[pve-firewall.git] / test / fwtester.pl

#!/usr/bin/perl

use lib '../src';
use strict;
use warnings;
use Data::Dumper;
use PVE::Firewall;
use Getopt::Long;
use File::Basename;
use Net::IP;

my $mark;
my $trace;

my $debug = 0;

sub print_usage_and_exit {
    die "usage: $0 [--debug] [testfile [testid]]\n";
}

if (!GetOptions ('debug' => \$debug)) {
    print_usage_and_exit();
}

my $testfilename = shift;
my $testid = shift;

sub add_trace {
    my ($text) = @_;

    if ($debug) {
	print $text;
    } else {
	$trace .= $text;
    }
}

sub nf_dev_match {
    my ($devre, $dev) = @_;

    $devre =~ s/\+$/\.\*/;
    return  ($dev =~ m/^${devre}$/) ? 1 : 0;
}

sub ipset_match {
    my ($ipsetname, $ipset, $ipaddr) = @_;

    my $ip = Net::IP->new($ipaddr);

    foreach my $entry (@$ipset) {
	next if $entry =~ m/^create/; # simply ignore
	if ($entry =~ m/add \S+ (\S+)$/) {
	    my $test = Net::IP->new($1);
	    if ($test->overlaps($ip)) {
		add_trace("IPSET $ipsetname match $ipaddr\n");
		return 1;
	    }
	} else {
	    die "implement me";
	}
    }

    return 0;
}

sub rule_match {
    my ($ipset_ruleset, $chain, $rule, $pkg) = @_;

    $rule =~ s/^-A $chain // || die "got strange rule: $rule";

    while (length($rule)) {

	if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
	    my $cstate = $1;

	    return undef if $cstate eq 'INVALID'; # no match
	    return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
	    
	    next if $cstate =~ m/NEW/;
	    
	    die "please implement cstate test '$cstate'";
	}

	if ($rule =~ s/^-m addrtype\s*//) {
	    return undef; # simply ignore
	}

	if ($rule =~ s/^-i (\S+)\s*//) {
	    my $devre = $1;
	    die "missing iface_in" if !$pkg->{iface_in};
	    return undef if !nf_dev_match($devre, $pkg->{iface_in});
	    next;
	}

	if ($rule =~ s/^-o (\S+)\s*//) {
	    my $devre = $1;
	    die "missing iface_out" if !$pkg->{iface_out};
	    return undef if !nf_dev_match($devre, $pkg->{iface_out});
	    next;
	}

	if ($rule =~ s/^-p (tcp|udp)\s*//) {
	    die "missing proto" if !$pkg->{proto};
	    return undef if $pkg->{proto} ne $1; # no match
	    next;
	}

	if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
	    die "missing dport" if !$pkg->{dport};
	    return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
	    next;
	}

	if ($rule =~ s/^--dport (\d+)\s*//) {
	    die "missing dport" if !$pkg->{dport};
	    return undef if $pkg->{dport} != $1; # no match
	    next;
	}

	if ($rule =~ s/^-s (\S+)\s*//) {
	    die "missing source" if !$pkg->{source};
	    my $ip = Net::IP->new($1);
	    return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
	    next;
	}
    
	if ($rule =~ s/^-d (\S+)\s*//) {
	    die "missing destination" if !$pkg->{dest};
	    my $ip = Net::IP->new($1);
	    return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
	    next;
	}

	if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
	    die "missing source" if !$pkg->{source};
	    my $ipset = $ipset_ruleset->{$1};
	    die "no such ip set '$1'" if !$ipset;
	    return undef if !ipset_match($1, $ipset, $pkg->{source});
	    next;
	}

	if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
	    die "missing destination" if !$pkg->{dest};
	    my $ipset = $ipset_ruleset->{$1};
	    die "no such ip set '$1'" if !$ipset;
	    return undef if !ipset_match($1, $ipset, $pkg->{dest});
	    next;
	}

	if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
	    die "missing source mac" if !$pkg->{mac_source};
	    return undef if $pkg->{mac_source} eq $1; # no match
	    next;
	}

	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
	    my $devre = $1;
	    return undef if !$pkg->{physdev_in};
	    return undef if !nf_dev_match($devre, $pkg->{physdev_in});
	    next;
	}

	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
	    my $devre = $1;
	    return undef if !$pkg->{physdev_out};
	    return undef if !nf_dev_match($devre, $pkg->{physdev_out});
	    next;
	}

	if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
	    return undef if !defined($mark) || $mark != $1;
	    next;
	}

	# final actions

	if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
	    $mark = $1;
	    return undef;
	}

	if ($rule =~ s/^-j (\S+)\s*$//) {
	    return (0, $1);
	}

	if ($rule =~ s/^-g (\S+)\s*$//) {
	    return (1, $1);
	}

	if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
	    return undef; 
	}

	last;
    }

    die "unable to parse rule: $rule";
}

sub ruleset_simulate_chain {
    my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;

    add_trace("ENTER chain $chain\n");
    
    my $counter = 0;

    if ($chain eq 'PVEFW-Drop') {
	add_trace("LEAVE chain $chain\n");
	return ('DROP', $counter);
    }
    if ($chain eq 'PVEFW-reject') {
	add_trace("LEAVE chain $chain\n");
	return ('REJECT', $counter);
    }

    if ($chain eq 'PVEFW-tcpflags') {
	add_trace("LEAVE chain $chain\n");
	return (undef, $counter);
    }

    my $rules = $ruleset->{$chain} ||
	die "no such chain '$chain'";

    foreach my $rule (@$rules) {
	$counter++;
	my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
	if (!defined($action)) {
	    add_trace("SKIP: $rule\n");
	    next;
	}
	add_trace("MATCH: $rule\n");
	
	if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
	    add_trace("TERMINATE chain $chain: $action\n");
	    return ($action, $counter);
	} elsif ($action eq 'RETURN') {
	    add_trace("RETURN FROM chain $chain\n");
	    last;
	} else {
	    if ($goto) {
		add_trace("LEAVE chain $chain - goto $action\n");
		return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
		#$chain = $action;
		#$rules = $ruleset->{$chain} || die "no such chain '$chain'";
	    } else {
		my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
		$counter += $ctr;
		return ($act, $counter) if $act;
		add_trace("CONTINUE chain $chain\n");
	    }
	}
    }

    add_trace("LEAVE chain $chain\n");
    if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
	return ('ACCEPT', $counter); # default policy
    }

    return (undef, $counter);
}

sub copy_packet {
    my ($pkg) = @_;

    my $res = {};

    while (my ($k,$v) = each %$pkg) {
	$res->{$k} = $v;
    }

    return $res;
}

# Try to simulate packet traversal inside kernel. This invokes iptable
# checks several times.
sub route_packet {
    my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;

    my $route_state = $start_state;

    my $physdev_in;

    my $ipt_invocation_counter = 0;
    my $rule_check_counter = 0;

    while ($route_state ne $target->{iface}) {

	my $chain;
	my $next_route_state;
	my $next_physdev_in;

	$pkg->{iface_in} = $pkg->{iface_out} = undef;
	$pkg->{physdev_in} = $pkg->{physdev_out} = undef;

	if ($route_state eq 'from-bport') {
	    $next_route_state = $from_info->{bridge} || die 'internal error';
	    $next_physdev_in = $from_info->{iface} || die 'internal error';
	} elsif ($route_state eq 'host') {

	    if ($target->{type} eq 'bport') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = $target->{iface} || die 'internal error';
	    } elsif ($target->{type} eq 'ct') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = 'venet0';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = 'venet-in';
	    } elsif ($target->{type} eq 'vm') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = 'fwbr-in';
	    } else {
		die "implement me";
	    }

	} elsif ($route_state eq 'venet-out') {

	    if ($target->{type} eq 'host') {

		$chain = 'PVEFW-INPUT';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = 'lo';
		$next_route_state = 'host';

	    } elsif ($target->{type} eq 'bport') {
		
		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$next_route_state = $target->{iface} || die 'internal error';

	    } elsif ($target->{type} eq 'vm') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$next_route_state = 'fwbr-in';

	    } elsif ($target->{type} eq 'ct') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = 'venet0';
		$next_route_state = 'venet-in';

	    } else {
		die "implement me";
	    }

	} elsif ($route_state eq 'fwbr-out') {

	    $chain = 'PVEFW-FORWARD';
	    $next_route_state = $from_info->{bridge} || die 'internal error';
	    $next_physdev_in = $from_info->{fwpr} || die 'internal error';
	    $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
	    $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
	    $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
	    $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
	
	} elsif ($route_state eq 'fwbr-in') {

	    $chain = 'PVEFW-FORWARD';
	    $next_route_state = $target->{tapdev};
	    $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
	    $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
	    $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
	    $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';

	} elsif ($route_state =~ m/^vmbr\d+$/) {
	    
	    die "missing physdev_in - internal error?" if !$physdev_in;
	    $pkg->{physdev_in} = $physdev_in;

	    if ($target->{type} eq 'host') {

		$chain = 'PVEFW-INPUT';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = 'lo';
		$next_route_state = 'host';

	    } elsif ($target->{type} eq 'bport') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		# conditionally set physdev_out (same behavior as kernel)
		if ($route_state eq $target->{bridge}) {
		    $pkg->{physdev_out} = $target->{iface} || die 'internal error';
		}
		$next_route_state = $target->{iface};

	    } elsif ($target->{type} eq 'ct') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = 'venet0';
		$next_route_state = 'venet-in';

	    } elsif ($target->{type} eq 'vm') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = $target->{bridge};
		# conditionally set physdev_out (same behavior as kernel)
		if ($route_state eq $target->{bridge}) {
		    $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
		}
		$next_route_state = 'fwbr-in';

	    } else {
		die "implement me";
	    }

	} else {
	    die "implement me $route_state";
	}

	die "internal error" if !defined($next_route_state);

	if ($chain) {
	    add_trace("IPT check at $route_state (chain $chain)\n");
	    add_trace(Dumper($pkg));
	    $ipt_invocation_counter++;
	    my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
	    $rule_check_counter += $ctr;
	    return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
	} 

	$route_state = $next_route_state;

	$physdev_in = $next_physdev_in;
    }

    return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
}

sub extract_ct_info {
    my ($vmdata, $vmid) = @_;

    my $info = { type => 'ct', vmid => $vmid };

    my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
    if ($conf->{ip_address}) {
	$info->{ip_address} = $conf->{ip_address}->{value};
    } else {
	die "implement me";
    }
    return $info;
}

sub extract_vm_info {
    my ($vmdata, $vmid) = @_;

    my $info = { type => 'vm', vmid => $vmid };

    my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
    my $net = PVE::QemuServer::parse_net($conf->{net0});
    $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
    $info->{bridge} = $net->{bridge} || die "unable to get bridge";
    $info->{fwbr} = "fwbr${vmid}i0";
    $info->{tapdev} = "tap${vmid}i0";
    $info->{fwln} = "fwln${vmid}i0";
    $info->{fwpr} = "fwpr${vmid}p0";

    return $info;
}

sub simulate_firewall {
    my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;

    my $from = $test->{from} || die "missing 'from' field";
    my $to = $test->{to} || die "missing 'to' field";
    my $action = $test->{action} || die "missing 'action'";
    
    my $testid = $test->{id};
    
    die "from/to needs to be different" if $from eq $to;

    my $pkg = {
	proto => 'tcp',
	sport => undef,
	dport => undef,
	source => undef,
	dest => undef,
    };

    while (my ($k,$v) = each %$test) {
	next if $k eq 'from';
	next if $k eq 'to';
	next if $k eq 'action';
	next if $k eq 'id';
	die "unknown attribute '$k'\n" if !exists($pkg->{$k});
	$pkg->{$k} = $v;
    }

    my $from_info = {};

    my $start_state;

    my $host_ip = '10.11.12.13';

    if ($from eq 'host') {
	$from_info->{type} = 'host';
	$start_state = 'host';
	$pkg->{source} = $host_ip if !defined($pkg->{source});
    } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
	$from_info->{type} = 'bport';
	$from_info->{bridge} = $1;
	$from_info->{iface} = $2;
	$start_state = 'from-bport';
    } elsif ($from eq 'outside') {
	$from_info->{type} = 'bport';
	$from_info->{bridge} = 'vmbr0';
	$from_info->{iface} = 'eth0';
	$start_state = 'from-bport';
    } elsif ($from eq 'nfvm') {
	$from_info->{type} = 'bport';
	$from_info->{bridge} = 'vmbr0';
	$from_info->{iface} = 'tapXYZ';
	$start_state = 'from-bport';
    } elsif ($from =~ m/^ct(\d+)$/) {
	my $vmid = $1;
	$from_info = extract_ct_info($vmdata, $vmid);
	if ($from_info->{ip_address}) {
	    $pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
	    $start_state = 'venet-out';
	} else {
	    die "implement me";
	}
    } elsif ($from =~ m/^vm(\d+)$/) {
	my $vmid = $1;
	$from_info = extract_vm_info($vmdata, $vmid);
	$start_state = 'fwbr-out'; 
	$pkg->{mac_source} = $from_info->{macaddr};
    } else {
	die "unable to parse \"from => '$from'\"\n";
    }

    my $target;

    if ($to eq 'host') {
	$target->{type} = 'host';
	$target->{iface} = 'host';
	$pkg->{dest} = $host_ip if !defined($pkg->{dest});
    } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
	$target->{type} = 'bport';
	$target->{bridge} = $1;
	$target->{iface} = $2;
    } elsif ($to eq 'outside') {
	$target->{type} = 'bport';
	$target->{bridge} = 'vmbr0';
	$target->{iface} = 'eth0';
     } elsif ($to eq 'nfvm') {
	$target->{type} = 'bport';
	$target->{bridge} = 'vmbr0';
	$target->{iface} = 'tapXYZ';
    } elsif ($to =~ m/^ct(\d+)$/) {
	my $vmid = $1;
	$target = extract_ct_info($vmdata, $vmid);
	$target->{iface} = 'venet-in';

	if ($target->{ip_address}) {
	    $pkg->{dest} = $target->{ip_address};
	} else {
	    die "implement me";
	}
   } elsif ($to =~ m/^vm(\d+)$/) {
	my $vmid = $1;
	$target = extract_vm_info($vmdata, $vmid);
	$target->{iface} = $target->{tapdev};
    } else {
	die "unable to parse \"to => '$to'\"\n";
    }

    $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
    $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});

    my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg, 
				       $from_info, $target, $start_state);

    add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 
    die "test failed ($res != $action)\n" if $action ne $res;

    return undef; 
}

sub run_tests {
    my ($vmdata, $testdir, $testfile, $testid) = @_;

    $testfile = 'tests' if !$testfile;

    $vmdata->{testdir} = $testdir;

    my ($ruleset, $ipset_ruleset) = 
	PVE::Firewall::compile(undef, undef, $vmdata);

    my $filename = "$testdir/$testfile";
    my $fh = IO::File->new($filename) ||
	die "unable to open '$filename' - $!\n";

    my $testcount = 0;
    while (defined(my $line = <$fh>)) {
	next if $line =~ m/^\s*$/;
	next if $line =~ m/^#.*$/;
	if ($line =~ m/^\{.*\}\s*$/) {
	    my $test = eval $line;
	    die $@ if $@;
	    next if defined($testid) && (!defined($test->{id}) || ($testid ne $test->{id}));
	    $trace = '';
	    print Dumper($ruleset) if $debug;
	    $testcount++;
	    eval {
		my @test_zones = qw(host outside nfvm vm100 ct200);
		if (!defined($test->{from}) && !defined($test->{to})) {
		    die "missing zone speification (from, to)\n";
		} elsif (!defined($test->{to})) {
		    foreach my $zone (@test_zones) {
			next if $zone eq $test->{from};
			$test->{to} = $zone;
			add_trace("Set Zone: to => '$zone'\n"); 
			simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
		    }
		} elsif (!defined($test->{from})) {
		    foreach my $zone (@test_zones) {
			next if $zone eq $test->{to};
			$test->{from} = $zone;
			add_trace("Set Zone: from => '$zone'\n"); 
			simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
		    }
		} else {
		    simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
		}
	    };
	    if (my $err = $@) {

		print Dumper($ruleset) if !$debug;

		print "$trace\n" if !$debug;

		print "$filename line $.: $line";

		print "test failed: $err\n";

		exit(-1);
	    }
	} else {
	    die "parse error";
	}
    }

    die "no tests found\n" if $testcount <= 0;

    print "PASS: $filename\n";

    return undef;
}

my $vmdata = {
    qemu => {
	100 => {
	    net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
	},
	101 => {
	    net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
	},
	# on bridge vmbr1
	110 => {
	    net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
	},
    },
    openvz => {
	200 => {
	    ip_address => { value => '10.0.200.1' },
	},
	201 => {
	    ip_address => { value => '10.0.200.2' },
	},
    },
};

if ($testfilename) {
    my $testfile;
    my $dir;

    if (-d $testfilename) {
	$dir = $testfilename;
    } elsif (-f $testfilename) {
	$dir = dirname($testfilename);
	$testfile = basename($testfilename);
    } else {
	die "no such file/dir '$testfilename'\n"; 
    }

    run_tests($vmdata, $dir, $testfile, $testid);

} else { 
    foreach my $dir (<test-*>) {
	next if ! -d $dir;
	run_tests($vmdata, $dir);
    }
}

print "OK - all tests passed\n";

exit(0);
Commit	Line	Data
f1bafd37 DM	1	#!/usr/bin/perl
	2
	3	use lib '../src';
	4	use strict;
	5	use warnings;
	6	use Data::Dumper;
	7	use PVE::Firewall;
ec2e28f6 DM	8	use Getopt::Long;
ec2e28f6 DM	9	use File::Basename;
680d56ee	10	use Net::IP;
f1bafd37 DM	11
	12	my $mark;
	13	my $trace;
	14
d1486f38 DM	15	my $debug = 0;
d1486f38 DM	16
ec2e28f6 DM	17	sub print_usage_and_exit {
	18	die "usage: $0 [--debug] [testfile [testid]]\n";
	19	}
	20
	21	if (!GetOptions ('debug' => \$debug)) {
	22	print_usage_and_exit();
	23	}
	24
	25	my $testfilename = shift;
	26	my $testid = shift;
	27
d1486f38 DM	28	sub add_trace {
	29	my ($text) = @_;
	30
	31	if ($debug) {
	32	print $text;
	33	} else {
	34	$trace .= $text;
	35	}
	36	}
	37
e4e5fcaf DM	38	sub nf_dev_match {
	39	my ($devre, $dev) = @_;
	40
	41	$devre =~ s/\+$/\.\*/;
	42	return ($dev =~ m/^${devre}$/) ? 1 : 0;
	43	}
	44
292e0ad9 DM	45	sub ipset_match {
	46	my ($ipsetname, $ipset, $ipaddr) = @_;
	47
	48	my $ip = Net::IP->new($ipaddr);
	49
	50	foreach my $entry (@$ipset) {
	51	next if $entry =~ m/^create/; # simply ignore
	52	if ($entry =~ m/add \S+ (\S+)$/) {
	53	my $test = Net::IP->new($1);
	54	if ($test->overlaps($ip)) {
	55	add_trace("IPSET $ipsetname match $ipaddr\n");
	56	return 1;
	57	}
	58	} else {
	59	die "implement me";
	60	}
	61	}
	62
	63	return 0;
	64	}
	65
f1bafd37	66	sub rule_match {
292e0ad9	67	my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
f1bafd37 DM	68
	69	$rule =~ s/^-A $chain // \|\| die "got strange rule: $rule";
	70
680d56ee DM	71	while (length($rule)) {
680d56ee DM	72
832cd14c DM	73	if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
	74	my $cstate = $1;
	75
	76	return undef if $cstate eq 'INVALID'; # no match
	77	return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
	78
	79	next if $cstate =~ m/NEW/;
	80
	81	die "please implement cstate test '$cstate'";
680d56ee DM	82	}
	83
	84	if ($rule =~ s/^-m addrtype\s*//) {
	85	return undef; # simply ignore
	86	}
	87
	88	if ($rule =~ s/^-i (\S+)\s*//) {
	89	my $devre = $1;
	90	die "missing iface_in" if !$pkg->{iface_in};
	91	return undef if !nf_dev_match($devre, $pkg->{iface_in});
	92	next;
	93	}
	94
	95	if ($rule =~ s/^-o (\S+)\s*//) {
	96	my $devre = $1;
	97	die "missing iface_out" if !$pkg->{iface_out};
	98	return undef if !nf_dev_match($devre, $pkg->{iface_out});
	99	next;
	100	}
	101
	102	if ($rule =~ s/^-p (tcp\|udp)\s*//) {
	103	die "missing proto" if !$pkg->{proto};
	104	return undef if $pkg->{proto} ne $1; # no match
	105	next;
	106	}
	107
	108	if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
	109	die "missing dport" if !$pkg->{dport};
	110	return undef if ($pkg->{dport} < $1) \|\| ($pkg->{dport} > $2); # no match
	111	next;
	112	}
	113
	114	if ($rule =~ s/^--dport (\d+)\s*//) {
	115	die "missing dport" if !$pkg->{dport};
	116	return undef if $pkg->{dport} != $1; # no match
	117	next;
	118	}
	119
	120	if ($rule =~ s/^-s (\S+)\s*//) {
	121	die "missing source" if !$pkg->{source};
	122	my $ip = Net::IP->new($1);
	123	return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
	124	next;
	125	}
f1bafd37	126
680d56ee DM	127	if ($rule =~ s/^-d (\S+)\s*//) {
	128	die "missing destination" if !$pkg->{dest};
	129	my $ip = Net::IP->new($1);
	130	return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
	131	next;
	132	}
	133
292e0ad9 DM	134	if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
	135	die "missing source" if !$pkg->{source};
	136	my $ipset = $ipset_ruleset->{$1};
	137	die "no such ip set '$1'" if !$ipset;
	138	return undef if !ipset_match($1, $ipset, $pkg->{source});
	139	next;
	140	}
	141
	142	if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
	143	die "missing destination" if !$pkg->{dest};
	144	my $ipset = $ipset_ruleset->{$1};
	145	die "no such ip set '$1'" if !$ipset;
	146	return undef if !ipset_match($1, $ipset, $pkg->{dest});
	147	next;
	148	}
	149
680d56ee DM	150	if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
	151	die "missing source mac" if !$pkg->{mac_source};
	152	return undef if $pkg->{mac_source} eq $1; # no match
	153	next;
	154	}
	155
	156	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
	157	my $devre = $1;
	158	return undef if !$pkg->{physdev_in};
	159	return undef if !nf_dev_match($devre, $pkg->{physdev_in});
	160	next;
	161	}
	162
	163	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
	164	my $devre = $1;
	165	return undef if !$pkg->{physdev_out};
	166	return undef if !nf_dev_match($devre, $pkg->{physdev_out});
	167	next;
	168	}
	169
	170	if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
	171	return undef if !defined($mark) \|\| $mark != $1;
	172	next;
	173	}
	174
	175	# final actions
292e0ad9	176
680d56ee DM	177	if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
	178	$mark = $1;
	179	return undef;
	180	}
	181
	182	if ($rule =~ s/^-j (\S+)\s*$//) {
	183	return (0, $1);
	184	}
	185
	186	if ($rule =~ s/^-g (\S+)\s*$//) {
	187	return (1, $1);
	188	}
	189
292e0ad9 DM	190	if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
	191	return undef;
	192	}
	193
680d56ee	194	last;
f1bafd37 DM	195	}
	196
	197	die "unable to parse rule: $rule";
	198	}
	199
	200	sub ruleset_simulate_chain {
292e0ad9	201	my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
f1bafd37	202
d1486f38	203	add_trace("ENTER chain $chain\n");
f1bafd37	204
6a84e461	205	my $counter = 0;
111cce51	206
f1bafd37	207	if ($chain eq 'PVEFW-Drop') {
d1486f38	208	add_trace("LEAVE chain $chain\n");
111cce51	209	return ('DROP', $counter);
f1bafd37 DM	210	}
f1bafd37 DM	211	if ($chain eq 'PVEFW-reject') {
d1486f38	212	add_trace("LEAVE chain $chain\n");
111cce51	213	return ('REJECT', $counter);
f1bafd37 DM	214	}
	215
	216	if ($chain eq 'PVEFW-tcpflags') {
d1486f38	217	add_trace("LEAVE chain $chain\n");
111cce51	218	return (undef, $counter);
f1bafd37 DM	219	}
	220
	221	my $rules = $ruleset->{$chain} \|\|
	222	die "no such chain '$chain'";
	223
	224	foreach my $rule (@$rules) {
111cce51	225	$counter++;
292e0ad9	226	my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
f1bafd37	227	if (!defined($action)) {
d1486f38	228	add_trace("SKIP: $rule\n");
f1bafd37 DM	229	next;
f1bafd37 DM	230	}
d1486f38	231	add_trace("MATCH: $rule\n");
f1bafd37 DM	232
f1bafd37 DM	233	if ($action eq 'ACCEPT' \|\| $action eq 'DROP' \|\| $action eq 'REJECT') {
d1486f38	234	add_trace("TERMINATE chain $chain: $action\n");
111cce51	235	return ($action, $counter);
f1bafd37	236	} elsif ($action eq 'RETURN') {
d1486f38	237	add_trace("RETURN FROM chain $chain\n");
f1bafd37 DM	238	last;
	239	} else {
	240	if ($goto) {
d1486f38	241	add_trace("LEAVE chain $chain - goto $action\n");
292e0ad9	242	return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
f1bafd37 DM	243	#$chain = $action;
	244	#$rules = $ruleset->{$chain} \|\| die "no such chain '$chain'";
	245	} else {
292e0ad9	246	my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
111cce51 DM	247	$counter += $ctr;
111cce51 DM	248	return ($act, $counter) if $act;
d1486f38	249	add_trace("CONTINUE chain $chain\n");
f1bafd37 DM	250	}
	251	}
	252	}
	253
d1486f38	254	add_trace("LEAVE chain $chain\n");
f1bafd37	255	if ($chain =~ m/^PVEFW-(INPUT\|OUTPUT\|FORWARD)$/) {
111cce51	256	return ('ACCEPT', $counter); # default policy
f1bafd37 DM	257	}
f1bafd37 DM	258
111cce51	259	return (undef, $counter);
f1bafd37 DM	260	}
	261
	262	sub copy_packet {
	263	my ($pkg) = @_;
	264
	265	my $res = {};
	266
	267	while (my ($k,$v) = each %$pkg) {
	268	$res->{$k} = $v;
	269	}
	270
	271	return $res;
	272	}
	273
d1486f38 DM	274	# Try to simulate packet traversal inside kernel. This invokes iptable
	275	# checks several times.
	276	sub route_packet {
	277	my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
	278
	279	my $route_state = $start_state;
	280
	281	my $physdev_in;
	282
111cce51 DM	283	my $ipt_invocation_counter = 0;
	284	my $rule_check_counter = 0;
	285
d1486f38 DM	286	while ($route_state ne $target->{iface}) {
	287
	288	my $chain;
	289	my $next_route_state;
	290	my $next_physdev_in;
	291
	292	$pkg->{iface_in} = $pkg->{iface_out} = undef;
	293	$pkg->{physdev_in} = $pkg->{physdev_out} = undef;
	294
47ece390 DM	295	if ($route_state eq 'from-bport') {
	296	$next_route_state = $from_info->{bridge} \|\| die 'internal error';
	297	$next_physdev_in = $from_info->{iface} \|\| die 'internal error';
31dc73f1	298	} elsif ($route_state eq 'host') {
d1486f38	299
47ece390	300	if ($target->{type} eq 'bport') {
c0c871d8	301	$pkg->{iface_in} = 'lo';
47ece390	302	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
c0c871d8	303	$chain = 'PVEFW-OUTPUT';
47ece390	304	$next_route_state = $target->{iface} \|\| die 'internal error';
31dc73f1	305	} elsif ($target->{type} eq 'ct') {
d1486f38 DM	306	$pkg->{iface_in} = 'lo';
	307	$pkg->{iface_out} = 'venet0';
	308	$chain = 'PVEFW-OUTPUT';
	309	$next_route_state = 'venet-in';
	310	} elsif ($target->{type} eq 'vm') {
	311	$pkg->{iface_in} = 'lo';
	312	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	313	$chain = 'PVEFW-OUTPUT';
	314	$next_route_state = 'fwbr-in';
	315	} else {
	316	die "implement me";
	317	}
	318
	319	} elsif ($route_state eq 'venet-out') {
	320
	321	if ($target->{type} eq 'host') {
	322
	323	$chain = 'PVEFW-INPUT';
	324	$pkg->{iface_in} = 'venet0';
	325	$pkg->{iface_out} = 'lo';
	326	$next_route_state = 'host';
	327
47ece390	328	} elsif ($target->{type} eq 'bport') {
c0c871d8 DM	329
	330	$chain = 'PVEFW-FORWARD';
	331	$pkg->{iface_in} = 'venet0';
47ece390 DM	332	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
47ece390 DM	333	$next_route_state = $target->{iface} \|\| die 'internal error';
c0c871d8	334
d1486f38 DM	335	} elsif ($target->{type} eq 'vm') {
	336
	337	$chain = 'PVEFW-FORWARD';
	338	$pkg->{iface_in} = 'venet0';
	339	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	340	$next_route_state = 'fwbr-in';
	341
	342	} elsif ($target->{type} eq 'ct') {
	343
	344	$chain = 'PVEFW-FORWARD';
	345	$pkg->{iface_in} = 'venet0';
	346	$pkg->{iface_out} = 'venet0';
	347	$next_route_state = 'venet-in';
	348
	349	} else {
	350	die "implement me";
	351	}
	352
	353	} elsif ($route_state eq 'fwbr-out') {
	354
	355	$chain = 'PVEFW-FORWARD';
	356	$next_route_state = $from_info->{bridge} \|\| die 'internal error';
	357	$next_physdev_in = $from_info->{fwpr} \|\| die 'internal error';
	358	$pkg->{iface_in} = $from_info->{fwbr} \|\| die 'internal error';
	359	$pkg->{iface_out} = $from_info->{fwbr} \|\| die 'internal error';
	360	$pkg->{physdev_in} = $from_info->{tapdev} \|\| die 'internal error';
	361	$pkg->{physdev_out} = $from_info->{fwln} \|\| die 'internal error';
	362
	363	} elsif ($route_state eq 'fwbr-in') {
	364
	365	$chain = 'PVEFW-FORWARD';
	366	$next_route_state = $target->{tapdev};
	367	$pkg->{iface_in} = $target->{fwbr} \|\| die 'internal error';
	368	$pkg->{iface_out} = $target->{fwbr} \|\| die 'internal error';
	369	$pkg->{physdev_in} = $target->{fwln} \|\| die 'internal error';
	370	$pkg->{physdev_out} = $target->{tapdev} \|\| die 'internal error';
	371
	372	} elsif ($route_state =~ m/^vmbr\d+$/) {
	373
	374	die "missing physdev_in - internal error?" if !$physdev_in;
eb5faed9	375	$pkg->{physdev_in} = $physdev_in;
d1486f38 DM	376
	377	if ($target->{type} eq 'host') {
	378
	379	$chain = 'PVEFW-INPUT';
	380	$pkg->{iface_in} = $route_state;
	381	$pkg->{iface_out} = 'lo';
	382	$next_route_state = 'host';
	383
47ece390	384	} elsif ($target->{type} eq 'bport') {
31dc73f1 DM	385
	386	$chain = 'PVEFW-FORWARD';
	387	$pkg->{iface_in} = $route_state;
47ece390	388	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
c0c871d8	389	# conditionally set physdev_out (same behavior as kernel)
47ece390 DM	390	if ($route_state eq $target->{bridge}) {
47ece390 DM	391	$pkg->{physdev_out} = $target->{iface} \|\| die 'internal error';
c0c871d8	392	}
47ece390	393	$next_route_state = $target->{iface};
c0c871d8	394
d1486f38 DM	395	} elsif ($target->{type} eq 'ct') {
	396
	397	$chain = 'PVEFW-FORWARD';
	398	$pkg->{iface_in} = $route_state;
	399	$pkg->{iface_out} = 'venet0';
	400	$next_route_state = 'venet-in';
	401
	402	} elsif ($target->{type} eq 'vm') {
	403
	404	$chain = 'PVEFW-FORWARD';
31dc73f1 DM	405	$pkg->{iface_in} = $route_state;
31dc73f1 DM	406	$pkg->{iface_out} = $target->{bridge};
31dc73f1	407	# conditionally set physdev_out (same behavior as kernel)
d1486f38	408	if ($route_state eq $target->{bridge}) {
d1486f38	409	$pkg->{physdev_out} = $target->{fwpr} \|\| die 'internal error';
d1486f38 DM	410	}
	411	$next_route_state = 'fwbr-in';
	412
	413	} else {
	414	die "implement me";
	415	}
	416
	417	} else {
	418	die "implement me $route_state";
	419	}
	420
	421	die "internal error" if !defined($next_route_state);
	422
	423	if ($chain) {
	424	add_trace("IPT check at $route_state (chain $chain)\n");
	425	add_trace(Dumper($pkg));
111cce51	426	$ipt_invocation_counter++;
292e0ad9	427	my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
111cce51 DM	428	$rule_check_counter += $ctr;
111cce51 DM	429	return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
d1486f38 DM	430	}
	431
	432	$route_state = $next_route_state;
	433
	434	$physdev_in = $next_physdev_in;
	435	}
	436
111cce51	437	return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
d1486f38 DM	438	}
	439
	440	sub extract_ct_info {
	441	my ($vmdata, $vmid) = @_;
	442
	443	my $info = { type => 'ct', vmid => $vmid };
	444
	445	my $conf = $vmdata->{openvz}->{$vmid} \|\| die "no such CT '$vmid'";
	446	if ($conf->{ip_address}) {
	447	$info->{ip_address} = $conf->{ip_address}->{value};
	448	} else {
	449	die "implement me";
	450	}
	451	return $info;
	452	}
	453
	454	sub extract_vm_info {
	455	my ($vmdata, $vmid) = @_;
	456
	457	my $info = { type => 'vm', vmid => $vmid };
	458
	459	my $conf = $vmdata->{qemu}->{$vmid} \|\| die "no such VM '$vmid'";
	460	my $net = PVE::QemuServer::parse_net($conf->{net0});
	461	$info->{macaddr} = $net->{macaddr} \|\| die "unable to get mac address";
	462	$info->{bridge} = $net->{bridge} \|\| die "unable to get bridge";
	463	$info->{fwbr} = "fwbr${vmid}i0";
	464	$info->{tapdev} = "tap${vmid}i0";
	465	$info->{fwln} = "fwln${vmid}i0";
	466	$info->{fwpr} = "fwpr${vmid}p0";
	467
	468	return $info;
	469	}
f1bafd37 DM	470
	471	sub simulate_firewall {
	472	my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
	473
1352eaa1 DM	474	my $from = $test->{from} \|\| die "missing 'from' field";
	475	my $to = $test->{to} \|\| die "missing 'to' field";
	476	my $action = $test->{action} \|\| die "missing 'action'";
8215a0da	477
1352eaa1	478	my $testid = $test->{id};
8215a0da	479
f1bafd37 DM	480	die "from/to needs to be different" if $from eq $to;
	481
	482	my $pkg = {
f1bafd37	483	proto => 'tcp',
8215a0da DM	484	sport => undef,
	485	dport => undef,
	486	source => undef,
	487	dest => undef,
f1bafd37 DM	488	};
	489
	490	while (my ($k,$v) = each %$test) {
1352eaa1 DM	491	next if $k eq 'from';
	492	next if $k eq 'to';
	493	next if $k eq 'action';
	494	next if $k eq 'id';
8215a0da	495	die "unknown attribute '$k'\n" if !exists($pkg->{$k});
f1bafd37 DM	496	$pkg->{$k} = $v;
	497	}
	498
d1486f38 DM	499	my $from_info = {};
	500
	501	my $start_state;
f1bafd37	502
832cd14c DM	503	my $host_ip = '10.11.12.13';
832cd14c DM	504
f1bafd37	505	if ($from eq 'host') {
d1486f38 DM	506	$from_info->{type} = 'host';
d1486f38 DM	507	$start_state = 'host';
832cd14c	508	$pkg->{source} = $host_ip if !defined($pkg->{source});
47ece390 DM	509	} elsif ($from =~ m\|^(vmbr\d+)/(\S+)$\|) {
	510	$from_info->{type} = 'bport';
	511	$from_info->{bridge} = $1;
	512	$from_info->{iface} = $2;
	513	$start_state = 'from-bport';
31dc73f1	514	} elsif ($from eq 'outside') {
47ece390 DM	515	$from_info->{type} = 'bport';
	516	$from_info->{bridge} = 'vmbr0';
	517	$from_info->{iface} = 'eth0';
	518	$start_state = 'from-bport';
c0c871d8	519	} elsif ($from eq 'nfvm') {
47ece390 DM	520	$from_info->{type} = 'bport';
	521	$from_info->{bridge} = 'vmbr0';
	522	$from_info->{iface} = 'tapXYZ';
	523	$start_state = 'from-bport';
f1bafd37 DM	524	} elsif ($from =~ m/^ct(\d+)$/) {
f1bafd37 DM	525	my $vmid = $1;
d1486f38 DM	526	$from_info = extract_ct_info($vmdata, $vmid);
d1486f38 DM	527	if ($from_info->{ip_address}) {
1352eaa1	528	$pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
d1486f38	529	$start_state = 'venet-out';
f1bafd37 DM	530	} else {
	531	die "implement me";
	532	}
f1bafd37 DM	533	} elsif ($from =~ m/^vm(\d+)$/) {
f1bafd37 DM	534	my $vmid = $1;
d1486f38 DM	535	$from_info = extract_vm_info($vmdata, $vmid);
	536	$start_state = 'fwbr-out';
	537	$pkg->{mac_source} = $from_info->{macaddr};
f1bafd37	538	} else {
49e9d9a5	539	die "unable to parse \"from => '$from'\"\n";
f1bafd37 DM	540	}
f1bafd37 DM	541
d1486f38 DM	542	my $target;
d1486f38 DM	543
f1bafd37	544	if ($to eq 'host') {
d1486f38 DM	545	$target->{type} = 'host';
d1486f38 DM	546	$target->{iface} = 'host';
832cd14c	547	$pkg->{dest} = $host_ip if !defined($pkg->{dest});
47ece390 DM	548	} elsif ($to =~ m\|^(vmbr\d+)/(\S+)$\|) {
	549	$target->{type} = 'bport';
	550	$target->{bridge} = $1;
	551	$target->{iface} = $2;
31dc73f1	552	} elsif ($to eq 'outside') {
47ece390 DM	553	$target->{type} = 'bport';
	554	$target->{bridge} = 'vmbr0';
	555	$target->{iface} = 'eth0';
c0c871d8	556	} elsif ($to eq 'nfvm') {
47ece390 DM	557	$target->{type} = 'bport';
	558	$target->{bridge} = 'vmbr0';
	559	$target->{iface} = 'tapXYZ';
f1bafd37 DM	560	} elsif ($to =~ m/^ct(\d+)$/) {
f1bafd37 DM	561	my $vmid = $1;
d1486f38 DM	562	$target = extract_ct_info($vmdata, $vmid);
	563	$target->{iface} = 'venet-in';
	564
	565	if ($target->{ip_address}) {
	566	$pkg->{dest} = $target->{ip_address};
f1bafd37 DM	567	} else {
	568	die "implement me";
	569	}
f1bafd37 DM	570	} elsif ($to =~ m/^vm(\d+)$/) {
f1bafd37 DM	571	my $vmid = $1;
d1486f38 DM	572	$target = extract_vm_info($vmdata, $vmid);
d1486f38 DM	573	$target->{iface} = $target->{tapdev};
f1bafd37	574	} else {
49e9d9a5	575	die "unable to parse \"to => '$to'\"\n";
f1bafd37 DM	576	}
f1bafd37 DM	577
832cd14c DM	578	$pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
	579	$pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
	580
111cce51 DM	581	my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
111cce51 DM	582	$from_info, $target, $start_state);
f1bafd37	583
111cce51 DM	584	add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
111cce51 DM	585
d1486f38	586	die "test failed ($res != $action)\n" if $action ne $res;
f1bafd37	587
d1486f38	588	return undef;
f1bafd37 DM	589	}
	590
	591	sub run_tests {
ec2e28f6 DM	592	my ($vmdata, $testdir, $testfile, $testid) = @_;
	593
	594	$testfile = 'tests' if !$testfile;
f1bafd37 DM	595
	596	$vmdata->{testdir} = $testdir;
	597
	598	my ($ruleset, $ipset_ruleset) =
	599	PVE::Firewall::compile(undef, undef, $vmdata);
	600
ec2e28f6 DM	601	my $filename = "$testdir/$testfile";
	602	my $fh = IO::File->new($filename) \|\|
	603	die "unable to open '$filename' - $!\n";
f1bafd37	604
ec2e28f6	605	my $testcount = 0;
f1bafd37 DM	606	while (defined(my $line = <$fh>)) {
	607	next if $line =~ m/^\s*$/;
	608	next if $line =~ m/^#.*$/;
	609	if ($line =~ m/^\{.\}\s$/) {
	610	my $test = eval $line;
	611	die $@ if $@;
ec2e28f6	612	next if defined($testid) && (!defined($test->{id}) \|\| ($testid ne $test->{id}));
f1bafd37	613	$trace = '';
d1486f38	614	print Dumper($ruleset) if $debug;
ec2e28f6	615	$testcount++;
1352eaa1 DM	616	eval {
	617	my @test_zones = qw(host outside nfvm vm100 ct200);
	618	if (!defined($test->{from}) && !defined($test->{to})) {
	619	die "missing zone speification (from, to)\n";
	620	} elsif (!defined($test->{to})) {
	621	foreach my $zone (@test_zones) {
	622	next if $zone eq $test->{from};
	623	$test->{to} = $zone;
	624	add_trace("Set Zone: to => '$zone'\n");
	625	simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
	626	}
	627	} elsif (!defined($test->{from})) {
	628	foreach my $zone (@test_zones) {
	629	next if $zone eq $test->{to};
	630	$test->{from} = $zone;
	631	add_trace("Set Zone: from => '$zone'\n");
	632	simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
	633	}
	634	} else {
	635	simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test);
	636	}
	637	};
f1bafd37 DM	638	if (my $err = $@) {
f1bafd37 DM	639
d1486f38	640	print Dumper($ruleset) if !$debug;
f1bafd37	641
d1486f38	642	print "$trace\n" if !$debug;
f1bafd37	643
ec2e28f6	644	print "$filename line $.: $line";
f1bafd37 DM	645
	646	print "test failed: $err\n";
	647
	648	exit(-1);
	649	}
	650	} else {
	651	die "parse error";
	652	}
	653	}
	654
ec2e28f6 DM	655	die "no tests found\n" if $testcount <= 0;
	656
	657	print "PASS: $filename\n";
f1bafd37 DM	658
	659	return undef;
	660	}
	661
	662	my $vmdata = {
	663	qemu => {
	664	100 => {
db990d66	665	net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
d1486f38 DM	666	},
d1486f38 DM	667	101 => {
db990d66	668	net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
d1486f38 DM	669	},
	670	# on bridge vmbr1
	671	110 => {
db990d66	672	net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
f1bafd37 DM	673	},
	674	},
	675	openvz => {
	676	200 => {
	677	ip_address => { value => '10.0.200.1' },
	678	},
d1486f38 DM	679	201 => {
	680	ip_address => { value => '10.0.200.2' },
	681	},
f1bafd37 DM	682	},
	683	};
	684
ec2e28f6 DM	685	if ($testfilename) {
	686	my $testfile;
	687	my $dir;
	688
	689	if (-d $testfilename) {
	690	$dir = $testfilename;
	691	} elsif (-f $testfilename) {
	692	$dir = dirname($testfilename);
	693	$testfile = basename($testfilename);
	694	} else {
	695	die "no such file/dir '$testfilename'\n";
	696	}
	697
	698	run_tests($vmdata, $dir, $testfile, $testid);
	699
	700	} else {
	701	foreach my $dir (<test-*>) {
	702	next if ! -d $dir;
	703	run_tests($vmdata, $dir);
	704	}
f1bafd37 DM	705	}
	706
	707	print "OK - all tests passed\n";
	708
	709	exit(0);