move test code to FirewallSimulator.pm
[pve-firewall.git] / src / PVE / FirewallSimulator.pm
CommitLineData
63e8c70e
DM
1package PVE::FirewallSimulator;
2
3use strict;
4use warnings;
5use Data::Dumper;
6use PVE::Firewall;
7use File::Basename;
8use Net::IP;
9
10my $mark;
11my $trace;
12my $debug = 0;
13
14sub debug {
15 my $new_value = shift;
16
17 $debug = $new_value if defined($new_value);
18
19 return $debug;
20}
21
22sub reset_trace {
23 $trace = '';
24}
25
26sub get_trace {
27 return $trace;
28}
29
30sub add_trace {
31 my ($text) = @_;
32
33 if ($debug) {
34 print $text;
35 } else {
36 $trace .= $text;
37 }
38}
39
40sub nf_dev_match {
41 my ($devre, $dev) = @_;
42
43 $devre =~ s/\+$/\.\*/;
44 return ($dev =~ m/^${devre}$/) ? 1 : 0;
45}
46
47sub ipset_match {
48 my ($ipsetname, $ipset, $ipaddr) = @_;
49
50 my $ip = Net::IP->new($ipaddr);
51
52 foreach my $entry (@$ipset) {
53 next if $entry =~ m/^create/; # simply ignore
54 if ($entry =~ m/add \S+ (\S+)$/) {
55 my $test = Net::IP->new($1);
56 if ($test->overlaps($ip)) {
57 add_trace("IPSET $ipsetname match $ipaddr\n");
58 return 1;
59 }
60 } else {
61 die "implement me";
62 }
63 }
64
65 return 0;
66}
67
68sub rule_match {
69 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
70
71 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
72
73 while (length($rule)) {
74
75 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
76 my $cstate = $1;
77
78 return undef if $cstate eq 'INVALID'; # no match
79 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
80
81 next if $cstate =~ m/NEW/;
82
83 die "please implement cstate test '$cstate'";
84 }
85
86 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
87 my $atype = $1;
88 die "missing srctype" if !$pkg->{srctype};
89 return undef if $atype ne $pkg->{srctype};
90 }
91
92 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
93 my $atype = $1;
94 die "missing dsttype" if !$pkg->{dsttype};
95 return undef if $atype ne $pkg->{dsttype};
96 }
97
98 if ($rule =~ s/^-i (\S+)\s*//) {
99 my $devre = $1;
100 die "missing iface_in" if !$pkg->{iface_in};
101 return undef if !nf_dev_match($devre, $pkg->{iface_in});
102 next;
103 }
104
105 if ($rule =~ s/^-o (\S+)\s*//) {
106 my $devre = $1;
107 die "missing iface_out" if !$pkg->{iface_out};
108 return undef if !nf_dev_match($devre, $pkg->{iface_out});
109 next;
110 }
111
112 if ($rule =~ s/^-p (tcp|udp)\s*//) {
113 die "missing proto" if !$pkg->{proto};
114 return undef if $pkg->{proto} ne $1; # no match
115 next;
116 }
117
118 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
119 die "missing dport" if !$pkg->{dport};
120 return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
121 next;
122 }
123
124 if ($rule =~ s/^--dport (\d+)\s*//) {
125 die "missing dport" if !$pkg->{dport};
126 return undef if $pkg->{dport} != $1; # no match
127 next;
128 }
129
130 if ($rule =~ s/^-s (\S+)\s*//) {
131 die "missing source" if !$pkg->{source};
132 my $ip = Net::IP->new($1);
133 return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
134 next;
135 }
136
137 if ($rule =~ s/^-d (\S+)\s*//) {
138 die "missing destination" if !$pkg->{dest};
139 my $ip = Net::IP->new($1);
140 return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
141 next;
142 }
143
144 if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
145 die "missing source" if !$pkg->{source};
146 my $ipset = $ipset_ruleset->{$1};
147 die "no such ip set '$1'" if !$ipset;
148 return undef if !ipset_match($1, $ipset, $pkg->{source});
149 next;
150 }
151
152 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
153 die "missing destination" if !$pkg->{dest};
154 my $ipset = $ipset_ruleset->{$1};
155 die "no such ip set '$1'" if !$ipset;
156 return undef if !ipset_match($1, $ipset, $pkg->{dest});
157 next;
158 }
159
160 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
161 die "missing source mac" if !$pkg->{mac_source};
162 return undef if $pkg->{mac_source} eq $1; # no match
163 next;
164 }
165
166 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
167 my $devre = $1;
168 return undef if !$pkg->{physdev_in};
169 return undef if !nf_dev_match($devre, $pkg->{physdev_in});
170 next;
171 }
172
173 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
174 my $devre = $1;
175 return undef if !$pkg->{physdev_out};
176 return undef if !nf_dev_match($devre, $pkg->{physdev_out});
177 next;
178 }
179
180 if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
181 return undef if !defined($mark) || $mark != $1;
182 next;
183 }
184
185 # final actions
186
187 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
188 $mark = $1;
189 return undef;
190 }
191
192 if ($rule =~ s/^-j (\S+)\s*$//) {
193 return (0, $1);
194 }
195
196 if ($rule =~ s/^-g (\S+)\s*$//) {
197 return (1, $1);
198 }
199
200 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
201 return undef;
202 }
203
204 last;
205 }
206
207 die "unable to parse rule: $rule";
208}
209
210sub ruleset_simulate_chain {
211 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
212
213 add_trace("ENTER chain $chain\n");
214
215 my $counter = 0;
216
217 if ($chain eq 'PVEFW-Drop') {
218 add_trace("LEAVE chain $chain\n");
219 return ('DROP', $counter);
220 }
221 if ($chain eq 'PVEFW-reject') {
222 add_trace("LEAVE chain $chain\n");
223 return ('REJECT', $counter);
224 }
225
226 if ($chain eq 'PVEFW-tcpflags') {
227 add_trace("LEAVE chain $chain\n");
228 return (undef, $counter);
229 }
230
231 my $rules = $ruleset->{$chain} ||
232 die "no such chain '$chain'";
233
234 foreach my $rule (@$rules) {
235 $counter++;
236 my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
237 if (!defined($action)) {
238 add_trace("SKIP: $rule\n");
239 next;
240 }
241 add_trace("MATCH: $rule\n");
242
243 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
244 add_trace("TERMINATE chain $chain: $action\n");
245 return ($action, $counter);
246 } elsif ($action eq 'RETURN') {
247 add_trace("RETURN FROM chain $chain\n");
248 last;
249 } else {
250 if ($goto) {
251 add_trace("LEAVE chain $chain - goto $action\n");
252 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
253 #$chain = $action;
254 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
255 } else {
256 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
257 $counter += $ctr;
258 return ($act, $counter) if $act;
259 add_trace("CONTINUE chain $chain\n");
260 }
261 }
262 }
263
264 add_trace("LEAVE chain $chain\n");
265 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
266 return ('ACCEPT', $counter); # default policy
267 }
268
269 return (undef, $counter);
270}
271
272sub copy_packet {
273 my ($pkg) = @_;
274
275 my $res = {};
276
277 while (my ($k,$v) = each %$pkg) {
278 $res->{$k} = $v;
279 }
280
281 return $res;
282}
283
284# Try to simulate packet traversal inside kernel. This invokes iptable
285# checks several times.
286sub route_packet {
287 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
288
289 my $route_state = $start_state;
290
291 my $physdev_in;
292
293 my $ipt_invocation_counter = 0;
294 my $rule_check_counter = 0;
295
296 while ($route_state ne $target->{iface}) {
297
298 my $chain;
299 my $next_route_state;
300 my $next_physdev_in;
301
302 $pkg->{iface_in} = $pkg->{iface_out} = undef;
303 $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
304
305 if ($route_state eq 'from-bport') {
306 $next_route_state = $from_info->{bridge} || die 'internal error';
307 $next_physdev_in = $from_info->{iface} || die 'internal error';
308 } elsif ($route_state eq 'host') {
309
310 if ($target->{type} eq 'bport') {
311 $pkg->{iface_in} = 'lo';
312 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
313 $chain = 'PVEFW-OUTPUT';
314 $next_route_state = $target->{iface} || die 'internal error';
315 } elsif ($target->{type} eq 'ct') {
316 $pkg->{iface_in} = 'lo';
317 $pkg->{iface_out} = 'venet0';
318 $chain = 'PVEFW-OUTPUT';
319 $next_route_state = 'venet-in';
320 } elsif ($target->{type} eq 'vm') {
321 $pkg->{iface_in} = 'lo';
322 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
323 $chain = 'PVEFW-OUTPUT';
324 $next_route_state = 'fwbr-in';
325 } else {
326 die "implement me";
327 }
328
329 } elsif ($route_state eq 'venet-out') {
330
331 if ($target->{type} eq 'host') {
332
333 $chain = 'PVEFW-INPUT';
334 $pkg->{iface_in} = 'venet0';
335 $pkg->{iface_out} = 'lo';
336 $next_route_state = 'host';
337
338 } elsif ($target->{type} eq 'bport') {
339
340 $chain = 'PVEFW-FORWARD';
341 $pkg->{iface_in} = 'venet0';
342 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
343 $next_route_state = $target->{iface} || die 'internal error';
344
345 } elsif ($target->{type} eq 'vm') {
346
347 $chain = 'PVEFW-FORWARD';
348 $pkg->{iface_in} = 'venet0';
349 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
350 $next_route_state = 'fwbr-in';
351
352 } elsif ($target->{type} eq 'ct') {
353
354 $chain = 'PVEFW-FORWARD';
355 $pkg->{iface_in} = 'venet0';
356 $pkg->{iface_out} = 'venet0';
357 $next_route_state = 'venet-in';
358
359 } else {
360 die "implement me";
361 }
362
363 } elsif ($route_state eq 'fwbr-out') {
364
365 $chain = 'PVEFW-FORWARD';
366 $next_route_state = $from_info->{bridge} || die 'internal error';
367 $next_physdev_in = $from_info->{fwpr} || die 'internal error';
368 $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
369 $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
370 $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
371 $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
372
373 } elsif ($route_state eq 'fwbr-in') {
374
375 $chain = 'PVEFW-FORWARD';
376 $next_route_state = $target->{tapdev};
377 $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
378 $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
379 $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
380 $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
381
382 } elsif ($route_state =~ m/^vmbr\d+$/) {
383
384 die "missing physdev_in - internal error?" if !$physdev_in;
385 $pkg->{physdev_in} = $physdev_in;
386
387 if ($target->{type} eq 'host') {
388
389 $chain = 'PVEFW-INPUT';
390 $pkg->{iface_in} = $route_state;
391 $pkg->{iface_out} = 'lo';
392 $next_route_state = 'host';
393
394 } elsif ($target->{type} eq 'bport') {
395
396 $chain = 'PVEFW-FORWARD';
397 $pkg->{iface_in} = $route_state;
398 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
399 # conditionally set physdev_out (same behavior as kernel)
400 if ($route_state eq $target->{bridge}) {
401 $pkg->{physdev_out} = $target->{iface} || die 'internal error';
402 }
403 $next_route_state = $target->{iface};
404
405 } elsif ($target->{type} eq 'ct') {
406
407 $chain = 'PVEFW-FORWARD';
408 $pkg->{iface_in} = $route_state;
409 $pkg->{iface_out} = 'venet0';
410 $next_route_state = 'venet-in';
411
412 } elsif ($target->{type} eq 'vm') {
413
414 $chain = 'PVEFW-FORWARD';
415 $pkg->{iface_in} = $route_state;
416 $pkg->{iface_out} = $target->{bridge};
417 # conditionally set physdev_out (same behavior as kernel)
418 if ($route_state eq $target->{bridge}) {
419 $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
420 }
421 $next_route_state = 'fwbr-in';
422
423 } else {
424 die "implement me";
425 }
426
427 } else {
428 die "implement me $route_state";
429 }
430
431 die "internal error" if !defined($next_route_state);
432
433 if ($chain) {
434 add_trace("IPT check at $route_state (chain $chain)\n");
435 add_trace(Dumper($pkg));
436 $ipt_invocation_counter++;
437 my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
438 $rule_check_counter += $ctr;
439 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
440 }
441
442 $route_state = $next_route_state;
443
444 $physdev_in = $next_physdev_in;
445 }
446
447 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
448}
449
450sub extract_ct_info {
451 my ($vmdata, $vmid) = @_;
452
453 my $info = { type => 'ct', vmid => $vmid };
454
455 my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
456 if ($conf->{ip_address}) {
457 $info->{ip_address} = $conf->{ip_address}->{value};
458 } else {
459 die "implement me";
460 }
461 return $info;
462}
463
464sub extract_vm_info {
465 my ($vmdata, $vmid) = @_;
466
467 my $info = { type => 'vm', vmid => $vmid };
468
469 my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
470 my $net = PVE::QemuServer::parse_net($conf->{net0});
471 $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
472 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
473 $info->{fwbr} = "fwbr${vmid}i0";
474 $info->{tapdev} = "tap${vmid}i0";
475 $info->{fwln} = "fwln${vmid}i0";
476 $info->{fwpr} = "fwpr${vmid}p0";
477
478 return $info;
479}
480
481sub simulate_firewall {
482 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
483
484 my $from = $test->{from} || die "missing 'from' field";
485 my $to = $test->{to} || die "missing 'to' field";
486 my $action = $test->{action} || die "missing 'action'";
487
488 my $testid = $test->{id};
489
490 die "from/to needs to be different" if $from eq $to;
491
492 my $pkg = {
493 proto => 'tcp',
494 sport => undef,
495 dport => undef,
496 source => undef,
497 dest => undef,
498 srctype => 'UNICAST',
499 dsttype => 'UNICAST',
500 };
501
502 while (my ($k,$v) = each %$test) {
503 next if $k eq 'from';
504 next if $k eq 'to';
505 next if $k eq 'action';
506 next if $k eq 'id';
507 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
508 $pkg->{$k} = $v;
509 }
510
511 my $from_info = {};
512
513 my $start_state;
514
515 if ($from eq 'host') {
516 $from_info->{type} = 'host';
517 $start_state = 'host';
518 $pkg->{source} = $host_ip if !defined($pkg->{source});
519 } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
520 $from_info->{type} = 'bport';
521 $from_info->{bridge} = $1;
522 $from_info->{iface} = $2;
523 $start_state = 'from-bport';
524 } elsif ($from eq 'outside') {
525 $from_info->{type} = 'bport';
526 $from_info->{bridge} = 'vmbr0';
527 $from_info->{iface} = 'eth0';
528 $start_state = 'from-bport';
529 } elsif ($from eq 'nfvm') {
530 $from_info->{type} = 'bport';
531 $from_info->{bridge} = 'vmbr0';
532 $from_info->{iface} = 'tapXYZ';
533 $start_state = 'from-bport';
534 } elsif ($from =~ m/^ct(\d+)$/) {
535 my $vmid = $1;
536 $from_info = extract_ct_info($vmdata, $vmid);
537 if ($from_info->{ip_address}) {
538 $pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
539 $start_state = 'venet-out';
540 } else {
541 die "implement me";
542 }
543 } elsif ($from =~ m/^vm(\d+)$/) {
544 my $vmid = $1;
545 $from_info = extract_vm_info($vmdata, $vmid);
546 $start_state = 'fwbr-out';
547 $pkg->{mac_source} = $from_info->{macaddr};
548 } else {
549 die "unable to parse \"from => '$from'\"\n";
550 }
551
552 my $target;
553
554 if ($to eq 'host') {
555 $target->{type} = 'host';
556 $target->{iface} = 'host';
557 $pkg->{dest} = $host_ip if !defined($pkg->{dest});
558 } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
559 $target->{type} = 'bport';
560 $target->{bridge} = $1;
561 $target->{iface} = $2;
562 } elsif ($to eq 'outside') {
563 $target->{type} = 'bport';
564 $target->{bridge} = 'vmbr0';
565 $target->{iface} = 'eth0';
566 } elsif ($to eq 'nfvm') {
567 $target->{type} = 'bport';
568 $target->{bridge} = 'vmbr0';
569 $target->{iface} = 'tapXYZ';
570 } elsif ($to =~ m/^ct(\d+)$/) {
571 my $vmid = $1;
572 $target = extract_ct_info($vmdata, $vmid);
573 $target->{iface} = 'venet-in';
574
575 if ($target->{ip_address}) {
576 $pkg->{dest} = $target->{ip_address};
577 } else {
578 die "implement me";
579 }
580 } elsif ($to =~ m/^vm(\d+)$/) {
581 my $vmid = $1;
582 $target = extract_vm_info($vmdata, $vmid);
583 $target->{iface} = $target->{tapdev};
584 } else {
585 die "unable to parse \"to => '$to'\"\n";
586 }
587
588 $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
589 $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
590
591 my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
592 $from_info, $target, $start_state);
593
594 add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
595
596 die "test failed ($res != $action)\n" if $action ne $res;
597
598 return undef;
599}
600
6011;
602