[pve-firewall.git] / test / fwtester.pl

#!/usr/bin/perl

use lib '../src';
use strict;
use warnings;
use Data::Dumper;
use PVE::Firewall;
use Getopt::Long;
use File::Basename;

my $mark;
my $trace;

my $outside_iface = 'eth0';
my $outside_bridge = 'vmbr0';

my $nfvm_iface = 'tapXYZ';
my $nfvm_bridge = 'vmbr0';

my $debug = 0;

sub print_usage_and_exit {
    die "usage: $0 [--debug] [testfile [testid]]\n";
}

if (!GetOptions ('debug' => \$debug)) {
    print_usage_and_exit();
}

my $testfilename = shift;
my $testid = shift;

sub add_trace {
    my ($text) = @_;

    if ($debug) {
	print $text;
    } else {
	$trace .= $text;
    }
}

sub nf_dev_match {
    my ($devre, $dev) = @_;

    $devre =~ s/\+$/\.\*/;
    return  ($dev =~ m/^${devre}$/) ? 1 : 0;
}

sub rule_match {
    my ($chain, $rule, $pkg) = @_;

    $rule =~ s/^-A $chain // || die "got strange rule: $rule";

    if ($rule =~ s/^-m conntrack\s*//) {
	return undef; # simply ignore
    }

    if ($rule =~ s/^-m addrtype\s*//) {
	return undef; # simply ignore
    }

    if ($rule =~ s/^-i (\S+)\s*//) {
	my $devre = $1;
	die "missing iface_in" if !$pkg->{iface_in};
	return undef if !nf_dev_match($devre, $pkg->{iface_in});
    }
    if ($rule =~ s/^-o (\S+)\s*//) {
	my $devre = $1;
	die "missing iface_out" if !$pkg->{iface_out};
	return undef if !nf_dev_match($devre, $pkg->{iface_out});
    }

    if ($rule =~ s/^-p (tcp|udp)\s*//) {
	die "missing proto" if !$pkg->{proto};
	return undef if $pkg->{proto} ne $1; # no match
    }

    if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
	die "missing dport" if !$pkg->{dport};
	return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
    }

    if ($rule =~ s/^--dport (\d+)\s*//) {
	die "missing dport" if !$pkg->{dport};
	return undef if $pkg->{dport} != $1; # no match
    }

    if ($rule =~ s/^-s (\S+)\s*//) {
	die "missing source" if !$pkg->{source};
	return undef if $pkg->{source} ne $1; # no match
    }
    
    if ($rule =~ s/^-d (\S+)\s*//) {
	die "missing destination" if !$pkg->{dest};
	return undef if $pkg->{dest} ne $1; # no match
    }

    if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
	die "missing source mac" if !$pkg->{mac_source};
	return undef if $pkg->{mac_source} eq $1; # no match
    }

    if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
	my $devre = $1;
	return undef if !$pkg->{physdev_in};
	return undef if !nf_dev_match($devre, $pkg->{physdev_in});
    }

    if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
	my $devre = $1;
	return undef if !$pkg->{physdev_out};
	return undef if !nf_dev_match($devre, $pkg->{physdev_out});
    }

    if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
	$mark = $1;
	return undef;
    }

    if ($rule =~ s/^-j (\S+)\s*$//) {
	return (0, $1);
    }

    if ($rule =~ s/^-g (\S+)\s*$//) {
	return (1, $1);
    }

    die "unable to parse rule: $rule";
}

sub ruleset_simulate_chain {
    my ($ruleset, $chain, $pkg) = @_;

    add_trace("ENTER chain $chain\n");
    
    my $counter = 0;

    if ($chain eq 'PVEFW-Drop') {
	add_trace("LEAVE chain $chain\n");
	return ('DROP', $counter);
    }
    if ($chain eq 'PVEFW-reject') {
	add_trace("LEAVE chain $chain\n");
	return ('REJECT', $counter);
    }

    if ($chain eq 'PVEFW-tcpflags') {
	add_trace("LEAVE chain $chain\n");
	return (undef, $counter);
    }

    my $rules = $ruleset->{$chain} ||
	die "no such chain '$chain'";

    foreach my $rule (@$rules) {
	$counter++;
	my ($goto, $action) = rule_match($chain, $rule, $pkg);
	if (!defined($action)) {
	    add_trace("SKIP: $rule\n");
	    next;
	}
	add_trace("MATCH: $rule\n");
	
	if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
	    add_trace("TERMINATE chain $chain: $action\n");
	    return ($action, $counter);
	} elsif ($action eq 'RETURN') {
	    add_trace("RETURN FROM chain $chain\n");
	    last;
	} else {
	    if ($goto) {
		add_trace("LEAVE chain $chain - goto $action\n");
		return ruleset_simulate_chain($ruleset, $action, $pkg)
		#$chain = $action;
		#$rules = $ruleset->{$chain} || die "no such chain '$chain'";
	    } else {
		my ($act, $ctr) = ruleset_simulate_chain($ruleset, $action, $pkg);
		$counter += $ctr;
		return ($act, $counter) if $act;
		add_trace("CONTINUE chain $chain\n");
	    }
	}
    }

    add_trace("LEAVE chain $chain\n");
    if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
	return ('ACCEPT', $counter); # default policy
    }

    return (undef, $counter);
}

sub copy_packet {
    my ($pkg) = @_;

    my $res = {};

    while (my ($k,$v) = each %$pkg) {
	$res->{$k} = $v;
    }

    return $res;
}

# Try to simulate packet traversal inside kernel. This invokes iptable
# checks several times.
sub route_packet {
    my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;

    my $route_state = $start_state;

    my $physdev_in;

    my $ipt_invocation_counter = 0;
    my $rule_check_counter = 0;

    while ($route_state ne $target->{iface}) {

	my $chain;
	my $next_route_state;
	my $next_physdev_in;

	$pkg->{iface_in} = $pkg->{iface_out} = undef;
	$pkg->{physdev_in} = $pkg->{physdev_out} = undef;

	if ($route_state eq 'from-outside') {
	    $next_route_state = $outside_bridge || die 'internal error';
	    $next_physdev_in = $outside_iface || die 'internal error';
	} elsif ($route_state eq 'from-nfvm') {
	    $next_route_state = $nfvm_bridge || die 'internal error';
	    $next_physdev_in = $nfvm_iface || die 'internal error';
	} elsif ($route_state eq 'host') {

	    if ($target->{type} eq 'outside') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = $outside_bridge;
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = $outside_iface
	    } elsif ($target->{type} eq 'nfvm') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = $nfvm_bridge;
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = $nfvm_iface
	    } elsif ($target->{type} eq 'ct') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = 'venet0';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = 'venet-in';
	    } elsif ($target->{type} eq 'vm') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = 'fwbr-in';
	    } else {
		die "implement me";
	    }

	} elsif ($route_state eq 'venet-out') {

	    if ($target->{type} eq 'host') {

		$chain = 'PVEFW-INPUT';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = 'lo';
		$next_route_state = 'host';

	    } elsif ($target->{type} eq 'outside') {
		
		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = $outside_bridge;
		$next_route_state = $outside_iface;

	    } elsif ($target->{type} eq 'nfvm') {
		
		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = $nfvm_bridge;
		$next_route_state = $nfvm_iface;

	    } elsif ($target->{type} eq 'vm') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$next_route_state = 'fwbr-in';

	    } elsif ($target->{type} eq 'ct') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = 'venet0';
		$next_route_state = 'venet-in';

	    } else {
		die "implement me";
	    }

	} elsif ($route_state eq 'fwbr-out') {

	    $chain = 'PVEFW-FORWARD';
	    $next_route_state = $from_info->{bridge} || die 'internal error';
	    $next_physdev_in = $from_info->{fwpr} || die 'internal error';
	    $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
	    $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
	    $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
	    $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
	
	} elsif ($route_state eq 'fwbr-in') {

	    $chain = 'PVEFW-FORWARD';
	    $next_route_state = $target->{tapdev};
	    $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
	    $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
	    $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
	    $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';

	} elsif ($route_state =~ m/^vmbr\d+$/) {
	    
	    die "missing physdev_in - internal error?" if !$physdev_in;
	    $pkg->{physdev_in} = $physdev_in;

	    if ($target->{type} eq 'host') {

		$chain = 'PVEFW-INPUT';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = 'lo';
		$next_route_state = 'host';

	    } elsif ($target->{type} eq 'outside') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = $outside_bridge;
		# conditionally set physdev_out (same behavior as kernel)
		if ($route_state eq $outside_bridge) {
		    $pkg->{physdev_out} = $outside_iface || die 'internal error';
		}
		$next_route_state = $outside_iface;

	    } elsif ($target->{type} eq 'nfvm') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = $nfvm_bridge;
		# conditionally set physdev_out (same behavior as kernel)
		if ($route_state eq $nfvm_bridge) {
		    $pkg->{physdev_out} = $nfvm_iface || die 'internal error';
		}
		$next_route_state = $nfvm_iface;

	    } elsif ($target->{type} eq 'ct') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = 'venet0';
		$next_route_state = 'venet-in';

	    } elsif ($target->{type} eq 'vm') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = $target->{bridge};
		# conditionally set physdev_out (same behavior as kernel)
		if ($route_state eq $target->{bridge}) {
		    $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
		}
		$next_route_state = 'fwbr-in';

	    } else {
		die "implement me";
	    }

	} else {
	    die "implement me $route_state";
	}

	die "internal error" if !defined($next_route_state);

	if ($chain) {
	    add_trace("IPT check at $route_state (chain $chain)\n");
	    add_trace(Dumper($pkg));
	    $ipt_invocation_counter++;
	    my ($res, $ctr) = ruleset_simulate_chain($ruleset, $chain, $pkg);
	    $rule_check_counter += $ctr;
	    return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
	} 

	$route_state = $next_route_state;

	$physdev_in = $next_physdev_in;
    }

    return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
}

sub extract_ct_info {
    my ($vmdata, $vmid) = @_;

    my $info = { type => 'ct', vmid => $vmid };

    my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
    if ($conf->{ip_address}) {
	$info->{ip_address} = $conf->{ip_address}->{value};
    } else {
	die "implement me";
    }
    return $info;
}

sub extract_vm_info {
    my ($vmdata, $vmid) = @_;

    my $info = { type => 'vm', vmid => $vmid };

    my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
    my $net = PVE::QemuServer::parse_net($conf->{net0});
    $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
    $info->{bridge} = $net->{bridge} || die "unable to get bridge";
    $info->{fwbr} = "fwbr${vmid}i0";
    $info->{tapdev} = "tap${vmid}i0";
    $info->{fwln} = "fwln${vmid}i0";
    $info->{fwpr} = "fwpr${vmid}p0";

    return $info;
}

sub simulate_firewall {
    my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;

    my $from = delete $test->{from} || die "missing 'from' field";
    my $to = delete $test->{to} || die "missing 'to' field";
    my $action = delete $test->{action} || die "missing 'action'";
    
    my $testid = delete $test->{id};
    
    die "from/to needs to be different" if $from eq $to;

    my $pkg = {
	proto => 'tcp',
	sport => undef,
	dport => undef,
	source => undef,
	dest => undef,
    };

    while (my ($k,$v) = each %$test) {
	die "unknown attribute '$k'\n" if !exists($pkg->{$k});
	$pkg->{$k} = $v;
    }

    my $from_info = {};

    my $start_state;

    if ($from eq 'host') {
	$from_info->{type} = 'host';
	$start_state = 'host';
    } elsif ($from eq 'outside') {
	$from_info->{type} = 'outside';
	$start_state = 'from-outside';
    } elsif ($from eq 'nfvm') {
	$from_info->{type} = 'nfvm';
	$start_state = 'from-nfvm';
    } elsif ($from =~ m/^ct(\d+)$/) {
	my $vmid = $1;
	$from_info = extract_ct_info($vmdata, $vmid);
	if ($from_info->{ip_address}) {
	    $pkg->{source} = $from_info->{ip_address};
	    $start_state = 'venet-out';
	} else {
	    die "implement me";
	}
    } elsif ($from =~ m/^vm(\d+)$/) {
	my $vmid = $1;
	$from_info = extract_vm_info($vmdata, $vmid);
	$start_state = 'fwbr-out'; 
	$pkg->{mac_source} = $from_info->{macaddr};
    } else {
	die "implement me";
    }

    my $target;

    if ($to eq 'host') {
	$target->{type} = 'host';
	$target->{iface} = 'host';
    } elsif ($to eq 'outside') {
	$target->{type} = 'outside';
	$target->{iface} = $outside_iface;
     } elsif ($to eq 'nfvm') {
	$target->{type} = 'nfvm';
	$target->{iface} = $nfvm_iface;
    } elsif ($to =~ m/^ct(\d+)$/) {
	my $vmid = $1;
	$target = extract_ct_info($vmdata, $vmid);
	$target->{iface} = 'venet-in';

	if ($target->{ip_address}) {
	    $pkg->{dest} = $target->{ip_address};
	} else {
	    die "implement me";
	}
   } elsif ($to =~ m/^vm(\d+)$/) {
	my $vmid = $1;
	$target = extract_vm_info($vmdata, $vmid);
	$target->{iface} = $target->{tapdev};
    } else {
	die "implement me";
    }

    my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg, 
				       $from_info, $target, $start_state);

    add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 
    die "test failed ($res != $action)\n" if $action ne $res;

    return undef; 
}

sub run_tests {
    my ($vmdata, $testdir, $testfile, $testid) = @_;

    $testfile = 'tests' if !$testfile;

    $vmdata->{testdir} = $testdir;

    my ($ruleset, $ipset_ruleset) = 
	PVE::Firewall::compile(undef, undef, $vmdata);

    my $filename = "$testdir/$testfile";
    my $fh = IO::File->new($filename) ||
	die "unable to open '$filename' - $!\n";

    my $testcount = 0;
    while (defined(my $line = <$fh>)) {
	next if $line =~ m/^\s*$/;
	next if $line =~ m/^#.*$/;
	if ($line =~ m/^\{.*\}\s*$/) {
	    my $test = eval $line;
	    die $@ if $@;
	    next if defined($testid) && (!defined($test->{id}) || ($testid ne $test->{id}));
	    $trace = '';
	    print Dumper($ruleset) if $debug;
	    $testcount++;
	    eval { simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test); };
	    if (my $err = $@) {

		print Dumper($ruleset) if !$debug;

		print "$trace\n" if !$debug;

		print "$filename line $.: $line";

		print "test failed: $err\n";

		exit(-1);
	    }
	} else {
	    die "parse error";
	}
    }

    die "no tests found\n" if $testcount <= 0;

    print "PASS: $filename\n";

    return undef;
}

my $vmdata = {
    qemu => {
	100 => {
	    net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0",
	},
	101 => {
	    net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0",
	},
	# on bridge vmbr1
	110 => {
	    net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1",
	},
    },
    openvz => {
	200 => {
	    ip_address => { value => '10.0.200.1' },
	},
	201 => {
	    ip_address => { value => '10.0.200.2' },
	},
    },
};

if ($testfilename) {
    my $testfile;
    my $dir;

    if (-d $testfilename) {
	$dir = $testfilename;
    } elsif (-f $testfilename) {
	$dir = dirname($testfilename);
	$testfile = basename($testfilename);
    } else {
	die "no such file/dir '$testfilename'\n"; 
    }

    run_tests($vmdata, $dir, $testfile, $testid);

} else { 
    foreach my $dir (<test-*>) {
	next if ! -d $dir;
	run_tests($vmdata, $dir);
    }
}

print "OK - all tests passed\n";

exit(0);
Commit	Line	Data
f1bafd37 DM	1	#!/usr/bin/perl
	2
	3	use lib '../src';
	4	use strict;
	5	use warnings;
	6	use Data::Dumper;
	7	use PVE::Firewall;
ec2e28f6 DM	8	use Getopt::Long;
ec2e28f6 DM	9	use File::Basename;
f1bafd37 DM	10
	11	my $mark;
	12	my $trace;
	13
31dc73f1 DM	14	my $outside_iface = 'eth0';
	15	my $outside_bridge = 'vmbr0';
	16
c0c871d8 DM	17	my $nfvm_iface = 'tapXYZ';
	18	my $nfvm_bridge = 'vmbr0';
	19
d1486f38 DM	20	my $debug = 0;
d1486f38 DM	21
ec2e28f6 DM	22	sub print_usage_and_exit {
	23	die "usage: $0 [--debug] [testfile [testid]]\n";
	24	}
	25
	26	if (!GetOptions ('debug' => \$debug)) {
	27	print_usage_and_exit();
	28	}
	29
	30	my $testfilename = shift;
	31	my $testid = shift;
	32
d1486f38 DM	33	sub add_trace {
	34	my ($text) = @_;
	35
	36	if ($debug) {
	37	print $text;
	38	} else {
	39	$trace .= $text;
	40	}
	41	}
	42
e4e5fcaf DM	43	sub nf_dev_match {
	44	my ($devre, $dev) = @_;
	45
	46	$devre =~ s/\+$/\.\*/;
	47	return ($dev =~ m/^${devre}$/) ? 1 : 0;
	48	}
	49
f1bafd37 DM	50	sub rule_match {
	51	my ($chain, $rule, $pkg) = @_;
	52
	53	$rule =~ s/^-A $chain // \|\| die "got strange rule: $rule";
	54
	55	if ($rule =~ s/^-m conntrack\s*//) {
	56	return undef; # simply ignore
	57	}
	58
	59	if ($rule =~ s/^-m addrtype\s*//) {
	60	return undef; # simply ignore
	61	}
	62
	63	if ($rule =~ s/^-i (\S+)\s*//) {
e4e5fcaf	64	my $devre = $1;
f1bafd37	65	die "missing iface_in" if !$pkg->{iface_in};
e4e5fcaf	66	return undef if !nf_dev_match($devre, $pkg->{iface_in});
f1bafd37 DM	67	}
f1bafd37 DM	68	if ($rule =~ s/^-o (\S+)\s*//) {
e4e5fcaf	69	my $devre = $1;
f1bafd37	70	die "missing iface_out" if !$pkg->{iface_out};
e4e5fcaf	71	return undef if !nf_dev_match($devre, $pkg->{iface_out});
f1bafd37 DM	72	}
	73
	74	if ($rule =~ s/^-p (tcp\|udp)\s*//) {
	75	die "missing proto" if !$pkg->{proto};
	76	return undef if $pkg->{proto} ne $1; # no match
	77	}
	78
	79	if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
	80	die "missing dport" if !$pkg->{dport};
	81	return undef if ($pkg->{dport} < $1) \|\| ($pkg->{dport} > $2); # no match
	82	}
	83
	84	if ($rule =~ s/^--dport (\d+)\s*//) {
	85	die "missing dport" if !$pkg->{dport};
	86	return undef if $pkg->{dport} != $1; # no match
	87	}
	88
	89	if ($rule =~ s/^-s (\S+)\s*//) {
	90	die "missing source" if !$pkg->{source};
	91	return undef if $pkg->{source} ne $1; # no match
	92	}
	93
	94	if ($rule =~ s/^-d (\S+)\s*//) {
	95	die "missing destination" if !$pkg->{dest};
	96	return undef if $pkg->{dest} ne $1; # no match
	97	}
	98
	99	if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
	100	die "missing source mac" if !$pkg->{mac_source};
	101	return undef if $pkg->{mac_source} eq $1; # no match
	102	}
	103
	104	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
	105	my $devre = $1;
f1bafd37	106	return undef if !$pkg->{physdev_in};
e4e5fcaf	107	return undef if !nf_dev_match($devre, $pkg->{physdev_in});
f1bafd37 DM	108	}
	109
	110	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
	111	my $devre = $1;
f1bafd37	112	return undef if !$pkg->{physdev_out};
e4e5fcaf	113	return undef if !nf_dev_match($devre, $pkg->{physdev_out});
f1bafd37 DM	114	}
	115
	116	if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
	117	$mark = $1;
	118	return undef;
	119	}
	120
	121	if ($rule =~ s/^-j (\S+)\s*$//) {
	122	return (0, $1);
	123	}
	124
	125	if ($rule =~ s/^-g (\S+)\s*$//) {
	126	return (1, $1);
	127	}
	128
	129	die "unable to parse rule: $rule";
	130	}
	131
	132	sub ruleset_simulate_chain {
	133	my ($ruleset, $chain, $pkg) = @_;
	134
d1486f38	135	add_trace("ENTER chain $chain\n");
f1bafd37	136
6a84e461	137	my $counter = 0;
111cce51	138
f1bafd37	139	if ($chain eq 'PVEFW-Drop') {
d1486f38	140	add_trace("LEAVE chain $chain\n");
111cce51	141	return ('DROP', $counter);
f1bafd37 DM	142	}
f1bafd37 DM	143	if ($chain eq 'PVEFW-reject') {
d1486f38	144	add_trace("LEAVE chain $chain\n");
111cce51	145	return ('REJECT', $counter);
f1bafd37 DM	146	}
	147
	148	if ($chain eq 'PVEFW-tcpflags') {
d1486f38	149	add_trace("LEAVE chain $chain\n");
111cce51	150	return (undef, $counter);
f1bafd37 DM	151	}
	152
	153	my $rules = $ruleset->{$chain} \|\|
	154	die "no such chain '$chain'";
	155
	156	foreach my $rule (@$rules) {
111cce51	157	$counter++;
f1bafd37 DM	158	my ($goto, $action) = rule_match($chain, $rule, $pkg);
f1bafd37 DM	159	if (!defined($action)) {
d1486f38	160	add_trace("SKIP: $rule\n");
f1bafd37 DM	161	next;
f1bafd37 DM	162	}
d1486f38	163	add_trace("MATCH: $rule\n");
f1bafd37 DM	164
f1bafd37 DM	165	if ($action eq 'ACCEPT' \|\| $action eq 'DROP' \|\| $action eq 'REJECT') {
d1486f38	166	add_trace("TERMINATE chain $chain: $action\n");
111cce51	167	return ($action, $counter);
f1bafd37	168	} elsif ($action eq 'RETURN') {
d1486f38	169	add_trace("RETURN FROM chain $chain\n");
f1bafd37 DM	170	last;
	171	} else {
	172	if ($goto) {
d1486f38	173	add_trace("LEAVE chain $chain - goto $action\n");
f1bafd37 DM	174	return ruleset_simulate_chain($ruleset, $action, $pkg)
	175	#$chain = $action;
	176	#$rules = $ruleset->{$chain} \|\| die "no such chain '$chain'";
	177	} else {
111cce51 DM	178	my ($act, $ctr) = ruleset_simulate_chain($ruleset, $action, $pkg);
	179	$counter += $ctr;
	180	return ($act, $counter) if $act;
d1486f38	181	add_trace("CONTINUE chain $chain\n");
f1bafd37 DM	182	}
	183	}
	184	}
	185
d1486f38	186	add_trace("LEAVE chain $chain\n");
f1bafd37	187	if ($chain =~ m/^PVEFW-(INPUT\|OUTPUT\|FORWARD)$/) {
111cce51	188	return ('ACCEPT', $counter); # default policy
f1bafd37 DM	189	}
f1bafd37 DM	190
111cce51	191	return (undef, $counter);
f1bafd37 DM	192	}
	193
	194	sub copy_packet {
	195	my ($pkg) = @_;
	196
	197	my $res = {};
	198
	199	while (my ($k,$v) = each %$pkg) {
	200	$res->{$k} = $v;
	201	}
	202
	203	return $res;
	204	}
	205
d1486f38 DM	206	# Try to simulate packet traversal inside kernel. This invokes iptable
	207	# checks several times.
	208	sub route_packet {
	209	my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
	210
	211	my $route_state = $start_state;
	212
	213	my $physdev_in;
	214
111cce51 DM	215	my $ipt_invocation_counter = 0;
	216	my $rule_check_counter = 0;
	217
d1486f38 DM	218	while ($route_state ne $target->{iface}) {
	219
	220	my $chain;
	221	my $next_route_state;
	222	my $next_physdev_in;
	223
	224	$pkg->{iface_in} = $pkg->{iface_out} = undef;
	225	$pkg->{physdev_in} = $pkg->{physdev_out} = undef;
	226
31dc73f1 DM	227	if ($route_state eq 'from-outside') {
	228	$next_route_state = $outside_bridge \|\| die 'internal error';
	229	$next_physdev_in = $outside_iface \|\| die 'internal error';
c0c871d8 DM	230	} elsif ($route_state eq 'from-nfvm') {
	231	$next_route_state = $nfvm_bridge \|\| die 'internal error';
	232	$next_physdev_in = $nfvm_iface \|\| die 'internal error';
31dc73f1	233	} elsif ($route_state eq 'host') {
d1486f38	234
31dc73f1 DM	235	if ($target->{type} eq 'outside') {
	236	$pkg->{iface_in} = 'lo';
	237	$pkg->{iface_out} = $outside_bridge;
	238	$chain = 'PVEFW-OUTPUT';
	239	$next_route_state = $outside_iface
c0c871d8 DM	240	} elsif ($target->{type} eq 'nfvm') {
	241	$pkg->{iface_in} = 'lo';
	242	$pkg->{iface_out} = $nfvm_bridge;
	243	$chain = 'PVEFW-OUTPUT';
	244	$next_route_state = $nfvm_iface
31dc73f1	245	} elsif ($target->{type} eq 'ct') {
d1486f38 DM	246	$pkg->{iface_in} = 'lo';
	247	$pkg->{iface_out} = 'venet0';
	248	$chain = 'PVEFW-OUTPUT';
	249	$next_route_state = 'venet-in';
	250	} elsif ($target->{type} eq 'vm') {
	251	$pkg->{iface_in} = 'lo';
	252	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	253	$chain = 'PVEFW-OUTPUT';
	254	$next_route_state = 'fwbr-in';
	255	} else {
	256	die "implement me";
	257	}
	258
	259	} elsif ($route_state eq 'venet-out') {
	260
	261	if ($target->{type} eq 'host') {
	262
	263	$chain = 'PVEFW-INPUT';
	264	$pkg->{iface_in} = 'venet0';
	265	$pkg->{iface_out} = 'lo';
	266	$next_route_state = 'host';
	267
31dc73f1 DM	268	} elsif ($target->{type} eq 'outside') {
	269
	270	$chain = 'PVEFW-FORWARD';
	271	$pkg->{iface_in} = 'venet0';
	272	$pkg->{iface_out} = $outside_bridge;
	273	$next_route_state = $outside_iface;
	274
c0c871d8 DM	275	} elsif ($target->{type} eq 'nfvm') {
	276
	277	$chain = 'PVEFW-FORWARD';
	278	$pkg->{iface_in} = 'venet0';
	279	$pkg->{iface_out} = $nfvm_bridge;
	280	$next_route_state = $nfvm_iface;
	281
d1486f38 DM	282	} elsif ($target->{type} eq 'vm') {
	283
	284	$chain = 'PVEFW-FORWARD';
	285	$pkg->{iface_in} = 'venet0';
	286	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	287	$next_route_state = 'fwbr-in';
	288
	289	} elsif ($target->{type} eq 'ct') {
	290
	291	$chain = 'PVEFW-FORWARD';
	292	$pkg->{iface_in} = 'venet0';
	293	$pkg->{iface_out} = 'venet0';
	294	$next_route_state = 'venet-in';
	295
	296	} else {
	297	die "implement me";
	298	}
	299
	300	} elsif ($route_state eq 'fwbr-out') {
	301
	302	$chain = 'PVEFW-FORWARD';
	303	$next_route_state = $from_info->{bridge} \|\| die 'internal error';
	304	$next_physdev_in = $from_info->{fwpr} \|\| die 'internal error';
	305	$pkg->{iface_in} = $from_info->{fwbr} \|\| die 'internal error';
	306	$pkg->{iface_out} = $from_info->{fwbr} \|\| die 'internal error';
	307	$pkg->{physdev_in} = $from_info->{tapdev} \|\| die 'internal error';
	308	$pkg->{physdev_out} = $from_info->{fwln} \|\| die 'internal error';
	309
	310	} elsif ($route_state eq 'fwbr-in') {
	311
	312	$chain = 'PVEFW-FORWARD';
	313	$next_route_state = $target->{tapdev};
	314	$pkg->{iface_in} = $target->{fwbr} \|\| die 'internal error';
	315	$pkg->{iface_out} = $target->{fwbr} \|\| die 'internal error';
	316	$pkg->{physdev_in} = $target->{fwln} \|\| die 'internal error';
	317	$pkg->{physdev_out} = $target->{tapdev} \|\| die 'internal error';
	318
	319	} elsif ($route_state =~ m/^vmbr\d+$/) {
	320
	321	die "missing physdev_in - internal error?" if !$physdev_in;
eb5faed9	322	$pkg->{physdev_in} = $physdev_in;
d1486f38 DM	323
	324	if ($target->{type} eq 'host') {
	325
	326	$chain = 'PVEFW-INPUT';
	327	$pkg->{iface_in} = $route_state;
	328	$pkg->{iface_out} = 'lo';
	329	$next_route_state = 'host';
	330
31dc73f1 DM	331	} elsif ($target->{type} eq 'outside') {
	332
	333	$chain = 'PVEFW-FORWARD';
	334	$pkg->{iface_in} = $route_state;
	335	$pkg->{iface_out} = $outside_bridge;
31dc73f1 DM	336	# conditionally set physdev_out (same behavior as kernel)
	337	if ($route_state eq $outside_bridge) {
	338	$pkg->{physdev_out} = $outside_iface \|\| die 'internal error';
	339	}
	340	$next_route_state = $outside_iface;
	341
c0c871d8 DM	342	} elsif ($target->{type} eq 'nfvm') {
	343
	344	$chain = 'PVEFW-FORWARD';
	345	$pkg->{iface_in} = $route_state;
	346	$pkg->{iface_out} = $nfvm_bridge;
	347	# conditionally set physdev_out (same behavior as kernel)
	348	if ($route_state eq $nfvm_bridge) {
	349	$pkg->{physdev_out} = $nfvm_iface \|\| die 'internal error';
	350	}
	351	$next_route_state = $nfvm_iface;
	352
d1486f38 DM	353	} elsif ($target->{type} eq 'ct') {
	354
	355	$chain = 'PVEFW-FORWARD';
	356	$pkg->{iface_in} = $route_state;
	357	$pkg->{iface_out} = 'venet0';
	358	$next_route_state = 'venet-in';
	359
	360	} elsif ($target->{type} eq 'vm') {
	361
	362	$chain = 'PVEFW-FORWARD';
31dc73f1 DM	363	$pkg->{iface_in} = $route_state;
31dc73f1 DM	364	$pkg->{iface_out} = $target->{bridge};
31dc73f1	365	# conditionally set physdev_out (same behavior as kernel)
d1486f38	366	if ($route_state eq $target->{bridge}) {
d1486f38	367	$pkg->{physdev_out} = $target->{fwpr} \|\| die 'internal error';
d1486f38 DM	368	}
	369	$next_route_state = 'fwbr-in';
	370
	371	} else {
	372	die "implement me";
	373	}
	374
	375	} else {
	376	die "implement me $route_state";
	377	}
	378
	379	die "internal error" if !defined($next_route_state);
	380
	381	if ($chain) {
	382	add_trace("IPT check at $route_state (chain $chain)\n");
	383	add_trace(Dumper($pkg));
111cce51 DM	384	$ipt_invocation_counter++;
	385	my ($res, $ctr) = ruleset_simulate_chain($ruleset, $chain, $pkg);
	386	$rule_check_counter += $ctr;
	387	return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
d1486f38 DM	388	}
	389
	390	$route_state = $next_route_state;
	391
	392	$physdev_in = $next_physdev_in;
	393	}
	394
111cce51	395	return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
d1486f38 DM	396	}
	397
	398	sub extract_ct_info {
	399	my ($vmdata, $vmid) = @_;
	400
	401	my $info = { type => 'ct', vmid => $vmid };
	402
	403	my $conf = $vmdata->{openvz}->{$vmid} \|\| die "no such CT '$vmid'";
	404	if ($conf->{ip_address}) {
	405	$info->{ip_address} = $conf->{ip_address}->{value};
	406	} else {
	407	die "implement me";
	408	}
	409	return $info;
	410	}
	411
	412	sub extract_vm_info {
	413	my ($vmdata, $vmid) = @_;
	414
	415	my $info = { type => 'vm', vmid => $vmid };
	416
	417	my $conf = $vmdata->{qemu}->{$vmid} \|\| die "no such VM '$vmid'";
	418	my $net = PVE::QemuServer::parse_net($conf->{net0});
	419	$info->{macaddr} = $net->{macaddr} \|\| die "unable to get mac address";
	420	$info->{bridge} = $net->{bridge} \|\| die "unable to get bridge";
	421	$info->{fwbr} = "fwbr${vmid}i0";
	422	$info->{tapdev} = "tap${vmid}i0";
	423	$info->{fwln} = "fwln${vmid}i0";
	424	$info->{fwpr} = "fwpr${vmid}p0";
	425
	426	return $info;
	427	}
f1bafd37 DM	428
	429	sub simulate_firewall {
	430	my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
	431
	432	my $from = delete $test->{from} \|\| die "missing 'from' field";
	433	my $to = delete $test->{to} \|\| die "missing 'to' field";
	434	my $action = delete $test->{action} \|\| die "missing 'action'";
8215a0da DM	435
	436	my $testid = delete $test->{id};
	437
f1bafd37 DM	438	die "from/to needs to be different" if $from eq $to;
	439
	440	my $pkg = {
f1bafd37	441	proto => 'tcp',
8215a0da DM	442	sport => undef,
	443	dport => undef,
	444	source => undef,
	445	dest => undef,
f1bafd37 DM	446	};
	447
	448	while (my ($k,$v) = each %$test) {
8215a0da	449	die "unknown attribute '$k'\n" if !exists($pkg->{$k});
f1bafd37 DM	450	$pkg->{$k} = $v;
	451	}
	452
d1486f38 DM	453	my $from_info = {};
	454
	455	my $start_state;
f1bafd37 DM	456
f1bafd37 DM	457	if ($from eq 'host') {
d1486f38 DM	458	$from_info->{type} = 'host';
d1486f38 DM	459	$start_state = 'host';
31dc73f1 DM	460	} elsif ($from eq 'outside') {
	461	$from_info->{type} = 'outside';
	462	$start_state = 'from-outside';
c0c871d8 DM	463	} elsif ($from eq 'nfvm') {
	464	$from_info->{type} = 'nfvm';
	465	$start_state = 'from-nfvm';
f1bafd37 DM	466	} elsif ($from =~ m/^ct(\d+)$/) {
f1bafd37 DM	467	my $vmid = $1;
d1486f38 DM	468	$from_info = extract_ct_info($vmdata, $vmid);
	469	if ($from_info->{ip_address}) {
	470	$pkg->{source} = $from_info->{ip_address};
	471	$start_state = 'venet-out';
f1bafd37 DM	472	} else {
	473	die "implement me";
	474	}
f1bafd37 DM	475	} elsif ($from =~ m/^vm(\d+)$/) {
f1bafd37 DM	476	my $vmid = $1;
d1486f38 DM	477	$from_info = extract_vm_info($vmdata, $vmid);
	478	$start_state = 'fwbr-out';
	479	$pkg->{mac_source} = $from_info->{macaddr};
f1bafd37 DM	480	} else {
	481	die "implement me";
	482	}
	483
d1486f38 DM	484	my $target;
d1486f38 DM	485
f1bafd37	486	if ($to eq 'host') {
d1486f38 DM	487	$target->{type} = 'host';
d1486f38 DM	488	$target->{iface} = 'host';
31dc73f1 DM	489	} elsif ($to eq 'outside') {
	490	$target->{type} = 'outside';
	491	$target->{iface} = $outside_iface;
c0c871d8 DM	492	} elsif ($to eq 'nfvm') {
	493	$target->{type} = 'nfvm';
	494	$target->{iface} = $nfvm_iface;
f1bafd37 DM	495	} elsif ($to =~ m/^ct(\d+)$/) {
f1bafd37 DM	496	my $vmid = $1;
d1486f38 DM	497	$target = extract_ct_info($vmdata, $vmid);
	498	$target->{iface} = 'venet-in';
	499
	500	if ($target->{ip_address}) {
	501	$pkg->{dest} = $target->{ip_address};
f1bafd37 DM	502	} else {
	503	die "implement me";
	504	}
f1bafd37 DM	505	} elsif ($to =~ m/^vm(\d+)$/) {
f1bafd37 DM	506	my $vmid = $1;
d1486f38 DM	507	$target = extract_vm_info($vmdata, $vmid);
d1486f38 DM	508	$target->{iface} = $target->{tapdev};
f1bafd37 DM	509	} else {
	510	die "implement me";
	511	}
	512
111cce51 DM	513	my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
111cce51 DM	514	$from_info, $target, $start_state);
f1bafd37	515
111cce51 DM	516	add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
111cce51 DM	517
d1486f38	518	die "test failed ($res != $action)\n" if $action ne $res;
f1bafd37	519
d1486f38	520	return undef;
f1bafd37 DM	521	}
	522
	523	sub run_tests {
ec2e28f6 DM	524	my ($vmdata, $testdir, $testfile, $testid) = @_;
	525
	526	$testfile = 'tests' if !$testfile;
f1bafd37 DM	527
	528	$vmdata->{testdir} = $testdir;
	529
	530	my ($ruleset, $ipset_ruleset) =
	531	PVE::Firewall::compile(undef, undef, $vmdata);
	532
ec2e28f6 DM	533	my $filename = "$testdir/$testfile";
	534	my $fh = IO::File->new($filename) \|\|
	535	die "unable to open '$filename' - $!\n";
f1bafd37	536
ec2e28f6	537	my $testcount = 0;
f1bafd37 DM	538	while (defined(my $line = <$fh>)) {
	539	next if $line =~ m/^\s*$/;
	540	next if $line =~ m/^#.*$/;
	541	if ($line =~ m/^\{.\}\s$/) {
	542	my $test = eval $line;
	543	die $@ if $@;
ec2e28f6	544	next if defined($testid) && (!defined($test->{id}) \|\| ($testid ne $test->{id}));
f1bafd37	545	$trace = '';
d1486f38	546	print Dumper($ruleset) if $debug;
ec2e28f6	547	$testcount++;
f1bafd37 DM	548	eval { simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test); };
	549	if (my $err = $@) {
	550
d1486f38	551	print Dumper($ruleset) if !$debug;
f1bafd37	552
d1486f38	553	print "$trace\n" if !$debug;
f1bafd37	554
ec2e28f6	555	print "$filename line $.: $line";
f1bafd37 DM	556
	557	print "test failed: $err\n";
	558
	559	exit(-1);
	560	}
	561	} else {
	562	die "parse error";
	563	}
	564	}
	565
ec2e28f6 DM	566	die "no tests found\n" if $testcount <= 0;
	567
	568	print "PASS: $filename\n";
f1bafd37 DM	569
	570	return undef;
	571	}
	572
	573	my $vmdata = {
	574	qemu => {
	575	100 => {
d1486f38 DM	576	net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0",
	577	},
	578	101 => {
	579	net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0",
	580	},
	581	# on bridge vmbr1
	582	110 => {
	583	net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1",
f1bafd37 DM	584	},
	585	},
	586	openvz => {
	587	200 => {
	588	ip_address => { value => '10.0.200.1' },
	589	},
d1486f38 DM	590	201 => {
	591	ip_address => { value => '10.0.200.2' },
	592	},
f1bafd37 DM	593	},
	594	};
	595
ec2e28f6 DM	596	if ($testfilename) {
	597	my $testfile;
	598	my $dir;
	599
	600	if (-d $testfilename) {
	601	$dir = $testfilename;
	602	} elsif (-f $testfilename) {
	603	$dir = dirname($testfilename);
	604	$testfile = basename($testfilename);
	605	} else {
	606	die "no such file/dir '$testfilename'\n";
	607	}
	608
	609	run_tests($vmdata, $dir, $testfile, $testid);
	610
	611	} else {
	612	foreach my $dir (<test-*>) {
	613	next if ! -d $dir;
	614	run_tests($vmdata, $dir);
	615	}
f1bafd37 DM	616	}
	617
	618	print "OK - all tests passed\n";
	619
	620	exit(0);