resolve_alias: use better regex to detect alias
[pve-firewall.git] / src / PVE / FirewallSimulator.pm
CommitLineData
63e8c70e
DM
1package PVE::FirewallSimulator;
2
3use strict;
4use warnings;
5use Data::Dumper;
6use PVE::Firewall;
7use File::Basename;
8use Net::IP;
9
10my $mark;
11my $trace;
12my $debug = 0;
13
14sub debug {
15 my $new_value = shift;
16
17 $debug = $new_value if defined($new_value);
18
19 return $debug;
20}
21
22sub reset_trace {
23 $trace = '';
24}
25
26sub get_trace {
27 return $trace;
28}
29
30sub add_trace {
31 my ($text) = @_;
32
33 if ($debug) {
34 print $text;
35 } else {
36 $trace .= $text;
37 }
38}
39
49124851
DM
40$SIG{'__WARN__'} = sub {
41 my $err = $@;
42 my $t = $_[0];
43 chomp $t;
44 add_trace("$t\n");
45 $@ = $err;
46};
47
63e8c70e
DM
48sub nf_dev_match {
49 my ($devre, $dev) = @_;
50
51 $devre =~ s/\+$/\.\*/;
52 return ($dev =~ m/^${devre}$/) ? 1 : 0;
53}
54
55sub ipset_match {
56 my ($ipsetname, $ipset, $ipaddr) = @_;
57
58 my $ip = Net::IP->new($ipaddr);
59
60 foreach my $entry (@$ipset) {
61 next if $entry =~ m/^create/; # simply ignore
62 if ($entry =~ m/add \S+ (\S+)$/) {
63 my $test = Net::IP->new($1);
64 if ($test->overlaps($ip)) {
65 add_trace("IPSET $ipsetname match $ipaddr\n");
66 return 1;
67 }
68 } else {
69 die "implement me";
70 }
71 }
72
73 return 0;
74}
75
76sub rule_match {
77 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
78
79 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
80
81 while (length($rule)) {
82
83 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
84 my $cstate = $1;
85
86 return undef if $cstate eq 'INVALID'; # no match
87 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
88
89 next if $cstate =~ m/NEW/;
90
e76a9f53 91 die "cstate test '$cstate' not implemented\n";
63e8c70e
DM
92 }
93
94 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
95 my $atype = $1;
e76a9f53
DM
96 die "missing source address type (srctype)\n"
97 if !$pkg->{srctype};
63e8c70e
DM
98 return undef if $atype ne $pkg->{srctype};
99 }
100
101 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
102 my $atype = $1;
e76a9f53
DM
103 die "missing destination address type (dsttype)\n"
104 if !$pkg->{dsttype};
63e8c70e
DM
105 return undef if $atype ne $pkg->{dsttype};
106 }
107
108 if ($rule =~ s/^-i (\S+)\s*//) {
109 my $devre = $1;
e76a9f53 110 die "missing interface (iface_in)\n" if !$pkg->{iface_in};
63e8c70e
DM
111 return undef if !nf_dev_match($devre, $pkg->{iface_in});
112 next;
113 }
114
115 if ($rule =~ s/^-o (\S+)\s*//) {
116 my $devre = $1;
e76a9f53 117 die "missing interface (iface_out)\n" if !$pkg->{iface_out};
63e8c70e
DM
118 return undef if !nf_dev_match($devre, $pkg->{iface_out});
119 next;
120 }
121
cc8dc02f 122 if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
63e8c70e
DM
123 die "missing proto" if !$pkg->{proto};
124 return undef if $pkg->{proto} ne $1; # no match
125 next;
126 }
127
128 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
129 die "missing dport" if !$pkg->{dport};
130 return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
131 next;
132 }
133
134 if ($rule =~ s/^--dport (\d+)\s*//) {
135 die "missing dport" if !$pkg->{dport};
136 return undef if $pkg->{dport} != $1; # no match
137 next;
138 }
139
140 if ($rule =~ s/^-s (\S+)\s*//) {
141 die "missing source" if !$pkg->{source};
142 my $ip = Net::IP->new($1);
143 return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
144 next;
145 }
146
147 if ($rule =~ s/^-d (\S+)\s*//) {
148 die "missing destination" if !$pkg->{dest};
149 my $ip = Net::IP->new($1);
150 return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
151 next;
152 }
153
b625713b 154 if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
63e8c70e 155 die "missing source" if !$pkg->{source};
b625713b
DM
156 my $neg = $1;
157 my $ipset = $ipset_ruleset->{$2};
158 die "no such ip set '$2'" if !$ipset;
159 if ($neg) {
160 return undef if ipset_match($1, $ipset, $pkg->{source});
161 } else {
162 return undef if !ipset_match($1, $ipset, $pkg->{source});
163 }
63e8c70e
DM
164 next;
165 }
166
167 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
168 die "missing destination" if !$pkg->{dest};
169 my $ipset = $ipset_ruleset->{$1};
170 die "no such ip set '$1'" if !$ipset;
171 return undef if !ipset_match($1, $ipset, $pkg->{dest});
172 next;
173 }
174
175 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
176 die "missing source mac" if !$pkg->{mac_source};
177 return undef if $pkg->{mac_source} eq $1; # no match
178 next;
179 }
180
181 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
182 my $devre = $1;
183 return undef if !$pkg->{physdev_in};
184 return undef if !nf_dev_match($devre, $pkg->{physdev_in});
185 next;
186 }
187
188 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
189 my $devre = $1;
190 return undef if !$pkg->{physdev_out};
191 return undef if !nf_dev_match($devre, $pkg->{physdev_out});
192 next;
193 }
194
195 if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
196 return undef if !defined($mark) || $mark != $1;
197 next;
198 }
199
200 # final actions
201
202 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
203 $mark = $1;
204 return undef;
205 }
206
207 if ($rule =~ s/^-j (\S+)\s*$//) {
208 return (0, $1);
209 }
210
211 if ($rule =~ s/^-g (\S+)\s*$//) {
212 return (1, $1);
213 }
214
215 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
216 return undef;
217 }
218
219 last;
220 }
221
222 die "unable to parse rule: $rule";
223}
224
225sub ruleset_simulate_chain {
226 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
227
228 add_trace("ENTER chain $chain\n");
229
230 my $counter = 0;
231
232 if ($chain eq 'PVEFW-Drop') {
233 add_trace("LEAVE chain $chain\n");
234 return ('DROP', $counter);
235 }
236 if ($chain eq 'PVEFW-reject') {
237 add_trace("LEAVE chain $chain\n");
238 return ('REJECT', $counter);
239 }
240
241 if ($chain eq 'PVEFW-tcpflags') {
242 add_trace("LEAVE chain $chain\n");
243 return (undef, $counter);
244 }
245
246 my $rules = $ruleset->{$chain} ||
247 die "no such chain '$chain'";
248
249 foreach my $rule (@$rules) {
250 $counter++;
251 my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
252 if (!defined($action)) {
253 add_trace("SKIP: $rule\n");
254 next;
255 }
256 add_trace("MATCH: $rule\n");
257
258 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
259 add_trace("TERMINATE chain $chain: $action\n");
260 return ($action, $counter);
261 } elsif ($action eq 'RETURN') {
262 add_trace("RETURN FROM chain $chain\n");
263 last;
264 } else {
265 if ($goto) {
266 add_trace("LEAVE chain $chain - goto $action\n");
267 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
268 #$chain = $action;
269 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
270 } else {
271 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
272 $counter += $ctr;
273 return ($act, $counter) if $act;
274 add_trace("CONTINUE chain $chain\n");
275 }
276 }
277 }
278
279 add_trace("LEAVE chain $chain\n");
280 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
281 return ('ACCEPT', $counter); # default policy
282 }
283
284 return (undef, $counter);
285}
286
287sub copy_packet {
288 my ($pkg) = @_;
289
290 my $res = {};
291
292 while (my ($k,$v) = each %$pkg) {
293 $res->{$k} = $v;
294 }
295
296 return $res;
297}
298
299# Try to simulate packet traversal inside kernel. This invokes iptable
300# checks several times.
301sub route_packet {
302 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
303
304 my $route_state = $start_state;
305
306 my $physdev_in;
307
308 my $ipt_invocation_counter = 0;
309 my $rule_check_counter = 0;
310
311 while ($route_state ne $target->{iface}) {
312
313 my $chain;
314 my $next_route_state;
315 my $next_physdev_in;
316
317 $pkg->{iface_in} = $pkg->{iface_out} = undef;
318 $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
319
320 if ($route_state eq 'from-bport') {
321 $next_route_state = $from_info->{bridge} || die 'internal error';
322 $next_physdev_in = $from_info->{iface} || die 'internal error';
323 } elsif ($route_state eq 'host') {
324
325 if ($target->{type} eq 'bport') {
326 $pkg->{iface_in} = 'lo';
327 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
328 $chain = 'PVEFW-OUTPUT';
329 $next_route_state = $target->{iface} || die 'internal error';
330 } elsif ($target->{type} eq 'ct') {
331 $pkg->{iface_in} = 'lo';
332 $pkg->{iface_out} = 'venet0';
333 $chain = 'PVEFW-OUTPUT';
334 $next_route_state = 'venet-in';
335 } elsif ($target->{type} eq 'vm') {
336 $pkg->{iface_in} = 'lo';
337 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
338 $chain = 'PVEFW-OUTPUT';
339 $next_route_state = 'fwbr-in';
340 } else {
341 die "implement me";
342 }
343
344 } elsif ($route_state eq 'venet-out') {
345
346 if ($target->{type} eq 'host') {
347
348 $chain = 'PVEFW-INPUT';
349 $pkg->{iface_in} = 'venet0';
350 $pkg->{iface_out} = 'lo';
351 $next_route_state = 'host';
352
353 } elsif ($target->{type} eq 'bport') {
354
355 $chain = 'PVEFW-FORWARD';
356 $pkg->{iface_in} = 'venet0';
357 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
358 $next_route_state = $target->{iface} || die 'internal error';
359
360 } elsif ($target->{type} eq 'vm') {
361
362 $chain = 'PVEFW-FORWARD';
363 $pkg->{iface_in} = 'venet0';
364 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
365 $next_route_state = 'fwbr-in';
366
367 } elsif ($target->{type} eq 'ct') {
368
369 $chain = 'PVEFW-FORWARD';
370 $pkg->{iface_in} = 'venet0';
371 $pkg->{iface_out} = 'venet0';
372 $next_route_state = 'venet-in';
373
374 } else {
375 die "implement me";
376 }
377
378 } elsif ($route_state eq 'fwbr-out') {
379
380 $chain = 'PVEFW-FORWARD';
381 $next_route_state = $from_info->{bridge} || die 'internal error';
382 $next_physdev_in = $from_info->{fwpr} || die 'internal error';
383 $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
384 $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
385 $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
386 $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
387
388 } elsif ($route_state eq 'fwbr-in') {
389
390 $chain = 'PVEFW-FORWARD';
391 $next_route_state = $target->{tapdev};
392 $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
393 $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
394 $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
395 $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
396
397 } elsif ($route_state =~ m/^vmbr\d+$/) {
398
399 die "missing physdev_in - internal error?" if !$physdev_in;
400 $pkg->{physdev_in} = $physdev_in;
401
402 if ($target->{type} eq 'host') {
403
404 $chain = 'PVEFW-INPUT';
405 $pkg->{iface_in} = $route_state;
406 $pkg->{iface_out} = 'lo';
407 $next_route_state = 'host';
408
409 } elsif ($target->{type} eq 'bport') {
410
411 $chain = 'PVEFW-FORWARD';
412 $pkg->{iface_in} = $route_state;
413 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
414 # conditionally set physdev_out (same behavior as kernel)
415 if ($route_state eq $target->{bridge}) {
416 $pkg->{physdev_out} = $target->{iface} || die 'internal error';
417 }
418 $next_route_state = $target->{iface};
419
420 } elsif ($target->{type} eq 'ct') {
421
422 $chain = 'PVEFW-FORWARD';
423 $pkg->{iface_in} = $route_state;
424 $pkg->{iface_out} = 'venet0';
425 $next_route_state = 'venet-in';
426
427 } elsif ($target->{type} eq 'vm') {
428
429 $chain = 'PVEFW-FORWARD';
430 $pkg->{iface_in} = $route_state;
431 $pkg->{iface_out} = $target->{bridge};
432 # conditionally set physdev_out (same behavior as kernel)
433 if ($route_state eq $target->{bridge}) {
434 $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
435 }
436 $next_route_state = 'fwbr-in';
437
438 } else {
439 die "implement me";
440 }
441
442 } else {
443 die "implement me $route_state";
444 }
445
446 die "internal error" if !defined($next_route_state);
447
448 if ($chain) {
449 add_trace("IPT check at $route_state (chain $chain)\n");
450 add_trace(Dumper($pkg));
451 $ipt_invocation_counter++;
452 my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
453 $rule_check_counter += $ctr;
454 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
455 }
456
457 $route_state = $next_route_state;
458
459 $physdev_in = $next_physdev_in;
460 }
461
462 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
463}
464
465sub extract_ct_info {
466 my ($vmdata, $vmid) = @_;
467
468 my $info = { type => 'ct', vmid => $vmid };
469
470 my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
471 if ($conf->{ip_address}) {
472 $info->{ip_address} = $conf->{ip_address}->{value};
473 } else {
474 die "implement me";
475 }
476 return $info;
477}
478
479sub extract_vm_info {
b625713b 480 my ($vmdata, $vmid, $netnum) = @_;
63e8c70e
DM
481
482 my $info = { type => 'vm', vmid => $vmid };
483
484 my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
b625713b 485 my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
63e8c70e
DM
486 $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
487 $info->{bridge} = $net->{bridge} || die "unable to get bridge";
b625713b
DM
488 $info->{fwbr} = "fwbr${vmid}i$netnum";
489 $info->{tapdev} = "tap${vmid}i$netnum";
490 $info->{fwln} = "fwln${vmid}i$netnum";
491 $info->{fwpr} = "fwpr${vmid}p$netnum";
63e8c70e
DM
492
493 return $info;
494}
495
496sub simulate_firewall {
497 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
498
499 my $from = $test->{from} || die "missing 'from' field";
500 my $to = $test->{to} || die "missing 'to' field";
501 my $action = $test->{action} || die "missing 'action'";
502
503 my $testid = $test->{id};
504
505 die "from/to needs to be different" if $from eq $to;
506
507 my $pkg = {
508 proto => 'tcp',
509 sport => undef,
510 dport => undef,
511 source => undef,
512 dest => undef,
513 srctype => 'UNICAST',
514 dsttype => 'UNICAST',
515 };
516
517 while (my ($k,$v) = each %$test) {
518 next if $k eq 'from';
519 next if $k eq 'to';
520 next if $k eq 'action';
521 next if $k eq 'id';
522 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
523 $pkg->{$k} = $v;
524 }
525
526 my $from_info = {};
527
528 my $start_state;
529
530 if ($from eq 'host') {
531 $from_info->{type} = 'host';
532 $start_state = 'host';
533 $pkg->{source} = $host_ip if !defined($pkg->{source});
534 } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
535 $from_info->{type} = 'bport';
536 $from_info->{bridge} = $1;
537 $from_info->{iface} = $2;
538 $start_state = 'from-bport';
539 } elsif ($from eq 'outside') {
540 $from_info->{type} = 'bport';
541 $from_info->{bridge} = 'vmbr0';
542 $from_info->{iface} = 'eth0';
543 $start_state = 'from-bport';
544 } elsif ($from eq 'nfvm') {
545 $from_info->{type} = 'bport';
546 $from_info->{bridge} = 'vmbr0';
547 $from_info->{iface} = 'tapXYZ';
548 $start_state = 'from-bport';
549 } elsif ($from =~ m/^ct(\d+)$/) {
550 my $vmid = $1;
551 $from_info = extract_ct_info($vmdata, $vmid);
552 if ($from_info->{ip_address}) {
553 $pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
554 $start_state = 'venet-out';
555 } else {
556 die "implement me";
557 }
b625713b 558 } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
63e8c70e 559 my $vmid = $1;
b625713b
DM
560 my $netnum = $3 || 0;
561 $from_info = extract_vm_info($vmdata, $vmid, $netnum);
63e8c70e
DM
562 $start_state = 'fwbr-out';
563 $pkg->{mac_source} = $from_info->{macaddr};
564 } else {
565 die "unable to parse \"from => '$from'\"\n";
566 }
567
568 my $target;
569
570 if ($to eq 'host') {
571 $target->{type} = 'host';
572 $target->{iface} = 'host';
573 $pkg->{dest} = $host_ip if !defined($pkg->{dest});
574 } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
575 $target->{type} = 'bport';
576 $target->{bridge} = $1;
577 $target->{iface} = $2;
578 } elsif ($to eq 'outside') {
579 $target->{type} = 'bport';
580 $target->{bridge} = 'vmbr0';
581 $target->{iface} = 'eth0';
582 } elsif ($to eq 'nfvm') {
583 $target->{type} = 'bport';
584 $target->{bridge} = 'vmbr0';
585 $target->{iface} = 'tapXYZ';
586 } elsif ($to =~ m/^ct(\d+)$/) {
587 my $vmid = $1;
588 $target = extract_ct_info($vmdata, $vmid);
589 $target->{iface} = 'venet-in';
590
591 if ($target->{ip_address}) {
592 $pkg->{dest} = $target->{ip_address};
593 } else {
594 die "implement me";
595 }
596 } elsif ($to =~ m/^vm(\d+)$/) {
597 my $vmid = $1;
b625713b 598 $target = extract_vm_info($vmdata, $vmid, 0);
63e8c70e
DM
599 $target->{iface} = $target->{tapdev};
600 } else {
601 die "unable to parse \"to => '$to'\"\n";
602 }
603
604 $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
605 $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
606
607 my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
608 $from_info, $target, $start_state);
609
610 add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
611
814de832
DM
612 return $res if $action eq 'QUERY';
613
63e8c70e
DM
614 die "test failed ($res != $action)\n" if $action ne $res;
615
616 return undef;
617}
618
6191;
620