config defaults: macfilter defaults to on
[pve-firewall.git] / src / PVE / FirewallSimulator.pm
CommitLineData
63e8c70e
DM
1package PVE::FirewallSimulator;
2
3use strict;
4use warnings;
5use Data::Dumper;
6use PVE::Firewall;
7use File::Basename;
8use Net::IP;
09e11ad4
WB
9
10# dynamically include PVE::QemuServer and PVE::LXC
11# to avoid dependency problems
12my $have_qemu_server;
13eval {
14 require PVE::QemuServer;
15 $have_qemu_server = 1;
16};
17
18my $have_lxc;
19eval {
20 require PVE::LXC;
21 $have_lxc = 1;
22};
63e8c70e 23
45c8eeb8 24my $mark = 0;
63e8c70e
DM
25my $trace;
26my $debug = 0;
27
fe3d79b4
WB
28my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
29
63e8c70e
DM
30sub debug {
31 my $new_value = shift;
63e8c70e 32 $debug = $new_value if defined($new_value);
63e8c70e
DM
33 return $debug;
34}
75a12a9d 35
63e8c70e
DM
36sub reset_trace {
37 $trace = '';
38}
39
40sub get_trace {
41 return $trace;
42}
43
44sub add_trace {
45 my ($text) = @_;
46
47 if ($debug) {
48 print $text;
49 } else {
50 $trace .= $text;
51 }
52}
53
49124851
DM
54$SIG{'__WARN__'} = sub {
55 my $err = $@;
56 my $t = $_[0];
57 chomp $t;
58 add_trace("$t\n");
59 $@ = $err;
60};
61
63e8c70e
DM
62sub nf_dev_match {
63 my ($devre, $dev) = @_;
64
65 $devre =~ s/\+$/\.\*/;
66 return ($dev =~ m/^${devre}$/) ? 1 : 0;
67}
68
69sub ipset_match {
ca1a5a39
DM
70 my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
71
72 my $ipset = $ipset_ruleset->{$ipsetname};
73 die "no such ipset '$ipsetname'" if !$ipset;
63e8c70e
DM
74
75 my $ip = Net::IP->new($ipaddr);
76
ca1a5a39
DM
77 my $first = $ipset->[0];
78 if ($first =~ m/^create\s+\S+\s+list:/) {
79 foreach my $entry (@$ipset) {
80 next if $entry =~ m/^create/; # simply ignore
81 if ($entry =~ m/add \S+ (\S+)$/) {
82 return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
83 } else {
84 die "implement me";
85 }
86 }
87 return 0;
88 } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
89 foreach my $entry (@$ipset) {
90 next if $entry =~ m/^create/; # simply ignore
91 if ($entry =~ m/add \S+ (\S+)$/) {
92 my $test = Net::IP->new($1);
93 if ($test->overlaps($ip)) {
94 add_trace("IPSET $ipsetname match $ipaddr\n");
95 return 1;
96 }
97 } else {
98 die "implement me";
63e8c70e 99 }
63e8c70e 100 }
ca1a5a39
DM
101 return 0;
102 } else {
103 die "unknown ipset type '$first' - not implemented\n";
63e8c70e
DM
104 }
105
106 return 0;
107}
108
109sub rule_match {
110 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
111
1e9c5070 112 $rule =~ s/^-A $chain +// || die "got strange rule: $rule";
63e8c70e
DM
113
114 while (length($rule)) {
115
116 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
117 my $cstate = $1;
118
119 return undef if $cstate eq 'INVALID'; # no match
120 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
75a12a9d 121
63e8c70e 122 next if $cstate =~ m/NEW/;
75a12a9d 123
e76a9f53 124 die "cstate test '$cstate' not implemented\n";
63e8c70e
DM
125 }
126
127 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
128 my $atype = $1;
75a12a9d 129 die "missing source address type (srctype)\n"
e76a9f53 130 if !$pkg->{srctype};
63e8c70e
DM
131 return undef if $atype ne $pkg->{srctype};
132 }
133
134 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
135 my $atype = $1;
75a12a9d 136 die "missing destination address type (dsttype)\n"
e76a9f53 137 if !$pkg->{dsttype};
63e8c70e
DM
138 return undef if $atype ne $pkg->{dsttype};
139 }
140
29e5ce15
TL
141 if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
142 my $icmpv6 = !!$1;
143 my $icmptype = $2;
144 die "missing destination address type (dsttype)\n" if !defined($pkg->{dport});
145 return undef if $icmptype ne $pkg->{dport};
146 }
147
63e8c70e
DM
148 if ($rule =~ s/^-i (\S+)\s*//) {
149 my $devre = $1;
e76a9f53 150 die "missing interface (iface_in)\n" if !$pkg->{iface_in};
63e8c70e
DM
151 return undef if !nf_dev_match($devre, $pkg->{iface_in});
152 next;
153 }
154
155 if ($rule =~ s/^-o (\S+)\s*//) {
156 my $devre = $1;
e76a9f53 157 die "missing interface (iface_out)\n" if !$pkg->{iface_out};
63e8c70e
DM
158 return undef if !nf_dev_match($devre, $pkg->{iface_out});
159 next;
160 }
161
cc8dc02f 162 if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
63e8c70e
DM
163 die "missing proto" if !$pkg->{proto};
164 return undef if $pkg->{proto} ne $1; # no match
165 next;
166 }
167
168 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
169 die "missing dport" if !$pkg->{dport};
170 return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
171 next;
172 }
173
174 if ($rule =~ s/^--dport (\d+)\s*//) {
175 die "missing dport" if !$pkg->{dport};
176 return undef if $pkg->{dport} != $1; # no match
177 next;
178 }
179
180 if ($rule =~ s/^-s (\S+)\s*//) {
181 die "missing source" if !$pkg->{source};
182 my $ip = Net::IP->new($1);
183 return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
184 next;
185 }
75a12a9d 186
63e8c70e
DM
187 if ($rule =~ s/^-d (\S+)\s*//) {
188 die "missing destination" if !$pkg->{dest};
189 my $ip = Net::IP->new($1);
190 return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
191 next;
192 }
193
b625713b 194 if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
63e8c70e 195 die "missing source" if !$pkg->{source};
b625713b 196 my $neg = $1;
ca1a5a39 197 my $ipset_name = $2;
b625713b 198 if ($neg) {
ca1a5a39 199 return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
b625713b 200 } else {
ca1a5a39 201 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
b625713b 202 }
63e8c70e
DM
203 next;
204 }
205
206 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
207 die "missing destination" if !$pkg->{dest};
ca1a5a39
DM
208 my $ipset_name = $1;
209 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
63e8c70e
DM
210 next;
211 }
212
213 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
214 die "missing source mac" if !$pkg->{mac_source};
215 return undef if $pkg->{mac_source} eq $1; # no match
216 next;
217 }
218
219 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
220 my $devre = $1;
221 return undef if !$pkg->{physdev_in};
222 return undef if !nf_dev_match($devre, $pkg->{physdev_in});
223 next;
224 }
225
226 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
227 my $devre = $1;
228 return undef if !$pkg->{physdev_out};
229 return undef if !nf_dev_match($devre, $pkg->{physdev_out});
230 next;
231 }
232
fe3d79b4
WB
233 if ($rule =~ s@^-m mark --mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*@@) {
234 my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
45c8eeb8 235 return undef if ($mark & $mask) != $value;
63e8c70e
DM
236 next;
237 }
238
239 # final actions
240
fe3d79b4
WB
241 if ($rule =~ s@^-j MARK --set-mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*$@@) {
242 my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
243 $mark = ($mark & ~$mask) | $value;
63e8c70e
DM
244 return undef;
245 }
246
247 if ($rule =~ s/^-j (\S+)\s*$//) {
248 return (0, $1);
249 }
250
251 if ($rule =~ s/^-g (\S+)\s*$//) {
252 return (1, $1);
253 }
254
255 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
75a12a9d 256 return undef;
63e8c70e
DM
257 }
258
259 last;
260 }
261
262 die "unable to parse rule: $rule";
263}
264
265sub ruleset_simulate_chain {
266 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
267
268 add_trace("ENTER chain $chain\n");
75a12a9d 269
63e8c70e
DM
270 my $counter = 0;
271
272 if ($chain eq 'PVEFW-Drop') {
273 add_trace("LEAVE chain $chain\n");
274 return ('DROP', $counter);
275 }
276 if ($chain eq 'PVEFW-reject') {
277 add_trace("LEAVE chain $chain\n");
278 return ('REJECT', $counter);
279 }
280
281 if ($chain eq 'PVEFW-tcpflags') {
282 add_trace("LEAVE chain $chain\n");
283 return (undef, $counter);
284 }
285
286 my $rules = $ruleset->{$chain} ||
287 die "no such chain '$chain'";
288
289 foreach my $rule (@$rules) {
290 $counter++;
291 my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
292 if (!defined($action)) {
293 add_trace("SKIP: $rule\n");
294 next;
295 }
296 add_trace("MATCH: $rule\n");
75a12a9d 297
63e8c70e
DM
298 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
299 add_trace("TERMINATE chain $chain: $action\n");
300 return ($action, $counter);
301 } elsif ($action eq 'RETURN') {
302 add_trace("RETURN FROM chain $chain\n");
303 last;
304 } else {
305 if ($goto) {
306 add_trace("LEAVE chain $chain - goto $action\n");
307 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
308 #$chain = $action;
309 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
310 } else {
311 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
312 $counter += $ctr;
313 return ($act, $counter) if $act;
314 add_trace("CONTINUE chain $chain\n");
315 }
316 }
317 }
318
319 add_trace("LEAVE chain $chain\n");
320 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
321 return ('ACCEPT', $counter); # default policy
322 }
323
324 return (undef, $counter);
325}
326
327sub copy_packet {
328 my ($pkg) = @_;
329
330 my $res = {};
331
332 while (my ($k,$v) = each %$pkg) {
333 $res->{$k} = $v;
334 }
335
336 return $res;
337}
338
339# Try to simulate packet traversal inside kernel. This invokes iptable
340# checks several times.
341sub route_packet {
342 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
343
ca1a5a39
DM
344 $pkg->{ipversion} = 4; # fixme: allow ipv6
345
63e8c70e
DM
346 my $route_state = $start_state;
347
348 my $physdev_in;
349
350 my $ipt_invocation_counter = 0;
351 my $rule_check_counter = 0;
352
353 while ($route_state ne $target->{iface}) {
354
355 my $chain;
356 my $next_route_state;
357 my $next_physdev_in;
358
359 $pkg->{iface_in} = $pkg->{iface_out} = undef;
360 $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
361
362 if ($route_state eq 'from-bport') {
363 $next_route_state = $from_info->{bridge} || die 'internal error';
364 $next_physdev_in = $from_info->{iface} || die 'internal error';
365 } elsif ($route_state eq 'host') {
366
367 if ($target->{type} eq 'bport') {
368 $pkg->{iface_in} = 'lo';
369 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
370 $chain = 'PVEFW-OUTPUT';
371 $next_route_state = $target->{iface} || die 'internal error';
e038c485 372 } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
63e8c70e
DM
373 $pkg->{iface_in} = 'lo';
374 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
375 $chain = 'PVEFW-OUTPUT';
376 $next_route_state = 'fwbr-in';
377 } else {
378 die "implement me";
379 }
380
63e8c70e
DM
381 } elsif ($route_state eq 'fwbr-out') {
382
383 $chain = 'PVEFW-FORWARD';
384 $next_route_state = $from_info->{bridge} || die 'internal error';
385 $next_physdev_in = $from_info->{fwpr} || die 'internal error';
386 $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
387 $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
388 $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
389 $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
75a12a9d 390
63e8c70e
DM
391 } elsif ($route_state eq 'fwbr-in') {
392
393 $chain = 'PVEFW-FORWARD';
394 $next_route_state = $target->{tapdev};
395 $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
396 $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
397 $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
398 $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
399
400 } elsif ($route_state =~ m/^vmbr\d+$/) {
75a12a9d 401
63e8c70e
DM
402 die "missing physdev_in - internal error?" if !$physdev_in;
403 $pkg->{physdev_in} = $physdev_in;
404
405 if ($target->{type} eq 'host') {
406
407 $chain = 'PVEFW-INPUT';
408 $pkg->{iface_in} = $route_state;
409 $pkg->{iface_out} = 'lo';
410 $next_route_state = 'host';
411
412 } elsif ($target->{type} eq 'bport') {
413
414 $chain = 'PVEFW-FORWARD';
415 $pkg->{iface_in} = $route_state;
416 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
417 # conditionally set physdev_out (same behavior as kernel)
418 if ($route_state eq $target->{bridge}) {
419 $pkg->{physdev_out} = $target->{iface} || die 'internal error';
420 }
421 $next_route_state = $target->{iface};
422
e038c485 423 } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
63e8c70e
DM
424
425 $chain = 'PVEFW-FORWARD';
426 $pkg->{iface_in} = $route_state;
427 $pkg->{iface_out} = $target->{bridge};
428 # conditionally set physdev_out (same behavior as kernel)
429 if ($route_state eq $target->{bridge}) {
430 $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
431 }
432 $next_route_state = 'fwbr-in';
433
434 } else {
435 die "implement me";
436 }
437
438 } else {
439 die "implement me $route_state";
440 }
441
442 die "internal error" if !defined($next_route_state);
443
444 if ($chain) {
445 add_trace("IPT check at $route_state (chain $chain)\n");
446 add_trace(Dumper($pkg));
447 $ipt_invocation_counter++;
448 my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
449 $rule_check_counter += $ctr;
450 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
75a12a9d 451 }
63e8c70e
DM
452
453 $route_state = $next_route_state;
454
455 $physdev_in = $next_physdev_in;
456 }
457
458 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
459}
460
461sub extract_ct_info {
e038c485 462 my ($vmdata, $vmid, $netnum) = @_;
63e8c70e
DM
463
464 my $info = { type => 'ct', vmid => $vmid };
465
e038c485 466 my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
a7c85d56 467 my $net = PVE::LXC::Config->parse_lxc_network($conf->{"net$netnum"});
e038c485
DM
468 $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
469 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
470 $info->{fwbr} = "fwbr${vmid}i$netnum";
471 $info->{tapdev} = "veth${vmid}i$netnum";
472 $info->{fwln} = "fwln${vmid}i$netnum";
473 $info->{fwpr} = "fwpr${vmid}p$netnum";
474 $info->{ip_address} = $net->{ip} || die "unable to get ip address";
475
63e8c70e
DM
476 return $info;
477}
478
479sub extract_vm_info {
b625713b 480 my ($vmdata, $vmid, $netnum) = @_;
63e8c70e
DM
481
482 my $info = { type => 'vm', vmid => $vmid };
483
484 my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
b625713b 485 my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
63e8c70e
DM
486 $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
487 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
b625713b
DM
488 $info->{fwbr} = "fwbr${vmid}i$netnum";
489 $info->{tapdev} = "tap${vmid}i$netnum";
490 $info->{fwln} = "fwln${vmid}i$netnum";
491 $info->{fwpr} = "fwpr${vmid}p$netnum";
63e8c70e
DM
492
493 return $info;
494}
495
496sub simulate_firewall {
497 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
498
499 my $from = $test->{from} || die "missing 'from' field";
500 my $to = $test->{to} || die "missing 'to' field";
501 my $action = $test->{action} || die "missing 'action'";
75a12a9d 502
63e8c70e 503 my $testid = $test->{id};
75a12a9d 504
63e8c70e
DM
505 die "from/to needs to be different" if $from eq $to;
506
507 my $pkg = {
508 proto => 'tcp',
509 sport => undef,
510 dport => undef,
511 source => undef,
512 dest => undef,
513 srctype => 'UNICAST',
514 dsttype => 'UNICAST',
515 };
516
517 while (my ($k,$v) = each %$test) {
518 next if $k eq 'from';
519 next if $k eq 'to';
520 next if $k eq 'action';
521 next if $k eq 'id';
522 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
523 $pkg->{$k} = $v;
524 }
525
526 my $from_info = {};
527
528 my $start_state;
529
530 if ($from eq 'host') {
531 $from_info->{type} = 'host';
532 $start_state = 'host';
533 $pkg->{source} = $host_ip if !defined($pkg->{source});
534 } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
535 $from_info->{type} = 'bport';
536 $from_info->{bridge} = $1;
537 $from_info->{iface} = $2;
538 $start_state = 'from-bport';
539 } elsif ($from eq 'outside') {
540 $from_info->{type} = 'bport';
541 $from_info->{bridge} = 'vmbr0';
542 $from_info->{iface} = 'eth0';
543 $start_state = 'from-bport';
544 } elsif ($from eq 'nfvm') {
545 $from_info->{type} = 'bport';
546 $from_info->{bridge} = 'vmbr0';
547 $from_info->{iface} = 'tapXYZ';
548 $start_state = 'from-bport';
549 } elsif ($from =~ m/^ct(\d+)$/) {
09e11ad4 550 return 'SKIPPED' if !$have_lxc;
63e8c70e 551 my $vmid = $1;
e038c485 552 $from_info = extract_ct_info($vmdata, $vmid, 0);
75a12a9d 553 $start_state = 'fwbr-out';
e038c485 554 $pkg->{mac_source} = $from_info->{macaddr};
b625713b 555 } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
09e11ad4 556 return 'SKIPPED' if !$have_qemu_server;
63e8c70e 557 my $vmid = $1;
b625713b
DM
558 my $netnum = $3 || 0;
559 $from_info = extract_vm_info($vmdata, $vmid, $netnum);
75a12a9d 560 $start_state = 'fwbr-out';
63e8c70e
DM
561 $pkg->{mac_source} = $from_info->{macaddr};
562 } else {
563 die "unable to parse \"from => '$from'\"\n";
564 }
565
566 my $target;
567
568 if ($to eq 'host') {
569 $target->{type} = 'host';
570 $target->{iface} = 'host';
571 $pkg->{dest} = $host_ip if !defined($pkg->{dest});
572 } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
573 $target->{type} = 'bport';
574 $target->{bridge} = $1;
575 $target->{iface} = $2;
576 } elsif ($to eq 'outside') {
577 $target->{type} = 'bport';
578 $target->{bridge} = 'vmbr0';
579 $target->{iface} = 'eth0';
580 } elsif ($to eq 'nfvm') {
581 $target->{type} = 'bport';
582 $target->{bridge} = 'vmbr0';
583 $target->{iface} = 'tapXYZ';
584 } elsif ($to =~ m/^ct(\d+)$/) {
09e11ad4 585 return 'SKIPPED' if !$have_lxc;
63e8c70e 586 my $vmid = $1;
e038c485
DM
587 $target = extract_ct_info($vmdata, $vmid, 0);
588 $target->{iface} = $target->{tapdev};
63e8c70e 589 } elsif ($to =~ m/^vm(\d+)$/) {
09e11ad4 590 return 'SKIPPED' if !$have_qemu_server;
63e8c70e 591 my $vmid = $1;
b625713b 592 $target = extract_vm_info($vmdata, $vmid, 0);
63e8c70e
DM
593 $target->{iface} = $target->{tapdev};
594 } else {
595 die "unable to parse \"to => '$to'\"\n";
596 }
597
598 $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
599 $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
600
75a12a9d 601 my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
63e8c70e
DM
602 $from_info, $target, $start_state);
603
604 add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
75a12a9d 605
814de832
DM
606 return $res if $action eq 'QUERY';
607
63e8c70e
DM
608 die "test failed ($res != $action)\n" if $action ne $res;
609
75a12a9d 610 return undef;
63e8c70e
DM
611}
612
6131;
614