PVE/Firewall.pm

   1 package PVE::Firewall;
   2
   3 use warnings;
   4 use strict;
   5 use Data::Dumper;
   6 use PVE::Tools;
   7 use PVE::QemuServer;
   8 use File::Path;
   9 use IO::File;
  10 use Net::IP;
  11 use PVE::Tools qw(run_command);
  12
  13 use Data::Dumper;
  14
  15 my $macros;
  16 my @ruleset = ();
  17
  18 # todo: implement some kind of MACROS, like shorewall /usr/share/shorewall/macro.*
  19 sub get_firewall_macros {
  20
  21     return $macros if $macros;
  22
  23     #foreach my $path (</usr/share/shorewall/macro.*>) {
  24     #  if ($path =~ m|/macro\.(\S+)$|) {
  25     #    $macros->{$1} = 1;
  26     #  }
  27     #}
  28
  29     $macros = {}; # fixme: implemet me
  30
  31     return $macros;
  32 }
  33
  34 my $etc_services;
  35
  36 sub get_etc_services {
  37
  38     return $etc_services if $etc_services;
  39
  40     my $filename = "/etc/services";
  41
  42     my $fh = IO::File->new($filename, O_RDONLY);
  43     if (!$fh) {
  44         warn "unable to read '$filename' - $!\n";
  45         return {};
  46     }
  47
  48     my $services = {};
  49
  50     while (my $line = <$fh>) {
  51         chomp ($line);
  52         next if $line =~m/^#/;
  53         next if ($line =~m/^\s*$/);
  54
  55         if ($line =~ m!^(\S+)\s+(\S+)/(tcp|udp).*$!) {
  56             $services->{byid}->{$2}->{name} = $1;
  57             $services->{byid}->{$2}->{$3} = 1;
  58             $services->{byname}->{$1} = $services->{byid}->{$2};
  59         }
  60     }
  61
  62     close($fh);
  63
  64     $etc_services = $services;
  65
  66
  67     return $etc_services;
  68 }
  69
  70 my $etc_protocols;
  71
  72 sub get_etc_protocols {
  73     return $etc_protocols if $etc_protocols;
  74
  75     my $filename = "/etc/protocols";
  76
  77     my $fh = IO::File->new($filename, O_RDONLY);
  78     if (!$fh) {
  79         warn "unable to read '$filename' - $!\n";
  80         return {};
  81     }
  82
  83     my $protocols = {};
  84
  85     while (my $line = <$fh>) {
  86         chomp ($line);
  87         next if $line =~m/^#/;
  88         next if ($line =~m/^\s*$/);
  89
  90         if ($line =~ m!^(\S+)\s+(\d+)\s+.*$!) {
  91             $protocols->{byid}->{$2}->{name} = $1;
  92             $protocols->{byname}->{$1} = $protocols->{byid}->{$2};
  93         }
  94     }
  95
  96     close($fh);
  97
  98     $etc_protocols = $protocols;
  99
 100     return $etc_protocols;
 101 }
 102
 103 sub parse_address_list {
 104     my ($str) = @_;
 105
 106     my $nbaor = 0;
 107     foreach my $aor (split(/,/, $str)) {
 108         if (!Net::IP->new($aor)) {
 109             my $err = Net::IP::Error();
 110             die "invalid IP address: $err\n";
 111         }else{
 112             $nbaor++;
 113         }
 114     }
 115     return $nbaor;
 116 }
 117
 118 sub parse_port_name_number_or_range {
 119     my ($str) = @_;
 120
 121     my $services = PVE::Firewall::get_etc_services();
 122     my $nbports = 0;
 123     foreach my $item (split(/,/, $str)) {
 124         my $portlist = "";
 125         foreach my $pon (split(':', $item, 2)) {
 126             if ($pon =~ m/^\d+$/){
 127                 die "invalid port '$pon'\n" if $pon < 0 && $pon > 65536;
 128             }else{
 129                 die "invalid port $services->{byname}->{$pon}\n" if !$services->{byname}->{$pon};
 130             }
 131             $nbports++;
 132         }
 133     }
 134
 135     return ($nbports);
 136 }
 137
 138 my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
 139
 140 sub iptables {
 141     my ($cmd) = @_;
 142
 143     run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {});
 144 }
 145
 146 sub iptables_restore {
 147
 148     unshift (@ruleset, '*filter');
 149     push (@ruleset, 'COMMIT');
 150
 151     my $cmdlist = join("\n", @ruleset);
 152
 153     run_command("echo '$cmdlist' | /sbin/iptables-restore -n", outfunc => sub {});
 154 }
 155
 156 sub iptables_addrule {
 157    my ($rule) = @_;
 158
 159    push (@ruleset, $rule);
 160 }
 161
 162 sub iptables_chain_exist {
 163     my ($chain) = @_;
 164
 165     eval{
 166         iptables("-n --list $chain");
 167     };
 168     return undef if $@;
 169
 170     return 1;
 171 }
 172
 173 sub iptables_rule_exist {
 174     my ($rule) = @_;
 175
 176     eval{
 177         iptables("-C $rule");
 178     };
 179     return undef if $@;
 180
 181     return 1;
 182 }
 183
 184 sub iptables_generate_rule {
 185     my ($chain, $rule) = @_;
 186
 187     my $cmd = "-A $chain";
 188
 189     $cmd .= " -m iprange --src-range" if $rule->{nbsource} && $rule->{nbsource} > 1;
 190     $cmd .= " -s $rule->{source}" if $rule->{source};
 191     $cmd .= " -m iprange --dst-range" if $rule->{nbdest} && $rule->{nbdest} > 1;
 192     $cmd .= " -d $rule->{dest}" if $rule->{destination};
 193     $cmd .= " -p $rule->{proto}" if $rule->{proto};
 194     $cmd .= "  --match multiport" if $rule->{nbdport} && $rule->{nbdport} > 1;
 195     $cmd .= " --dport $rule->{dport}" if $rule->{dport};
 196     $cmd .= "  --match multiport" if $rule->{nbsport} && $rule->{nbsport} > 1;
 197     $cmd .= " --sport $rule->{sport}" if $rule->{sport};
 198     $cmd .= " -j $rule->{action}" if $rule->{action};
 199
 200     iptables_addrule($cmd);
 201
 202 }
 203
 204 sub generate_bridge_rules {
 205     my ($bridge) = @_;
 206
 207     if(!iptables_chain_exist("BRIDGEFW-OUT")){
 208         iptables_addrule(":BRIDGEFW-OUT - [0:0]");
 209     }
 210
 211     if(!iptables_chain_exist("BRIDGEFW-IN")){
 212         iptables_addrule(":BRIDGEFW-IN - [0:0]");
 213     }
 214
 215     if(!iptables_chain_exist("proxmoxfw-FORWARD")){
 216         iptables_addrule(":proxmoxfw-FORWARD - [0:0]");
 217         iptables_addrule("-I FORWARD -j proxmoxfw-FORWARD");
 218         iptables_addrule("-A proxmoxfw-FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT");
 219         iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-in --physdev-is-bridged -j BRIDGEFW-OUT");
 220         iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-out --physdev-is-bridged -j BRIDGEFW-IN");
 221
 222     }
 223
 224     generate_proxmoxfwinput();
 225
 226     if(!iptables_chain_exist("$bridge-IN")){
 227         iptables_addrule(":$bridge-IN - [0:0]");
 228         iptables_addrule("-A proxmoxfw-FORWARD -i $bridge -j DROP");  #disable interbridge routing
 229         iptables_addrule("-A BRIDGEFW-IN -j $bridge-IN");
 230         iptables_addrule("-A $bridge-IN -j ACCEPT");
 231
 232     }
 233
 234     if(!iptables_chain_exist("$bridge-OUT")){
 235         iptables_addrule(":$bridge-OUT - [0:0]");
 236         iptables_addrule("-A proxmoxfw-FORWARD -o $bridge -j DROP"); # disable interbridge routing
 237         iptables_addrule("-A BRIDGEFW-OUT -j $bridge-OUT");
 238
 239     }
 240
 241 }
 242
 243
 244 sub generate_tap_rules_direction {
 245     my ($iface, $netid, $rules, $bridge, $direction) = @_;
 246
 247     my $tapchain = "$iface-$direction";
 248
 249     iptables_addrule(":$tapchain - [0:0]");
 250
 251     iptables_addrule("-A $tapchain -m state --state INVALID -j DROP");
 252     iptables_addrule("-A $tapchain -m state --state RELATED,ESTABLISHED -j ACCEPT");
 253
 254     if (scalar(@$rules)) {
 255         foreach my $rule (@$rules) {
 256             next if $rule->{iface} && $rule->{iface} ne $netid;
 257             if($rule->{action}  =~ m/^(GROUP-(\S+))$/){
 258                     $rule->{action} .= "-$direction";
 259                     #generate empty group rule if don't exist
 260                     if(!iptables_chain_exist($rule->{action})){
 261                         generate_group_rules($2);
 262                     }
 263             }
 264             #we go to vmbr-IN if accept in out rules
 265             $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT';
 266             iptables_generate_rule($tapchain, $rule);
 267         }
 268     }
 269
 270     iptables_addrule("-A $tapchain -j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4");
 271     iptables_addrule("-A $tapchain -j DROP");
 272
 273     #plug the tap chain to bridge chain
 274     my $physdevdirection = $direction eq 'IN' ? "out":"in";
 275     my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain";
 276
 277     if(!iptables_rule_exist($rule)){
 278         iptables_addrule("-I $rule");
 279     }
 280
 281     if($direction eq 'OUT'){
 282         #add tap->host rules
 283         my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain";
 284
 285         if(!iptables_rule_exist($rule)){
 286             iptables_addrule("-A $rule");
 287         }
 288     }
 289 }
 290
 291 sub generate_tap_rules {
 292     my ($net, $netid, $vmid) = @_;
 293
 294     my $filename = "/etc/pve/firewall/$vmid.fw";
 295     my $fh = IO::File->new($filename, O_RDONLY);
 296     return if !$fh;
 297
 298     #generate bridge rules
 299     my $bridge = $net->{bridge};
 300     my $tag = $net->{tag};
 301     $bridge .= "v$tag" if $tag;
 302
 303     #generate tap chain
 304     my $rules = parse_fw_rules($filename, $fh);
 305
 306     my $inrules = $rules->{in};
 307     my $outrules = $rules->{out};
 308
 309     my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/;
 310
 311     generate_bridge_rules($bridge);
 312     generate_tap_rules_direction($iface, $netid, $inrules, $bridge, 'IN');
 313     generate_tap_rules_direction($iface, $netid, $outrules, $bridge, 'OUT');
 314     iptables_restore();
 315 }
 316
 317 sub flush_tap_rules {
 318     my ($net, $netid, $vmid) = @_;
 319
 320     my $bridge = $net->{bridge};
 321     my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/;
 322
 323     flush_tap_rules_direction($iface, $bridge, 'IN');
 324     flush_tap_rules_direction($iface, $bridge, 'OUT');
 325     iptables_restore();
 326 }
 327
 328 sub flush_tap_rules_direction {
 329     my ($iface, $bridge, $direction) = @_;
 330
 331     my $tapchain = "$iface-$direction";
 332
 333     if(iptables_chain_exist($tapchain)){
 334         iptables_addrule("-F $tapchain");
 335
 336         my $physdevdirection = $direction eq 'IN' ? "out":"in";
 337         my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain";
 338         if(iptables_rule_exist($rule)){
 339             iptables_addrule("-D $rule");
 340         }
 341
 342         if($direction eq 'OUT'){
 343             my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain";
 344             if(iptables_rule_exist($rule)){
 345                 iptables_addrule("-D $rule");
 346             }
 347         }
 348
 349         iptables_addrule("-X $tapchain");
 350     }
 351 }
 352
 353 sub enablehostfw {
 354
 355     generate_proxmoxfwinput();
 356     generate_proxmoxfwoutput();
 357
 358     my $filename = "/etc/pve/local/host.fw";
 359     my $fh = IO::File->new($filename, O_RDONLY);
 360     return if !$fh;
 361
 362     my $rules = parse_fw_rules($filename, $fh);
 363     my $inrules = $rules->{in};
 364     my $outrules = $rules->{out};
 365
 366     #host inbound firewall
 367     iptables_addrule(":host-IN - [0:0]");
 368     iptables_addrule("-A host-IN -m state --state INVALID -j DROP");
 369     iptables_addrule("-A host-IN -m state --state RELATED,ESTABLISHED -j ACCEPT");
 370     iptables_addrule("-A host-IN -i lo -j ACCEPT");
 371     iptables_addrule("-A host-IN -m addrtype --dst-type MULTICAST -j ACCEPT");
 372     iptables_addrule("-A host-IN -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT");
 373     iptables_addrule("-A host-IN -p udp -m udp --dport 9000 -j ACCEPT"); #corosync
 374
 375     if (scalar(@$inrules)) {
 376         foreach my $rule (@$inrules) {
 377             #we use RETURN because we need to check also tap rules
 378             $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT';
 379             iptables_generate_rule('host-IN', $rule);
 380         }
 381     }
 382
 383     iptables_addrule("-A host-IN -j LOG --log-prefix \"kvmhost-IN dropped: \" --log-level 4");
 384     iptables_addrule("-A host-IN -j DROP");
 385
 386     #host outbound firewall
 387     iptables_addrule(":host-OUT - [0:0]");
 388     iptables_addrule("-A host-OUT -m state --state INVALID -j DROP");
 389     iptables_addrule("-A host-OUT -m state --state RELATED,ESTABLISHED -j ACCEPT");
 390     iptables_addrule("-A host-OUT -o lo -j ACCEPT");
 391     iptables_addrule("-A host-OUT -m addrtype --dst-type MULTICAST -j ACCEPT");
 392     iptables_addrule("-A host-OUT -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT");
 393     iptables_addrule("-A host-OUT -p udp -m udp --dport 9000 -j ACCEPT"); #corosync
 394
 395     if (scalar(@$outrules)) {
 396         foreach my $rule (@$outrules) {
 397             #we use RETURN because we need to check also tap rules
 398             $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT';
 399             iptables_generate_rule('host-OUT', $rule);
 400         }
 401     }
 402
 403     iptables_addrule("-A host-OUT -j LOG --log-prefix \"kvmhost-OUT dropped: \" --log-level 4");
 404     iptables_addrule("-A host-OUT -j DROP");
 405
 406
 407     my $rule = "proxmoxfw-INPUT -j host-IN";
 408     if(!iptables_rule_exist($rule)){
 409         iptables_addrule("-I $rule");
 410     }
 411
 412     $rule = "proxmoxfw-OUTPUT -j host-OUT";
 413     if(!iptables_rule_exist($rule)){
 414         iptables_addrule("-I $rule");
 415     }
 416
 417     iptables_restore();
 418
 419
 420 }
 421
 422 sub disablehostfw {
 423
 424     my $chain = "host-IN";
 425
 426     my $rule = "proxmoxfw-INPUT -j $chain";
 427     if(iptables_rule_exist($rule)){
 428         iptables_addrule("-D $rule");
 429     }
 430
 431     if(iptables_chain_exist($chain)){
 432         iptables_addrule("-F $chain");
 433         iptables_addrule("-X $chain");
 434     }
 435
 436     $chain = "host-OUT";
 437
 438     $rule = "proxmoxfw-OUTPUT -j $chain";
 439     if(iptables_rule_exist($rule)){
 440         iptables_addrule("-D $rule");
 441     }
 442
 443     if(iptables_chain_exist($chain)){
 444         iptables_addrule("-F $chain");
 445         iptables_addrule("-X $chain");
 446     }
 447
 448     iptables_restore();
 449 }
 450
 451 sub generate_proxmoxfwinput {
 452
 453     if(!iptables_chain_exist("proxmoxfw-INPUT")){
 454         iptables_addrule(":proxmoxfw-INPUT - [0:0]");
 455         iptables_addrule("-I INPUT -j proxmoxfw-INPUT");
 456         iptables_addrule("-A INPUT -j ACCEPT");
 457     }
 458 }
 459
 460 sub generate_proxmoxfwoutput {
 461
 462     if(!iptables_chain_exist("proxmoxfw-OUTPUT")){
 463         iptables_addrule(":proxmoxfw-OUTPUT - [0:0]");
 464         iptables_addrule("-I OUTPUT -j proxmoxfw-OUTPUT");
 465         iptables_addrule("-A OUTPUT -j ACCEPT");
 466     }
 467
 468 }
 469
 470 sub enable_group_rules {
 471     my ($group) = @_;
 472
 473     generate_group_rules($group);
 474     iptables_restore();
 475 }
 476
 477 sub generate_group_rules {
 478     my ($group) = @_;
 479
 480     my $filename = "/etc/pve/firewall/groups.fw";
 481     my $fh = IO::File->new($filename, O_RDONLY);
 482     return if !$fh;
 483
 484     my $rules = parse_fw_rules($filename, $fh, $group);
 485     my $inrules = $rules->{in};
 486     my $outrules = $rules->{out};
 487
 488     my $chain = "GROUP-".$group."-IN";
 489
 490     iptables_addrule(":$chain - [0:0]");
 491
 492     if (scalar(@$inrules)) {
 493         foreach my $rule (@$inrules) {
 494             iptables_generate_rule($chain, $rule);
 495         }
 496     }
 497
 498     $chain = "GROUP-".$group."-OUT";
 499
 500     iptables_addrule(":$chain - [0:0]");
 501
 502     if(!iptables_chain_exist("BRIDGEFW-OUT")){
 503         iptables_addrule(":BRIDGEFW-OUT - [0:0]");
 504     }
 505
 506     if(!iptables_chain_exist("BRIDGEFW-IN")){
 507         iptables_addrule(":BRIDGEFW-IN - [0:0]");
 508     }
 509
 510     if (scalar(@$outrules)) {
 511         foreach my $rule (@$outrules) {
 512             #we go the BRIDGEFW-IN because we need to check also other tap rules
 513             #(and group rules can be set on any bridge, so we can't go to VMBRXX-IN)
 514             $rule->{action} = 'BRIDGEFW-IN' if $rule->{action} eq 'ACCEPT';
 515             iptables_generate_rule($chain, $rule);
 516         }
 517     }
 518
 519 }
 520
 521 sub disable_group_rules {
 522     my ($group) = @_;
 523
 524     my $chain = "GROUP-".$group."-IN";
 525
 526     if(iptables_chain_exist($chain)){
 527         iptables_addrule("-F $chain");
 528         iptables_addrule("-X $chain");
 529     }
 530
 531     $chain = "GROUP-".$group."-OUT";
 532
 533     if(iptables_chain_exist($chain)){
 534         iptables_addrule("-F $chain");
 535         iptables_addrule("-X $chain");
 536     }
 537
 538     #iptables_restore will die if security group is linked in a tap chain
 539     #maybe can we improve that, parsing each vm config, or parsing iptables -S
 540     #to see if the security group is linked or not
 541     iptables_restore();
 542 }
 543
 544
 545 my $generate_input_rule = sub {
 546     my ($zoneinfo, $rule, $net, $netid) = @_;
 547
 548     my $zone = $net->{zone} || die "internal error";
 549     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
 550     my $tap = $net->{tap} || die "internal error";
 551
 552     my $dest = "$zid:$tap";
 553
 554     if ($rule->{dest}) {
 555         $dest .= ":$rule->{dest}";
 556     }
 557
 558     my $action = $rule->{service} ?
 559         "$rule->{service}($rule->{action})" : $rule->{action};
 560
 561     my $sources = [];
 562
 563     if (!$rule->{source}) {
 564         push @$sources, 'all';
 565     } elsif ($zoneinfo->{$zone}->{type} eq 'bport') {
 566         my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error";
 567         my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
 568
 569         # using 'all' does not work, so we create one rule for
 570         # each related zone on the same bridge
 571         push @$sources, "${zoneref}:$rule->{source}";
 572         foreach my $z (keys %$zoneinfo) {
 573             next if $z eq $zone;
 574             next if !$zoneinfo->{$z}->{bridge_zone};
 575             next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone;
 576             $zoneref = $zoneinfo->{$z}->{zoneref} || die "internal error";
 577             push @$sources, "${zoneref}:$rule->{source}";
 578         }
 579     } else {
 580         push @$sources, "all:$rule->{source}";
 581     }
 582
 583     my $out = '';
 584
 585     foreach my $source (@$sources) {
 586         $out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-',
 587                         $rule->{dport} || '-', $rule->{sport} || '-');
 588     }
 589
 590     return $out;
 591 };
 592
 593 my $generate_output_rule = sub {
 594     my ($zoneinfo, $rule, $net, $netid) = @_;
 595
 596     my $zone = $net->{zone} || die "internal error";
 597     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
 598     my $tap = $net->{tap} || die "internal error";
 599
 600     my $action = $rule->{service} ?
 601         "$rule->{service}($rule->{action})" : $rule->{action};
 602
 603     my $dest;
 604
 605     if (!$rule->{dest}) {
 606         $dest = 'all';
 607     } else {
 608         $dest = "all:$rule->{dest}";
 609     }
 610
 611     return sprintf($rule_format, $action, "$zid:$tap", $dest,
 612                    $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
 613 };
 614
 615 # we need complete VM configuration of all VMs (openvz/qemu)
 616 # in vmdata
 617
 618 my $compile_shorewall = sub {
 619     my ($targetdir, $vmdata, $rules) = @_;
 620
 621     # remove existing data ?
 622     foreach my $file (qw(params zones rules interfaces  maclist  policy)) {
 623         unlink "$targetdir/$file";
 624     }
 625
 626     my $netinfo;
 627
 628     my $zoneinfo = {
 629         fw => { type => 'firewall' },
 630     };
 631
 632     my $maclist = {};
 633
 634     my $register_bridge;
 635
 636     $register_bridge = sub {
 637         my ($bridge, $vlan) = @_;
 638
 639         my $zone =  $bridge;
 640
 641         return $zone if $zoneinfo->{$zone};
 642
 643         my $ext_zone = "${bridge}_ext";
 644
 645         $zoneinfo->{$zone} = {
 646             type => 'bridge',
 647             bridge => $bridge,
 648             bridge_ext_zone => $ext_zone,
 649         };
 650
 651         # physical input devices
 652         my $dir = "/sys/class/net/$bridge/brif";
 653         my $physical = {};
 654         PVE::Tools::dir_glob_foreach($dir, '((eth|bond).+)', sub {
 655             my ($slave) = @_;
 656             $physical->{$slave} = 1;
 657         });
 658
 659         $zoneinfo->{$ext_zone} = {
 660             type => 'bport',
 661             bridge_zone => $zone,
 662             ifaces => $physical,
 663         };
 664
 665         return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
 666
 667         return $zone;
 668     };
 669
 670     my $register_bridge_port = sub {
 671         my ($bridge, $vlan, $vmzone, $tap) = @_;
 672
 673         my $bridge_zone = &$register_bridge($bridge, $vlan);
 674         my $zone = $bridge_zone . '_' . $vmzone;
 675
 676         if (!$zoneinfo->{$zone}) {
 677             $zoneinfo->{$zone} = {
 678                 type => 'bport',
 679                 bridge_zone => $bridge_zone,
 680                 ifaces => {},
 681             };
 682         }
 683
 684         $zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
 685
 686         return $zone;
 687     };
 688
 689     foreach my $vmid (keys %{$vmdata->{qemu}}) {
 690         $netinfo->{$vmid} = {};
 691         my $conf = $vmdata->{qemu}->{$vmid};
 692         foreach my $opt (keys %$conf) {
 693             next if $opt !~ m/^net(\d+)$/;
 694             my $netnum = $1;
 695             my $net = PVE::QemuServer::parse_net($conf->{$opt});
 696             next if !$net;
 697             die "implement me" if !$net->{bridge};
 698
 699             my $vmzone = $conf->{zone} || "vm$vmid";
 700             $net->{tap} = "tap${vmid}i${netnum}";
 701             $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error";
 702             $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
 703             $netinfo->{$vmid}->{$opt} = $net;
 704         }
 705     }
 706
 707     #print Dumper($netinfo);
 708
 709     # NOTE: zone names have length limit, so we need to
 710     # translate them into shorter names
 711
 712     my $zoneid = 0;
 713     my $zonemap = { fw => 'fw' };
 714
 715     my $lookup_zonename = sub {
 716         my ($zone) = @_;
 717
 718         return $zonemap->{$zone} if defined($zonemap->{$zone});
 719         $zonemap->{$zone} = 'z' . $zoneid++;
 720
 721         return $zonemap->{$zone};
 722     };
 723
 724     foreach my $z (sort keys %$zoneinfo) {
 725         $zoneinfo->{$z}->{id} = &$lookup_zonename($z);
 726         $zoneinfo->{$z}->{zonevar} = uc($z);
 727         $zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
 728     }
 729
 730     my $out;
 731
 732     # dump params file
 733     $out = "# PVE zones\n";
 734     foreach my $z (sort keys %$zoneinfo) {
 735         $out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
 736     }
 737     PVE::Tools::file_set_contents("$targetdir/params", $out);
 738
 739     # dump zone file
 740
 741     my $format = "%-30s %-10s %-15s\n";
 742     $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
 743
 744     foreach my $z (sort keys %$zoneinfo) {
 745         my $zid = $zoneinfo->{$z}->{zoneref};
 746         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 747             $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
 748         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 749             $out .= sprintf($format, $zid, 'ipv4', '');
 750         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 751             my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 752             my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
 753             $out .= sprintf($format, "$zid:$bzid", 'bport', '');
 754         } else {
 755             die "internal error";
 756         }
 757     }
 758
 759     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 760
 761     PVE::Tools::file_set_contents("$targetdir/zones", $out);
 762
 763     # dump interfaces
 764
 765     $format = "%-25s %-20s %-10s %-15s\n";
 766     $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');
 767
 768     my $maclist_format = "%-15s %-15s %-15s\n";
 769     my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');
 770
 771     foreach my $z (sort keys %$zoneinfo) {
 772         my $zid = $zoneinfo->{$z}->{zoneref};
 773         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 774             # do nothing;
 775         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 776             my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error";
 777             $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
 778         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 779             my $ifaces = $zoneinfo->{$z}->{ifaces};
 780             foreach my $iface (sort keys %$ifaces) {
 781                 my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 782                 my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error";
 783                 my $iftxt = "$bridge:$iface";
 784
 785                 if ($maclist->{$iface}) {
 786                     $out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
 787                     $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
 788                 } else {
 789                     $out .= sprintf($format, $zid, $iftxt, '-', '');
 790                 }
 791             }
 792         } else {
 793             die "internal error";
 794         }
 795     }
 796
 797     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 798
 799     PVE::Tools::file_set_contents("$targetdir/interfaces", $out);
 800
 801     # dump maclist
 802     PVE::Tools::file_set_contents("$targetdir/maclist", $macs);
 803
 804     # dump policy
 805
 806     $format = "%-15s %-15s %-15s %s\n";
 807     $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
 808     $out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');
 809
 810     # we need to disable intra-zone traffic on bridges. Else traffic
 811     # from untracked interfaces simply pass the firewall
 812     foreach my $z (sort keys %$zoneinfo) {
 813         my $zid = $zoneinfo->{$z}->{zoneref};
 814         if ($zoneinfo->{$z}->{type} eq 'bridge') {
 815             $out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
 816         }
 817     }
 818     $out .= sprintf($format, 'all', 'all', 'REJECT', 'info');
 819
 820     PVE::Tools::file_set_contents("$targetdir/policy", $out);
 821
 822     # dump rules
 823     $out = '';
 824
 825     $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
 826     foreach my $vmid (sort keys %$rules) {
 827         my $inrules = $rules->{$vmid}->{in};
 828         my $outrules = $rules->{$vmid}->{out};
 829
 830         if (scalar(@$inrules)) {
 831             $out .= "# IN to VM $vmid\n";
 832             foreach my $rule (@$inrules) {
 833                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 834                     my $net = $netinfo->{$vmid}->{$netid};
 835                     next if $rule->{iface} && $rule->{iface} ne $netid;
 836                     $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
 837                 }
 838             }
 839         }
 840
 841         if (scalar(@$outrules)) {
 842             $out .= "# OUT from VM $vmid\n";
 843             foreach my $rule (@$outrules) {
 844                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 845                     my $net = $netinfo->{$vmid}->{$netid};
 846                     next if $rule->{iface} && $rule->{iface} ne $netid;
 847                     $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
 848                 }
 849             }
 850         }
 851     }
 852
 853     PVE::Tools::file_set_contents("$targetdir/rules", $out);
 854 };
 855
 856
 857 sub parse_fw_rules {
 858     my ($filename, $fh, $group) = @_;
 859
 860     my $section;
 861     my $securitygroup;
 862     my $securitygroupexist;
 863
 864     my $res = { in => [], out => [] };
 865
 866     my $macros = get_firewall_macros();
 867     my $protocols = get_etc_protocols();
 868
 869     while (defined(my $line = <$fh>)) {
 870         next if $line =~ m/^#/;
 871         next if $line =~ m/^\s*$/;
 872
 873         if ($line =~ m/^\[(in|out)(:(\S+))?\]\s*$/i) {
 874             $section = lc($1);
 875             $securitygroup = lc($3) if $3;
 876             $securitygroupexist = 1 if $securitygroup &&  $securitygroup eq $group;
 877             next;
 878         }
 879         next if !$section;
 880         next if $group && $securitygroup ne $group;
 881
 882         my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
 883             split(/\s+/, $line);
 884
 885         if (!$action) {
 886             warn "skip incomplete line\n";
 887             next;
 888         }
 889
 890         my $service;
 891         if ($action =~ m/^(ACCEPT|DROP|REJECT|GROUP-(\S+))$/) {
 892             # OK
 893         } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
 894             ($service, $action) = ($1, $2);
 895             if (!$macros->{$service}) {
 896                 warn "unknown service '$service'\n";
 897                 next;
 898             }
 899         } else {
 900             warn "unknown action '$action'\n";
 901             next;
 902         }
 903
 904         $iface = undef if $iface && $iface eq '-';
 905         if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
 906             warn "unknown interface '$iface'\n";
 907             next;
 908         }
 909
 910         $proto = undef if $proto && $proto eq '-';
 911         if ($proto && !(defined($protocols->{byname}->{$proto}) ||
 912                         defined($protocols->{byid}->{$proto}))) {
 913             warn "unknown protokol '$proto'\n";
 914             next;
 915         }
 916
 917         $source = undef if $source && $source eq '-';
 918         $dest = undef if $dest && $dest eq '-';
 919
 920         $dport = undef if $dport && $dport eq '-';
 921         $sport = undef if $sport && $sport eq '-';
 922         my $nbdport = undef;
 923         my $nbsport = undef;
 924         my $nbsource = undef;
 925         my $nbdest = undef;
 926
 927         eval {
 928             $nbsource = parse_address_list($source) if $source;
 929             $nbdest = parse_address_list($dest) if $dest;
 930             $nbdport = parse_port_name_number_or_range($dport) if $dport;
 931             $nbsport = parse_port_name_number_or_range($sport) if $sport;
 932         };
 933         if (my $err = $@) {
 934             warn $err;
 935             next;
 936
 937         }
 938
 939
 940         my $rule = {
 941             action => $action,
 942             service => $service,
 943             iface => $iface,
 944             source => $source,
 945             dest => $dest,
 946             nbsource => $nbsource,
 947             nbdest => $nbdest,
 948             proto => $proto,
 949             dport => $dport,
 950             sport => $sport,
 951             nbdport => $nbdport,
 952             nbsport => $nbsport,
 953
 954         };
 955
 956         push @{$res->{$section}}, $rule;
 957     }
 958
 959     die "security group $group don't exist" if $group && !$securitygroupexist;
 960     return $res;
 961 }
 962
 963 sub read_local_vm_config {
 964
 965     my $openvz = {};
 966
 967     my $qemu = {};
 968
 969     my $list = PVE::QemuServer::config_list();
 970
 971     foreach my $vmid (keys %$list) {
 972         #next if !($vmid eq '100' || $vmid eq '102');
 973         my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
 974         if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
 975             $qemu->{$vmid} = $conf;
 976         }
 977     }
 978
 979     my $vmdata = { openvz => $openvz, qemu => $qemu };
 980
 981     return $vmdata;
 982 };
 983
 984 sub read_vm_firewall_rules {
 985     my ($vmdata) = @_;
 986     my $rules = {};
 987     foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
 988         my $filename = "/etc/pve/firewall/$vmid.fw";
 989         my $fh = IO::File->new($filename, O_RDONLY);
 990         next if !$fh;
 991
 992         $rules->{$vmid} = parse_fw_rules($filename, $fh);
 993     }
 994
 995     return $rules;
 996 }
 997
 998 sub compile {
 999     my $vmdata = read_local_vm_config();
1000     my $rules = read_vm_firewall_rules($vmdata);
1001
1002     # print Dumper($vmdata);
1003
1004     die "implement me";
1005 }
1006
1007 sub compile_and_start {
1008     my ($restart) = @_;
1009
1010     compile();
1011
1012      die "implement me";
1013 }
1014
1015 1;