PVE/Firewall.pm

   1 package PVE::Firewall;
   2
   3 use warnings;
   4 use strict;
   5 use Data::Dumper;
   6 use Digest::SHA;
   7 use PVE::Tools;
   8 use PVE::QemuServer;
   9 use File::Path;
  10 use IO::File;
  11 use Net::IP;
  12 use PVE::Tools qw(run_command lock_file);
  13
  14 use Data::Dumper;
  15
  16 my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
  17
  18 my $macros;
  19 my @ruleset = ();
  20
  21 # todo: implement some kind of MACROS, like shorewall /usr/share/shorewall/macro.*
  22 sub get_firewall_macros {
  23
  24     return $macros if $macros;
  25
  26     #foreach my $path (</usr/share/shorewall/macro.*>) {
  27     #  if ($path =~ m|/macro\.(\S+)$|) {
  28     #    $macros->{$1} = 1;
  29     #  }
  30     #}
  31
  32     $macros = {}; # fixme: implemet me
  33
  34     return $macros;
  35 }
  36
  37 my $etc_services;
  38
  39 sub get_etc_services {
  40
  41     return $etc_services if $etc_services;
  42
  43     my $filename = "/etc/services";
  44
  45     my $fh = IO::File->new($filename, O_RDONLY);
  46     if (!$fh) {
  47         warn "unable to read '$filename' - $!\n";
  48         return {};
  49     }
  50
  51     my $services = {};
  52
  53     while (my $line = <$fh>) {
  54         chomp ($line);
  55         next if $line =~m/^#/;
  56         next if ($line =~m/^\s*$/);
  57
  58         if ($line =~ m!^(\S+)\s+(\S+)/(tcp|udp).*$!) {
  59             $services->{byid}->{$2}->{name} = $1;
  60             $services->{byid}->{$2}->{$3} = 1;
  61             $services->{byname}->{$1} = $services->{byid}->{$2};
  62         }
  63     }
  64
  65     close($fh);
  66
  67     $etc_services = $services;
  68
  69
  70     return $etc_services;
  71 }
  72
  73 my $etc_protocols;
  74
  75 sub get_etc_protocols {
  76     return $etc_protocols if $etc_protocols;
  77
  78     my $filename = "/etc/protocols";
  79
  80     my $fh = IO::File->new($filename, O_RDONLY);
  81     if (!$fh) {
  82         warn "unable to read '$filename' - $!\n";
  83         return {};
  84     }
  85
  86     my $protocols = {};
  87
  88     while (my $line = <$fh>) {
  89         chomp ($line);
  90         next if $line =~m/^#/;
  91         next if ($line =~m/^\s*$/);
  92
  93         if ($line =~ m!^(\S+)\s+(\d+)\s+.*$!) {
  94             $protocols->{byid}->{$2}->{name} = $1;
  95             $protocols->{byname}->{$1} = $protocols->{byid}->{$2};
  96         }
  97     }
  98
  99     close($fh);
 100
 101     $etc_protocols = $protocols;
 102
 103     return $etc_protocols;
 104 }
 105
 106 sub parse_address_list {
 107     my ($str) = @_;
 108
 109     my $nbaor = 0;
 110     foreach my $aor (split(/,/, $str)) {
 111         if (!Net::IP->new($aor)) {
 112             my $err = Net::IP::Error();
 113             die "invalid IP address: $err\n";
 114         }else{
 115             $nbaor++;
 116         }
 117     }
 118     return $nbaor;
 119 }
 120
 121 sub parse_port_name_number_or_range {
 122     my ($str) = @_;
 123
 124     my $services = PVE::Firewall::get_etc_services();
 125     my $nbports = 0;
 126     foreach my $item (split(/,/, $str)) {
 127         my $portlist = "";
 128         foreach my $pon (split(':', $item, 2)) {
 129             if ($pon =~ m/^\d+$/){
 130                 die "invalid port '$pon'\n" if $pon < 0 && $pon > 65536;
 131             }else{
 132                 die "invalid port $services->{byname}->{$pon}\n" if !$services->{byname}->{$pon};
 133             }
 134             $nbports++;
 135         }
 136     }
 137
 138     return ($nbports);
 139 }
 140
 141 my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
 142
 143 sub iptables {
 144     my ($cmd) = @_;
 145
 146     run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {});
 147 }
 148
 149 sub iptables_restore_cmdlist {
 150     my ($cmdlist) = @_;
 151
 152     my $verbose = 1; # fixme: how/when do we set this
 153
 154     #run_command("echo '$cmdlist' | /sbin/iptables-restore -n");
 155     eval { run_command("/sbin/iptables-restore -n ", input => $cmdlist); };
 156     if (my $err = $@) {
 157         print STDERR $cmdlist if $verbose;
 158         die $err;
 159     }
 160 }
 161
 162 sub iptables_restore {
 163
 164     unshift (@ruleset, '*filter');
 165     push (@ruleset, 'COMMIT');
 166
 167     my $cmdlist = join("\n", @ruleset) . "\n";
 168
 169     iptables_restore_cmdlist($cmdlist);
 170 }
 171
 172 # experimental code to read existing chains and compute SHA1 checksum
 173 # for each chain.
 174 sub iptables_get_chains {
 175
 176     my $res = {};
 177
 178     # check what chains we want to track
 179     my $is_pvefw_chain = sub {
 180         my $name = shift;
 181
 182         return 1 if $name =~ m/^BRIDGEFW-(:?IN|OUT)$/;
 183         return 1 if $name =~ m/^proxmoxfw-\S+$/;
 184         return 1 if $name =~ m/^tap\d+i\d+-(:?IN|OUT)$/;
 185         return 1 if $name =~ m/^vmbr\d+-(:?IN|OUT)$/;
 186         return 1 if $name =~ m/^GROUP-(:?[^\s\-]+)-(:?IN|OUT)$/;
 187         return 1 if $name =~ m/^host-(:?IN|OUT)$/;
 188
 189         return undef;
 190     };
 191
 192     my $table = '';
 193
 194     my $dhash = {};
 195
 196     my $parser = sub {
 197         my $line = shift;
 198
 199         return if $line =~ m/^#/;
 200         return if $line =~ m/^\s*$/;
 201
 202         if ($line =~ m/^\*(\S+)$/) {
 203             $table = $1;
 204             return;
 205         }
 206
 207         return if $table ne 'filter';
 208
 209         if ($line =~ m/^:(\S+)\s/) {
 210             my $chain = $1;
 211             return if !&$is_pvefw_chain($chain);
 212             $dhash->{$chain} = Digest::SHA->new('sha1');
 213         } elsif ($line =~ m/^-([A-Z]) (\S+)\s/) {
 214             my $chain = $2;
 215             return if !&$is_pvefw_chain($chain);
 216             my $sha = $dhash->{$chain} || die "undefined chain '$chain'";
 217             $sha->add_bits("$line\n");
 218         } else {
 219             # simply ignore the rest
 220             return;
 221         }
 222     };
 223
 224     run_command("/sbin/iptables-save", outfunc => $parser);
 225
 226     foreach my $chain (keys %$dhash) {
 227         my $sha = $dhash->{$chain};
 228         $res->{$chain} = $sha->b64digest;
 229     }
 230
 231     return $res;
 232 }
 233
 234 sub iptables_addrule {
 235    my ($rule) = @_;
 236
 237    push (@ruleset, $rule);
 238 }
 239
 240 sub iptables_chain_exist {
 241     my ($chain) = @_;
 242
 243     eval{
 244         iptables("-n --list $chain");
 245     };
 246     return undef if $@;
 247
 248     return 1;
 249 }
 250
 251 sub iptables_rule_exist {
 252     my ($rule) = @_;
 253
 254     eval{
 255         iptables("-C $rule");
 256     };
 257     return undef if $@;
 258
 259     return 1;
 260 }
 261
 262 sub iptables_generate_rule {
 263     my ($chain, $rule) = @_;
 264
 265     my $cmd = "-A $chain";
 266
 267     $cmd .= " -m iprange --src-range" if $rule->{nbsource} && $rule->{nbsource} > 1;
 268     $cmd .= " -s $rule->{source}" if $rule->{source};
 269     $cmd .= " -m iprange --dst-range" if $rule->{nbdest} && $rule->{nbdest} > 1;
 270     $cmd .= " -d $rule->{dest}" if $rule->{destination};
 271     $cmd .= " -p $rule->{proto}" if $rule->{proto};
 272     $cmd .= "  --match multiport" if $rule->{nbdport} && $rule->{nbdport} > 1;
 273     $cmd .= " --dport $rule->{dport}" if $rule->{dport};
 274     $cmd .= "  --match multiport" if $rule->{nbsport} && $rule->{nbsport} > 1;
 275     $cmd .= " --sport $rule->{sport}" if $rule->{sport};
 276     $cmd .= " -j $rule->{action}" if $rule->{action};
 277
 278     iptables_addrule($cmd);
 279
 280 }
 281
 282 sub generate_bridge_rules {
 283     my ($bridge) = @_;
 284
 285     if(!iptables_chain_exist("BRIDGEFW-OUT")){
 286         iptables_addrule(":BRIDGEFW-OUT - [0:0]");
 287     }
 288
 289     if(!iptables_chain_exist("BRIDGEFW-IN")){
 290         iptables_addrule(":BRIDGEFW-IN - [0:0]");
 291     }
 292
 293     if(!iptables_chain_exist("proxmoxfw-FORWARD")){
 294         iptables_addrule(":proxmoxfw-FORWARD - [0:0]");
 295         iptables_addrule("-I FORWARD -j proxmoxfw-FORWARD");
 296         iptables_addrule("-A proxmoxfw-FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT");
 297         iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-in --physdev-is-bridged -j BRIDGEFW-OUT");
 298         iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-out --physdev-is-bridged -j BRIDGEFW-IN");
 299
 300     }
 301
 302     generate_proxmoxfwinput();
 303
 304     if(!iptables_chain_exist("$bridge-IN")){
 305         iptables_addrule(":$bridge-IN - [0:0]");
 306         iptables_addrule("-A proxmoxfw-FORWARD -i $bridge -j DROP");  #disable interbridge routing
 307         iptables_addrule("-A BRIDGEFW-IN -j $bridge-IN");
 308         iptables_addrule("-A $bridge-IN -j ACCEPT");
 309
 310     }
 311
 312     if(!iptables_chain_exist("$bridge-OUT")){
 313         iptables_addrule(":$bridge-OUT - [0:0]");
 314         iptables_addrule("-A proxmoxfw-FORWARD -o $bridge -j DROP"); # disable interbridge routing
 315         iptables_addrule("-A BRIDGEFW-OUT -j $bridge-OUT");
 316
 317     }
 318
 319 }
 320
 321
 322 sub generate_tap_rules_direction {
 323     my ($iface, $netid, $rules, $bridge, $direction) = @_;
 324
 325     my $tapchain = "$iface-$direction";
 326
 327     iptables_addrule(":$tapchain - [0:0]");
 328
 329     iptables_addrule("-A $tapchain -m state --state INVALID -j DROP");
 330     iptables_addrule("-A $tapchain -m state --state RELATED,ESTABLISHED -j ACCEPT");
 331
 332     if (scalar(@$rules)) {
 333         foreach my $rule (@$rules) {
 334             next if $rule->{iface} && $rule->{iface} ne $netid;
 335             if($rule->{action}  =~ m/^(GROUP-(\S+))$/){
 336                     $rule->{action} .= "-$direction";
 337                     #generate empty group rule if don't exist
 338                     if(!iptables_chain_exist($rule->{action})){
 339                         generate_group_rules($2);
 340                     }
 341             }
 342             #we go to vmbr-IN if accept in out rules
 343             $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT';
 344             iptables_generate_rule($tapchain, $rule);
 345         }
 346     }
 347
 348     iptables_addrule("-A $tapchain -j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4");
 349     iptables_addrule("-A $tapchain -j DROP");
 350
 351     #plug the tap chain to bridge chain
 352     my $physdevdirection = $direction eq 'IN' ? "out":"in";
 353     my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain";
 354
 355     if(!iptables_rule_exist($rule)){
 356         iptables_addrule("-I $rule");
 357     }
 358
 359     if($direction eq 'OUT'){
 360         #add tap->host rules
 361         my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain";
 362
 363         if(!iptables_rule_exist($rule)){
 364             iptables_addrule("-A $rule");
 365         }
 366     }
 367 }
 368
 369 sub generate_tap_rules {
 370     my ($net, $netid, $vmid) = @_;
 371
 372     my $filename = "/etc/pve/firewall/$vmid.fw";
 373     my $fh = IO::File->new($filename, O_RDONLY);
 374     return if !$fh;
 375
 376     #generate bridge rules
 377     my $bridge = $net->{bridge};
 378     my $tag = $net->{tag};
 379     $bridge .= "v$tag" if $tag;
 380
 381     #generate tap chain
 382     my $rules = parse_fw_rules($filename, $fh);
 383
 384     my $inrules = $rules->{in};
 385     my $outrules = $rules->{out};
 386
 387     my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/;
 388
 389     generate_bridge_rules($bridge);
 390     generate_tap_rules_direction($iface, $netid, $inrules, $bridge, 'IN');
 391     generate_tap_rules_direction($iface, $netid, $outrules, $bridge, 'OUT');
 392     iptables_restore();
 393 }
 394
 395 sub flush_tap_rules {
 396     my ($net, $netid, $vmid) = @_;
 397
 398     my $bridge = $net->{bridge};
 399     my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/;
 400
 401     flush_tap_rules_direction($iface, $bridge, 'IN');
 402     flush_tap_rules_direction($iface, $bridge, 'OUT');
 403     iptables_restore();
 404 }
 405
 406 sub flush_tap_rules_direction {
 407     my ($iface, $bridge, $direction) = @_;
 408
 409     my $tapchain = "$iface-$direction";
 410
 411     if(iptables_chain_exist($tapchain)){
 412         iptables_addrule("-F $tapchain");
 413
 414         my $physdevdirection = $direction eq 'IN' ? "out":"in";
 415         my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain";
 416         if(iptables_rule_exist($rule)){
 417             iptables_addrule("-D $rule");
 418         }
 419
 420         if($direction eq 'OUT'){
 421             my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain";
 422             if(iptables_rule_exist($rule)){
 423                 iptables_addrule("-D $rule");
 424             }
 425         }
 426
 427         iptables_addrule("-X $tapchain");
 428     }
 429 }
 430
 431 sub enablehostfw {
 432
 433     generate_proxmoxfwinput();
 434     generate_proxmoxfwoutput();
 435
 436     my $filename = "/etc/pve/local/host.fw";
 437     my $fh = IO::File->new($filename, O_RDONLY);
 438     return if !$fh;
 439
 440     my $rules = parse_fw_rules($filename, $fh);
 441     my $inrules = $rules->{in};
 442     my $outrules = $rules->{out};
 443
 444     #host inbound firewall
 445     iptables_addrule(":host-IN - [0:0]");
 446     iptables_addrule("-A host-IN -m state --state INVALID -j DROP");
 447     iptables_addrule("-A host-IN -m state --state RELATED,ESTABLISHED -j ACCEPT");
 448     iptables_addrule("-A host-IN -i lo -j ACCEPT");
 449     iptables_addrule("-A host-IN -m addrtype --dst-type MULTICAST -j ACCEPT");
 450     iptables_addrule("-A host-IN -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT");
 451     iptables_addrule("-A host-IN -p udp -m udp --dport 9000 -j ACCEPT"); #corosync
 452
 453     if (scalar(@$inrules)) {
 454         foreach my $rule (@$inrules) {
 455             #we use RETURN because we need to check also tap rules
 456             $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT';
 457             iptables_generate_rule('host-IN', $rule);
 458         }
 459     }
 460
 461     iptables_addrule("-A host-IN -j LOG --log-prefix \"kvmhost-IN dropped: \" --log-level 4");
 462     iptables_addrule("-A host-IN -j DROP");
 463
 464     #host outbound firewall
 465     iptables_addrule(":host-OUT - [0:0]");
 466     iptables_addrule("-A host-OUT -m state --state INVALID -j DROP");
 467     iptables_addrule("-A host-OUT -m state --state RELATED,ESTABLISHED -j ACCEPT");
 468     iptables_addrule("-A host-OUT -o lo -j ACCEPT");
 469     iptables_addrule("-A host-OUT -m addrtype --dst-type MULTICAST -j ACCEPT");
 470     iptables_addrule("-A host-OUT -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT");
 471     iptables_addrule("-A host-OUT -p udp -m udp --dport 9000 -j ACCEPT"); #corosync
 472
 473     if (scalar(@$outrules)) {
 474         foreach my $rule (@$outrules) {
 475             #we use RETURN because we need to check also tap rules
 476             $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT';
 477             iptables_generate_rule('host-OUT', $rule);
 478         }
 479     }
 480
 481     iptables_addrule("-A host-OUT -j LOG --log-prefix \"kvmhost-OUT dropped: \" --log-level 4");
 482     iptables_addrule("-A host-OUT -j DROP");
 483
 484
 485     my $rule = "proxmoxfw-INPUT -j host-IN";
 486     if(!iptables_rule_exist($rule)){
 487         iptables_addrule("-I $rule");
 488     }
 489
 490     $rule = "proxmoxfw-OUTPUT -j host-OUT";
 491     if(!iptables_rule_exist($rule)){
 492         iptables_addrule("-I $rule");
 493     }
 494
 495     iptables_restore();
 496
 497
 498 }
 499
 500 sub disablehostfw {
 501
 502     my $chain = "host-IN";
 503
 504     my $rule = "proxmoxfw-INPUT -j $chain";
 505     if(iptables_rule_exist($rule)){
 506         iptables_addrule("-D $rule");
 507     }
 508
 509     if(iptables_chain_exist($chain)){
 510         iptables_addrule("-F $chain");
 511         iptables_addrule("-X $chain");
 512     }
 513
 514     $chain = "host-OUT";
 515
 516     $rule = "proxmoxfw-OUTPUT -j $chain";
 517     if(iptables_rule_exist($rule)){
 518         iptables_addrule("-D $rule");
 519     }
 520
 521     if(iptables_chain_exist($chain)){
 522         iptables_addrule("-F $chain");
 523         iptables_addrule("-X $chain");
 524     }
 525
 526     iptables_restore();
 527 }
 528
 529 sub generate_proxmoxfwinput {
 530
 531     if(!iptables_chain_exist("proxmoxfw-INPUT")){
 532         iptables_addrule(":proxmoxfw-INPUT - [0:0]");
 533         iptables_addrule("-I INPUT -j proxmoxfw-INPUT");
 534         iptables_addrule("-A INPUT -j ACCEPT");
 535     }
 536 }
 537
 538 sub generate_proxmoxfwoutput {
 539
 540     if(!iptables_chain_exist("proxmoxfw-OUTPUT")){
 541         iptables_addrule(":proxmoxfw-OUTPUT - [0:0]");
 542         iptables_addrule("-I OUTPUT -j proxmoxfw-OUTPUT");
 543         iptables_addrule("-A OUTPUT -j ACCEPT");
 544     }
 545
 546 }
 547
 548 sub enable_group_rules {
 549     my ($group) = @_;
 550
 551     generate_group_rules($group);
 552     iptables_restore();
 553 }
 554
 555 sub generate_group_rules {
 556     my ($group) = @_;
 557
 558     my $filename = "/etc/pve/firewall/groups.fw";
 559     my $fh = IO::File->new($filename, O_RDONLY);
 560     return if !$fh;
 561
 562     my $rules = parse_fw_rules($filename, $fh, $group);
 563     my $inrules = $rules->{in};
 564     my $outrules = $rules->{out};
 565
 566     my $chain = "GROUP-".$group."-IN";
 567
 568     iptables_addrule(":$chain - [0:0]");
 569
 570     if (scalar(@$inrules)) {
 571         foreach my $rule (@$inrules) {
 572             iptables_generate_rule($chain, $rule);
 573         }
 574     }
 575
 576     $chain = "GROUP-".$group."-OUT";
 577
 578     iptables_addrule(":$chain - [0:0]");
 579
 580     if(!iptables_chain_exist("BRIDGEFW-OUT")){
 581         iptables_addrule(":BRIDGEFW-OUT - [0:0]");
 582     }
 583
 584     if(!iptables_chain_exist("BRIDGEFW-IN")){
 585         iptables_addrule(":BRIDGEFW-IN - [0:0]");
 586     }
 587
 588     if (scalar(@$outrules)) {
 589         foreach my $rule (@$outrules) {
 590             #we go the BRIDGEFW-IN because we need to check also other tap rules
 591             #(and group rules can be set on any bridge, so we can't go to VMBRXX-IN)
 592             $rule->{action} = 'BRIDGEFW-IN' if $rule->{action} eq 'ACCEPT';
 593             iptables_generate_rule($chain, $rule);
 594         }
 595     }
 596
 597 }
 598
 599 sub disable_group_rules {
 600     my ($group) = @_;
 601
 602     my $chain = "GROUP-".$group."-IN";
 603
 604     if(iptables_chain_exist($chain)){
 605         iptables_addrule("-F $chain");
 606         iptables_addrule("-X $chain");
 607     }
 608
 609     $chain = "GROUP-".$group."-OUT";
 610
 611     if(iptables_chain_exist($chain)){
 612         iptables_addrule("-F $chain");
 613         iptables_addrule("-X $chain");
 614     }
 615
 616     #iptables_restore will die if security group is linked in a tap chain
 617     #maybe can we improve that, parsing each vm config, or parsing iptables -S
 618     #to see if the security group is linked or not
 619     iptables_restore();
 620 }
 621
 622 sub parse_fw_rules {
 623     my ($filename, $fh, $group) = @_;
 624
 625     my $section;
 626     my $securitygroup;
 627     my $securitygroupexist;
 628
 629     my $res = { in => [], out => [] };
 630
 631     my $macros = get_firewall_macros();
 632     my $protocols = get_etc_protocols();
 633
 634     while (defined(my $line = <$fh>)) {
 635         next if $line =~ m/^#/;
 636         next if $line =~ m/^\s*$/;
 637
 638         if ($line =~ m/^\[(in|out)(:(\S+))?\]\s*$/i) {
 639             $section = lc($1);
 640             $securitygroup = lc($3) if $3;
 641             $securitygroupexist = 1 if $securitygroup &&  $securitygroup eq $group;
 642             next;
 643         }
 644         next if !$section;
 645         next if $group && $securitygroup ne $group;
 646
 647         my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
 648             split(/\s+/, $line);
 649
 650         if (!$action) {
 651             warn "skip incomplete line\n";
 652             next;
 653         }
 654
 655         my $service;
 656         if ($action =~ m/^(ACCEPT|DROP|REJECT|GROUP-(\S+))$/) {
 657             # OK
 658         } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
 659             ($service, $action) = ($1, $2);
 660             if (!$macros->{$service}) {
 661                 warn "unknown service '$service'\n";
 662                 next;
 663             }
 664         } else {
 665             warn "unknown action '$action'\n";
 666             next;
 667         }
 668
 669         $iface = undef if $iface && $iface eq '-';
 670         if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
 671             warn "unknown interface '$iface'\n";
 672             next;
 673         }
 674
 675         $proto = undef if $proto && $proto eq '-';
 676         if ($proto && !(defined($protocols->{byname}->{$proto}) ||
 677                         defined($protocols->{byid}->{$proto}))) {
 678             warn "unknown protokol '$proto'\n";
 679             next;
 680         }
 681
 682         $source = undef if $source && $source eq '-';
 683         $dest = undef if $dest && $dest eq '-';
 684
 685         $dport = undef if $dport && $dport eq '-';
 686         $sport = undef if $sport && $sport eq '-';
 687         my $nbdport = undef;
 688         my $nbsport = undef;
 689         my $nbsource = undef;
 690         my $nbdest = undef;
 691
 692         eval {
 693             $nbsource = parse_address_list($source) if $source;
 694             $nbdest = parse_address_list($dest) if $dest;
 695             $nbdport = parse_port_name_number_or_range($dport) if $dport;
 696             $nbsport = parse_port_name_number_or_range($sport) if $sport;
 697         };
 698         if (my $err = $@) {
 699             warn $err;
 700             next;
 701
 702         }
 703
 704
 705         my $rule = {
 706             action => $action,
 707             service => $service,
 708             iface => $iface,
 709             source => $source,
 710             dest => $dest,
 711             nbsource => $nbsource,
 712             nbdest => $nbdest,
 713             proto => $proto,
 714             dport => $dport,
 715             sport => $sport,
 716             nbdport => $nbdport,
 717             nbsport => $nbsport,
 718
 719         };
 720
 721         push @{$res->{$section}}, $rule;
 722     }
 723
 724     die "security group $group don't exist" if $group && !$securitygroupexist;
 725     return $res;
 726 }
 727
 728 sub run_locked {
 729     my ($code, @param) = @_;
 730
 731     my $timeout = 10;
 732
 733     my $res = lock_file($pve_fw_lock_filename, $timeout, $code, @param);
 734
 735     die $@ if $@;
 736
 737     return $res;
 738 }
 739
 740 sub read_local_vm_config {
 741
 742     my $openvz = {};
 743
 744     my $qemu = {};
 745
 746     my $list = PVE::QemuServer::config_list();
 747
 748     foreach my $vmid (keys %$list) {
 749         #next if !($vmid eq '100' || $vmid eq '102');
 750         my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
 751         if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
 752             $qemu->{$vmid} = $conf;
 753         }
 754     }
 755
 756     my $vmdata = { openvz => $openvz, qemu => $qemu };
 757
 758     return $vmdata;
 759 };
 760
 761 sub read_vm_firewall_rules {
 762     my ($vmdata) = @_;
 763     my $rules = {};
 764     foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
 765         my $filename = "/etc/pve/firewall/$vmid.fw";
 766         my $fh = IO::File->new($filename, O_RDONLY);
 767         next if !$fh;
 768
 769         $rules->{$vmid} = parse_fw_rules($filename, $fh);
 770     }
 771
 772     return $rules;
 773 }
 774
 775 sub compile {
 776     my $vmdata = read_local_vm_config();
 777     my $rules = read_vm_firewall_rules($vmdata);
 778
 779     # print Dumper($vmdata);
 780
 781     die "implement me";
 782 }
 783
 784 sub compile_and_start {
 785     my ($restart) = @_;
 786
 787     compile();
 788
 789      die "implement me";
 790 }
 791
 792 1;