PVE/Firewall.pm

   1 package PVE::Firewall;
   2
   3 use warnings;
   4 use strict;
   5 use Data::Dumper;
   6 use PVE::Tools;
   7 use PVE::QemuServer;
   8 use File::Path;
   9 use IO::File;
  10 use Data::Dumper;
  11
  12 my $macros;
  13 sub get_shorewall_macros {
  14
  15     return $macros if $macros;
  16
  17     foreach my $path (</usr/share/shorewall/macro.*>) {
  18         if ($path =~ m|/macro\.(\S+)$|) {
  19             $macros->{$1} = 1;
  20         }
  21     }
  22     return $macros;
  23 }
  24
  25
  26 my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
  27
  28 my $generate_input_rule = sub {
  29     my ($zoneinfo, $rule, $net, $netid) = @_;
  30
  31     my $zone = $net->{zone} || die "internal error";
  32     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  33     my $tap = $net->{tap} || die "internal error";
  34
  35     my $dest = "$zid:$tap";
  36
  37     if ($rule->{dest}) {
  38         $dest .= ":$rule->{dest}";
  39     }
  40
  41     my $action = $rule->{service} ?
  42         "$rule->{service}($rule->{action})" : $rule->{action};
  43
  44     my $source;
  45
  46     if ($zoneinfo->{$zone}->{type} eq 'bport') {
  47         my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error";
  48         my $bridge_ext_zone = $zoneinfo->{$bridge_zone}->{bridge_ext_zone} || die "internal error";
  49         my $zoneref = $zoneinfo->{$bridge_ext_zone}->{zoneref} || die "internal error";
  50         if (!$rule->{source}) {
  51             # $source = "${zoneref}";
  52             $source = 'all';
  53         } else {
  54             # 'all' does not work
  55             $source = "${zoneref}:$rule->{source}";
  56         }
  57     } else {
  58         $source = "all:$rule->{source}";
  59     }
  60
  61     return sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-',
  62                    $rule->{dport} || '-', $rule->{sport} || '-');
  63 };
  64
  65 my $generate_output_rule = sub {
  66     my ($zoneinfo, $rule, $net, $netid) = @_;
  67
  68     my $zone = $net->{zone} || die "internal error";
  69     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  70     my $tap = $net->{tap} || die "internal error";
  71
  72     my $action = $rule->{service} ?
  73         "$rule->{service}($rule->{action})" : $rule->{action};
  74
  75     my $dest;
  76
  77     if (!$rule->{dest}) {
  78         $dest = 'all';
  79     } else {
  80         $dest = "all:$rule->{dest}";
  81     }
  82
  83     return sprintf($rule_format, $action, "$zid:$tap", $dest,
  84                    $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
  85 };
  86
  87 # we need complete VM configuration of all VMs (openvz/qemu)
  88 # in vmdata
  89
  90 my $compile_shorewall = sub {
  91     my ($targetdir, $vmdata, $rules) = @_;
  92
  93     # remove existing data ?
  94     foreach my $file (qw(params zones rules interfaces  maclist  policy)) {
  95         unlink "$targetdir/$file";
  96     }
  97
  98     my $netinfo;
  99
 100     my $zoneinfo = {
 101         fw => { type => 'firewall' },
 102     };
 103
 104     my $maclist = {};
 105
 106     my $register_bridge;
 107
 108     $register_bridge = sub {
 109         my ($bridge, $vlan) = @_;
 110
 111         my $zone =  'z' . $bridge;
 112
 113         return $zone if $zoneinfo->{$zone};
 114
 115         my $ext_zone = "z${bridge}ext";
 116
 117         $zoneinfo->{$zone} = {
 118             type => 'bridge',
 119             bridge => $bridge,
 120             bridge_ext_zone => $ext_zone,
 121         };
 122
 123         # physical input devices
 124         my $dir = "/sys/class/net/$bridge/brif";
 125         my $physical = {};
 126         PVE::Tools::dir_glob_foreach($dir, '((eth|bond).+)', sub {
 127             my ($slave) = @_;
 128             $physical->{$slave} = 1;
 129         });
 130
 131         $zoneinfo->{$ext_zone} = {
 132             type => 'bport',
 133             bridge_zone => $zone,
 134             ifaces => $physical,
 135         };
 136
 137         return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
 138
 139         return $zone;
 140     };
 141
 142     my $register_bridge_port = sub {
 143         my ($bridge, $vlan, $vmzone, $tap) = @_;
 144
 145         my $bridge_zone = &$register_bridge($bridge, $vlan);
 146         my $zone = $bridge_zone . $vmzone;
 147
 148         if (!$zoneinfo->{$zone}) {
 149             $zoneinfo->{$zone} = {
 150                 type => 'bport',
 151                 bridge_zone => $bridge_zone,
 152                 ifaces => {},
 153             };
 154         }
 155
 156         $zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
 157
 158         return $zone;
 159     };
 160
 161     foreach my $vmid (keys %{$vmdata->{qemu}}) {
 162         $netinfo->{$vmid} = {};
 163         my $conf = $vmdata->{qemu}->{$vmid};
 164         foreach my $opt (keys %$conf) {
 165             next if $opt !~ m/^net(\d+)$/;
 166             my $netnum = $1;
 167             my $net = PVE::QemuServer::parse_net($conf->{$opt});
 168             next if !$net;
 169             die "implement me" if !$net->{bridge};
 170
 171             my $vmzone = $conf->{zone} || "vm$vmid";
 172             $net->{tap} = "tap${vmid}i${netnum}";
 173             $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error";
 174             $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
 175             $netinfo->{$vmid}->{$opt} = $net;
 176         }
 177     }
 178
 179     #print Dumper($netinfo);
 180
 181     # NOTE: zone names have length limit, so we need to
 182     # translate them into shorter names
 183
 184     my $zoneid = 0;
 185     my $zonemap = { fw => 'fw' };
 186
 187     my $lookup_zonename = sub {
 188         my ($zone) = @_;
 189
 190         return $zonemap->{$zone} if defined($zonemap->{$zone});
 191         $zonemap->{$zone} = 'z' . $zoneid++;
 192
 193         return $zonemap->{$zone};
 194     };
 195
 196     foreach my $z (sort keys %$zoneinfo) {
 197         $zoneinfo->{$z}->{id} = &$lookup_zonename($z);
 198         $zoneinfo->{$z}->{zonevar} = uc($z);
 199         $zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
 200     }
 201
 202     my $out;
 203
 204     # dump params file
 205     $out = "# PVE zones\n";
 206     foreach my $z (sort keys %$zoneinfo) {
 207         $out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
 208     }
 209     PVE::Tools::file_set_contents("$targetdir/params", $out);
 210
 211     # dump zone file
 212
 213     my $format = "%-30s %-10s %-15s\n";
 214     $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
 215
 216     foreach my $z (sort keys %$zoneinfo) {
 217         my $zid = $zoneinfo->{$z}->{zoneref};
 218         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 219             $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
 220         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 221             $out .= sprintf($format, $zid, 'ipv4', '');
 222         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 223             my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 224             my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
 225             $out .= sprintf($format, "$zid:$bzid", 'bport', '');
 226         } else {
 227             die "internal error";
 228         }
 229     }
 230
 231     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 232
 233     PVE::Tools::file_set_contents("$targetdir/zones", $out);
 234
 235     # dump interfaces
 236
 237     $format = "%-25s %-20s %-10s %-15s\n";
 238     $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');
 239
 240     my $maclist_format = "%-15s %-15s %-15s\n";
 241     my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');
 242
 243     foreach my $z (sort keys %$zoneinfo) {
 244         my $zid = $zoneinfo->{$z}->{zoneref};
 245         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 246             # do nothing;
 247         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 248             my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error";
 249             $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
 250         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 251             my $ifaces = $zoneinfo->{$z}->{ifaces};
 252             foreach my $iface (sort keys %$ifaces) {
 253                 my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 254                 my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error";
 255                 my $iftxt = "$bridge:$iface";
 256
 257                 if ($maclist->{$iface}) {
 258                     $out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
 259                     $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
 260                 } else {
 261                     $out .= sprintf($format, $zid, $iftxt, '-', '');
 262                 }
 263             }
 264         } else {
 265             die "internal error";
 266         }
 267     }
 268
 269     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 270
 271     PVE::Tools::file_set_contents("$targetdir/interfaces", $out);
 272
 273     # dump maclist
 274     PVE::Tools::file_set_contents("$targetdir/maclist", $macs);
 275
 276     # dump policy
 277
 278     $format = "%-15s %-15s %-15s %s\n";
 279     $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
 280     $out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');
 281
 282     # we need to disable intra-zone traffic on bridges. Else traffic
 283     # from untracked interfaces simply pass the firewall
 284     foreach my $z (sort keys %$zoneinfo) {
 285         my $zid = $zoneinfo->{$z}->{zoneref};
 286         if ($zoneinfo->{$z}->{type} eq 'bridge') {
 287             $out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
 288         }
 289     }
 290     $out .= sprintf($format, 'all', 'all', 'REJECT', 'info');
 291
 292     PVE::Tools::file_set_contents("$targetdir/policy", $out);
 293
 294     # dump rules
 295     $out = '';
 296
 297     $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
 298     foreach my $vmid (sort keys %$rules) {
 299         my $inrules = $rules->{$vmid}->{in};
 300         my $outrules = $rules->{$vmid}->{out};
 301
 302         if (scalar(@$inrules)) {
 303             $out .= "# IN to VM $vmid\n";
 304             foreach my $rule (@$inrules) {
 305                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 306                     my $net = $netinfo->{$vmid}->{$netid};
 307                     next if $rule->{iface} && $rule->{iface} ne $netid;
 308                     $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
 309                 }
 310             }
 311         }
 312
 313         if (scalar(@$outrules)) {
 314             $out .= "# OUT from VM $vmid\n";
 315             foreach my $rule (@$outrules) {
 316                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 317                     my $net = $netinfo->{$vmid}->{$netid};
 318                     next if $rule->{iface} && $rule->{iface} ne $netid;
 319                     $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
 320                 }
 321             }
 322         }
 323     }
 324
 325     PVE::Tools::file_set_contents("$targetdir/rules", $out);
 326 };
 327
 328
 329 sub parse_fw_rules {
 330     my ($filename, $fh) = @_;
 331
 332     my $section;
 333
 334     my $res = { in => [], out => [] };
 335
 336     my $macros = PVE::Firewall::get_shorewall_macros();
 337
 338     while (defined(my $line = <$fh>)) {
 339         next if $line =~ m/^#/;
 340         next if $line =~ m/^\s*$/;
 341
 342         if ($line =~ m/^\[(in|out)\]\s*$/i) {
 343             $section = lc($1);
 344             next;
 345         }
 346         next if !$section;
 347
 348         my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
 349             split(/\s+/, $line);
 350
 351         if (!$action) {
 352             warn "skip incomplete line\n";
 353             next;
 354         }
 355
 356         my $service;
 357         if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) {
 358             # OK
 359         } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
 360             ($service, $action) = ($1, $2);
 361             if (!$macros->{$service}) {
 362                 warn "unknown service '$service'\n";
 363                 next;
 364             }
 365         } else {
 366             warn "unknown action '$action'\n";
 367             next;
 368         }
 369
 370         $iface = undef if $iface && $iface eq '-';
 371         if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
 372             warn "unknown interface '$iface'\n";
 373             next;
 374         }
 375
 376         $proto = undef if $proto && $proto eq '-';
 377         if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) {
 378             warn "unknown protokol '$proto'\n";
 379             next;
 380         }
 381
 382         $source = undef if $source && $source eq '-';
 383
 384 #       if ($source !~ m/^(XYZ)$/) {
 385 #           warn "unknown source '$source'\n";
 386 #           next;
 387 #       }
 388
 389         $dest = undef if $dest && $dest eq '-';
 390 #       if ($dest !~ m/^XYZ)$/) {
 391 #           warn "unknown destination '$dest'\n";
 392 #           next;
 393 #       }
 394
 395         $dport = undef if $dport && $dport eq '-';
 396         $sport = undef if $sport && $sport eq '-';
 397
 398         my $rule = {
 399             action => $action,
 400             service => $service,
 401             iface => $iface,
 402             source => $source,
 403             dest => $dest,
 404             proto => $proto,
 405             dport => $dport,
 406             sport => $sport,
 407         };
 408
 409         push @{$res->{$section}}, $rule;
 410     }
 411
 412     return $res;
 413 }
 414
 415 sub read_local_vm_config {
 416
 417     my $openvz = {};
 418
 419     my $qemu = {};
 420
 421     my $list = PVE::QemuServer::config_list();
 422
 423     foreach my $vmid (keys %$list) {
 424         # next if $vmid ne '100';
 425         my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
 426         if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
 427             $qemu->{$vmid} = $conf;
 428         }
 429     }
 430
 431     my $vmdata = { openvz => $openvz, qemu => $qemu };
 432
 433     return $vmdata;
 434 };
 435
 436 sub read_vm_firewall_rules {
 437     my ($vmdata) = @_;
 438     my $rules = {};
 439     foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
 440         my $filename = "/etc/pve/firewall/$vmid.fw";
 441         my $fh = IO::File->new($filename, O_RDONLY);
 442         next if !$fh;
 443
 444         $rules->{$vmid} = parse_fw_rules($filename, $fh);
 445     }
 446
 447     return $rules;
 448 }
 449
 450 sub compile {
 451
 452     my $vmdata = read_local_vm_config();
 453     my $rules = read_vm_firewall_rules($vmdata);
 454
 455     # print Dumper($vmdata);
 456
 457     my $swdir = '/etc/shorewall';
 458     mkdir $swdir;
 459
 460     &$compile_shorewall($swdir, $vmdata, $rules);
 461
 462     PVE::Tools::run_command(['shorewall', 'compile']);
 463 }
 464
 465 sub compile_and_start {
 466     my ($restart) = @_;
 467
 468     compile();
 469
 470     PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']);
 471 }
 472
 473
 474 1;