PVE/Firewall.pm

   1 package PVE::Firewall;
   2
   3 use warnings;
   4 use strict;
   5 use Data::Dumper;
   6 use PVE::Tools;
   7 use PVE::QemuServer;
   8 use File::Path;
   9 use IO::File;
  10 use Data::Dumper;
  11
  12 my $macros;
  13 sub get_shorewall_macros {
  14
  15     return $macros if $macros;
  16
  17     foreach my $path (</usr/share/shorewall/macro.*>) {
  18         if ($path =~ m|/macro\.(\S+)$|) {
  19             $macros->{$1} = 1;
  20         }
  21     }
  22     return $macros;
  23 }
  24
  25
  26 my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
  27
  28 my $generate_input_rule = sub {
  29     my ($zoneinfo, $rule, $net, $netid) = @_;
  30
  31     my $zone = $net->{zone} || die "internal error";
  32     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  33     my $tap = $net->{tap} || die "internal error";
  34
  35     my $dest = "$zid:$tap";
  36
  37     if ($rule->{dest}) {
  38         $dest .= ":$rule->{dest}";
  39     }
  40
  41     my $action = $rule->{service} ?
  42         "$rule->{service}($rule->{action})" : $rule->{action};
  43
  44     my $source;
  45
  46     if ($zoneinfo->{$zone}->{type} eq 'bport') {
  47         my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error";
  48         my $bridge_ext_zone = $zoneinfo->{$bridge_zone}->{bridge_ext_zone} || die "internal error";
  49         my $zoneref = $zoneinfo->{$bridge_ext_zone}->{zoneref} || die "internal error";
  50         if (!$rule->{source}) {
  51             $source = "${zoneref}";
  52         } else {
  53             $source = "${zoneref}:$rule->{source}";
  54         }
  55     } else {
  56         $source = "all:$rule->{source}";
  57     }
  58
  59     return sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-',
  60                    $rule->{dport} || '-', $rule->{sport} || '-');
  61 };
  62
  63 my $generate_output_rule = sub {
  64     my ($zoneinfo, $rule, $net, $netid) = @_;
  65
  66     my $zone = $net->{zone} || die "internal error";
  67     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  68     my $tap = $net->{tap} || die "internal error";
  69
  70     my $action = $rule->{service} ?
  71         "$rule->{service}($rule->{action})" : $rule->{action};
  72
  73     my $dest;
  74
  75     if (!$rule->{dest}) {
  76         $dest = 'all';
  77     } else {
  78         $dest = "all:$rule->{dest}";
  79     }
  80
  81     return sprintf($rule_format, $action, "$zid:$tap", $dest,
  82                    $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
  83 };
  84
  85 # we need complete VM configuration of all VMs (openvz/qemu)
  86 # in vmdata
  87
  88 my $compile_shorewall = sub {
  89     my ($targetdir, $vmdata, $rules) = @_;
  90
  91     # remove existing data ?
  92     foreach my $file (qw(params zones rules interfaces  maclist  policy)) {
  93         unlink "$targetdir/$file";
  94     }
  95
  96     my $netinfo;
  97
  98     my $zoneinfo = {
  99         fw => { type => 'firewall' },
 100     };
 101
 102     my $maclist = {};
 103
 104     my $register_bridge;
 105
 106     $register_bridge = sub {
 107         my ($bridge, $vlan) = @_;
 108
 109         my $zone =  'z' . $bridge;
 110
 111         return $zone if $zoneinfo->{$zone};
 112
 113         my $ext_zone = "z${bridge}ext";
 114
 115         $zoneinfo->{$zone} = {
 116             type => 'bridge',
 117             bridge => $bridge,
 118             bridge_ext_zone => $ext_zone,
 119         };
 120
 121         # physical input devices
 122         my $dir = "/sys/class/net/$bridge/brif";
 123         my $physical = {};
 124         PVE::Tools::dir_glob_foreach($dir, '((eth|bond).+)', sub {
 125             my ($slave) = @_;
 126             $physical->{$slave} = 1;
 127         });
 128
 129         $zoneinfo->{$ext_zone} = {
 130             type => 'bport',
 131             bridge_zone => $zone,
 132             ifaces => $physical,
 133         };
 134
 135         return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
 136
 137         return $zone;
 138     };
 139
 140     my $register_bridge_port = sub {
 141         my ($bridge, $vlan, $vmzone, $tap) = @_;
 142
 143         my $bridge_zone = &$register_bridge($bridge, $vlan);
 144         my $zone = $bridge_zone . $vmzone;
 145
 146         if (!$zoneinfo->{$zone}) {
 147             $zoneinfo->{$zone} = {
 148                 type => 'bport',
 149                 bridge_zone => $bridge_zone,
 150                 ifaces => {},
 151             };
 152         }
 153
 154         $zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
 155
 156         return $zone;
 157     };
 158
 159     foreach my $vmid (keys %{$vmdata->{qemu}}) {
 160         $netinfo->{$vmid} = {};
 161         my $conf = $vmdata->{qemu}->{$vmid};
 162         foreach my $opt (keys %$conf) {
 163             next if $opt !~ m/^net(\d+)$/;
 164             my $netnum = $1;
 165             my $net = PVE::QemuServer::parse_net($conf->{$opt});
 166             next if !$net;
 167             die "implement me" if !$net->{bridge};
 168
 169             my $vmzone = $conf->{zone} || "vm$vmid";
 170             $net->{tap} = "tap${vmid}i${netnum}";
 171             $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error";
 172             $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
 173             $netinfo->{$vmid}->{$opt} = $net;
 174         }
 175     }
 176
 177     #print Dumper($netinfo);
 178
 179     # NOTE: zone names have length limit, so we need to
 180     # translate them into shorter names
 181
 182     my $zoneid = 0;
 183     my $zonemap = { fw => 'fw' };
 184
 185     my $lookup_zonename = sub {
 186         my ($zone) = @_;
 187
 188         return $zonemap->{$zone} if defined($zonemap->{$zone});
 189         $zonemap->{$zone} = 'z' . $zoneid++;
 190
 191         return $zonemap->{$zone};
 192     };
 193
 194     foreach my $z (sort keys %$zoneinfo) {
 195         $zoneinfo->{$z}->{id} = &$lookup_zonename($z);
 196         $zoneinfo->{$z}->{zonevar} = uc($z);
 197         $zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
 198     }
 199
 200     my $out;
 201
 202     # dump params file
 203     $out = "# PVE zones\n";
 204     foreach my $z (sort keys %$zoneinfo) {
 205         $out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
 206     }
 207     PVE::Tools::file_set_contents("$targetdir/params", $out);
 208
 209     # dump zone file
 210
 211     my $format = "%-30s %-10s %-15s\n";
 212     $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
 213
 214     foreach my $z (sort keys %$zoneinfo) {
 215         my $zid = $zoneinfo->{$z}->{zoneref};
 216         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 217             $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
 218         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 219             $out .= sprintf($format, $zid, 'ipv4', '');
 220         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 221             my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 222             my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
 223             $out .= sprintf($format, "$zid:$bzid", 'bport', '');
 224         } else {
 225             die "internal error";
 226         }
 227     }
 228
 229     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 230
 231     PVE::Tools::file_set_contents("$targetdir/zones", $out);
 232
 233     # dump interfaces
 234
 235     $format = "%-25s %-20s %-10s %-15s\n";
 236     $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');
 237
 238     my $maclist_format = "%-15s %-15s %-15s\n";
 239     my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');
 240
 241     foreach my $z (sort keys %$zoneinfo) {
 242         my $zid = $zoneinfo->{$z}->{zoneref};
 243         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 244             # do nothing;
 245         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 246             my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error";
 247             $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
 248         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 249             my $ifaces = $zoneinfo->{$z}->{ifaces};
 250             foreach my $iface (sort keys %$ifaces) {
 251                 my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 252                 my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error";
 253                 my $iftxt = "$bridge:$iface";
 254
 255                 if ($maclist->{$iface}) {
 256                     $out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
 257                     $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
 258                 } else {
 259                     $out .= sprintf($format, $zid, $iftxt, '-', '');
 260                 }
 261             }
 262         } else {
 263             die "internal error";
 264         }
 265     }
 266
 267     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 268
 269     PVE::Tools::file_set_contents("$targetdir/interfaces", $out);
 270
 271     # dump maclist
 272     PVE::Tools::file_set_contents("$targetdir/maclist", $macs);
 273
 274     # dump policy
 275
 276     $format = "%-15s %-15s %-15s %s\n";
 277     $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
 278     $out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');
 279
 280     # we need to disable intra-zone traffic on bridges. Else traffic
 281     # from untracked interfaces simply pass the firewall
 282     foreach my $z (sort keys %$zoneinfo) {
 283         my $zid = $zoneinfo->{$z}->{zoneref};
 284         if ($zoneinfo->{$z}->{type} eq 'bridge') {
 285             $out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
 286         }
 287     }
 288     $out .= sprintf($format, 'all', 'all', 'REJECT', 'info');
 289
 290     PVE::Tools::file_set_contents("$targetdir/policy", $out);
 291
 292     # dump rules
 293     $out = '';
 294
 295     $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
 296     foreach my $vmid (sort keys %$rules) {
 297         my $inrules = $rules->{$vmid}->{in};
 298         my $outrules = $rules->{$vmid}->{out};
 299
 300         if (scalar(@$inrules)) {
 301             $out .= "# IN to VM $vmid\n";
 302             foreach my $rule (@$inrules) {
 303                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 304                     my $net = $netinfo->{$vmid}->{$netid};
 305                     next if $rule->{iface} && $rule->{iface} ne $netid;
 306                     $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
 307                 }
 308             }
 309         }
 310
 311         if (scalar(@$outrules)) {
 312             $out .= "# OUT from VM $vmid\n";
 313             foreach my $rule (@$outrules) {
 314                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 315                     my $net = $netinfo->{$vmid}->{$netid};
 316                     next if $rule->{iface} && $rule->{iface} ne $netid;
 317                     $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
 318                 }
 319             }
 320         }
 321     }
 322
 323     PVE::Tools::file_set_contents("$targetdir/rules", $out);
 324 };
 325
 326
 327 sub parse_fw_rules {
 328     my ($filename, $fh) = @_;
 329
 330     my $section;
 331
 332     my $res = { in => [], out => [] };
 333
 334     my $macros = PVE::Firewall::get_shorewall_macros();
 335
 336     while (defined(my $line = <$fh>)) {
 337         next if $line =~ m/^#/;
 338         next if $line =~ m/^\s*$/;
 339
 340         if ($line =~ m/^\[(in|out)\]\s*$/i) {
 341             $section = lc($1);
 342             next;
 343         }
 344         next if !$section;
 345
 346         my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
 347             split(/\s+/, $line);
 348
 349         if (!$action) {
 350             warn "skip incomplete line\n";
 351             next;
 352         }
 353
 354         my $service;
 355         if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) {
 356             # OK
 357         } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
 358             ($service, $action) = ($1, $2);
 359             if (!$macros->{$service}) {
 360                 warn "unknown service '$service'\n";
 361                 next;
 362             }
 363         } else {
 364             warn "unknown action '$action'\n";
 365             next;
 366         }
 367
 368         $iface = undef if $iface && $iface eq '-';
 369         if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
 370             warn "unknown interface '$iface'\n";
 371             next;
 372         }
 373
 374         $proto = undef if $proto && $proto eq '-';
 375         if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) {
 376             warn "unknown protokol '$proto'\n";
 377             next;
 378         }
 379
 380         $source = undef if $source && $source eq '-';
 381
 382 #       if ($source !~ m/^(XYZ)$/) {
 383 #           warn "unknown source '$source'\n";
 384 #           next;
 385 #       }
 386
 387         $dest = undef if $dest && $dest eq '-';
 388 #       if ($dest !~ m/^XYZ)$/) {
 389 #           warn "unknown destination '$dest'\n";
 390 #           next;
 391 #       }
 392
 393         $dport = undef if $dport && $dport eq '-';
 394         $sport = undef if $sport && $sport eq '-';
 395
 396         my $rule = {
 397             action => $action,
 398             service => $service,
 399             iface => $iface,
 400             source => $source,
 401             dest => $dest,
 402             proto => $proto,
 403             dport => $dport,
 404             sport => $sport,
 405         };
 406
 407         push @{$res->{$section}}, $rule;
 408     }
 409
 410     return $res;
 411 }
 412
 413 sub read_local_vm_config {
 414
 415     my $openvz = {};
 416
 417     my $qemu = {};
 418
 419     my $list = PVE::QemuServer::config_list();
 420
 421     foreach my $vmid (keys %$list) {
 422         # next if $vmid ne '100';
 423         my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
 424         if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
 425             $qemu->{$vmid} = $conf;
 426         }
 427     }
 428
 429     my $vmdata = { openvz => $openvz, qemu => $qemu };
 430
 431     return $vmdata;
 432 };
 433
 434 sub read_vm_firewall_rules {
 435     my ($vmdata) = @_;
 436     my $rules = {};
 437     foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
 438         my $filename = "/etc/pve/firewall/$vmid.fw";
 439         my $fh = IO::File->new($filename, O_RDONLY);
 440         next if !$fh;
 441
 442         $rules->{$vmid} = parse_fw_rules($filename, $fh);
 443     }
 444
 445     return $rules;
 446 }
 447
 448 sub compile {
 449
 450     my $vmdata = read_local_vm_config();
 451     my $rules = read_vm_firewall_rules($vmdata);
 452
 453     # print Dumper($vmdata);
 454
 455     my $swdir = '/etc/shorewall';
 456     mkdir $swdir;
 457
 458     &$compile_shorewall($swdir, $vmdata, $rules);
 459
 460     PVE::Tools::run_command(['shorewall', 'compile']);
 461 }
 462
 463 sub compile_and_start {
 464     my ($restart) = @_;
 465
 466     compile();
 467
 468     PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']);
 469 }
 470
 471
 472 1;