-MARK (Instead of ACCEPT) because we need to
1486 # check also other tap rules later
1487 ruleset_generate_rule($ruleset, $chain, $rule,
1488 { ACCEPT => 'PVEFW-SET-ACCEPT-MARK', REJECT => "PVEFW-reject" });
9d31b418 1489 }
9d31b418
AD		 1490}
1491
51bae274
DM		 1492my $MAX_NETS = 32;
1493my $valid_netdev_names = {};
1494for (my $i = 0; $i < $MAX_NETS; $i++) {
1495 $valid_netdev_names->{"net$i"} = 1;
1496}
5e1267a5 1497
51bae274
DM		 1498sub parse_fw_rule {
1499 my ($line, $need_iface, $allow_groups) = @_;
5e1267a5 1500
92e976b3 1501 my ($type, $action, $iface, $source, $dest, $proto, $dport, $sport);
51bae274 1502
11bac5c2 1503 # we can add single line comments to the end of the rule
30c1ae52 1504 my $comment = decode('utf8', $1) if $line =~ s/#\s*(.*?)\s*$//;
11bac5c2
DM		 1505
1506 # we can disable a rule when prefixed with '|'
ea9e5116
DM		 1507 my $enable = 1;
1508
1509 $enable = 0 if $line =~ s/^\|//;
51bae274
DM		 1510
1511 my @data = split(/\s+/, $line);
92e976b3 1512 my $expected_elements = $need_iface ? 8 : 7;
51bae274
DM		 1513
1514 die "wrong number of rule elements\n" if scalar(@data) > $expected_elements;
1515
1516 if ($need_iface) {
92e976b3 1517 ($type, $action, $iface, $source, $dest, $proto, $dport, $sport) = @data
51bae274 1518 } else {
92e976b3 1519 ($type, $action, $source, $dest, $proto, $dport, $sport) = @data;
51bae274
DM		 1520 }
1521
92e976b3 1522 die "incomplete rule\n" if ! ($type && $action);
51bae274 1523
961b4928 1524 my $macro;
961b4928 1525
92e976b3
DM		 1526 $type = lc($type);
1527
1528 if ($type eq 'in' || $type eq 'out') {
1529 if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) {
1530 # OK
1531 } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
e5076eee
DM		 1532 $action = $2;
1533 my $preferred_name = $pve_fw_preferred_macro_names->{lc($1)};
1534 die "unknown macro '$1'\n" if !$preferred_name;
1535 $macro = $preferred_name;
92e976b3
DM		 1536 } else {
1537 die "unknown action '$action'\n";
1538 }
1539 } elsif ($type eq 'group') {
1540 die "wrong number of rule elements\n" if scalar(@data) != 3;
1541 die "groups disabled\n" if !$allow_groups;
1542
1543 die "invalid characters in group name\n" if $action !~ m/^[A-Za-z0-9_\-]+$/;
51bae274 1544 } else {
92e976b3 1545 die "unknown rule type '$type'\n";
51bae274
DM		 1546 }
1547
1548 if ($need_iface) {
1549 $iface = undef if $iface && $iface eq '-';
51bae274
DM		 1550 }
1551
1552 $proto = undef if $proto && $proto eq '-';
54cd19a8 1553 pve_fw_verify_protocol_spec($proto) if $proto;
51bae274
DM		 1554
1555 $source = undef if $source && $source eq '-';
1556 $dest = undef if $dest && $dest eq '-';
1557
1558 $dport = undef if $dport && $dport eq '-';
1559 $sport = undef if $sport && $sport eq '-';
1560
e5076eee
DM		 1561 parse_port_name_number_or_range($dport) if defined($dport);
1562 parse_port_name_number_or_range($sport) if defined($sport);
1563
1564 parse_address_list($source) if $source;
1565 parse_address_list($dest) if $dest;
51bae274 1566
e5076eee 1567 return {
92e976b3 1568 type => $type,
ea9e5116 1569 enable => $enable,
11bac5c2 1570 comment => $comment,
51bae274 1571 action => $action,
e5076eee 1572 macro => $macro,
51bae274
DM		 1573 iface => $iface,
1574 source => $source,
1575 dest => $dest,
51bae274
DM		 1576 proto => $proto,
1577 dport => $dport,
1578 sport => $sport,
51bae274
DM		 1579 };
1580}
1581
2d404ffc 1582sub parse_vmfw_option {
85c6eaed
DM		 1583 my ($line) = @_;
1584
1585 my ($opt, $value);
1586
178a63be
DM		 1587 my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog";
1588
b47ecc88 1589 if ($line =~ m/^(enable|dhcp|macfilter|nosmurfs|tcpflags|ips):\s*(0|1)\s*$/i) {
9c6b6efd
DM		 1590 $opt = lc($1);
1591 $value = int($2);
178a63be
DM		 1592 } elsif ($line =~ m/^(log_level_in|log_level_out):\s*(($loglevels)\s*)?$/i) {
1593 $opt = lc($1);
1594 $value = $2 ? lc($3) : '';
72f63fde 1595 } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) {
85c6eaed
DM		 1596 $opt = lc($1);
1597 $value = uc($3);
b47ecc88
AD		 1598 } elsif ($line =~ m/^(ips_queues):\s*((\d+)(:(\d+))?)\s*$/i) {
1599 $opt = lc($1);
1600 $value = $2;
9c6b6efd 1601 } else {
85c6eaed
DM		 1602 chomp $line;
1603 die "can't parse option '$line'\n"
1604 }
1605
1606 return ($opt, $value);
1607}
1608
2d404ffc
DM		 1609sub parse_hostfw_option {
1610 my ($line) = @_;
1611
1612 my ($opt, $value);
1613
1614 my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog";
1615
cc10e5d7 1616 if ($line =~ m/^(enable|dhcp|nosmurfs|tcpflags|allow_bridge_route|optimize):\s*(0|1)\s*$/i) {
2d404ffc
DM		 1617 $opt = lc($1);
1618 $value = int($2);
178a63be 1619 } elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) {
2d404ffc
DM		 1620 $opt = lc($1);
1621 $value = $2 ? lc($3) : '';
72f63fde 1622 } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) {
2d404ffc
DM		 1623 $opt = lc($1);
1624 $value = uc($3);
490cdead
DM		 1625 } elsif ($line =~ m/^(nf_conntrack_max):\s*(\d+)\s*$/i) {
1626 $opt = lc($1);
1627 $value = int($2);
2d404ffc
DM		 1628 } else {
1629 chomp $line;
1630 die "can't parse option '$line'\n"
1631 }
1632
1633 return ($opt, $value);
1634}
1635
51bae274
DM		 1636sub parse_vm_fw_rules {
1637 my ($filename, $fh) = @_;
1638
92e976b3 1639 my $res = { rules => [], options => {}};
51bae274
DM		 1640
1641 my $section;
1642
e7b35711
DM		 1643 my $digest = Digest::SHA->new('sha1');
1644
5e1267a5 1645 while (defined(my $line = <$fh>)) {
e7b35711
DM		 1646 $digest->add($line);
1647
5e1267a5
DM		 1648 next if $line =~ m/^#/;
1649 next if $line =~ m/^\s*$/;
1650
961b4928
DM		 1651 my $linenr = $fh->input_line_number();
1652 my $prefix = "$filename (line $linenr)";
1653
85c6eaed 1654 if ($line =~ m/^\[(\S+)\]\s*$/i) {
5e1267a5 1655 $section = lc($1);
85c6eaed 1656 warn "$prefix: ignore unknown section '$section'\n" if !$res->{$section};
5e1267a5
DM		 1657 next;
1658 }
51bae274 1659 if (!$section) {
961b4928 1660 warn "$prefix: skip line - no section";
5e1267a5
DM		 1661 next;
1662 }
1663
85c6eaed
DM		 1664 next if !$res->{$section}; # skip undefined section
1665
1666 if ($section eq 'options') {
6158271d 1667 eval {
2d404ffc 1668 my ($opt, $value) = parse_vmfw_option($line);
85c6eaed
DM		 1669 $res->{options}->{$opt} = $value;
1670 };
1671 warn "$prefix: $@" if $@;
1672 next;
1673 }
1674
e5076eee
DM		 1675 my $rule;
1676 eval { $rule = parse_fw_rule($line, 1, 1); };
51bae274 1677 if (my $err = $@) {
961b4928 1678 warn "$prefix: $err";
5e1267a5
DM		 1679 next;
1680 }
1681
e5076eee 1682 push @{$res->{$section}}, $rule;
51bae274
DM		 1683 }
1684
e7b35711
DM		 1685 $res->{digest} = $digest->b64digest;
1686
51bae274
DM		 1687 return $res;
1688}
1689
1690sub parse_host_fw_rules {
1691 my ($filename, $fh) = @_;
1692
92e976b3 1693 my $res = { rules => [], options => {}};
51bae274
DM		 1694
1695 my $section;
1696
8b27beb9
DM		 1697 my $digest = Digest::SHA->new('sha1');
1698
51bae274 1699 while (defined(my $line = <$fh>)) {
8b27beb9
DM		 1700 $digest->add($line);
1701
51bae274
DM		 1702 next if $line =~ m/^#/;
1703 next if $line =~ m/^\s*$/;
1704
961b4928
DM		 1705 my $linenr = $fh->input_line_number();
1706 my $prefix = "$filename (line $linenr)";
1707
2d404ffc 1708 if ($line =~ m/^\[(\S+)\]\s*$/i) {
51bae274 1709 $section = lc($1);
2d404ffc 1710 warn "$prefix: ignore unknown section '$section'\n" if !$res->{$section};
5e1267a5
DM		 1711 next;
1712 }
51bae274 1713 if (!$section) {
961b4928 1714 warn "$prefix: skip line - no section";
5e1267a5
DM		 1715 next;
1716 }
1717
2d404ffc
DM		 1718 next if !$res->{$section}; # skip undefined section
1719
1720 if ($section eq 'options') {
1721 eval {
2d404ffc
DM		 1722 my ($opt, $value) = parse_hostfw_option($line);
1723 $res->{options}->{$opt} = $value;
1724 };
1725 warn "$prefix: $@" if $@;
1726 next;
1727 }
1728
e5076eee
DM		 1729 my $rule;
1730 eval { $rule = parse_fw_rule($line, 1, 1); };
ecbea048 1731 if (my $err = $@) {
961b4928 1732 warn "$prefix: $err";
ecbea048 1733 next;
ecbea048 1734 }
e5076eee
DM		 1735
1736 push @{$res->{$section}}, $rule;
51bae274 1737 }
ecbea048 1738
8b27beb9
DM		 1739 $res->{digest} = $digest->b64digest;
1740
51bae274
DM		 1741 return $res;
1742}
4cdbb3b7 1743
51bae274
DM		 1744sub parse_group_fw_rules {
1745 my ($filename, $fh) = @_;
5e1267a5 1746
51bae274
DM		 1747 my $section;
1748 my $group;
1749
34cdedfa 1750 my $res = { rules => {}, ipset => {} };
6158271d 1751
d1c53b3e
DM		 1752 my $digest = Digest::SHA->new('sha1');
1753
51bae274 1754 while (defined(my $line = <$fh>)) {
d1c53b3e
DM		 1755 $digest->add($line);
1756
51bae274
DM		 1757 next if $line =~ m/^#/;
1758 next if $line =~ m/^\s*$/;
1759
961b4928
DM		 1760 my $linenr = $fh->input_line_number();
1761 my $prefix = "$filename (line $linenr)";
1762
92e976b3
DM		 1763 if ($line =~ m/^\[group\s+(\S+)\]\s*$/i) {
1764 $section = 'rules';
1765 $group = lc($1);
51bae274
DM		 1766 next;
1767 }
34cdedfa
AD		 1768
1769 if ($line =~ m/^\[ipgroup\s+(\S+)\]\s*$/i) {
1770 $section = 'ipset';
1771 $group = lc($1);
1772 $res->{$section}->{$group}->{type} = 'hash:ip family inet hashsize 1024 maxelem 65536 ';
1773
1774 next;
1775 }
1776 if ($line =~ m/^\[netgroup\s+(\S+)\]\s*$/i) {
1777 $section = 'ipset';
1778 $group = lc($1);
1779 $res->{$section}->{$group}->{type} = 'hash:net family inet hashsize 1024 maxelem 65536 ';
1780
1781 next;
1782 }
1783
51bae274 1784 if (!$section || !$group) {
961b4928 1785 warn "$prefix: skip line - no section";
51bae274
DM		 1786 next;
1787 }
1788
34cdedfa
AD		 1789 if($section eq 'rules'){
1790 my $rule;
1791 eval { $rule = parse_fw_rule($line, 0, 0); };
1792 if (my $err = $@) {
1793 warn "$prefix: $err";
1794 next;
1795 }
1796 push @{$res->{$section}->{$group}}, $rule;
1797
1798 }elsif($section eq 'ipset'){
1799 my $ip;
1800 if (!Net::IP->new($line)) {
1801 warn "$prefix: $line is not an valid ip address";
1802 next;
1803 }
1804 push @{$res->{$section}->{$group}->{ip}}, $line;
51bae274 1805 }
34cdedfa 1806
e5076eee 1807
5e1267a5
DM		 1808 }
1809
d1c53b3e
DM		 1810 $res->{digest} = $digest->b64digest;
1811
5e1267a5
DM		 1812 return $res;
1813}
1814
06320eb0
DM		 1815sub run_locked {
1816 my ($code, @param) = @_;
1817
1818 my $timeout = 10;
1819
1820 my $res = lock_file($pve_fw_lock_filename, $timeout, $code, @param);
1821
1822 die $@ if $@;
1823
1824 return $res;
1825}
1826
5e1267a5
DM		 1827sub read_local_vm_config {
1828
1829 my $openvz = {};
5e1267a5
DM		 1830 my $qemu = {};
1831
c8301d63 1832 my $vmdata = { openvz => $openvz, qemu => $qemu };
5e1267a5 1833
c8301d63
DM		 1834 my $vmlist = PVE::Cluster::get_vmlist();
1835 return $vmdata if !$vmlist || !$vmlist->{ids};
1836 my $ids = $vmlist->{ids};
1837
1838 foreach my $vmid (keys %$ids) {
1839 next if !$vmid; # skip VE0
1840 my $d = $ids->{$vmid};
1841 next if !$d->{node} || $d->{node} ne $nodename;
1842 next if !$d->{type};
1843 if ($d->{type} eq 'openvz') {
d9fee004
DM		 1844 if ($have_pve_manager) {
1845 my $cfspath = PVE::OpenVZ::cfs_config_path($vmid);
1846 if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
1847 $openvz->{$vmid} = $conf;
1848 }
c8301d63
DM		 1849 }
1850 } elsif ($d->{type} eq 'qemu') {
d9fee004
DM		 1851 if ($have_qemu_server) {
1852 my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
1853 if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
1854 $qemu->{$vmid} = $conf;
1855 }
c8301d63 1856 }
5e1267a5
DM		 1857 }
1858 }
d9fee004 1859
5e1267a5
DM		 1860 return $vmdata;
1861};
1862
e7b35711
DM		 1863sub load_vmfw_conf {
1864 my ($vmid) = @_;
1865
1866 my $vmfw_conf = {};
1867
1868 my $filename = "/etc/pve/firewall/$vmid.fw";
1869 if (my $fh = IO::File->new($filename, O_RDONLY)) {
1870 $vmfw_conf = parse_vm_fw_rules($filename, $fh);
1871 }
1872
1873 return $vmfw_conf;
1874}
1875
6fc63ffd 1876sub read_vm_firewall_configs {
5e1267a5 1877 my ($vmdata) = @_;
6fc63ffd 1878 my $vmfw_configs = {};
c8301d63 1879
5e1267a5 1880 foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
e7b35711
DM		 1881 my $vmfw_conf = load_vmfw_conf($vmid);
1882 next if !$vmfw_conf->{options}; # skip if file does not exists
1883 $vmfw_configs->{$vmid} = $vmfw_conf;
5e1267a5
DM		 1884 }
1885
6fc63ffd 1886 return $vmfw_configs;
5e1267a5
DM		 1887}
1888
2d404ffc
DM		 1889sub get_option_log_level {
1890 my ($options, $k) = @_;
1891
1892 my $v = $options->{$k};
178a63be 1893 $v = $default_log_level if !defined($v);
2d404ffc
DM		 1894
1895 return undef if $v eq '' || $v eq 'nolog';
1896
1897 $v = $log_level_hash->{$v} if defined($log_level_hash->{$v});
1898
1899 return $v if ($v >= 0) && ($v <= 7);
1900
1901 warn "unknown log level ($k = '$v')\n";
1902
1903 return undef;
1904}
1905
d8f2505e 1906sub generate_std_chains {
2d404ffc
DM		 1907 my ($ruleset, $options) = @_;
1908
1909 my $loglevel = get_option_log_level($options, 'smurf_log_level');
1910
1911 # same as shorewall smurflog.
782c4cde
DM		 1912 my $chain = 'PVEFW-smurflog';
1913
1914 push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel;
1915 push @{$pve_std_chains->{$chain}}, "-j DROP";
2d404ffc
DM		 1916
1917 # same as shorewall logflags action.
1918 $loglevel = get_option_log_level($options, 'tcp_flags_log_level');
782c4cde
DM		 1919 $chain = 'PVEFW-logflags';
1920 # fixme: is this correctly logged by pvewf-logger? (ther is no --log-ip-options for NFLOG)
1921 push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel;
1922 push @{$pve_std_chains->{$chain}}, "-j DROP";
d8f2505e
DM		 1923
1924 foreach my $chain (keys %$pve_std_chains) {
1925 ruleset_create_chain($ruleset, $chain);
1926 foreach my $rule (@{$pve_std_chains->{$chain}}) {
1927 if (ref($rule)) {
1928 ruleset_generate_rule($ruleset, $chain, $rule);
1929 } else {
1930 ruleset_addrule($ruleset, $chain, $rule);
1931 }
1932 }
1933 }
1934}
1935
34cdedfa
AD		 1936sub generate_ipset_chains {
1937 my ($ipset_ruleset, $options) = @_;
1938
1939 foreach my $ipset (keys %{$options->{ipset}}) {
1940 generate_ipset($ipset_ruleset, $ipset, $options->{ipset}->{$ipset});
1941 }
1942}
1943
1944sub generate_ipset {
1945 my ($ipset_ruleset, $name, $options) = @_;
1946
1947 push @{$ipset_ruleset->{$name}}, "create $name $options->{type}";
1948
1949 foreach my $ip (@{$options->{ip}}) {
1950 push @{$ipset_ruleset->{$name}}, "add $name $ip";
1951 }
1952}
1953
6b9f68a2
DM		 1954sub save_pvefw_status {
1955 my ($status) = @_;
1956
1957 die "unknown status '$status' - internal error"
1958 if $status !~ m/^(stopped|active)$/;
1959
1960 mkdir dirname($pve_fw_status_filename);
1961 PVE::Tools::file_set_contents($pve_fw_status_filename, $status);
1962}
1963
1964sub read_pvefw_status {
1965
1966 my $status = 'unknown';
1967
1968 return 'stopped' if ! -f $pve_fw_status_filename;
1969
1970 eval {
1971 $status = PVE::Tools::file_get_contents($pve_fw_status_filename);
1972 };
1973 warn $@ if $@;
1974
1975 return $status;
1976}
1977
530c005e
DM		 1978# fixme: move to pve-common PVE::ProcFSTools
1979sub read_proc_net_route {
1980 my $filename = "/proc/net/route";
1981
1982 my $res = {};
1983
1984 my $fh = IO::File->new ($filename, "r");
1985 return $res if !$fh;
1986
1987 my $int_to_quad = sub {
1988 return join '.' => map { ($_[0] >> 8*(3-$_)) % 256 } (3, 2, 1, 0);
1989 };
1990
1991 while (defined(my $line = <$fh>)) {
1992 next if $line =~/^Iface\s+Destination/; # skip head
1993 my ($iface, $dest, $gateway, $metric, $mask, $mtu) = (split(/\s+/, $line))[0,1,2,6,7,8];
1994 push @{$res->{$iface}}, {
1995 dest => &$int_to_quad(hex($dest)),
1996 gateway => &$int_to_quad(hex($gateway)),
1997 mask => &$int_to_quad(hex($mask)),
1998 metric => $metric,
1999 mtu => $mtu,
2000 };
2001 }
2002
2003 return $res;
2004}
2005
e5d76bde 2006sub load_security_groups {
530c005e 2007
92e976b3 2008 my $groups_conf = {};
51bae274
DM		 2009 my $filename = "/etc/pve/firewall/groups.fw";
2010 if (my $fh = IO::File->new($filename, O_RDONLY)) {
92e976b3 2011 $groups_conf = parse_group_fw_rules($filename, $fh);
51bae274 2012 }
5e1267a5 2013
34cdedfa 2014 return ($groups_conf);
e5d76bde
DM		 2015}
2016
9c7e0858
DM		 2017sub save_security_groups {
2018 my ($groups_conf) = @_;
2019
2020 my $raw = '';
2021 my $filename = "/etc/pve/firewall/groups.fw";
2022
2023 foreach my $group (sort keys %{$groups_conf->{rules}}) {
2024 my $rules = $groups_conf->{rules}->{$group};
2025 $raw .= "[group $group]\n\n";
2026
2027 foreach my $rule (@$rules) {
2028 if ($rule->{type} eq 'in' || $rule->{type} eq 'out') {
2029 $raw .= '|' if defined($rule->{enable}) && !$rule->{enable};
2030 $raw .= uc($rule->{type});
2031 $raw .= " " . $rule->{action};
2032 $raw .= " " . ($rule->{source} || '-');
2033 $raw .= " " . ($rule->{dest} || '-');
2034 $raw .= " " . ($rule->{proto} || '-');
2035 $raw .= " " . ($rule->{dport} || '-');
2036 $raw .= " " . ($rule->{sport} || '-');
2037 $raw .= " # " . encode('utf8', $rule->{comment})
2038 if $rule->{comment} && $rule->{comment} !~ m/^\s*$/;
2039 $raw .= "\n";
2040 } else {
2041 die "implement me '$rule->{type}'";
2042 }
2043 }
2044
2045 $raw .= "\n";
2046 }
2047
2048 PVE::Tools::file_set_contents($filename, $raw);
2049}
2050
8b27beb9
DM		 2051sub load_hostfw_conf {
2052
2053 my $hostfw_conf = {};
2054 my $filename = "/etc/pve/local/host.fw";
2055 if (my $fh = IO::File->new($filename, O_RDONLY)) {
2056 $hostfw_conf = parse_host_fw_rules($filename, $fh);
2057 }
2058 return $hostfw_conf;
2059}
2060
e5d76bde
DM		 2061sub compile {
2062 my $vmdata = read_local_vm_config();
2063 my $vmfw_configs = read_vm_firewall_configs($vmdata);
2064
2065 my $routing_table = read_proc_net_route();
2066
2067 my $groups_conf = load_security_groups();
2068
34cdedfa
AD		 2069 my $ipset_ruleset = {};
2070 generate_ipset_chains($ipset_ruleset, $groups_conf);
2071
3fa83edf
DM		 2072 my $ruleset = {};
2073
dec84fcd
DM		 2074 ruleset_create_chain($ruleset, "PVEFW-INPUT");
2075 ruleset_create_chain($ruleset, "PVEFW-OUTPUT");
5b1df9a0 2076
fadb13dd 2077 ruleset_create_chain($ruleset, "PVEFW-FORWARD");
3fa83edf 2078
8b27beb9
DM		 2079 my $hostfw_conf = load_hostfw_conf();
2080 my $hostfw_options = $hostfw_conf->{options} || {};
fadb13dd 2081
92e976b3 2082 generate_std_chains($ruleset, $hostfw_options);
fadb13dd 2083
6d2ab017 2084 my $hostfw_enable = !(defined($hostfw_options->{enable}) && ($hostfw_options->{enable} == 0));
2d404ffc 2085
d18c1e2b 2086 enable_host_firewall($ruleset, $hostfw_conf, $groups_conf) if $hostfw_enable;
3fa83edf 2087
6158271d 2088 # generate firewall rules for QEMU VMs
3fa83edf
DM		 2089 foreach my $vmid (keys %{$vmdata->{qemu}}) {
2090 my $conf = $vmdata->{qemu}->{$vmid};
6fc63ffd 2091 my $vmfw_conf = $vmfw_configs->{$vmid};
fa9c4a6f
DM		 2092 next if !$vmfw_conf;
2093 next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0);
3fa83edf
DM		 2094
2095 foreach my $netid (keys %$conf) {
2096 next if $netid !~ m/^net(\d+)$/;
2097 my $net = PVE::QemuServer::parse_net($conf->{$netid});
2098 next if !$net;
2099 my $iface = "tap${vmid}i$1";
5e1267a5 2100
3fa83edf
DM		 2101 my $bridge = $net->{bridge};
2102 next if !$bridge; # fixme: ?
2103
2104 $bridge .= "v$net->{tag}" if $net->{tag};
2105
530c005e 2106 generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table);
3fa83edf 2107
c29f55c9 2108 my $macaddr = $net->{macaddr};
782c4cde
DM		 2109 generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
2110 $vmfw_conf, $vmid, $bridge, 'IN');
2111 generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
2112 $vmfw_conf, $vmid, $bridge, 'OUT');
3fa83edf
DM		 2113 }
2114 }
c8301d63
DM		 2115
2116 # generate firewall rules for OpenVZ containers
2117 foreach my $vmid (keys %{$vmdata->{openvz}}) {
2118 my $conf = $vmdata->{openvz}->{$vmid};
2119
2120 my $vmfw_conf = $vmfw_configs->{$vmid};
2121 next if !$vmfw_conf;
2122 next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0);
2123
2124 if ($conf->{ip_address} && $conf->{ip_address}->{value}) {
2125 my $ip = $conf->{ip_address}->{value};
9e15114a
DM		 2126 generate_venet_rules_direction($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, 'IN');
2127 generate_venet_rules_direction($ruleset, $groups_conf, $vmfw_conf, $vmid, $ip, 'OUT');
c8301d63
DM		 2128 }
2129
2130 if ($conf->{netif} && $conf->{netif}->{value}) {
2131 my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value});
c8301d63
DM		 2132 foreach my $netid (keys %$netif) {
2133 my $d = $netif->{$netid};
2134 my $bridge = $d->{bridge};
2135 if (!$bridge) {
2136 warn "no bridge device for CT $vmid iface '$netid'\n";
2137 next; # fixme?
2138 }
530c005e
DM		 2139
2140 generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table);
2141
12d0f130 2142 my $macaddr = $d->{mac};
c8301d63 2143 my $iface = $d->{host_ifname};
782c4cde
DM		 2144 generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
2145 $vmfw_conf, $vmid, $bridge, 'IN');
2146 generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
2147 $vmfw_conf, $vmid, $bridge, 'OUT');
c8301d63
DM		 2148 }
2149 }
2150 }
c0413e35 2151
cc10e5d7 2152 if($hostfw_options->{optimize}){
da6fc60b 2153
e9d9a73e 2154 my $accept = ruleset_chain_exist($ruleset, "PVEFW-IPS") ? "PVEFW-IPS" : "ACCEPT";
da6fc60b 2155 ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
cc10e5d7
AD		 2156 ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate INVALID -j DROP");
2157 }
2158
eba0fb64
DM		 2159 # fixme: what log level should we use here?
2160 my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
2161
c98c037d
DM		 2162 # fixme: should we really block inter-bridge traffic?
2163
2164 # always allow traffic from containers?
2165 ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j RETURN");
2166
eba0fb64
DM		 2167 # disable interbridge routing
2168 ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j PVEFW-Drop");
2169 ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j PVEFW-Drop");
782c4cde
DM		 2170 ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-o vmbr+");
2171 ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-i vmbr+");
eba0fb64
DM		 2172 ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP");
2173 ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");
2174
34cdedfa 2175 return wantarray ? ($ruleset, $hostfw_conf, $ipset_ruleset) : $ruleset;
3fa83edf
DM		 2176}
2177
2178sub get_ruleset_status {
34cdedfa 2179 my ($ruleset, $verbose, $ipset) = @_;
3fa83edf 2180
34cdedfa
AD		 2181 my $active_chains = undef;
2182 if($ipset){
2183 $active_chains = ipset_get_chains();
2184 }else{
2185 $active_chains = iptables_get_chains();
2186 }
3fa83edf
DM		 2187
2188 my $statushash = {};
2189
2190 foreach my $chain (sort keys %$ruleset) {
09d5f68e 2191 my $digest = Digest::SHA->new('sha1');
3fa83edf
DM		 2192 foreach my $cmd (@{$ruleset->{$chain}}) {
2193 $digest->add("$cmd\n");
2194 }
2195 my $sig = $digest->b64digest;
2196 $statushash->{$chain}->{sig} = $sig;
2197
2198 my $oldsig = $active_chains->{$chain};
2199 if (!defined($oldsig)) {
2200 $statushash->{$chain}->{action} = 'create';
2201 } else {
2202 if ($oldsig eq $sig) {
2203 $statushash->{$chain}->{action} = 'exists';
2204 } else {
2205 $statushash->{$chain}->{action} = 'update';
2206 }
2207 }
2208 print "$statushash->{$chain}->{action} $chain ($sig)\n" if $verbose;
2209 foreach my $cmd (@{$ruleset->{$chain}}) {
2210 print "\t$cmd\n" if $verbose;
2211 }
2212 }
2213
2214 foreach my $chain (sort keys %$active_chains) {
2215 if (!defined($ruleset->{$chain})) {
2216 my $sig = $active_chains->{$chain};
2217 $statushash->{$chain}->{action} = 'delete';
2218 $statushash->{$chain}->{sig} = $sig;
2219 print "delete $chain ($sig)\n" if $verbose;
2220 }
6158271d 2221 }
3fa83edf
DM		 2222
2223 return $statushash;
2224}
2225
2226sub print_ruleset {
2227 my ($ruleset) = @_;
2228
2229 get_ruleset_status($ruleset, 1);
2230}
2231
2232sub print_sig_rule {
2233 my ($chain, $sig) = @_;
2234
09d5f68e
DM		 2235 # We just use this to store a SHA1 checksum used to detect changes
2236 return "-A $chain -m comment --comment \"PVESIG:$sig\"\n";
b6360c3f
DM		 2237}
2238
6b9f68a2 2239sub get_rulset_cmdlist {
a84f4d96 2240 my ($ruleset, $verbose) = @_;
3fa83edf 2241
3fa83edf
DM		 2242 my $cmdlist = "*filter\n"; # we pass this to iptables-restore;
2243
2244 my $statushash = get_ruleset_status($ruleset, $verbose);
2245
2246 # create missing chains first
2247 foreach my $chain (sort keys %$ruleset) {
2248 my $stat = $statushash->{$chain};
2249 die "internal error" if !$stat;
2250 next if $stat->{action} ne 'create';
886aba9c 2251
3fa83edf
DM		 2252 $cmdlist .= ":$chain - [0:0]\n";
2253 }
2254
dec84fcd 2255 my $rule = "INPUT -j PVEFW-INPUT";
3fa83edf
DM		 2256 if (!PVE::Firewall::iptables_rule_exist($rule)) {
2257 $cmdlist .= "-A $rule\n";
2258 }
dec84fcd 2259 $rule = "OUTPUT -j PVEFW-OUTPUT";
3fa83edf
DM		 2260 if (!PVE::Firewall::iptables_rule_exist($rule)) {
2261 $cmdlist .= "-A $rule\n";
2262 }
2263
dec84fcd 2264 $rule = "FORWARD -j PVEFW-FORWARD";
3fa83edf
DM		 2265 if (!PVE::Firewall::iptables_rule_exist($rule)) {
2266 $cmdlist .= "-A $rule\n";
2267 }
2268
2269 foreach my $chain (sort keys %$ruleset) {
2270 my $stat = $statushash->{$chain};
2271 die "internal error" if !$stat;
2272
2273 if ($stat->{action} eq 'update' || $stat->{action} eq 'create') {
2274 $cmdlist .= "-F $chain\n";
2275 foreach my $cmd (@{$ruleset->{$chain}}) {
2276 $cmdlist .= "$cmd\n";
2277 }
2278 $cmdlist .= print_sig_rule($chain, $stat->{sig});
2279 } elsif ($stat->{action} eq 'delete') {
f5d28682 2280 die "internal error"; # this should not happen
3fa83edf
DM		 2281 } elsif ($stat->{action} eq 'exists') {
2282 # do nothing
2283 } else {
2284 die "internal error - unknown status '$stat->{action}'";
2285 }
2286 }
2287
f5d28682
DM		 2288 foreach my $chain (keys %$statushash) {
2289 next if $statushash->{$chain}->{action} ne 'delete';
2290 $cmdlist .= "-F $chain\n";
2291 }
2292 foreach my $chain (keys %$statushash) {
2293 next if $statushash->{$chain}->{action} ne 'delete';
fadb13dd
DM		 2294 next if $chain eq 'PVEFW-INPUT';
2295 next if $chain eq 'PVEFW-OUTPUT';
2296 next if $chain eq 'PVEFW-FORWARD';
f5d28682
DM		 2297 $cmdlist .= "-X $chain\n";
2298 }
2299
3fa83edf
DM		 2300 $cmdlist .= "COMMIT\n";
2301
6b9f68a2
DM		 2302 return $cmdlist;
2303}
2304
34cdedfa
AD		 2305sub get_ipset_cmdlist {
2306 my ($ruleset, $verbose) = @_;
2307
2308 my $cmdlist = "";
2309
2310 my $statushash = get_ruleset_status($ruleset, $verbose, 1);
2311
2312 foreach my $chain (sort keys %$ruleset) {
2313 my $stat = $statushash->{$chain};
2314 die "internal error" if !$stat;
2315
2316 if ($stat->{action} eq 'create') {
2317 foreach my $cmd (@{$ruleset->{$chain}}) {
2318 $cmdlist .= "$cmd\n";
2319 }
2320 }
2321
2322 if ($stat->{action} eq 'update') {
2323 my $chain_swap = $chain."_swap";
2324
2325 foreach my $cmd (@{$ruleset->{$chain}}) {
2326 $cmd =~ s/$chain/$chain_swap/;
2327 $cmdlist .= "$cmd\n";
2328
2329 }
2330 $cmdlist .= "swap $chain_swap $chain\n";
2331 $cmdlist .= "flush $chain_swap\n";
2332 $cmdlist .= "destroy $chain_swap\n";
2333
2334 }
2335
2336 }
2337
2338 foreach my $chain (keys %$statushash) {
2339 next if $statushash->{$chain}->{action} ne 'delete';
2340 $cmdlist .= "flush $chain\n";
2341 $cmdlist .= "destroy $chain\n";
2342 }
2343
2344 return $cmdlist;
2345}
2346
6b9f68a2 2347sub apply_ruleset {
34cdedfa 2348 my ($ruleset, $hostfw_conf, $ipset_ruleset, $verbose) = @_;
6b9f68a2
DM		 2349
2350 enable_bridge_firewall();
2351
edb75ba9
DM		 2352 update_nf_conntrack_max($hostfw_conf);
2353
34cdedfa
AD		 2354 my $ipsetcmdlist = get_ipset_cmdlist($ipset_ruleset, $verbose);
2355
6b9f68a2
DM		 2356 my $cmdlist = get_rulset_cmdlist($ruleset, $verbose);
2357
3fa83edf
DM		 2358 print $cmdlist if $verbose;
2359
34cdedfa
AD		 2360 ipset_restore_cmdlist($ipsetcmdlist);
2361
3fa83edf
DM		 2362 iptables_restore_cmdlist($cmdlist);
2363
6158271d 2364 # test: re-read status and check if everything is up to date
6b9f68a2 2365 my $statushash = get_ruleset_status($ruleset);
3fa83edf
DM		 2366
2367 my $errors;
2368 foreach my $chain (sort keys %$ruleset) {
2369 my $stat = $statushash->{$chain};
2370 if ($stat->{action} ne 'exists') {
2371 warn "unable to update chain '$chain'\n";
2372 $errors = 1;
2373 }
2374 }
b6360c3f 2375
3fa83edf 2376 die "unable to apply firewall changes\n" if $errors;
b6360c3f
DM		 2377}
2378
490cdead
DM		 2379sub update_nf_conntrack_max {
2380 my ($hostfw_conf) = @_;
2381
2382 my $max = 65536; # reasonable default
2383
2384 my $options = $hostfw_conf->{options} || {};
2385
2386 if (defined($options->{nf_conntrack_max}) && ($options->{nf_conntrack_max} > $max)) {
2387 $max = $options->{nf_conntrack_max};
2388 $max = int(($max+ 8191)/8192)*8192; # round to multiples of 8192
2389 }
2390
2391 my $filename_nf_conntrack_max = "/proc/sys/net/nf_conntrack_max";
2392 my $filename_hashsize = "/sys/module/nf_conntrack/parameters/hashsize";
2393
2394 my $current = int(PVE::Tools::file_read_firstline($filename_nf_conntrack_max) || $max);
2395
2396 if ($current != $max) {
2397 my $hashsize = int($max/4);
2398 PVE::ProcFSTools::write_proc_entry($filename_hashsize, $hashsize);
2399 PVE::ProcFSTools::write_proc_entry($filename_nf_conntrack_max, $max);
2400 }
2401}
2402
6b9f68a2
DM		 2403sub update {
2404 my ($start, $verbose) = @_;
2405
2406 my $code = sub {
2407 my $status = read_pvefw_status();
2408
34cdedfa 2409 my ($ruleset, $hostfw_conf, $ipset_ruleset) = PVE::Firewall::compile();
490cdead 2410
6b9f68a2
DM		 2411 if ($start || $status eq 'active') {
2412
2413 save_pvefw_status('active') if ($status ne 'active');
2414
34cdedfa 2415 apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $verbose);
6b9f68a2
DM		 2416 } else {
2417 print "Firewall not active (status = $status)\n" if $verbose;
2418 }
2419 };
2420
2421 run_locked($code);
2422}
2423
2424
b6360c3f 24251;
Firewall test scripts