PVE/Firewall.pm

   1 package PVE::Firewall;
   2
   3 use warnings;
   4 use strict;
   5 use Data::Dumper;
   6 use PVE::Tools;
   7 use PVE::QemuServer;
   8
   9 my $macros;
  10 sub get_shorewall_macros {
  11
  12     return $macros if $macros;
  13
  14     foreach my $path (</usr/share/shorewall/macro.*>) {
  15         if ($path =~ m|/macro\.(\S+)$|) {
  16             $macros->{$1} = 1;
  17         }
  18     }
  19     return $macros;
  20 }
  21
  22
  23 my $rule_format = "%-15s %-15s %-15s %-15s %-15s %-15s\n";
  24
  25 my $generate_input_rule = sub {
  26     my ($zoneinfo, $rule, $net, $netid) = @_;
  27
  28     die "not implemented" if $rule->{source} ne 'any';
  29     die "not implemented" if $rule->{dest} ne 'any';
  30
  31     my $zone = $net->{zone} || die "internal error";
  32     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  33     my $tap = $net->{tap} || die "internal error";
  34
  35     my $action = $rule->{service} ?
  36         "$rule->{service}($rule->{action})" : $rule->{action};
  37
  38     return sprintf($rule_format, $action, $rule->{source}, "$zid:$tap",
  39                    $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
  40 };
  41
  42 my $generate_output_rule = sub {
  43     my ($zoneinfo, $rule, $net, $netid) = @_;
  44
  45     die "not implemented" if $rule->{source} ne 'any';
  46     die "not implemented" if $rule->{dest} ne 'any';
  47
  48     my $zone = $net->{zone} || die "internal error";
  49     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  50     my $tap = $net->{tap} || die "internal error";
  51
  52     my $action = $rule->{service} ?
  53         "$rule->{service}($rule->{action})" : $rule->{action};
  54
  55     return sprintf($rule_format, $action, "$zid:$tap", $rule->{dest},
  56                    $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
  57 };
  58
  59 # we need complete VM configuration of all VMs (openvz/qemu)
  60 # in vmdata
  61
  62 sub compile {
  63     my ($targetdir, $vmdata, $rules) = @_;
  64
  65     # remove existing data ?
  66     foreach my $file (qw(params zones rules interfaces  maclist  policy)) {
  67         unlink "$targetdir/$file";
  68     }
  69
  70     my $netinfo;
  71
  72     my $zoneinfo = {
  73         fw => { type => 'firewall' },
  74     };
  75
  76     my $maclist = {};
  77
  78     my $register_bridge;
  79
  80     $register_bridge = sub {
  81         my ($bridge, $vlan) = @_;
  82
  83         my $zone =  'z' . $bridge;
  84
  85         return $zone if $zoneinfo->{$zone};
  86
  87         $zoneinfo->{$zone} = {
  88             type => 'bridge',
  89             bridge => $bridge,
  90         };
  91
  92         return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
  93
  94         return $zone;
  95     };
  96
  97     my $register_bridge_port = sub {
  98         my ($bridge, $vlan, $vmzone, $tap) = @_;
  99
 100         my $bridge_zone = &$register_bridge($bridge, $vlan);
 101         my $zone = $bridge_zone . $vmzone;
 102
 103         if (!$zoneinfo->{$zone}) {
 104             $zoneinfo->{$zone} = {
 105                 type => 'bport',
 106                 bridge_zone => $bridge_zone,
 107                 ifaces => {},
 108             };
 109         }
 110
 111         $zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
 112
 113         return $zone;
 114     };
 115
 116     foreach my $vmid (keys %{$vmdata->{qemu}}) {
 117         $netinfo->{$vmid} = {};
 118         my $conf = $vmdata->{qemu}->{$vmid};
 119         foreach my $opt (keys %$conf) {
 120             next if $opt !~ m/^net(\d+)$/;
 121             my $netnum = $1;
 122             my $net = PVE::QemuServer::parse_net($conf->{$opt});
 123             next if !$net;
 124             die "implement me" if !$net->{bridge};
 125
 126             my $vmzone = $conf->{zone} || "vm$vmid";
 127             $net->{tap} = "tap${vmid}i${netnum}";
 128             $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error";
 129             $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
 130             $netinfo->{$vmid}->{$opt} = $net;
 131         }
 132     }
 133
 134     #print Dumper($netinfo);
 135
 136     # NOTE: zone names have length limit, so we need to
 137     # translate them into shorter names
 138
 139     my $zoneid = 0;
 140     my $zonemap = { fw => 'fw' };
 141
 142     my $lookup_zonename = sub {
 143         my ($zone) = @_;
 144
 145         return $zonemap->{$zone} if defined($zonemap->{$zone});
 146         $zonemap->{$zone} = 'z' . $zoneid++;
 147
 148         return $zonemap->{$zone};
 149     };
 150
 151     foreach my $z (sort keys %$zoneinfo) {
 152         $zoneinfo->{$z}->{id} = &$lookup_zonename($z);
 153         $zoneinfo->{$z}->{zonevar} = uc($z);
 154         $zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
 155     }
 156
 157     my $out;
 158
 159     # dump params file
 160     $out = "# PVE zones\n";
 161     foreach my $z (sort keys %$zoneinfo) {
 162         $out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
 163     }
 164     PVE::Tools::file_set_contents("$targetdir/params", $out);
 165
 166     # dump zone file
 167
 168     my $format = "%-30s %-10s %-15s\n";
 169     $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
 170
 171     foreach my $z (sort keys %$zoneinfo) {
 172         my $zid = $zoneinfo->{$z}->{zoneref};
 173         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 174             $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
 175         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 176             $out .= sprintf($format, $zid, 'ipv4', '');
 177         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 178             my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 179             my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
 180             $out .= sprintf($format, "$zid:$bzid", 'bport', '');
 181         } else {
 182             die "internal error";
 183         }
 184     }
 185
 186     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 187
 188     PVE::Tools::file_set_contents("$targetdir/zones", $out);
 189
 190     # dump interfaces
 191
 192     $format = "%-25s %-20s %-10s %-15s\n";
 193     $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');
 194
 195     my $maclist_format = "%-15s %-15s %-15s\n";
 196     my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');
 197
 198     foreach my $z (sort keys %$zoneinfo) {
 199         my $zid = $zoneinfo->{$z}->{zoneref};
 200         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 201             # do nothing;
 202         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 203             my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error";
 204             $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
 205
 206         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 207             my $ifaces = $zoneinfo->{$z}->{ifaces};
 208             foreach my $iface (sort keys %$ifaces) {
 209                 my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 210                 my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error";
 211                 my $iftxt = "$bridge:$iface";
 212                 $out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
 213                 $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
 214             }
 215         } else {
 216             die "internal error";
 217         }
 218     }
 219
 220     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 221
 222     PVE::Tools::file_set_contents("$targetdir/interfaces", $out);
 223
 224     # dump maclist
 225     PVE::Tools::file_set_contents("$targetdir/maclist", $macs);
 226
 227     # dump policy
 228
 229     $format = "%-15s %-15s %-15s %s\n";
 230     $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
 231     #$out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');
 232     $out .= sprintf($format, 'all', 'all', 'REJECT', 'info');
 233
 234     PVE::Tools::file_set_contents("$targetdir/policy", $out);
 235
 236     # dump rules
 237     $out = '';
 238
 239     $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
 240     foreach my $vmid (sort keys %$rules) {
 241         my $inrules = $rules->{$vmid}->{in};
 242         my $outrules = $rules->{$vmid}->{out};
 243
 244         if (scalar(@$inrules)) {
 245             $out .= "# IN to VM $vmid\n";
 246             foreach my $rule (@$inrules) {
 247                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 248                     my $net = $netinfo->{$vmid}->{$netid};
 249                     next if !($rule->{iface} eq 'any' || $rule->{iface} eq $netid);
 250                     $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
 251                 }
 252             }
 253         }
 254
 255         if (scalar(@$outrules)) {
 256             $out .= "# OUT from VM $vmid\n";
 257             foreach my $rule (@$outrules) {
 258                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 259                     my $net = $netinfo->{$vmid}->{$netid};
 260                     next if !($rule->{iface} eq 'any' || $rule->{iface} eq $netid);
 261                     $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
 262                 }
 263             }
 264         }
 265     }
 266
 267     PVE::Tools::file_set_contents("$targetdir/rules", $out);
 268
 269 }
 270
 271
 272 sub activate {
 273
 274 }
 275
 276
 277 1;