bump version to 4.0-9
[pve-firewall.git] / src / PVE / FirewallSimulator.pm
CommitLineData
63e8c70e
DM
1package PVE::FirewallSimulator;
2
3use strict;
4use warnings;
5use Data::Dumper;
6use PVE::Firewall;
7use File::Basename;
8use Net::IP;
09e11ad4
WB
9
10# dynamically include PVE::QemuServer and PVE::LXC
11# to avoid dependency problems
12my $have_qemu_server;
13eval {
14 require PVE::QemuServer;
15 $have_qemu_server = 1;
16};
17
18my $have_lxc;
19eval {
20 require PVE::LXC;
21 $have_lxc = 1;
22};
63e8c70e 23
45c8eeb8 24my $mark = 0;
63e8c70e
DM
25my $trace;
26my $debug = 0;
27
fe3d79b4
WB
28my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
29
63e8c70e
DM
30sub debug {
31 my $new_value = shift;
32
33 $debug = $new_value if defined($new_value);
34
35 return $debug;
36}
37
38sub reset_trace {
39 $trace = '';
40}
41
42sub get_trace {
43 return $trace;
44}
45
46sub add_trace {
47 my ($text) = @_;
48
49 if ($debug) {
50 print $text;
51 } else {
52 $trace .= $text;
53 }
54}
55
49124851
DM
56$SIG{'__WARN__'} = sub {
57 my $err = $@;
58 my $t = $_[0];
59 chomp $t;
60 add_trace("$t\n");
61 $@ = $err;
62};
63
63e8c70e
DM
64sub nf_dev_match {
65 my ($devre, $dev) = @_;
66
67 $devre =~ s/\+$/\.\*/;
68 return ($dev =~ m/^${devre}$/) ? 1 : 0;
69}
70
71sub ipset_match {
ca1a5a39
DM
72 my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
73
74 my $ipset = $ipset_ruleset->{$ipsetname};
75 die "no such ipset '$ipsetname'" if !$ipset;
63e8c70e
DM
76
77 my $ip = Net::IP->new($ipaddr);
78
ca1a5a39
DM
79 my $first = $ipset->[0];
80 if ($first =~ m/^create\s+\S+\s+list:/) {
81 foreach my $entry (@$ipset) {
82 next if $entry =~ m/^create/; # simply ignore
83 if ($entry =~ m/add \S+ (\S+)$/) {
84 return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
85 } else {
86 die "implement me";
87 }
88 }
89 return 0;
90 } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
91 foreach my $entry (@$ipset) {
92 next if $entry =~ m/^create/; # simply ignore
93 if ($entry =~ m/add \S+ (\S+)$/) {
94 my $test = Net::IP->new($1);
95 if ($test->overlaps($ip)) {
96 add_trace("IPSET $ipsetname match $ipaddr\n");
97 return 1;
98 }
99 } else {
100 die "implement me";
63e8c70e 101 }
63e8c70e 102 }
ca1a5a39
DM
103 return 0;
104 } else {
105 die "unknown ipset type '$first' - not implemented\n";
63e8c70e
DM
106 }
107
108 return 0;
109}
110
111sub rule_match {
112 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
113
1e9c5070 114 $rule =~ s/^-A $chain +// || die "got strange rule: $rule";
63e8c70e
DM
115
116 while (length($rule)) {
117
118 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
119 my $cstate = $1;
120
121 return undef if $cstate eq 'INVALID'; # no match
122 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
123
124 next if $cstate =~ m/NEW/;
125
e76a9f53 126 die "cstate test '$cstate' not implemented\n";
63e8c70e
DM
127 }
128
129 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
130 my $atype = $1;
e76a9f53
DM
131 die "missing source address type (srctype)\n"
132 if !$pkg->{srctype};
63e8c70e
DM
133 return undef if $atype ne $pkg->{srctype};
134 }
135
136 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
137 my $atype = $1;
e76a9f53
DM
138 die "missing destination address type (dsttype)\n"
139 if !$pkg->{dsttype};
63e8c70e
DM
140 return undef if $atype ne $pkg->{dsttype};
141 }
142
143 if ($rule =~ s/^-i (\S+)\s*//) {
144 my $devre = $1;
e76a9f53 145 die "missing interface (iface_in)\n" if !$pkg->{iface_in};
63e8c70e
DM
146 return undef if !nf_dev_match($devre, $pkg->{iface_in});
147 next;
148 }
149
150 if ($rule =~ s/^-o (\S+)\s*//) {
151 my $devre = $1;
e76a9f53 152 die "missing interface (iface_out)\n" if !$pkg->{iface_out};
63e8c70e
DM
153 return undef if !nf_dev_match($devre, $pkg->{iface_out});
154 next;
155 }
156
cc8dc02f 157 if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
63e8c70e
DM
158 die "missing proto" if !$pkg->{proto};
159 return undef if $pkg->{proto} ne $1; # no match
160 next;
161 }
162
163 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
164 die "missing dport" if !$pkg->{dport};
165 return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
166 next;
167 }
168
169 if ($rule =~ s/^--dport (\d+)\s*//) {
170 die "missing dport" if !$pkg->{dport};
171 return undef if $pkg->{dport} != $1; # no match
172 next;
173 }
174
175 if ($rule =~ s/^-s (\S+)\s*//) {
176 die "missing source" if !$pkg->{source};
177 my $ip = Net::IP->new($1);
178 return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
179 next;
180 }
181
182 if ($rule =~ s/^-d (\S+)\s*//) {
183 die "missing destination" if !$pkg->{dest};
184 my $ip = Net::IP->new($1);
185 return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
186 next;
187 }
188
b625713b 189 if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
63e8c70e 190 die "missing source" if !$pkg->{source};
b625713b 191 my $neg = $1;
ca1a5a39 192 my $ipset_name = $2;
b625713b 193 if ($neg) {
ca1a5a39 194 return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
b625713b 195 } else {
ca1a5a39 196 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
b625713b 197 }
63e8c70e
DM
198 next;
199 }
200
201 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
202 die "missing destination" if !$pkg->{dest};
ca1a5a39
DM
203 my $ipset_name = $1;
204 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
63e8c70e
DM
205 next;
206 }
207
208 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
209 die "missing source mac" if !$pkg->{mac_source};
210 return undef if $pkg->{mac_source} eq $1; # no match
211 next;
212 }
213
214 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
215 my $devre = $1;
216 return undef if !$pkg->{physdev_in};
217 return undef if !nf_dev_match($devre, $pkg->{physdev_in});
218 next;
219 }
220
221 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
222 my $devre = $1;
223 return undef if !$pkg->{physdev_out};
224 return undef if !nf_dev_match($devre, $pkg->{physdev_out});
225 next;
226 }
227
fe3d79b4
WB
228 if ($rule =~ s@^-m mark --mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*@@) {
229 my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
45c8eeb8 230 return undef if ($mark & $mask) != $value;
63e8c70e
DM
231 next;
232 }
233
234 # final actions
235
fe3d79b4
WB
236 if ($rule =~ s@^-j MARK --set-mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*$@@) {
237 my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
238 $mark = ($mark & ~$mask) | $value;
63e8c70e
DM
239 return undef;
240 }
241
242 if ($rule =~ s/^-j (\S+)\s*$//) {
243 return (0, $1);
244 }
245
246 if ($rule =~ s/^-g (\S+)\s*$//) {
247 return (1, $1);
248 }
249
250 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
251 return undef;
252 }
253
254 last;
255 }
256
257 die "unable to parse rule: $rule";
258}
259
260sub ruleset_simulate_chain {
261 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
262
263 add_trace("ENTER chain $chain\n");
264
265 my $counter = 0;
266
267 if ($chain eq 'PVEFW-Drop') {
268 add_trace("LEAVE chain $chain\n");
269 return ('DROP', $counter);
270 }
271 if ($chain eq 'PVEFW-reject') {
272 add_trace("LEAVE chain $chain\n");
273 return ('REJECT', $counter);
274 }
275
276 if ($chain eq 'PVEFW-tcpflags') {
277 add_trace("LEAVE chain $chain\n");
278 return (undef, $counter);
279 }
280
281 my $rules = $ruleset->{$chain} ||
282 die "no such chain '$chain'";
283
284 foreach my $rule (@$rules) {
285 $counter++;
286 my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
287 if (!defined($action)) {
288 add_trace("SKIP: $rule\n");
289 next;
290 }
291 add_trace("MATCH: $rule\n");
292
293 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
294 add_trace("TERMINATE chain $chain: $action\n");
295 return ($action, $counter);
296 } elsif ($action eq 'RETURN') {
297 add_trace("RETURN FROM chain $chain\n");
298 last;
299 } else {
300 if ($goto) {
301 add_trace("LEAVE chain $chain - goto $action\n");
302 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
303 #$chain = $action;
304 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
305 } else {
306 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
307 $counter += $ctr;
308 return ($act, $counter) if $act;
309 add_trace("CONTINUE chain $chain\n");
310 }
311 }
312 }
313
314 add_trace("LEAVE chain $chain\n");
315 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
316 return ('ACCEPT', $counter); # default policy
317 }
318
319 return (undef, $counter);
320}
321
322sub copy_packet {
323 my ($pkg) = @_;
324
325 my $res = {};
326
327 while (my ($k,$v) = each %$pkg) {
328 $res->{$k} = $v;
329 }
330
331 return $res;
332}
333
334# Try to simulate packet traversal inside kernel. This invokes iptable
335# checks several times.
336sub route_packet {
337 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
338
ca1a5a39
DM
339 $pkg->{ipversion} = 4; # fixme: allow ipv6
340
63e8c70e
DM
341 my $route_state = $start_state;
342
343 my $physdev_in;
344
345 my $ipt_invocation_counter = 0;
346 my $rule_check_counter = 0;
347
348 while ($route_state ne $target->{iface}) {
349
350 my $chain;
351 my $next_route_state;
352 my $next_physdev_in;
353
354 $pkg->{iface_in} = $pkg->{iface_out} = undef;
355 $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
356
357 if ($route_state eq 'from-bport') {
358 $next_route_state = $from_info->{bridge} || die 'internal error';
359 $next_physdev_in = $from_info->{iface} || die 'internal error';
360 } elsif ($route_state eq 'host') {
361
362 if ($target->{type} eq 'bport') {
363 $pkg->{iface_in} = 'lo';
364 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
365 $chain = 'PVEFW-OUTPUT';
366 $next_route_state = $target->{iface} || die 'internal error';
e038c485 367 } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
63e8c70e
DM
368 $pkg->{iface_in} = 'lo';
369 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
370 $chain = 'PVEFW-OUTPUT';
371 $next_route_state = 'fwbr-in';
372 } else {
373 die "implement me";
374 }
375
63e8c70e
DM
376 } elsif ($route_state eq 'fwbr-out') {
377
378 $chain = 'PVEFW-FORWARD';
379 $next_route_state = $from_info->{bridge} || die 'internal error';
380 $next_physdev_in = $from_info->{fwpr} || die 'internal error';
381 $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
382 $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
383 $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
384 $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
385
386 } elsif ($route_state eq 'fwbr-in') {
387
388 $chain = 'PVEFW-FORWARD';
389 $next_route_state = $target->{tapdev};
390 $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
391 $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
392 $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
393 $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
394
395 } elsif ($route_state =~ m/^vmbr\d+$/) {
396
397 die "missing physdev_in - internal error?" if !$physdev_in;
398 $pkg->{physdev_in} = $physdev_in;
399
400 if ($target->{type} eq 'host') {
401
402 $chain = 'PVEFW-INPUT';
403 $pkg->{iface_in} = $route_state;
404 $pkg->{iface_out} = 'lo';
405 $next_route_state = 'host';
406
407 } elsif ($target->{type} eq 'bport') {
408
409 $chain = 'PVEFW-FORWARD';
410 $pkg->{iface_in} = $route_state;
411 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
412 # conditionally set physdev_out (same behavior as kernel)
413 if ($route_state eq $target->{bridge}) {
414 $pkg->{physdev_out} = $target->{iface} || die 'internal error';
415 }
416 $next_route_state = $target->{iface};
417
e038c485 418 } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
63e8c70e
DM
419
420 $chain = 'PVEFW-FORWARD';
421 $pkg->{iface_in} = $route_state;
422 $pkg->{iface_out} = $target->{bridge};
423 # conditionally set physdev_out (same behavior as kernel)
424 if ($route_state eq $target->{bridge}) {
425 $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
426 }
427 $next_route_state = 'fwbr-in';
428
429 } else {
430 die "implement me";
431 }
432
433 } else {
434 die "implement me $route_state";
435 }
436
437 die "internal error" if !defined($next_route_state);
438
439 if ($chain) {
440 add_trace("IPT check at $route_state (chain $chain)\n");
441 add_trace(Dumper($pkg));
442 $ipt_invocation_counter++;
443 my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
444 $rule_check_counter += $ctr;
445 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
446 }
447
448 $route_state = $next_route_state;
449
450 $physdev_in = $next_physdev_in;
451 }
452
453 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
454}
455
456sub extract_ct_info {
e038c485 457 my ($vmdata, $vmid, $netnum) = @_;
63e8c70e
DM
458
459 my $info = { type => 'ct', vmid => $vmid };
460
e038c485 461 my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
a7c85d56 462 my $net = PVE::LXC::Config->parse_lxc_network($conf->{"net$netnum"});
e038c485
DM
463 $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
464 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
465 $info->{fwbr} = "fwbr${vmid}i$netnum";
466 $info->{tapdev} = "veth${vmid}i$netnum";
467 $info->{fwln} = "fwln${vmid}i$netnum";
468 $info->{fwpr} = "fwpr${vmid}p$netnum";
469 $info->{ip_address} = $net->{ip} || die "unable to get ip address";
470
63e8c70e
DM
471 return $info;
472}
473
474sub extract_vm_info {
b625713b 475 my ($vmdata, $vmid, $netnum) = @_;
63e8c70e
DM
476
477 my $info = { type => 'vm', vmid => $vmid };
478
479 my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
b625713b 480 my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
63e8c70e
DM
481 $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
482 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
b625713b
DM
483 $info->{fwbr} = "fwbr${vmid}i$netnum";
484 $info->{tapdev} = "tap${vmid}i$netnum";
485 $info->{fwln} = "fwln${vmid}i$netnum";
486 $info->{fwpr} = "fwpr${vmid}p$netnum";
63e8c70e
DM
487
488 return $info;
489}
490
491sub simulate_firewall {
492 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
493
494 my $from = $test->{from} || die "missing 'from' field";
495 my $to = $test->{to} || die "missing 'to' field";
496 my $action = $test->{action} || die "missing 'action'";
497
498 my $testid = $test->{id};
499
500 die "from/to needs to be different" if $from eq $to;
501
502 my $pkg = {
503 proto => 'tcp',
504 sport => undef,
505 dport => undef,
506 source => undef,
507 dest => undef,
508 srctype => 'UNICAST',
509 dsttype => 'UNICAST',
510 };
511
512 while (my ($k,$v) = each %$test) {
513 next if $k eq 'from';
514 next if $k eq 'to';
515 next if $k eq 'action';
516 next if $k eq 'id';
517 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
518 $pkg->{$k} = $v;
519 }
520
521 my $from_info = {};
522
523 my $start_state;
524
525 if ($from eq 'host') {
526 $from_info->{type} = 'host';
527 $start_state = 'host';
528 $pkg->{source} = $host_ip if !defined($pkg->{source});
529 } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
530 $from_info->{type} = 'bport';
531 $from_info->{bridge} = $1;
532 $from_info->{iface} = $2;
533 $start_state = 'from-bport';
534 } elsif ($from eq 'outside') {
535 $from_info->{type} = 'bport';
536 $from_info->{bridge} = 'vmbr0';
537 $from_info->{iface} = 'eth0';
538 $start_state = 'from-bport';
539 } elsif ($from eq 'nfvm') {
540 $from_info->{type} = 'bport';
541 $from_info->{bridge} = 'vmbr0';
542 $from_info->{iface} = 'tapXYZ';
543 $start_state = 'from-bport';
544 } elsif ($from =~ m/^ct(\d+)$/) {
09e11ad4 545 return 'SKIPPED' if !$have_lxc;
63e8c70e 546 my $vmid = $1;
e038c485
DM
547 $from_info = extract_ct_info($vmdata, $vmid, 0);
548 $start_state = 'fwbr-out';
549 $pkg->{mac_source} = $from_info->{macaddr};
b625713b 550 } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
09e11ad4 551 return 'SKIPPED' if !$have_qemu_server;
63e8c70e 552 my $vmid = $1;
b625713b
DM
553 my $netnum = $3 || 0;
554 $from_info = extract_vm_info($vmdata, $vmid, $netnum);
63e8c70e
DM
555 $start_state = 'fwbr-out';
556 $pkg->{mac_source} = $from_info->{macaddr};
557 } else {
558 die "unable to parse \"from => '$from'\"\n";
559 }
560
561 my $target;
562
563 if ($to eq 'host') {
564 $target->{type} = 'host';
565 $target->{iface} = 'host';
566 $pkg->{dest} = $host_ip if !defined($pkg->{dest});
567 } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
568 $target->{type} = 'bport';
569 $target->{bridge} = $1;
570 $target->{iface} = $2;
571 } elsif ($to eq 'outside') {
572 $target->{type} = 'bport';
573 $target->{bridge} = 'vmbr0';
574 $target->{iface} = 'eth0';
575 } elsif ($to eq 'nfvm') {
576 $target->{type} = 'bport';
577 $target->{bridge} = 'vmbr0';
578 $target->{iface} = 'tapXYZ';
579 } elsif ($to =~ m/^ct(\d+)$/) {
09e11ad4 580 return 'SKIPPED' if !$have_lxc;
63e8c70e 581 my $vmid = $1;
e038c485
DM
582 $target = extract_ct_info($vmdata, $vmid, 0);
583 $target->{iface} = $target->{tapdev};
63e8c70e 584 } elsif ($to =~ m/^vm(\d+)$/) {
09e11ad4 585 return 'SKIPPED' if !$have_qemu_server;
63e8c70e 586 my $vmid = $1;
b625713b 587 $target = extract_vm_info($vmdata, $vmid, 0);
63e8c70e
DM
588 $target->{iface} = $target->{tapdev};
589 } else {
590 die "unable to parse \"to => '$to'\"\n";
591 }
592
593 $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
594 $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
595
596 my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
597 $from_info, $target, $start_state);
598
599 add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
600
814de832
DM
601 return $res if $action eq 'QUERY';
602
63e8c70e
DM
603 die "test failed ($res != $action)\n" if $action ne $res;
604
605 return undef;
606}
607
6081;
609