buildsys: make job safety
[pve-firewall.git] / src / PVE / FirewallSimulator.pm
CommitLineData
63e8c70e
DM
1package PVE::FirewallSimulator;
2
3use strict;
4use warnings;
5use Data::Dumper;
6use PVE::Firewall;
7use File::Basename;
8use Net::IP;
e038c485
DM
9use PVE::LXC;
10use PVE::QemuServer;
63e8c70e
DM
11
12my $mark;
13my $trace;
14my $debug = 0;
15
fe3d79b4
WB
16my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
17
63e8c70e
DM
18sub debug {
19 my $new_value = shift;
20
21 $debug = $new_value if defined($new_value);
22
23 return $debug;
24}
25
26sub reset_trace {
27 $trace = '';
28}
29
30sub get_trace {
31 return $trace;
32}
33
34sub add_trace {
35 my ($text) = @_;
36
37 if ($debug) {
38 print $text;
39 } else {
40 $trace .= $text;
41 }
42}
43
49124851
DM
44$SIG{'__WARN__'} = sub {
45 my $err = $@;
46 my $t = $_[0];
47 chomp $t;
48 add_trace("$t\n");
49 $@ = $err;
50};
51
63e8c70e
DM
52sub nf_dev_match {
53 my ($devre, $dev) = @_;
54
55 $devre =~ s/\+$/\.\*/;
56 return ($dev =~ m/^${devre}$/) ? 1 : 0;
57}
58
59sub ipset_match {
ca1a5a39
DM
60 my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
61
62 my $ipset = $ipset_ruleset->{$ipsetname};
63 die "no such ipset '$ipsetname'" if !$ipset;
63e8c70e
DM
64
65 my $ip = Net::IP->new($ipaddr);
66
ca1a5a39
DM
67 my $first = $ipset->[0];
68 if ($first =~ m/^create\s+\S+\s+list:/) {
69 foreach my $entry (@$ipset) {
70 next if $entry =~ m/^create/; # simply ignore
71 if ($entry =~ m/add \S+ (\S+)$/) {
72 return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
73 } else {
74 die "implement me";
75 }
76 }
77 return 0;
78 } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
79 foreach my $entry (@$ipset) {
80 next if $entry =~ m/^create/; # simply ignore
81 if ($entry =~ m/add \S+ (\S+)$/) {
82 my $test = Net::IP->new($1);
83 if ($test->overlaps($ip)) {
84 add_trace("IPSET $ipsetname match $ipaddr\n");
85 return 1;
86 }
87 } else {
88 die "implement me";
63e8c70e 89 }
63e8c70e 90 }
ca1a5a39
DM
91 return 0;
92 } else {
93 die "unknown ipset type '$first' - not implemented\n";
63e8c70e
DM
94 }
95
96 return 0;
97}
98
99sub rule_match {
100 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
101
102 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
103
104 while (length($rule)) {
105
106 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
107 my $cstate = $1;
108
109 return undef if $cstate eq 'INVALID'; # no match
110 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
111
112 next if $cstate =~ m/NEW/;
113
e76a9f53 114 die "cstate test '$cstate' not implemented\n";
63e8c70e
DM
115 }
116
117 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
118 my $atype = $1;
e76a9f53
DM
119 die "missing source address type (srctype)\n"
120 if !$pkg->{srctype};
63e8c70e
DM
121 return undef if $atype ne $pkg->{srctype};
122 }
123
124 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
125 my $atype = $1;
e76a9f53
DM
126 die "missing destination address type (dsttype)\n"
127 if !$pkg->{dsttype};
63e8c70e
DM
128 return undef if $atype ne $pkg->{dsttype};
129 }
130
131 if ($rule =~ s/^-i (\S+)\s*//) {
132 my $devre = $1;
e76a9f53 133 die "missing interface (iface_in)\n" if !$pkg->{iface_in};
63e8c70e
DM
134 return undef if !nf_dev_match($devre, $pkg->{iface_in});
135 next;
136 }
137
138 if ($rule =~ s/^-o (\S+)\s*//) {
139 my $devre = $1;
e76a9f53 140 die "missing interface (iface_out)\n" if !$pkg->{iface_out};
63e8c70e
DM
141 return undef if !nf_dev_match($devre, $pkg->{iface_out});
142 next;
143 }
144
cc8dc02f 145 if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
63e8c70e
DM
146 die "missing proto" if !$pkg->{proto};
147 return undef if $pkg->{proto} ne $1; # no match
148 next;
149 }
150
151 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
152 die "missing dport" if !$pkg->{dport};
153 return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
154 next;
155 }
156
157 if ($rule =~ s/^--dport (\d+)\s*//) {
158 die "missing dport" if !$pkg->{dport};
159 return undef if $pkg->{dport} != $1; # no match
160 next;
161 }
162
163 if ($rule =~ s/^-s (\S+)\s*//) {
164 die "missing source" if !$pkg->{source};
165 my $ip = Net::IP->new($1);
166 return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
167 next;
168 }
169
170 if ($rule =~ s/^-d (\S+)\s*//) {
171 die "missing destination" if !$pkg->{dest};
172 my $ip = Net::IP->new($1);
173 return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
174 next;
175 }
176
b625713b 177 if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
63e8c70e 178 die "missing source" if !$pkg->{source};
b625713b 179 my $neg = $1;
ca1a5a39 180 my $ipset_name = $2;
b625713b 181 if ($neg) {
ca1a5a39 182 return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
b625713b 183 } else {
ca1a5a39 184 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
b625713b 185 }
63e8c70e
DM
186 next;
187 }
188
189 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
190 die "missing destination" if !$pkg->{dest};
ca1a5a39
DM
191 my $ipset_name = $1;
192 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
63e8c70e
DM
193 next;
194 }
195
196 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
197 die "missing source mac" if !$pkg->{mac_source};
198 return undef if $pkg->{mac_source} eq $1; # no match
199 next;
200 }
201
202 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
203 my $devre = $1;
204 return undef if !$pkg->{physdev_in};
205 return undef if !nf_dev_match($devre, $pkg->{physdev_in});
206 next;
207 }
208
209 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
210 my $devre = $1;
211 return undef if !$pkg->{physdev_out};
212 return undef if !nf_dev_match($devre, $pkg->{physdev_out});
213 next;
214 }
215
fe3d79b4
WB
216 if ($rule =~ s@^-m mark --mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*@@) {
217 my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
218 return undef if !defined($mark) || ($mark & $mask) != $value;
63e8c70e
DM
219 next;
220 }
221
222 # final actions
223
fe3d79b4
WB
224 if ($rule =~ s@^-j MARK --set-mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*$@@) {
225 my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
226 $mark = ($mark & ~$mask) | $value;
63e8c70e
DM
227 return undef;
228 }
229
230 if ($rule =~ s/^-j (\S+)\s*$//) {
231 return (0, $1);
232 }
233
234 if ($rule =~ s/^-g (\S+)\s*$//) {
235 return (1, $1);
236 }
237
238 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
239 return undef;
240 }
241
242 last;
243 }
244
245 die "unable to parse rule: $rule";
246}
247
248sub ruleset_simulate_chain {
249 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
250
251 add_trace("ENTER chain $chain\n");
252
253 my $counter = 0;
254
255 if ($chain eq 'PVEFW-Drop') {
256 add_trace("LEAVE chain $chain\n");
257 return ('DROP', $counter);
258 }
259 if ($chain eq 'PVEFW-reject') {
260 add_trace("LEAVE chain $chain\n");
261 return ('REJECT', $counter);
262 }
263
264 if ($chain eq 'PVEFW-tcpflags') {
265 add_trace("LEAVE chain $chain\n");
266 return (undef, $counter);
267 }
268
269 my $rules = $ruleset->{$chain} ||
270 die "no such chain '$chain'";
271
272 foreach my $rule (@$rules) {
273 $counter++;
274 my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
275 if (!defined($action)) {
276 add_trace("SKIP: $rule\n");
277 next;
278 }
279 add_trace("MATCH: $rule\n");
280
281 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
282 add_trace("TERMINATE chain $chain: $action\n");
283 return ($action, $counter);
284 } elsif ($action eq 'RETURN') {
285 add_trace("RETURN FROM chain $chain\n");
286 last;
287 } else {
288 if ($goto) {
289 add_trace("LEAVE chain $chain - goto $action\n");
290 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
291 #$chain = $action;
292 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
293 } else {
294 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
295 $counter += $ctr;
296 return ($act, $counter) if $act;
297 add_trace("CONTINUE chain $chain\n");
298 }
299 }
300 }
301
302 add_trace("LEAVE chain $chain\n");
303 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
304 return ('ACCEPT', $counter); # default policy
305 }
306
307 return (undef, $counter);
308}
309
310sub copy_packet {
311 my ($pkg) = @_;
312
313 my $res = {};
314
315 while (my ($k,$v) = each %$pkg) {
316 $res->{$k} = $v;
317 }
318
319 return $res;
320}
321
322# Try to simulate packet traversal inside kernel. This invokes iptable
323# checks several times.
324sub route_packet {
325 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
326
ca1a5a39
DM
327 $pkg->{ipversion} = 4; # fixme: allow ipv6
328
63e8c70e
DM
329 my $route_state = $start_state;
330
331 my $physdev_in;
332
333 my $ipt_invocation_counter = 0;
334 my $rule_check_counter = 0;
335
336 while ($route_state ne $target->{iface}) {
337
338 my $chain;
339 my $next_route_state;
340 my $next_physdev_in;
341
342 $pkg->{iface_in} = $pkg->{iface_out} = undef;
343 $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
344
345 if ($route_state eq 'from-bport') {
346 $next_route_state = $from_info->{bridge} || die 'internal error';
347 $next_physdev_in = $from_info->{iface} || die 'internal error';
348 } elsif ($route_state eq 'host') {
349
350 if ($target->{type} eq 'bport') {
351 $pkg->{iface_in} = 'lo';
352 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
353 $chain = 'PVEFW-OUTPUT';
354 $next_route_state = $target->{iface} || die 'internal error';
e038c485 355 } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
63e8c70e
DM
356 $pkg->{iface_in} = 'lo';
357 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
358 $chain = 'PVEFW-OUTPUT';
359 $next_route_state = 'fwbr-in';
360 } else {
361 die "implement me";
362 }
363
63e8c70e
DM
364 } elsif ($route_state eq 'fwbr-out') {
365
366 $chain = 'PVEFW-FORWARD';
367 $next_route_state = $from_info->{bridge} || die 'internal error';
368 $next_physdev_in = $from_info->{fwpr} || die 'internal error';
369 $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
370 $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
371 $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
372 $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
373
374 } elsif ($route_state eq 'fwbr-in') {
375
376 $chain = 'PVEFW-FORWARD';
377 $next_route_state = $target->{tapdev};
378 $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
379 $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
380 $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
381 $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
382
383 } elsif ($route_state =~ m/^vmbr\d+$/) {
384
385 die "missing physdev_in - internal error?" if !$physdev_in;
386 $pkg->{physdev_in} = $physdev_in;
387
388 if ($target->{type} eq 'host') {
389
390 $chain = 'PVEFW-INPUT';
391 $pkg->{iface_in} = $route_state;
392 $pkg->{iface_out} = 'lo';
393 $next_route_state = 'host';
394
395 } elsif ($target->{type} eq 'bport') {
396
397 $chain = 'PVEFW-FORWARD';
398 $pkg->{iface_in} = $route_state;
399 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
400 # conditionally set physdev_out (same behavior as kernel)
401 if ($route_state eq $target->{bridge}) {
402 $pkg->{physdev_out} = $target->{iface} || die 'internal error';
403 }
404 $next_route_state = $target->{iface};
405
e038c485 406 } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
63e8c70e
DM
407
408 $chain = 'PVEFW-FORWARD';
409 $pkg->{iface_in} = $route_state;
410 $pkg->{iface_out} = $target->{bridge};
411 # conditionally set physdev_out (same behavior as kernel)
412 if ($route_state eq $target->{bridge}) {
413 $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
414 }
415 $next_route_state = 'fwbr-in';
416
417 } else {
418 die "implement me";
419 }
420
421 } else {
422 die "implement me $route_state";
423 }
424
425 die "internal error" if !defined($next_route_state);
426
427 if ($chain) {
428 add_trace("IPT check at $route_state (chain $chain)\n");
429 add_trace(Dumper($pkg));
430 $ipt_invocation_counter++;
431 my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
432 $rule_check_counter += $ctr;
433 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
434 }
435
436 $route_state = $next_route_state;
437
438 $physdev_in = $next_physdev_in;
439 }
440
441 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
442}
443
444sub extract_ct_info {
e038c485 445 my ($vmdata, $vmid, $netnum) = @_;
63e8c70e
DM
446
447 my $info = { type => 'ct', vmid => $vmid };
448
e038c485 449 my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
a7c85d56 450 my $net = PVE::LXC::Config->parse_lxc_network($conf->{"net$netnum"});
e038c485
DM
451 $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
452 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
453 $info->{fwbr} = "fwbr${vmid}i$netnum";
454 $info->{tapdev} = "veth${vmid}i$netnum";
455 $info->{fwln} = "fwln${vmid}i$netnum";
456 $info->{fwpr} = "fwpr${vmid}p$netnum";
457 $info->{ip_address} = $net->{ip} || die "unable to get ip address";
458
63e8c70e
DM
459 return $info;
460}
461
462sub extract_vm_info {
b625713b 463 my ($vmdata, $vmid, $netnum) = @_;
63e8c70e
DM
464
465 my $info = { type => 'vm', vmid => $vmid };
466
467 my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
b625713b 468 my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
63e8c70e
DM
469 $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
470 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
b625713b
DM
471 $info->{fwbr} = "fwbr${vmid}i$netnum";
472 $info->{tapdev} = "tap${vmid}i$netnum";
473 $info->{fwln} = "fwln${vmid}i$netnum";
474 $info->{fwpr} = "fwpr${vmid}p$netnum";
63e8c70e
DM
475
476 return $info;
477}
478
479sub simulate_firewall {
480 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
481
482 my $from = $test->{from} || die "missing 'from' field";
483 my $to = $test->{to} || die "missing 'to' field";
484 my $action = $test->{action} || die "missing 'action'";
485
486 my $testid = $test->{id};
487
488 die "from/to needs to be different" if $from eq $to;
489
490 my $pkg = {
491 proto => 'tcp',
492 sport => undef,
493 dport => undef,
494 source => undef,
495 dest => undef,
496 srctype => 'UNICAST',
497 dsttype => 'UNICAST',
498 };
499
500 while (my ($k,$v) = each %$test) {
501 next if $k eq 'from';
502 next if $k eq 'to';
503 next if $k eq 'action';
504 next if $k eq 'id';
505 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
506 $pkg->{$k} = $v;
507 }
508
509 my $from_info = {};
510
511 my $start_state;
512
513 if ($from eq 'host') {
514 $from_info->{type} = 'host';
515 $start_state = 'host';
516 $pkg->{source} = $host_ip if !defined($pkg->{source});
517 } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
518 $from_info->{type} = 'bport';
519 $from_info->{bridge} = $1;
520 $from_info->{iface} = $2;
521 $start_state = 'from-bport';
522 } elsif ($from eq 'outside') {
523 $from_info->{type} = 'bport';
524 $from_info->{bridge} = 'vmbr0';
525 $from_info->{iface} = 'eth0';
526 $start_state = 'from-bport';
527 } elsif ($from eq 'nfvm') {
528 $from_info->{type} = 'bport';
529 $from_info->{bridge} = 'vmbr0';
530 $from_info->{iface} = 'tapXYZ';
531 $start_state = 'from-bport';
532 } elsif ($from =~ m/^ct(\d+)$/) {
533 my $vmid = $1;
e038c485
DM
534 $from_info = extract_ct_info($vmdata, $vmid, 0);
535 $start_state = 'fwbr-out';
536 $pkg->{mac_source} = $from_info->{macaddr};
b625713b 537 } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
63e8c70e 538 my $vmid = $1;
b625713b
DM
539 my $netnum = $3 || 0;
540 $from_info = extract_vm_info($vmdata, $vmid, $netnum);
63e8c70e
DM
541 $start_state = 'fwbr-out';
542 $pkg->{mac_source} = $from_info->{macaddr};
543 } else {
544 die "unable to parse \"from => '$from'\"\n";
545 }
546
547 my $target;
548
549 if ($to eq 'host') {
550 $target->{type} = 'host';
551 $target->{iface} = 'host';
552 $pkg->{dest} = $host_ip if !defined($pkg->{dest});
553 } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
554 $target->{type} = 'bport';
555 $target->{bridge} = $1;
556 $target->{iface} = $2;
557 } elsif ($to eq 'outside') {
558 $target->{type} = 'bport';
559 $target->{bridge} = 'vmbr0';
560 $target->{iface} = 'eth0';
561 } elsif ($to eq 'nfvm') {
562 $target->{type} = 'bport';
563 $target->{bridge} = 'vmbr0';
564 $target->{iface} = 'tapXYZ';
565 } elsif ($to =~ m/^ct(\d+)$/) {
566 my $vmid = $1;
e038c485
DM
567 $target = extract_ct_info($vmdata, $vmid, 0);
568 $target->{iface} = $target->{tapdev};
63e8c70e
DM
569 } elsif ($to =~ m/^vm(\d+)$/) {
570 my $vmid = $1;
b625713b 571 $target = extract_vm_info($vmdata, $vmid, 0);
63e8c70e
DM
572 $target->{iface} = $target->{tapdev};
573 } else {
574 die "unable to parse \"to => '$to'\"\n";
575 }
576
577 $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
578 $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
579
580 my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
581 $from_info, $target, $start_state);
582
583 add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
584
814de832
DM
585 return $res if $action eq 'QUERY';
586
63e8c70e
DM
587 die "test failed ($res != $action)\n" if $action ne $res;
588
589 return undef;
590}
591
5921;
593