| | 1 | package PVE::Firewall; |
| | 2 | |
| | 3 | use warnings; |
| | 4 | use strict; |
| | 5 | use Data::Dumper; |
| | 6 | use PVE::Tools; |
| | 7 | use PVE::QemuServer; |
| | 8 | use File::Path; |
| | 9 | use IO::File; |
| | 10 | use Net::IP; |
| | 11 | use PVE::Tools qw(run_command); |
| | 12 | |
| | 13 | use Data::Dumper; |
| | 14 | |
| | 15 | my $macros; |
| | 16 | my @ruleset = (); |
| | 17 | |
| | 18 | sub get_shorewall_macros { |
| | 19 | |
| | 20 | return $macros if $macros; |
| | 21 | |
| | 22 | foreach my $path (</usr/share/shorewall/macro.*>) { |
| | 23 | if ($path =~ m|/macro\.(\S+)$|) { |
| | 24 | $macros->{$1} = 1; |
| | 25 | } |
| | 26 | } |
| | 27 | return $macros; |
| | 28 | } |
| | 29 | |
| | 30 | my $etc_services; |
| | 31 | |
| | 32 | sub get_etc_services { |
| | 33 | |
| | 34 | return $etc_services if $etc_services; |
| | 35 | |
| | 36 | my $filename = "/etc/services"; |
| | 37 | |
| | 38 | my $fh = IO::File->new($filename, O_RDONLY); |
| | 39 | if (!$fh) { |
| | 40 | warn "unable to read '$filename' - $!\n"; |
| | 41 | return {}; |
| | 42 | } |
| | 43 | |
| | 44 | my $services = {}; |
| | 45 | |
| | 46 | while (my $line = <$fh>) { |
| | 47 | chomp ($line); |
| | 48 | next if $line =~m/^#/; |
| | 49 | next if ($line =~m/^\s*$/); |
| | 50 | |
| | 51 | if ($line =~ m!^(\S+)\s+(\S+)/(tcp|udp).*$!) { |
| | 52 | $services->{byid}->{$2}->{name} = $1; |
| | 53 | $services->{byid}->{$2}->{$3} = 1; |
| | 54 | $services->{byname}->{$1} = $services->{byid}->{$2}; |
| | 55 | } |
| | 56 | } |
| | 57 | |
| | 58 | close($fh); |
| | 59 | |
| | 60 | $etc_services = $services; |
| | 61 | |
| | 62 | |
| | 63 | return $etc_services; |
| | 64 | } |
| | 65 | |
| | 66 | my $etc_protocols; |
| | 67 | |
| | 68 | sub get_etc_protocols { |
| | 69 | return $etc_protocols if $etc_protocols; |
| | 70 | |
| | 71 | my $filename = "/etc/protocols"; |
| | 72 | |
| | 73 | my $fh = IO::File->new($filename, O_RDONLY); |
| | 74 | if (!$fh) { |
| | 75 | warn "unable to read '$filename' - $!\n"; |
| | 76 | return {}; |
| | 77 | } |
| | 78 | |
| | 79 | my $protocols = {}; |
| | 80 | |
| | 81 | while (my $line = <$fh>) { |
| | 82 | chomp ($line); |
| | 83 | next if $line =~m/^#/; |
| | 84 | next if ($line =~m/^\s*$/); |
| | 85 | |
| | 86 | if ($line =~ m!^(\S+)\s+(\d+)\s+.*$!) { |
| | 87 | $protocols->{byid}->{$2}->{name} = $1; |
| | 88 | $protocols->{byname}->{$1} = $protocols->{byid}->{$2}; |
| | 89 | } |
| | 90 | } |
| | 91 | |
| | 92 | close($fh); |
| | 93 | |
| | 94 | $etc_protocols = $protocols; |
| | 95 | |
| | 96 | return $etc_protocols; |
| | 97 | } |
| | 98 | |
| | 99 | sub parse_address_list { |
| | 100 | my ($str) = @_; |
| | 101 | |
| | 102 | my $nbaor = 0; |
| | 103 | foreach my $aor (split(/,/, $str)) { |
| | 104 | if (!Net::IP->new($aor)) { |
| | 105 | my $err = Net::IP::Error(); |
| | 106 | die "invalid IP address: $err\n"; |
| | 107 | }else{ |
| | 108 | $nbaor++; |
| | 109 | } |
| | 110 | } |
| | 111 | return $nbaor; |
| | 112 | } |
| | 113 | |
| | 114 | sub parse_port_name_number_or_range { |
| | 115 | my ($str) = @_; |
| | 116 | |
| | 117 | my $services = PVE::Firewall::get_etc_services(); |
| | 118 | my $nbports = 0; |
| | 119 | foreach my $item (split(/,/, $str)) { |
| | 120 | my $portlist = ""; |
| | 121 | foreach my $pon (split(':', $item, 2)) { |
| | 122 | if ($pon =~ m/^\d+$/){ |
| | 123 | die "invalid port '$pon'\n" if $pon < 0 && $pon > 65536; |
| | 124 | }else{ |
| | 125 | die "invalid port $services->{byname}->{$pon}\n" if !$services->{byname}->{$pon}; |
| | 126 | } |
| | 127 | $nbports++; |
| | 128 | } |
| | 129 | } |
| | 130 | |
| | 131 | return ($nbports); |
| | 132 | } |
| | 133 | |
| | 134 | my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n"; |
| | 135 | |
| | 136 | sub iptables { |
| | 137 | my ($cmd) = @_; |
| | 138 | |
| | 139 | run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {}); |
| | 140 | } |
| | 141 | |
| | 142 | sub iptables_restore { |
| | 143 | |
| | 144 | unshift (@ruleset, '*filter'); |
| | 145 | push (@ruleset, 'COMMIT'); |
| | 146 | |
| | 147 | my $cmdlist = join("\n", @ruleset); |
| | 148 | |
| | 149 | run_command("echo '$cmdlist' | /sbin/iptables-restore -n", outfunc => sub {}); |
| | 150 | } |
| | 151 | |
| | 152 | sub iptables_addrule { |
| | 153 | my ($rule) = @_; |
| | 154 | |
| | 155 | push (@ruleset, $rule); |
| | 156 | } |
| | 157 | |
| | 158 | sub iptables_chain_exist { |
| | 159 | my ($chain) = @_; |
| | 160 | |
| | 161 | eval{ |
| | 162 | iptables("-n --list $chain"); |
| | 163 | }; |
| | 164 | return undef if $@; |
| | 165 | |
| | 166 | return 1; |
| | 167 | } |
| | 168 | |
| | 169 | sub iptables_rule_exist { |
| | 170 | my ($rule) = @_; |
| | 171 | |
| | 172 | eval{ |
| | 173 | iptables("-C $rule"); |
| | 174 | }; |
| | 175 | return undef if $@; |
| | 176 | |
| | 177 | return 1; |
| | 178 | } |
| | 179 | |
| | 180 | sub iptables_generate_rule { |
| | 181 | my ($chain, $rule) = @_; |
| | 182 | |
| | 183 | my $cmd = "-A $chain"; |
| | 184 | |
| | 185 | $cmd .= " -m iprange --src-range" if $rule->{nbsource} && $rule->{nbsource} > 1; |
| | 186 | $cmd .= " -s $rule->{source}" if $rule->{source}; |
| | 187 | $cmd .= " -m iprange --dst-range" if $rule->{nbdest} && $rule->{nbdest} > 1; |
| | 188 | $cmd .= " -d $rule->{dest}" if $rule->{destination}; |
| | 189 | $cmd .= " -p $rule->{proto}" if $rule->{proto}; |
| | 190 | $cmd .= " --match multiport" if $rule->{nbdport} && $rule->{nbdport} > 1; |
| | 191 | $cmd .= " --dport $rule->{dport}" if $rule->{dport}; |
| | 192 | $cmd .= " --match multiport" if $rule->{nbsport} && $rule->{nbsport} > 1; |
| | 193 | $cmd .= " --sport $rule->{sport}" if $rule->{sport}; |
| | 194 | $cmd .= " -j $rule->{action}" if $rule->{action}; |
| | 195 | |
| | 196 | iptables_addrule($cmd); |
| | 197 | |
| | 198 | } |
| | 199 | |
| | 200 | sub generate_bridge_rules { |
| | 201 | my ($bridge) = @_; |
| | 202 | |
| | 203 | if(!iptables_chain_exist("BRIDGEFW-OUT")){ |
| | 204 | iptables_addrule(":BRIDGEFW-OUT - [0:0]"); |
| | 205 | } |
| | 206 | |
| | 207 | if(!iptables_chain_exist("BRIDGEFW-IN")){ |
| | 208 | iptables_addrule(":BRIDGEFW-IN - [0:0]"); |
| | 209 | } |
| | 210 | |
| | 211 | if(!iptables_chain_exist("proxmoxfw-FORWARD")){ |
| | 212 | iptables_addrule(":proxmoxfw-FORWARD - [0:0]"); |
| | 213 | iptables_addrule("-I FORWARD -j proxmoxfw-FORWARD"); |
| | 214 | iptables_addrule("-A proxmoxfw-FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT"); |
| | 215 | iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-in --physdev-is-bridged -j BRIDGEFW-OUT"); |
| | 216 | iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-out --physdev-is-bridged -j BRIDGEFW-IN"); |
| | 217 | |
| | 218 | } |
| | 219 | |
| | 220 | generate_proxmoxfwinput(); |
| | 221 | |
| | 222 | if(!iptables_chain_exist("$bridge-IN")){ |
| | 223 | iptables_addrule(":$bridge-IN - [0:0]"); |
| | 224 | iptables_addrule("-A proxmoxfw-FORWARD -i $bridge -j DROP"); #disable interbridge routing |
| | 225 | iptables_addrule("-A BRIDGEFW-IN -j $bridge-IN"); |
| | 226 | iptables_addrule("-A $bridge-IN -j ACCEPT"); |
| | 227 | |
| | 228 | } |
| | 229 | |
| | 230 | if(!iptables_chain_exist("$bridge-OUT")){ |
| | 231 | iptables_addrule(":$bridge-OUT - [0:0]"); |
| | 232 | iptables_addrule("-A proxmoxfw-FORWARD -o $bridge -j DROP"); # disable interbridge routing |
| | 233 | iptables_addrule("-A BRIDGEFW-OUT -j $bridge-OUT"); |
| | 234 | |
| | 235 | } |
| | 236 | |
| | 237 | } |
| | 238 | |
| | 239 | |
| | 240 | sub generate_tap_rules_direction { |
| | 241 | my ($iface, $netid, $rules, $bridge, $direction) = @_; |
| | 242 | |
| | 243 | my $tapchain = "$iface-$direction"; |
| | 244 | |
| | 245 | iptables_addrule(":$tapchain - [0:0]"); |
| | 246 | |
| | 247 | iptables_addrule("-A $tapchain -m state --state INVALID -j DROP"); |
| | 248 | iptables_addrule("-A $tapchain -m state --state RELATED,ESTABLISHED -j ACCEPT"); |
| | 249 | |
| | 250 | if (scalar(@$rules)) { |
| | 251 | foreach my $rule (@$rules) { |
| | 252 | next if $rule->{iface} && $rule->{iface} ne $netid; |
| | 253 | if($rule->{action} =~ m/^(GROUP-(\S+))$/){ |
| | 254 | $rule->{action} .= "-$direction"; |
| | 255 | #generate empty group rule if don't exist |
| | 256 | if(!iptables_chain_exist($rule->{action})){ |
| | 257 | generate_group_rules($2); |
| | 258 | } |
| | 259 | } |
| | 260 | #we go to vmbr-IN if accept in out rules |
| | 261 | $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT'; |
| | 262 | iptables_generate_rule($tapchain, $rule); |
| | 263 | } |
| | 264 | } |
| | 265 | |
| | 266 | iptables_addrule("-A $tapchain -j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4"); |
| | 267 | iptables_addrule("-A $tapchain -j DROP"); |
| | 268 | |
| | 269 | #plug the tap chain to bridge chain |
| | 270 | my $physdevdirection = $direction eq 'IN' ? "out":"in"; |
| | 271 | my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain"; |
| | 272 | |
| | 273 | if(!iptables_rule_exist($rule)){ |
| | 274 | iptables_addrule("-I $rule"); |
| | 275 | } |
| | 276 | |
| | 277 | if($direction eq 'OUT'){ |
| | 278 | #add tap->host rules |
| | 279 | my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain"; |
| | 280 | |
| | 281 | if(!iptables_rule_exist($rule)){ |
| | 282 | iptables_addrule("-A $rule"); |
| | 283 | } |
| | 284 | } |
| | 285 | } |
| | 286 | |
| | 287 | sub generate_tap_rules { |
| | 288 | my ($net, $netid, $vmid) = @_; |
| | 289 | |
| | 290 | my $filename = "/etc/pve/firewall/$vmid.fw"; |
| | 291 | my $fh = IO::File->new($filename, O_RDONLY); |
| | 292 | return if !$fh; |
| | 293 | |
| | 294 | #generate bridge rules |
| | 295 | my $bridge = $net->{bridge}; |
| | 296 | my $tag = $net->{tag}; |
| | 297 | $bridge .= "v$tag" if $tag; |
| | 298 | |
| | 299 | #generate tap chain |
| | 300 | my $rules = parse_fw_rules($filename, $fh); |
| | 301 | |
| | 302 | my $inrules = $rules->{in}; |
| | 303 | my $outrules = $rules->{out}; |
| | 304 | |
| | 305 | my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/; |
| | 306 | |
| | 307 | generate_bridge_rules($bridge); |
| | 308 | generate_tap_rules_direction($iface, $netid, $inrules, $bridge, 'IN'); |
| | 309 | generate_tap_rules_direction($iface, $netid, $outrules, $bridge, 'OUT'); |
| | 310 | iptables_restore(); |
| | 311 | } |
| | 312 | |
| | 313 | sub flush_tap_rules { |
| | 314 | my ($net, $netid, $vmid) = @_; |
| | 315 | |
| | 316 | my $bridge = $net->{bridge}; |
| | 317 | my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/; |
| | 318 | |
| | 319 | flush_tap_rules_direction($iface, $bridge, 'IN'); |
| | 320 | flush_tap_rules_direction($iface, $bridge, 'OUT'); |
| | 321 | iptables_restore(); |
| | 322 | } |
| | 323 | |
| | 324 | sub flush_tap_rules_direction { |
| | 325 | my ($iface, $bridge, $direction) = @_; |
| | 326 | |
| | 327 | my $tapchain = "$iface-$direction"; |
| | 328 | |
| | 329 | if(iptables_chain_exist($tapchain)){ |
| | 330 | iptables_addrule("-F $tapchain"); |
| | 331 | |
| | 332 | my $physdevdirection = $direction eq 'IN' ? "out":"in"; |
| | 333 | my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain"; |
| | 334 | if(iptables_rule_exist($rule)){ |
| | 335 | iptables_addrule("-D $rule"); |
| | 336 | } |
| | 337 | |
| | 338 | if($direction eq 'OUT'){ |
| | 339 | my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain"; |
| | 340 | if(iptables_rule_exist($rule)){ |
| | 341 | iptables_addrule("-D $rule"); |
| | 342 | } |
| | 343 | } |
| | 344 | |
| | 345 | iptables_addrule("-X $tapchain"); |
| | 346 | } |
| | 347 | } |
| | 348 | |
| | 349 | sub enablehostfw { |
| | 350 | |
| | 351 | generate_proxmoxfwinput(); |
| | 352 | generate_proxmoxfwoutput(); |
| | 353 | |
| | 354 | my $filename = "/etc/pve/local/host.fw"; |
| | 355 | my $fh = IO::File->new($filename, O_RDONLY); |
| | 356 | return if !$fh; |
| | 357 | |
| | 358 | my $rules = parse_fw_rules($filename, $fh); |
| | 359 | my $inrules = $rules->{in}; |
| | 360 | my $outrules = $rules->{out}; |
| | 361 | |
| | 362 | #host inbound firewall |
| | 363 | iptables_addrule(":host-IN - [0:0]"); |
| | 364 | iptables_addrule("-A host-IN -m state --state INVALID -j DROP"); |
| | 365 | iptables_addrule("-A host-IN -m state --state RELATED,ESTABLISHED -j ACCEPT"); |
| | 366 | iptables_addrule("-A host-IN -i lo -j ACCEPT"); |
| | 367 | iptables_addrule("-A host-IN -m addrtype --dst-type MULTICAST -j ACCEPT"); |
| | 368 | iptables_addrule("-A host-IN -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT"); |
| | 369 | iptables_addrule("-A host-IN -p udp -m udp --dport 9000 -j ACCEPT"); #corosync |
| | 370 | |
| | 371 | if (scalar(@$inrules)) { |
| | 372 | foreach my $rule (@$inrules) { |
| | 373 | #we use RETURN because we need to check also tap rules |
| | 374 | $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT'; |
| | 375 | iptables_generate_rule('host-IN', $rule); |
| | 376 | } |
| | 377 | } |
| | 378 | |
| | 379 | iptables_addrule("-A host-IN -j LOG --log-prefix \"kvmhost-IN dropped: \" --log-level 4"); |
| | 380 | iptables_addrule("-A host-IN -j DROP"); |
| | 381 | |
| | 382 | #host outbound firewall |
| | 383 | iptables_addrule(":host-OUT - [0:0]"); |
| | 384 | iptables_addrule("-A host-OUT -m state --state INVALID -j DROP"); |
| | 385 | iptables_addrule("-A host-OUT -m state --state RELATED,ESTABLISHED -j ACCEPT"); |
| | 386 | iptables_addrule("-A host-OUT -o lo -j ACCEPT"); |
| | 387 | iptables_addrule("-A host-OUT -m addrtype --dst-type MULTICAST -j ACCEPT"); |
| | 388 | iptables_addrule("-A host-OUT -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT"); |
| | 389 | iptables_addrule("-A host-OUT -p udp -m udp --dport 9000 -j ACCEPT"); #corosync |
| | 390 | |
| | 391 | if (scalar(@$outrules)) { |
| | 392 | foreach my $rule (@$outrules) { |
| | 393 | #we use RETURN because we need to check also tap rules |
| | 394 | $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT'; |
| | 395 | iptables_generate_rule('host-OUT', $rule); |
| | 396 | } |
| | 397 | } |
| | 398 | |
| | 399 | iptables_addrule("-A host-OUT -j LOG --log-prefix \"kvmhost-OUT dropped: \" --log-level 4"); |
| | 400 | iptables_addrule("-A host-OUT -j DROP"); |
| | 401 | |
| | 402 | |
| | 403 | my $rule = "proxmoxfw-INPUT -j host-IN"; |
| | 404 | if(!iptables_rule_exist($rule)){ |
| | 405 | iptables_addrule("-I $rule"); |
| | 406 | } |
| | 407 | |
| | 408 | $rule = "proxmoxfw-OUTPUT -j host-OUT"; |
| | 409 | if(!iptables_rule_exist($rule)){ |
| | 410 | iptables_addrule("-I $rule"); |
| | 411 | } |
| | 412 | |
| | 413 | iptables_restore(); |
| | 414 | |
| | 415 | |
| | 416 | } |
| | 417 | |
| | 418 | sub disablehostfw { |
| | 419 | |
| | 420 | my $chain = "host-IN"; |
| | 421 | |
| | 422 | my $rule = "proxmoxfw-INPUT -j $chain"; |
| | 423 | if(iptables_rule_exist($rule)){ |
| | 424 | iptables_addrule("-D $rule"); |
| | 425 | } |
| | 426 | |
| | 427 | if(iptables_chain_exist($chain)){ |
| | 428 | iptables_addrule("-F $chain"); |
| | 429 | iptables_addrule("-X $chain"); |
| | 430 | } |
| | 431 | |
| | 432 | $chain = "host-OUT"; |
| | 433 | |
| | 434 | $rule = "proxmoxfw-OUTPUT -j $chain"; |
| | 435 | if(iptables_rule_exist($rule)){ |
| | 436 | iptables_addrule("-D $rule"); |
| | 437 | } |
| | 438 | |
| | 439 | if(iptables_chain_exist($chain)){ |
| | 440 | iptables_addrule("-F $chain"); |
| | 441 | iptables_addrule("-X $chain"); |
| | 442 | } |
| | 443 | |
| | 444 | iptables_restore(); |
| | 445 | } |
| | 446 | |
| | 447 | sub generate_proxmoxfwinput { |
| | 448 | |
| | 449 | if(!iptables_chain_exist("proxmoxfw-INPUT")){ |
| | 450 | iptables_addrule(":proxmoxfw-INPUT - [0:0]"); |
| | 451 | iptables_addrule("-I INPUT -j proxmoxfw-INPUT"); |
| | 452 | iptables_addrule("-A INPUT -j ACCEPT"); |
| | 453 | } |
| | 454 | } |
| | 455 | |
| | 456 | sub generate_proxmoxfwoutput { |
| | 457 | |
| | 458 | if(!iptables_chain_exist("proxmoxfw-OUTPUT")){ |
| | 459 | iptables_addrule(":proxmoxfw-OUTPUT - [0:0]"); |
| | 460 | iptables_addrule("-I OUTPUT -j proxmoxfw-OUTPUT"); |
| | 461 | iptables_addrule("-A OUTPUT -j ACCEPT"); |
| | 462 | } |
| | 463 | |
| | 464 | } |
| | 465 | |
| | 466 | sub enable_group_rules { |
| | 467 | my ($group) = @_; |
| | 468 | |
| | 469 | generate_group_rules($group); |
| | 470 | iptables_restore(); |
| | 471 | } |
| | 472 | |
| | 473 | sub generate_group_rules { |
| | 474 | my ($group) = @_; |
| | 475 | |
| | 476 | my $filename = "/etc/pve/firewall/groups.fw"; |
| | 477 | my $fh = IO::File->new($filename, O_RDONLY); |
| | 478 | return if !$fh; |
| | 479 | |
| | 480 | my $rules = parse_fw_rules($filename, $fh, $group); |
| | 481 | my $inrules = $rules->{in}; |
| | 482 | my $outrules = $rules->{out}; |
| | 483 | |
| | 484 | my $chain = "GROUP-".$group."-IN"; |
| | 485 | |
| | 486 | iptables_addrule(":$chain - [0:0]"); |
| | 487 | |
| | 488 | if (scalar(@$inrules)) { |
| | 489 | foreach my $rule (@$inrules) { |
| | 490 | iptables_generate_rule($chain, $rule); |
| | 491 | } |
| | 492 | } |
| | 493 | |
| | 494 | $chain = "GROUP-".$group."-OUT"; |
| | 495 | |
| | 496 | iptables_addrule(":$chain - [0:0]"); |
| | 497 | |
| | 498 | if(!iptables_chain_exist("BRIDGEFW-OUT")){ |
| | 499 | iptables_addrule(":BRIDGEFW-OUT - [0:0]"); |
| | 500 | } |
| | 501 | |
| | 502 | if(!iptables_chain_exist("BRIDGEFW-IN")){ |
| | 503 | iptables_addrule(":BRIDGEFW-IN - [0:0]"); |
| | 504 | } |
| | 505 | |
| | 506 | if (scalar(@$outrules)) { |
| | 507 | foreach my $rule (@$outrules) { |
| | 508 | #we go the BRIDGEFW-IN because we need to check also other tap rules |
| | 509 | #(and group rules can be set on any bridge, so we can't go to VMBRXX-IN) |
| | 510 | $rule->{action} = 'BRIDGEFW-IN' if $rule->{action} eq 'ACCEPT'; |
| | 511 | iptables_generate_rule($chain, $rule); |
| | 512 | } |
| | 513 | } |
| | 514 | |
| | 515 | } |
| | 516 | |
| | 517 | sub disable_group_rules { |
| | 518 | my ($group) = @_; |
| | 519 | |
| | 520 | my $chain = "GROUP-".$group."-IN"; |
| | 521 | |
| | 522 | if(iptables_chain_exist($chain)){ |
| | 523 | iptables_addrule("-F $chain"); |
| | 524 | iptables_addrule("-X $chain"); |
| | 525 | } |
| | 526 | |
| | 527 | $chain = "GROUP-".$group."-OUT"; |
| | 528 | |
| | 529 | if(iptables_chain_exist($chain)){ |
| | 530 | iptables_addrule("-F $chain"); |
| | 531 | iptables_addrule("-X $chain"); |
| | 532 | } |
| | 533 | |
| | 534 | #iptables_restore will die if security group is linked in a tap chain |
| | 535 | #maybe can we improve that, parsing each vm config, or parsing iptables -S |
| | 536 | #to see if the security group is linked or not |
| | 537 | iptables_restore(); |
| | 538 | } |
| | 539 | |
| | 540 | |
| | 541 | my $generate_input_rule = sub { |
| | 542 | my ($zoneinfo, $rule, $net, $netid) = @_; |
| | 543 | |
| | 544 | my $zone = $net->{zone} || die "internal error"; |
| | 545 | my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error"; |
| | 546 | my $tap = $net->{tap} || die "internal error"; |
| | 547 | |
| | 548 | my $dest = "$zid:$tap"; |
| | 549 | |
| | 550 | if ($rule->{dest}) { |
| | 551 | $dest .= ":$rule->{dest}"; |
| | 552 | } |
| | 553 | |
| | 554 | my $action = $rule->{service} ? |
| | 555 | "$rule->{service}($rule->{action})" : $rule->{action}; |
| | 556 | |
| | 557 | my $sources = []; |
| | 558 | |
| | 559 | if (!$rule->{source}) { |
| | 560 | push @$sources, 'all'; |
| | 561 | } elsif ($zoneinfo->{$zone}->{type} eq 'bport') { |
| | 562 | my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error"; |
| | 563 | my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error"; |
| | 564 | |
| | 565 | # using 'all' does not work, so we create one rule for |
| | 566 | # each related zone on the same bridge |
| | 567 | push @$sources, "${zoneref}:$rule->{source}"; |
| | 568 | foreach my $z (keys %$zoneinfo) { |
| | 569 | next if $z eq $zone; |
| | 570 | next if !$zoneinfo->{$z}->{bridge_zone}; |
| | 571 | next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone; |
| | 572 | $zoneref = $zoneinfo->{$z}->{zoneref} || die "internal error"; |
| | 573 | push @$sources, "${zoneref}:$rule->{source}"; |
| | 574 | } |
| | 575 | } else { |
| | 576 | push @$sources, "all:$rule->{source}"; |
| | 577 | } |
| | 578 | |
| | 579 | my $out = ''; |
| | 580 | |
| | 581 | foreach my $source (@$sources) { |
| | 582 | $out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-', |
| | 583 | $rule->{dport} || '-', $rule->{sport} || '-'); |
| | 584 | } |
| | 585 | |
| | 586 | return $out; |
| | 587 | }; |
| | 588 | |
| | 589 | my $generate_output_rule = sub { |
| | 590 | my ($zoneinfo, $rule, $net, $netid) = @_; |
| | 591 | |
| | 592 | my $zone = $net->{zone} || die "internal error"; |
| | 593 | my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error"; |
| | 594 | my $tap = $net->{tap} || die "internal error"; |
| | 595 | |
| | 596 | my $action = $rule->{service} ? |
| | 597 | "$rule->{service}($rule->{action})" : $rule->{action}; |
| | 598 | |
| | 599 | my $dest; |
| | 600 | |
| | 601 | if (!$rule->{dest}) { |
| | 602 | $dest = 'all'; |
| | 603 | } else { |
| | 604 | $dest = "all:$rule->{dest}"; |
| | 605 | } |
| | 606 | |
| | 607 | return sprintf($rule_format, $action, "$zid:$tap", $dest, |
| | 608 | $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-'); |
| | 609 | }; |
| | 610 | |
| | 611 | # we need complete VM configuration of all VMs (openvz/qemu) |
| | 612 | # in vmdata |
| | 613 | |
| | 614 | my $compile_shorewall = sub { |
| | 615 | my ($targetdir, $vmdata, $rules) = @_; |
| | 616 | |
| | 617 | # remove existing data ? |
| | 618 | foreach my $file (qw(params zones rules interfaces maclist policy)) { |
| | 619 | unlink "$targetdir/$file"; |
| | 620 | } |
| | 621 | |
| | 622 | my $netinfo; |
| | 623 | |
| | 624 | my $zoneinfo = { |
| | 625 | fw => { type => 'firewall' }, |
| | 626 | }; |
| | 627 | |
| | 628 | my $maclist = {}; |
| | 629 | |
| | 630 | my $register_bridge; |
| | 631 | |
| | 632 | $register_bridge = sub { |
| | 633 | my ($bridge, $vlan) = @_; |
| | 634 | |
| | 635 | my $zone = $bridge; |
| | 636 | |
| | 637 | return $zone if $zoneinfo->{$zone}; |
| | 638 | |
| | 639 | my $ext_zone = "${bridge}_ext"; |
| | 640 | |
| | 641 | $zoneinfo->{$zone} = { |
| | 642 | type => 'bridge', |
| | 643 | bridge => $bridge, |
| | 644 | bridge_ext_zone => $ext_zone, |
| | 645 | }; |
| | 646 | |
| | 647 | # physical input devices |
| | 648 | my $dir = "/sys/class/net/$bridge/brif"; |
| | 649 | my $physical = {}; |
| | 650 | PVE::Tools::dir_glob_foreach($dir, '((eth|bond).+)', sub { |
| | 651 | my ($slave) = @_; |
| | 652 | $physical->{$slave} = 1; |
| | 653 | }); |
| | 654 | |
| | 655 | $zoneinfo->{$ext_zone} = { |
| | 656 | type => 'bport', |
| | 657 | bridge_zone => $zone, |
| | 658 | ifaces => $physical, |
| | 659 | }; |
| | 660 | |
| | 661 | return &$register_bridge("${bridge}v${vlan}") if defined($vlan); |
| | 662 | |
| | 663 | return $zone; |
| | 664 | }; |
| | 665 | |
| | 666 | my $register_bridge_port = sub { |
| | 667 | my ($bridge, $vlan, $vmzone, $tap) = @_; |
| | 668 | |
| | 669 | my $bridge_zone = &$register_bridge($bridge, $vlan); |
| | 670 | my $zone = $bridge_zone . '_' . $vmzone; |
| | 671 | |
| | 672 | if (!$zoneinfo->{$zone}) { |
| | 673 | $zoneinfo->{$zone} = { |
| | 674 | type => 'bport', |
| | 675 | bridge_zone => $bridge_zone, |
| | 676 | ifaces => {}, |
| | 677 | }; |
| | 678 | } |
| | 679 | |
| | 680 | $zoneinfo->{$zone}->{ifaces}->{$tap} = 1; |
| | 681 | |
| | 682 | return $zone; |
| | 683 | }; |
| | 684 | |
| | 685 | foreach my $vmid (keys %{$vmdata->{qemu}}) { |
| | 686 | $netinfo->{$vmid} = {}; |
| | 687 | my $conf = $vmdata->{qemu}->{$vmid}; |
| | 688 | foreach my $opt (keys %$conf) { |
| | 689 | next if $opt !~ m/^net(\d+)$/; |
| | 690 | my $netnum = $1; |
| | 691 | my $net = PVE::QemuServer::parse_net($conf->{$opt}); |
| | 692 | next if !$net; |
| | 693 | die "implement me" if !$net->{bridge}; |
| | 694 | |
| | 695 | my $vmzone = $conf->{zone} || "vm$vmid"; |
| | 696 | $net->{tap} = "tap${vmid}i${netnum}"; |
| | 697 | $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error"; |
| | 698 | $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap}); |
| | 699 | $netinfo->{$vmid}->{$opt} = $net; |
| | 700 | } |
| | 701 | } |
| | 702 | |
| | 703 | #print Dumper($netinfo); |
| | 704 | |
| | 705 | # NOTE: zone names have length limit, so we need to |
| | 706 | # translate them into shorter names |
| | 707 | |
| | 708 | my $zoneid = 0; |
| | 709 | my $zonemap = { fw => 'fw' }; |
| | 710 | |
| | 711 | my $lookup_zonename = sub { |
| | 712 | my ($zone) = @_; |
| | 713 | |
| | 714 | return $zonemap->{$zone} if defined($zonemap->{$zone}); |
| | 715 | $zonemap->{$zone} = 'z' . $zoneid++; |
| | 716 | |
| | 717 | return $zonemap->{$zone}; |
| | 718 | }; |
| | 719 | |
| | 720 | foreach my $z (sort keys %$zoneinfo) { |
| | 721 | $zoneinfo->{$z}->{id} = &$lookup_zonename($z); |
| | 722 | $zoneinfo->{$z}->{zonevar} = uc($z); |
| | 723 | $zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar}; |
| | 724 | } |
| | 725 | |
| | 726 | my $out; |
| | 727 | |
| | 728 | # dump params file |
| | 729 | $out = "# PVE zones\n"; |
| | 730 | foreach my $z (sort keys %$zoneinfo) { |
| | 731 | $out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n"; |
| | 732 | } |
| | 733 | PVE::Tools::file_set_contents("$targetdir/params", $out); |
| | 734 | |
| | 735 | # dump zone file |
| | 736 | |
| | 737 | my $format = "%-30s %-10s %-15s\n"; |
| | 738 | $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS'); |
| | 739 | |
| | 740 | foreach my $z (sort keys %$zoneinfo) { |
| | 741 | my $zid = $zoneinfo->{$z}->{zoneref}; |
| | 742 | if ($zoneinfo->{$z}->{type} eq 'firewall') { |
| | 743 | $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, ''); |
| | 744 | } elsif ($zoneinfo->{$z}->{type} eq 'bridge') { |
| | 745 | $out .= sprintf($format, $zid, 'ipv4', ''); |
| | 746 | } elsif ($zoneinfo->{$z}->{type} eq 'bport') { |
| | 747 | my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error"; |
| | 748 | my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error"; |
| | 749 | $out .= sprintf($format, "$zid:$bzid", 'bport', ''); |
| | 750 | } else { |
| | 751 | die "internal error"; |
| | 752 | } |
| | 753 | } |
| | 754 | |
| | 755 | $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n"); |
| | 756 | |
| | 757 | PVE::Tools::file_set_contents("$targetdir/zones", $out); |
| | 758 | |
| | 759 | # dump interfaces |
| | 760 | |
| | 761 | $format = "%-25s %-20s %-10s %-15s\n"; |
| | 762 | $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS'); |
| | 763 | |
| | 764 | my $maclist_format = "%-15s %-15s %-15s\n"; |
| | 765 | my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE'); |
| | 766 | |
| | 767 | foreach my $z (sort keys %$zoneinfo) { |
| | 768 | my $zid = $zoneinfo->{$z}->{zoneref}; |
| | 769 | if ($zoneinfo->{$z}->{type} eq 'firewall') { |
| | 770 | # do nothing; |
| | 771 | } elsif ($zoneinfo->{$z}->{type} eq 'bridge') { |
| | 772 | my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error"; |
| | 773 | $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional'); |
| | 774 | } elsif ($zoneinfo->{$z}->{type} eq 'bport') { |
| | 775 | my $ifaces = $zoneinfo->{$z}->{ifaces}; |
| | 776 | foreach my $iface (sort keys %$ifaces) { |
| | 777 | my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error"; |
| | 778 | my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error"; |
| | 779 | my $iftxt = "$bridge:$iface"; |
| | 780 | |
| | 781 | if ($maclist->{$iface}) { |
| | 782 | $out .= sprintf($format, $zid, $iftxt, '-', 'maclist'); |
| | 783 | $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface}); |
| | 784 | } else { |
| | 785 | $out .= sprintf($format, $zid, $iftxt, '-', ''); |
| | 786 | } |
| | 787 | } |
| | 788 | } else { |
| | 789 | die "internal error"; |
| | 790 | } |
| | 791 | } |
| | 792 | |
| | 793 | $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n"); |
| | 794 | |
| | 795 | PVE::Tools::file_set_contents("$targetdir/interfaces", $out); |
| | 796 | |
| | 797 | # dump maclist |
| | 798 | PVE::Tools::file_set_contents("$targetdir/maclist", $macs); |
| | 799 | |
| | 800 | # dump policy |
| | 801 | |
| | 802 | $format = "%-15s %-15s %-15s %s\n"; |
| | 803 | $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG'); |
| | 804 | $out .= sprintf($format, 'fw', 'all', 'ACCEPT', ''); |
| | 805 | |
| | 806 | # we need to disable intra-zone traffic on bridges. Else traffic |
| | 807 | # from untracked interfaces simply pass the firewall |
| | 808 | foreach my $z (sort keys %$zoneinfo) { |
| | 809 | my $zid = $zoneinfo->{$z}->{zoneref}; |
| | 810 | if ($zoneinfo->{$z}->{type} eq 'bridge') { |
| | 811 | $out .= sprintf($format, $zid, $zid, 'REJECT', 'info'); |
| | 812 | } |
| | 813 | } |
| | 814 | $out .= sprintf($format, 'all', 'all', 'REJECT', 'info'); |
| | 815 | |
| | 816 | PVE::Tools::file_set_contents("$targetdir/policy", $out); |
| | 817 | |
| | 818 | # dump rules |
| | 819 | $out = ''; |
| | 820 | |
| | 821 | $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT'); |
| | 822 | foreach my $vmid (sort keys %$rules) { |
| | 823 | my $inrules = $rules->{$vmid}->{in}; |
| | 824 | my $outrules = $rules->{$vmid}->{out}; |
| | 825 | |
| | 826 | if (scalar(@$inrules)) { |
| | 827 | $out .= "# IN to VM $vmid\n"; |
| | 828 | foreach my $rule (@$inrules) { |
| | 829 | foreach my $netid (keys %{$netinfo->{$vmid}}) { |
| | 830 | my $net = $netinfo->{$vmid}->{$netid}; |
| | 831 | next if $rule->{iface} && $rule->{iface} ne $netid; |
| | 832 | $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid); |
| | 833 | } |
| | 834 | } |
| | 835 | } |
| | 836 | |
| | 837 | if (scalar(@$outrules)) { |
| | 838 | $out .= "# OUT from VM $vmid\n"; |
| | 839 | foreach my $rule (@$outrules) { |
| | 840 | foreach my $netid (keys %{$netinfo->{$vmid}}) { |
| | 841 | my $net = $netinfo->{$vmid}->{$netid}; |
| | 842 | next if $rule->{iface} && $rule->{iface} ne $netid; |
| | 843 | $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid); |
| | 844 | } |
| | 845 | } |
| | 846 | } |
| | 847 | } |
| | 848 | |
| | 849 | PVE::Tools::file_set_contents("$targetdir/rules", $out); |
| | 850 | }; |
| | 851 | |
| | 852 | |
| | 853 | sub parse_fw_rules { |
| | 854 | my ($filename, $fh, $group) = @_; |
| | 855 | |
| | 856 | my $section; |
| | 857 | my $securitygroup; |
| | 858 | my $securitygroupexist; |
| | 859 | |
| | 860 | my $res = { in => [], out => [] }; |
| | 861 | |
| | 862 | my $macros = get_shorewall_macros(); |
| | 863 | my $protocols = get_etc_protocols(); |
| | 864 | |
| | 865 | while (defined(my $line = <$fh>)) { |
| | 866 | next if $line =~ m/^#/; |
| | 867 | next if $line =~ m/^\s*$/; |
| | 868 | |
| | 869 | if ($line =~ m/^\[(in|out)(:(\S+))?\]\s*$/i) { |
| | 870 | $section = lc($1); |
| | 871 | $securitygroup = lc($3) if $3; |
| | 872 | $securitygroupexist = 1 if $securitygroup && $securitygroup eq $group; |
| | 873 | next; |
| | 874 | } |
| | 875 | next if !$section; |
| | 876 | next if $group && $securitygroup ne $group; |
| | 877 | |
| | 878 | my ($action, $iface, $source, $dest, $proto, $dport, $sport) = |
| | 879 | split(/\s+/, $line); |
| | 880 | |
| | 881 | if (!$action) { |
| | 882 | warn "skip incomplete line\n"; |
| | 883 | next; |
| | 884 | } |
| | 885 | |
| | 886 | my $service; |
| | 887 | if ($action =~ m/^(ACCEPT|DROP|REJECT|GROUP-(\S+))$/) { |
| | 888 | # OK |
| | 889 | } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) { |
| | 890 | ($service, $action) = ($1, $2); |
| | 891 | if (!$macros->{$service}) { |
| | 892 | warn "unknown service '$service'\n"; |
| | 893 | next; |
| | 894 | } |
| | 895 | } else { |
| | 896 | warn "unknown action '$action'\n"; |
| | 897 | next; |
| | 898 | } |
| | 899 | |
| | 900 | $iface = undef if $iface && $iface eq '-'; |
| | 901 | if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) { |
| | 902 | warn "unknown interface '$iface'\n"; |
| | 903 | next; |
| | 904 | } |
| | 905 | |
| | 906 | $proto = undef if $proto && $proto eq '-'; |
| | 907 | if ($proto && !(defined($protocols->{byname}->{$proto}) || |
| | 908 | defined($protocols->{byid}->{$proto}))) { |
| | 909 | warn "unknown protokol '$proto'\n"; |
| | 910 | next; |
| | 911 | } |
| | 912 | |
| | 913 | $source = undef if $source && $source eq '-'; |
| | 914 | $dest = undef if $dest && $dest eq '-'; |
| | 915 | |
| | 916 | $dport = undef if $dport && $dport eq '-'; |
| | 917 | $sport = undef if $sport && $sport eq '-'; |
| | 918 | my $nbdport = undef; |
| | 919 | my $nbsport = undef; |
| | 920 | my $nbsource = undef; |
| | 921 | my $nbdest = undef; |
| | 922 | |
| | 923 | eval { |
| | 924 | $nbsource = parse_address_list($source) if $source; |
| | 925 | $nbdest = parse_address_list($dest) if $dest; |
| | 926 | $nbdport = parse_port_name_number_or_range($dport) if $dport; |
| | 927 | $nbsport = parse_port_name_number_or_range($sport) if $sport; |
| | 928 | }; |
| | 929 | if (my $err = $@) { |
| | 930 | warn $err; |
| | 931 | next; |
| | 932 | |
| | 933 | } |
| | 934 | |
| | 935 | |
| | 936 | my $rule = { |
| | 937 | action => $action, |
| | 938 | service => $service, |
| | 939 | iface => $iface, |
| | 940 | source => $source, |
| | 941 | dest => $dest, |
| | 942 | nbsource => $nbsource, |
| | 943 | nbdest => $nbdest, |
| | 944 | proto => $proto, |
| | 945 | dport => $dport, |
| | 946 | sport => $sport, |
| | 947 | nbdport => $nbdport, |
| | 948 | nbsport => $nbsport, |
| | 949 | |
| | 950 | }; |
| | 951 | |
| | 952 | push @{$res->{$section}}, $rule; |
| | 953 | } |
| | 954 | |
| | 955 | die "security group $group don't exist" if $group && !$securitygroupexist; |
| | 956 | return $res; |
| | 957 | } |
| | 958 | |
| | 959 | sub read_local_vm_config { |
| | 960 | |
| | 961 | my $openvz = {}; |
| | 962 | |
| | 963 | my $qemu = {}; |
| | 964 | |
| | 965 | my $list = PVE::QemuServer::config_list(); |
| | 966 | |
| | 967 | foreach my $vmid (keys %$list) { |
| | 968 | #next if !($vmid eq '100' || $vmid eq '102'); |
| | 969 | my $cfspath = PVE::QemuServer::cfs_config_path($vmid); |
| | 970 | if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { |
| | 971 | $qemu->{$vmid} = $conf; |
| | 972 | } |
| | 973 | } |
| | 974 | |
| | 975 | my $vmdata = { openvz => $openvz, qemu => $qemu }; |
| | 976 | |
| | 977 | return $vmdata; |
| | 978 | }; |
| | 979 | |
| | 980 | sub read_vm_firewall_rules { |
| | 981 | my ($vmdata) = @_; |
| | 982 | my $rules = {}; |
| | 983 | foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) { |
| | 984 | my $filename = "/etc/pve/firewall/$vmid.fw"; |
| | 985 | my $fh = IO::File->new($filename, O_RDONLY); |
| | 986 | next if !$fh; |
| | 987 | |
| | 988 | $rules->{$vmid} = parse_fw_rules($filename, $fh); |
| | 989 | } |
| | 990 | |
| | 991 | return $rules; |
| | 992 | } |
| | 993 | |
| | 994 | sub compile { |
| | 995 | |
| | 996 | my $vmdata = read_local_vm_config(); |
| | 997 | my $rules = read_vm_firewall_rules($vmdata); |
| | 998 | |
| | 999 | # print Dumper($vmdata); |
| | 1000 | |
| | 1001 | my $swdir = '/etc/shorewall'; |
| | 1002 | mkdir $swdir; |
| | 1003 | |
| | 1004 | &$compile_shorewall($swdir, $vmdata, $rules); |
| | 1005 | |
| | 1006 | PVE::Tools::run_command(['shorewall', 'compile']); |
| | 1007 | } |
| | 1008 | |
| | 1009 | sub compile_and_start { |
| | 1010 | my ($restart) = @_; |
| | 1011 | |
| | 1012 | compile(); |
| | 1013 | |
| | 1014 | PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']); |
| | 1015 | } |
| | 1016 | |
| | 1017 | |
| | 1018 | 1; |
projects / pve-firewall.git / blame_incremental