[pve-firewall.git] / src / PVE / FirewallSimulator.pm

package PVE::FirewallSimulator;

use strict;
use warnings;
use Data::Dumper;
use PVE::Firewall;
use File::Basename;
use Net::IP;

my $mark;
my $trace;
my $debug = 0;

sub debug {
    my $new_value = shift;

    $debug = $new_value if defined($new_value);

    return $debug;
}
    
sub reset_trace {
    $trace = '';
}

sub get_trace {
    return $trace;
}

sub add_trace {
    my ($text) = @_;

    if ($debug) {
	print $text;
    } else {
	$trace .= $text;
    }
}

$SIG{'__WARN__'} = sub {
    my $err = $@;
    my $t = $_[0];
    chomp $t;
    add_trace("$t\n");
    $@ = $err;
};

sub nf_dev_match {
    my ($devre, $dev) = @_;

    $devre =~ s/\+$/\.\*/;
    return  ($dev =~ m/^${devre}$/) ? 1 : 0;
}

sub ipset_match {
    my ($ipsetname, $ipset, $ipaddr) = @_;

    my $ip = Net::IP->new($ipaddr);

    foreach my $entry (@$ipset) {
	next if $entry =~ m/^create/; # simply ignore
	if ($entry =~ m/add \S+ (\S+)$/) {
	    my $test = Net::IP->new($1);
	    if ($test->overlaps($ip)) {
		add_trace("IPSET $ipsetname match $ipaddr\n");
		return 1;
	    }
	} else {
	    die "implement me";
	}
    }

    return 0;
}

sub rule_match {
    my ($ipset_ruleset, $chain, $rule, $pkg) = @_;

    $rule =~ s/^-A $chain // || die "got strange rule: $rule";

    while (length($rule)) {

	if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
	    my $cstate = $1;

	    return undef if $cstate eq 'INVALID'; # no match
	    return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
	    
	    next if $cstate =~ m/NEW/;
	    
	    die "cstate test '$cstate' not implemented\n";
	}

	if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
	    my $atype = $1;
	    die "missing source address type (srctype)\n" 
		if !$pkg->{srctype};
	    return undef if $atype ne $pkg->{srctype};
	}

	if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
	    my $atype = $1;
	    die "missing destination address type (dsttype)\n" 
		if !$pkg->{dsttype};
	    return undef if $atype ne $pkg->{dsttype};
	}

	if ($rule =~ s/^-i (\S+)\s*//) {
	    my $devre = $1;
	    die "missing interface (iface_in)\n" if !$pkg->{iface_in};
	    return undef if !nf_dev_match($devre, $pkg->{iface_in});
	    next;
	}

	if ($rule =~ s/^-o (\S+)\s*//) {
	    my $devre = $1;
	    die "missing interface (iface_out)\n" if !$pkg->{iface_out};
	    return undef if !nf_dev_match($devre, $pkg->{iface_out});
	    next;
	}

	if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
	    die "missing proto" if !$pkg->{proto};
	    return undef if $pkg->{proto} ne $1; # no match
	    next;
	}

	if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
	    die "missing dport" if !$pkg->{dport};
	    return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
	    next;
	}

	if ($rule =~ s/^--dport (\d+)\s*//) {
	    die "missing dport" if !$pkg->{dport};
	    return undef if $pkg->{dport} != $1; # no match
	    next;
	}

	if ($rule =~ s/^-s (\S+)\s*//) {
	    die "missing source" if !$pkg->{source};
	    my $ip = Net::IP->new($1);
	    return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
	    next;
	}
    
	if ($rule =~ s/^-d (\S+)\s*//) {
	    die "missing destination" if !$pkg->{dest};
	    my $ip = Net::IP->new($1);
	    return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
	    next;
	}

	if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
	    die "missing source" if !$pkg->{source};
	    my $neg = $1;
	    my $ipset = $ipset_ruleset->{$2};
	    die "no such ip set '$2'" if !$ipset;
	    if ($neg) {
		return undef if ipset_match($1, $ipset, $pkg->{source});
	    } else {
		return undef if !ipset_match($1, $ipset, $pkg->{source});
	    }
	    next;
	}

	if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
	    die "missing destination" if !$pkg->{dest};
	    my $ipset = $ipset_ruleset->{$1};
	    die "no such ip set '$1'" if !$ipset;
	    return undef if !ipset_match($1, $ipset, $pkg->{dest});
	    next;
	}

	if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
	    die "missing source mac" if !$pkg->{mac_source};
	    return undef if $pkg->{mac_source} eq $1; # no match
	    next;
	}

	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
	    my $devre = $1;
	    return undef if !$pkg->{physdev_in};
	    return undef if !nf_dev_match($devre, $pkg->{physdev_in});
	    next;
	}

	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
	    my $devre = $1;
	    return undef if !$pkg->{physdev_out};
	    return undef if !nf_dev_match($devre, $pkg->{physdev_out});
	    next;
	}

	if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
	    return undef if !defined($mark) || $mark != $1;
	    next;
	}

	# final actions

	if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
	    $mark = $1;
	    return undef;
	}

	if ($rule =~ s/^-j (\S+)\s*$//) {
	    return (0, $1);
	}

	if ($rule =~ s/^-g (\S+)\s*$//) {
	    return (1, $1);
	}

	if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
	    return undef; 
	}

	last;
    }

    die "unable to parse rule: $rule";
}

sub ruleset_simulate_chain {
    my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;

    add_trace("ENTER chain $chain\n");
    
    my $counter = 0;

    if ($chain eq 'PVEFW-Drop') {
	add_trace("LEAVE chain $chain\n");
	return ('DROP', $counter);
    }
    if ($chain eq 'PVEFW-reject') {
	add_trace("LEAVE chain $chain\n");
	return ('REJECT', $counter);
    }

    if ($chain eq 'PVEFW-tcpflags') {
	add_trace("LEAVE chain $chain\n");
	return (undef, $counter);
    }

    my $rules = $ruleset->{$chain} ||
	die "no such chain '$chain'";

    foreach my $rule (@$rules) {
	$counter++;
	my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
	if (!defined($action)) {
	    add_trace("SKIP: $rule\n");
	    next;
	}
	add_trace("MATCH: $rule\n");
	
	if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
	    add_trace("TERMINATE chain $chain: $action\n");
	    return ($action, $counter);
	} elsif ($action eq 'RETURN') {
	    add_trace("RETURN FROM chain $chain\n");
	    last;
	} else {
	    if ($goto) {
		add_trace("LEAVE chain $chain - goto $action\n");
		return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
		#$chain = $action;
		#$rules = $ruleset->{$chain} || die "no such chain '$chain'";
	    } else {
		my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
		$counter += $ctr;
		return ($act, $counter) if $act;
		add_trace("CONTINUE chain $chain\n");
	    }
	}
    }

    add_trace("LEAVE chain $chain\n");
    if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
	return ('ACCEPT', $counter); # default policy
    }

    return (undef, $counter);
}

sub copy_packet {
    my ($pkg) = @_;

    my $res = {};

    while (my ($k,$v) = each %$pkg) {
	$res->{$k} = $v;
    }

    return $res;
}

# Try to simulate packet traversal inside kernel. This invokes iptable
# checks several times.
sub route_packet {
    my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;

    my $route_state = $start_state;

    my $physdev_in;

    my $ipt_invocation_counter = 0;
    my $rule_check_counter = 0;

    while ($route_state ne $target->{iface}) {

	my $chain;
	my $next_route_state;
	my $next_physdev_in;

	$pkg->{iface_in} = $pkg->{iface_out} = undef;
	$pkg->{physdev_in} = $pkg->{physdev_out} = undef;

	if ($route_state eq 'from-bport') {
	    $next_route_state = $from_info->{bridge} || die 'internal error';
	    $next_physdev_in = $from_info->{iface} || die 'internal error';
	} elsif ($route_state eq 'host') {

	    if ($target->{type} eq 'bport') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = $target->{iface} || die 'internal error';
	    } elsif ($target->{type} eq 'ct') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = 'venet0';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = 'venet-in';
	    } elsif ($target->{type} eq 'vm') {
		$pkg->{iface_in} = 'lo';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$chain = 'PVEFW-OUTPUT';
		$next_route_state = 'fwbr-in';
	    } else {
		die "implement me";
	    }

	} elsif ($route_state eq 'venet-out') {

	    if ($target->{type} eq 'host') {

		$chain = 'PVEFW-INPUT';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = 'lo';
		$next_route_state = 'host';

	    } elsif ($target->{type} eq 'bport') {
		
		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$next_route_state = $target->{iface} || die 'internal error';

	    } elsif ($target->{type} eq 'vm') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		$next_route_state = 'fwbr-in';

	    } elsif ($target->{type} eq 'ct') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = 'venet0';
		$pkg->{iface_out} = 'venet0';
		$next_route_state = 'venet-in';

	    } else {
		die "implement me";
	    }

	} elsif ($route_state eq 'fwbr-out') {

	    $chain = 'PVEFW-FORWARD';
	    $next_route_state = $from_info->{bridge} || die 'internal error';
	    $next_physdev_in = $from_info->{fwpr} || die 'internal error';
	    $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
	    $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
	    $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
	    $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
	
	} elsif ($route_state eq 'fwbr-in') {

	    $chain = 'PVEFW-FORWARD';
	    $next_route_state = $target->{tapdev};
	    $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
	    $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
	    $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
	    $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';

	} elsif ($route_state =~ m/^vmbr\d+$/) {
	    
	    die "missing physdev_in - internal error?" if !$physdev_in;
	    $pkg->{physdev_in} = $physdev_in;

	    if ($target->{type} eq 'host') {

		$chain = 'PVEFW-INPUT';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = 'lo';
		$next_route_state = 'host';

	    } elsif ($target->{type} eq 'bport') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = $target->{bridge} || die 'internal error';
		# conditionally set physdev_out (same behavior as kernel)
		if ($route_state eq $target->{bridge}) {
		    $pkg->{physdev_out} = $target->{iface} || die 'internal error';
		}
		$next_route_state = $target->{iface};

	    } elsif ($target->{type} eq 'ct') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = 'venet0';
		$next_route_state = 'venet-in';

	    } elsif ($target->{type} eq 'vm') {

		$chain = 'PVEFW-FORWARD';
		$pkg->{iface_in} = $route_state;
		$pkg->{iface_out} = $target->{bridge};
		# conditionally set physdev_out (same behavior as kernel)
		if ($route_state eq $target->{bridge}) {
		    $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
		}
		$next_route_state = 'fwbr-in';

	    } else {
		die "implement me";
	    }

	} else {
	    die "implement me $route_state";
	}

	die "internal error" if !defined($next_route_state);

	if ($chain) {
	    add_trace("IPT check at $route_state (chain $chain)\n");
	    add_trace(Dumper($pkg));
	    $ipt_invocation_counter++;
	    my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
	    $rule_check_counter += $ctr;
	    return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
	} 

	$route_state = $next_route_state;

	$physdev_in = $next_physdev_in;
    }

    return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
}

sub extract_ct_info {
    my ($vmdata, $vmid) = @_;

    my $info = { type => 'ct', vmid => $vmid };

    my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
    if ($conf->{ip_address}) {
	$info->{ip_address} = $conf->{ip_address}->{value};
    } else {
	die "implement me";
    }
    return $info;
}

sub extract_vm_info {
    my ($vmdata, $vmid, $netnum) = @_;

    my $info = { type => 'vm', vmid => $vmid };

    my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
    my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
    $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
    $info->{bridge} = $net->{bridge} || die "unable to get bridge";
    $info->{fwbr} = "fwbr${vmid}i$netnum";
    $info->{tapdev} = "tap${vmid}i$netnum";
    $info->{fwln} = "fwln${vmid}i$netnum";
    $info->{fwpr} = "fwpr${vmid}p$netnum";

    return $info;
}

sub simulate_firewall {
    my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;

    my $from = $test->{from} || die "missing 'from' field";
    my $to = $test->{to} || die "missing 'to' field";
    my $action = $test->{action} || die "missing 'action'";
    
    my $testid = $test->{id};
    
    die "from/to needs to be different" if $from eq $to;

    my $pkg = {
	proto => 'tcp',
	sport => undef,
	dport => undef,
	source => undef,
	dest => undef,
	srctype => 'UNICAST',
	dsttype => 'UNICAST',
    };

    while (my ($k,$v) = each %$test) {
	next if $k eq 'from';
	next if $k eq 'to';
	next if $k eq 'action';
	next if $k eq 'id';
	die "unknown attribute '$k'\n" if !exists($pkg->{$k});
	$pkg->{$k} = $v;
    }

    my $from_info = {};

    my $start_state;

    if ($from eq 'host') {
	$from_info->{type} = 'host';
	$start_state = 'host';
	$pkg->{source} = $host_ip if !defined($pkg->{source});
    } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
	$from_info->{type} = 'bport';
	$from_info->{bridge} = $1;
	$from_info->{iface} = $2;
	$start_state = 'from-bport';
    } elsif ($from eq 'outside') {
	$from_info->{type} = 'bport';
	$from_info->{bridge} = 'vmbr0';
	$from_info->{iface} = 'eth0';
	$start_state = 'from-bport';
    } elsif ($from eq 'nfvm') {
	$from_info->{type} = 'bport';
	$from_info->{bridge} = 'vmbr0';
	$from_info->{iface} = 'tapXYZ';
	$start_state = 'from-bport';
    } elsif ($from =~ m/^ct(\d+)$/) {
	my $vmid = $1;
	$from_info = extract_ct_info($vmdata, $vmid);
	if ($from_info->{ip_address}) {
	    $pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
	    $start_state = 'venet-out';
	} else {
	    die "implement me";
	}
    } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
	my $vmid = $1;
	my $netnum = $3 || 0;
	$from_info = extract_vm_info($vmdata, $vmid, $netnum);
	$start_state = 'fwbr-out'; 
	$pkg->{mac_source} = $from_info->{macaddr};
    } else {
	die "unable to parse \"from => '$from'\"\n";
    }

    my $target;

    if ($to eq 'host') {
	$target->{type} = 'host';
	$target->{iface} = 'host';
	$pkg->{dest} = $host_ip if !defined($pkg->{dest});
    } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
	$target->{type} = 'bport';
	$target->{bridge} = $1;
	$target->{iface} = $2;
    } elsif ($to eq 'outside') {
	$target->{type} = 'bport';
	$target->{bridge} = 'vmbr0';
	$target->{iface} = 'eth0';
     } elsif ($to eq 'nfvm') {
	$target->{type} = 'bport';
	$target->{bridge} = 'vmbr0';
	$target->{iface} = 'tapXYZ';
    } elsif ($to =~ m/^ct(\d+)$/) {
	my $vmid = $1;
	$target = extract_ct_info($vmdata, $vmid);
	$target->{iface} = 'venet-in';

	if ($target->{ip_address}) {
	    $pkg->{dest} = $target->{ip_address};
	} else {
	    die "implement me";
	}
   } elsif ($to =~ m/^vm(\d+)$/) {
	my $vmid = $1;
	$target = extract_vm_info($vmdata, $vmid, 0);
	$target->{iface} = $target->{tapdev};
    } else {
	die "unable to parse \"to => '$to'\"\n";
    }

    $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
    $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});

    my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg, 
				       $from_info, $target, $start_state);

    add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 
    return $res if $action eq 'QUERY';

    die "test failed ($res != $action)\n" if $action ne $res;

    return undef; 
}

1;
Commit	Line	Data
	1	package PVE::FirewallSimulator;
	2
	3	use strict;
	4	use warnings;
	5	use Data::Dumper;
	6	use PVE::Firewall;
	7	use File::Basename;
	8	use Net::IP;
	9
	10	my $mark;
	11	my $trace;
	12	my $debug = 0;
	13
	14	sub debug {
	15	my $new_value = shift;
	16
	17	$debug = $new_value if defined($new_value);
	18
	19	return $debug;
	20	}
	21
	22	sub reset_trace {
	23	$trace = '';
	24	}
	25
	26	sub get_trace {
	27	return $trace;
	28	}
	29
	30	sub add_trace {
	31	my ($text) = @_;
	32
	33	if ($debug) {
	34	print $text;
	35	} else {
	36	$trace .= $text;
	37	}
	38	}
	39
	40	$SIG{'__WARN__'} = sub {
	41	my $err = $@;
	42	my $t = $_[0];
	43	chomp $t;
	44	add_trace("$t\n");
	45	$@ = $err;
	46	};
	47
	48	sub nf_dev_match {
	49	my ($devre, $dev) = @_;
	50
	51	$devre =~ s/\+$/\.\*/;
	52	return ($dev =~ m/^${devre}$/) ? 1 : 0;
	53	}
	54
	55	sub ipset_match {
	56	my ($ipsetname, $ipset, $ipaddr) = @_;
	57
	58	my $ip = Net::IP->new($ipaddr);
	59
	60	foreach my $entry (@$ipset) {
	61	next if $entry =~ m/^create/; # simply ignore
	62	if ($entry =~ m/add \S+ (\S+)$/) {
	63	my $test = Net::IP->new($1);
	64	if ($test->overlaps($ip)) {
	65	add_trace("IPSET $ipsetname match $ipaddr\n");
	66	return 1;
	67	}
	68	} else {
	69	die "implement me";
	70	}
	71	}
	72
	73	return 0;
	74	}
	75
	76	sub rule_match {
	77	my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
	78
	79	$rule =~ s/^-A $chain // \|\| die "got strange rule: $rule";
	80
	81	while (length($rule)) {
	82
	83	if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
	84	my $cstate = $1;
	85
	86	return undef if $cstate eq 'INVALID'; # no match
	87	return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
	88
	89	next if $cstate =~ m/NEW/;
	90
	91	die "cstate test '$cstate' not implemented\n";
	92	}
	93
	94	if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
	95	my $atype = $1;
	96	die "missing source address type (srctype)\n"
	97	if !$pkg->{srctype};
	98	return undef if $atype ne $pkg->{srctype};
	99	}
	100
	101	if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
	102	my $atype = $1;
	103	die "missing destination address type (dsttype)\n"
	104	if !$pkg->{dsttype};
	105	return undef if $atype ne $pkg->{dsttype};
	106	}
	107
	108	if ($rule =~ s/^-i (\S+)\s*//) {
	109	my $devre = $1;
	110	die "missing interface (iface_in)\n" if !$pkg->{iface_in};
	111	return undef if !nf_dev_match($devre, $pkg->{iface_in});
	112	next;
	113	}
	114
	115	if ($rule =~ s/^-o (\S+)\s*//) {
	116	my $devre = $1;
	117	die "missing interface (iface_out)\n" if !$pkg->{iface_out};
	118	return undef if !nf_dev_match($devre, $pkg->{iface_out});
	119	next;
	120	}
	121
	122	if ($rule =~ s/^-p (tcp\|udp\|igmp\|icmp)\s*//) {
	123	die "missing proto" if !$pkg->{proto};
	124	return undef if $pkg->{proto} ne $1; # no match
	125	next;
	126	}
	127
	128	if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
	129	die "missing dport" if !$pkg->{dport};
	130	return undef if ($pkg->{dport} < $1) \|\| ($pkg->{dport} > $2); # no match
	131	next;
	132	}
	133
	134	if ($rule =~ s/^--dport (\d+)\s*//) {
	135	die "missing dport" if !$pkg->{dport};
	136	return undef if $pkg->{dport} != $1; # no match
	137	next;
	138	}
	139
	140	if ($rule =~ s/^-s (\S+)\s*//) {
	141	die "missing source" if !$pkg->{source};
	142	my $ip = Net::IP->new($1);
	143	return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
	144	next;
	145	}
	146
	147	if ($rule =~ s/^-d (\S+)\s*//) {
	148	die "missing destination" if !$pkg->{dest};
	149	my $ip = Net::IP->new($1);
	150	return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
	151	next;
	152	}
	153
	154	if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
	155	die "missing source" if !$pkg->{source};
	156	my $neg = $1;
	157	my $ipset = $ipset_ruleset->{$2};
	158	die "no such ip set '$2'" if !$ipset;
	159	if ($neg) {
	160	return undef if ipset_match($1, $ipset, $pkg->{source});
	161	} else {
	162	return undef if !ipset_match($1, $ipset, $pkg->{source});
	163	}
	164	next;
	165	}
	166
	167	if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
	168	die "missing destination" if !$pkg->{dest};
	169	my $ipset = $ipset_ruleset->{$1};
	170	die "no such ip set '$1'" if !$ipset;
	171	return undef if !ipset_match($1, $ipset, $pkg->{dest});
	172	next;
	173	}
	174
	175	if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
	176	die "missing source mac" if !$pkg->{mac_source};
	177	return undef if $pkg->{mac_source} eq $1; # no match
	178	next;
	179	}
	180
	181	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
	182	my $devre = $1;
	183	return undef if !$pkg->{physdev_in};
	184	return undef if !nf_dev_match($devre, $pkg->{physdev_in});
	185	next;
	186	}
	187
	188	if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
	189	my $devre = $1;
	190	return undef if !$pkg->{physdev_out};
	191	return undef if !nf_dev_match($devre, $pkg->{physdev_out});
	192	next;
	193	}
	194
	195	if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
	196	return undef if !defined($mark) \|\| $mark != $1;
	197	next;
	198	}
	199
	200	# final actions
	201
	202	if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
	203	$mark = $1;
	204	return undef;
	205	}
	206
	207	if ($rule =~ s/^-j (\S+)\s*$//) {
	208	return (0, $1);
	209	}
	210
	211	if ($rule =~ s/^-g (\S+)\s*$//) {
	212	return (1, $1);
	213	}
	214
	215	if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
	216	return undef;
	217	}
	218
	219	last;
	220	}
	221
	222	die "unable to parse rule: $rule";
	223	}
	224
	225	sub ruleset_simulate_chain {
	226	my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
	227
	228	add_trace("ENTER chain $chain\n");
	229
	230	my $counter = 0;
	231
	232	if ($chain eq 'PVEFW-Drop') {
	233	add_trace("LEAVE chain $chain\n");
	234	return ('DROP', $counter);
	235	}
	236	if ($chain eq 'PVEFW-reject') {
	237	add_trace("LEAVE chain $chain\n");
	238	return ('REJECT', $counter);
	239	}
	240
	241	if ($chain eq 'PVEFW-tcpflags') {
	242	add_trace("LEAVE chain $chain\n");
	243	return (undef, $counter);
	244	}
	245
	246	my $rules = $ruleset->{$chain} \|\|
	247	die "no such chain '$chain'";
	248
	249	foreach my $rule (@$rules) {
	250	$counter++;
	251	my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
	252	if (!defined($action)) {
	253	add_trace("SKIP: $rule\n");
	254	next;
	255	}
	256	add_trace("MATCH: $rule\n");
	257
	258	if ($action eq 'ACCEPT' \|\| $action eq 'DROP' \|\| $action eq 'REJECT') {
	259	add_trace("TERMINATE chain $chain: $action\n");
	260	return ($action, $counter);
	261	} elsif ($action eq 'RETURN') {
	262	add_trace("RETURN FROM chain $chain\n");
	263	last;
	264	} else {
	265	if ($goto) {
	266	add_trace("LEAVE chain $chain - goto $action\n");
	267	return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
	268	#$chain = $action;
	269	#$rules = $ruleset->{$chain} \|\| die "no such chain '$chain'";
	270	} else {
	271	my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
	272	$counter += $ctr;
	273	return ($act, $counter) if $act;
	274	add_trace("CONTINUE chain $chain\n");
	275	}
	276	}
	277	}
	278
	279	add_trace("LEAVE chain $chain\n");
	280	if ($chain =~ m/^PVEFW-(INPUT\|OUTPUT\|FORWARD)$/) {
	281	return ('ACCEPT', $counter); # default policy
	282	}
	283
	284	return (undef, $counter);
	285	}
	286
	287	sub copy_packet {
	288	my ($pkg) = @_;
	289
	290	my $res = {};
	291
	292	while (my ($k,$v) = each %$pkg) {
	293	$res->{$k} = $v;
	294	}
	295
	296	return $res;
	297	}
	298
	299	# Try to simulate packet traversal inside kernel. This invokes iptable
	300	# checks several times.
	301	sub route_packet {
	302	my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
	303
	304	my $route_state = $start_state;
	305
	306	my $physdev_in;
	307
	308	my $ipt_invocation_counter = 0;
	309	my $rule_check_counter = 0;
	310
	311	while ($route_state ne $target->{iface}) {
	312
	313	my $chain;
	314	my $next_route_state;
	315	my $next_physdev_in;
	316
	317	$pkg->{iface_in} = $pkg->{iface_out} = undef;
	318	$pkg->{physdev_in} = $pkg->{physdev_out} = undef;
	319
	320	if ($route_state eq 'from-bport') {
	321	$next_route_state = $from_info->{bridge} \|\| die 'internal error';
	322	$next_physdev_in = $from_info->{iface} \|\| die 'internal error';
	323	} elsif ($route_state eq 'host') {
	324
	325	if ($target->{type} eq 'bport') {
	326	$pkg->{iface_in} = 'lo';
	327	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	328	$chain = 'PVEFW-OUTPUT';
	329	$next_route_state = $target->{iface} \|\| die 'internal error';
	330	} elsif ($target->{type} eq 'ct') {
	331	$pkg->{iface_in} = 'lo';
	332	$pkg->{iface_out} = 'venet0';
	333	$chain = 'PVEFW-OUTPUT';
	334	$next_route_state = 'venet-in';
	335	} elsif ($target->{type} eq 'vm') {
	336	$pkg->{iface_in} = 'lo';
	337	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	338	$chain = 'PVEFW-OUTPUT';
	339	$next_route_state = 'fwbr-in';
	340	} else {
	341	die "implement me";
	342	}
	343
	344	} elsif ($route_state eq 'venet-out') {
	345
	346	if ($target->{type} eq 'host') {
	347
	348	$chain = 'PVEFW-INPUT';
	349	$pkg->{iface_in} = 'venet0';
	350	$pkg->{iface_out} = 'lo';
	351	$next_route_state = 'host';
	352
	353	} elsif ($target->{type} eq 'bport') {
	354
	355	$chain = 'PVEFW-FORWARD';
	356	$pkg->{iface_in} = 'venet0';
	357	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	358	$next_route_state = $target->{iface} \|\| die 'internal error';
	359
	360	} elsif ($target->{type} eq 'vm') {
	361
	362	$chain = 'PVEFW-FORWARD';
	363	$pkg->{iface_in} = 'venet0';
	364	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	365	$next_route_state = 'fwbr-in';
	366
	367	} elsif ($target->{type} eq 'ct') {
	368
	369	$chain = 'PVEFW-FORWARD';
	370	$pkg->{iface_in} = 'venet0';
	371	$pkg->{iface_out} = 'venet0';
	372	$next_route_state = 'venet-in';
	373
	374	} else {
	375	die "implement me";
	376	}
	377
	378	} elsif ($route_state eq 'fwbr-out') {
	379
	380	$chain = 'PVEFW-FORWARD';
	381	$next_route_state = $from_info->{bridge} \|\| die 'internal error';
	382	$next_physdev_in = $from_info->{fwpr} \|\| die 'internal error';
	383	$pkg->{iface_in} = $from_info->{fwbr} \|\| die 'internal error';
	384	$pkg->{iface_out} = $from_info->{fwbr} \|\| die 'internal error';
	385	$pkg->{physdev_in} = $from_info->{tapdev} \|\| die 'internal error';
	386	$pkg->{physdev_out} = $from_info->{fwln} \|\| die 'internal error';
	387
	388	} elsif ($route_state eq 'fwbr-in') {
	389
	390	$chain = 'PVEFW-FORWARD';
	391	$next_route_state = $target->{tapdev};
	392	$pkg->{iface_in} = $target->{fwbr} \|\| die 'internal error';
	393	$pkg->{iface_out} = $target->{fwbr} \|\| die 'internal error';
	394	$pkg->{physdev_in} = $target->{fwln} \|\| die 'internal error';
	395	$pkg->{physdev_out} = $target->{tapdev} \|\| die 'internal error';
	396
	397	} elsif ($route_state =~ m/^vmbr\d+$/) {
	398
	399	die "missing physdev_in - internal error?" if !$physdev_in;
	400	$pkg->{physdev_in} = $physdev_in;
	401
	402	if ($target->{type} eq 'host') {
	403
	404	$chain = 'PVEFW-INPUT';
	405	$pkg->{iface_in} = $route_state;
	406	$pkg->{iface_out} = 'lo';
	407	$next_route_state = 'host';
	408
	409	} elsif ($target->{type} eq 'bport') {
	410
	411	$chain = 'PVEFW-FORWARD';
	412	$pkg->{iface_in} = $route_state;
	413	$pkg->{iface_out} = $target->{bridge} \|\| die 'internal error';
	414	# conditionally set physdev_out (same behavior as kernel)
	415	if ($route_state eq $target->{bridge}) {
	416	$pkg->{physdev_out} = $target->{iface} \|\| die 'internal error';
	417	}
	418	$next_route_state = $target->{iface};
	419
	420	} elsif ($target->{type} eq 'ct') {
	421
	422	$chain = 'PVEFW-FORWARD';
	423	$pkg->{iface_in} = $route_state;
	424	$pkg->{iface_out} = 'venet0';
	425	$next_route_state = 'venet-in';
	426
	427	} elsif ($target->{type} eq 'vm') {
	428
	429	$chain = 'PVEFW-FORWARD';
	430	$pkg->{iface_in} = $route_state;
	431	$pkg->{iface_out} = $target->{bridge};
	432	# conditionally set physdev_out (same behavior as kernel)
	433	if ($route_state eq $target->{bridge}) {
	434	$pkg->{physdev_out} = $target->{fwpr} \|\| die 'internal error';
	435	}
	436	$next_route_state = 'fwbr-in';
	437
	438	} else {
	439	die "implement me";
	440	}
	441
	442	} else {
	443	die "implement me $route_state";
	444	}
	445
	446	die "internal error" if !defined($next_route_state);
	447
	448	if ($chain) {
	449	add_trace("IPT check at $route_state (chain $chain)\n");
	450	add_trace(Dumper($pkg));
	451	$ipt_invocation_counter++;
	452	my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
	453	$rule_check_counter += $ctr;
	454	return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
	455	}
	456
	457	$route_state = $next_route_state;
	458
	459	$physdev_in = $next_physdev_in;
	460	}
	461
	462	return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
	463	}
	464
	465	sub extract_ct_info {
	466	my ($vmdata, $vmid) = @_;
	467
	468	my $info = { type => 'ct', vmid => $vmid };
	469
	470	my $conf = $vmdata->{openvz}->{$vmid} \|\| die "no such CT '$vmid'";
	471	if ($conf->{ip_address}) {
	472	$info->{ip_address} = $conf->{ip_address}->{value};
	473	} else {
	474	die "implement me";
	475	}
	476	return $info;
	477	}
	478
	479	sub extract_vm_info {
	480	my ($vmdata, $vmid, $netnum) = @_;
	481
	482	my $info = { type => 'vm', vmid => $vmid };
	483
	484	my $conf = $vmdata->{qemu}->{$vmid} \|\| die "no such VM '$vmid'";
	485	my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
	486	$info->{macaddr} = $net->{macaddr} \|\| die "unable to get mac address";
	487	$info->{bridge} = $net->{bridge} \|\| die "unable to get bridge";
	488	$info->{fwbr} = "fwbr${vmid}i$netnum";
	489	$info->{tapdev} = "tap${vmid}i$netnum";
	490	$info->{fwln} = "fwln${vmid}i$netnum";
	491	$info->{fwpr} = "fwpr${vmid}p$netnum";
	492
	493	return $info;
	494	}
	495
	496	sub simulate_firewall {
	497	my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
	498
	499	my $from = $test->{from} \|\| die "missing 'from' field";
	500	my $to = $test->{to} \|\| die "missing 'to' field";
	501	my $action = $test->{action} \|\| die "missing 'action'";
	502
	503	my $testid = $test->{id};
	504
	505	die "from/to needs to be different" if $from eq $to;
	506
	507	my $pkg = {
	508	proto => 'tcp',
	509	sport => undef,
	510	dport => undef,
	511	source => undef,
	512	dest => undef,
	513	srctype => 'UNICAST',
	514	dsttype => 'UNICAST',
	515	};
	516
	517	while (my ($k,$v) = each %$test) {
	518	next if $k eq 'from';
	519	next if $k eq 'to';
	520	next if $k eq 'action';
	521	next if $k eq 'id';
	522	die "unknown attribute '$k'\n" if !exists($pkg->{$k});
	523	$pkg->{$k} = $v;
	524	}
	525
	526	my $from_info = {};
	527
	528	my $start_state;
	529
	530	if ($from eq 'host') {
	531	$from_info->{type} = 'host';
	532	$start_state = 'host';
	533	$pkg->{source} = $host_ip if !defined($pkg->{source});
	534	} elsif ($from =~ m\|^(vmbr\d+)/(\S+)$\|) {
	535	$from_info->{type} = 'bport';
	536	$from_info->{bridge} = $1;
	537	$from_info->{iface} = $2;
	538	$start_state = 'from-bport';
	539	} elsif ($from eq 'outside') {
	540	$from_info->{type} = 'bport';
	541	$from_info->{bridge} = 'vmbr0';
	542	$from_info->{iface} = 'eth0';
	543	$start_state = 'from-bport';
	544	} elsif ($from eq 'nfvm') {
	545	$from_info->{type} = 'bport';
	546	$from_info->{bridge} = 'vmbr0';
	547	$from_info->{iface} = 'tapXYZ';
	548	$start_state = 'from-bport';
	549	} elsif ($from =~ m/^ct(\d+)$/) {
	550	my $vmid = $1;
	551	$from_info = extract_ct_info($vmdata, $vmid);
	552	if ($from_info->{ip_address}) {
	553	$pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
	554	$start_state = 'venet-out';
	555	} else {
	556	die "implement me";
	557	}
	558	} elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
	559	my $vmid = $1;
	560	my $netnum = $3 \|\| 0;
	561	$from_info = extract_vm_info($vmdata, $vmid, $netnum);
	562	$start_state = 'fwbr-out';
	563	$pkg->{mac_source} = $from_info->{macaddr};
	564	} else {
	565	die "unable to parse \"from => '$from'\"\n";
	566	}
	567
	568	my $target;
	569
	570	if ($to eq 'host') {
	571	$target->{type} = 'host';
	572	$target->{iface} = 'host';
	573	$pkg->{dest} = $host_ip if !defined($pkg->{dest});
	574	} elsif ($to =~ m\|^(vmbr\d+)/(\S+)$\|) {
	575	$target->{type} = 'bport';
	576	$target->{bridge} = $1;
	577	$target->{iface} = $2;
	578	} elsif ($to eq 'outside') {
	579	$target->{type} = 'bport';
	580	$target->{bridge} = 'vmbr0';
	581	$target->{iface} = 'eth0';
	582	} elsif ($to eq 'nfvm') {
	583	$target->{type} = 'bport';
	584	$target->{bridge} = 'vmbr0';
	585	$target->{iface} = 'tapXYZ';
	586	} elsif ($to =~ m/^ct(\d+)$/) {
	587	my $vmid = $1;
	588	$target = extract_ct_info($vmdata, $vmid);
	589	$target->{iface} = 'venet-in';
	590
	591	if ($target->{ip_address}) {
	592	$pkg->{dest} = $target->{ip_address};
	593	} else {
	594	die "implement me";
	595	}
	596	} elsif ($to =~ m/^vm(\d+)$/) {
	597	my $vmid = $1;
	598	$target = extract_vm_info($vmdata, $vmid, 0);
	599	$target->{iface} = $target->{tapdev};
	600	} else {
	601	die "unable to parse \"to => '$to'\"\n";
	602	}
	603
	604	$pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
	605	$pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
	606
	607	my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
	608	$from_info, $target, $start_state);
	609
	610	add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
	611
	612	return $res if $action eq 'QUERY';
	613
	614	die "test failed ($res != $action)\n" if $action ne $res;
	615
	616	return undef;
	617	}
	618
	619	1;
	620