PVE/Firewall.pm

   1 package PVE::Firewall;
   2
   3 use warnings;
   4 use strict;
   5 use Data::Dumper;
   6 use PVE::Tools;
   7 use PVE::QemuServer;
   8 use File::Path;
   9 use IO::File;
  10 use Data::Dumper;
  11
  12 my $macros;
  13 sub get_shorewall_macros {
  14
  15     return $macros if $macros;
  16
  17     foreach my $path (</usr/share/shorewall/macro.*>) {
  18         if ($path =~ m|/macro\.(\S+)$|) {
  19             $macros->{$1} = 1;
  20         }
  21     }
  22     return $macros;
  23 }
  24
  25
  26 my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
  27
  28 my $generate_input_rule = sub {
  29     my ($zoneinfo, $rule, $net, $netid) = @_;
  30
  31     my $zone = $net->{zone} || die "internal error";
  32     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  33     my $tap = $net->{tap} || die "internal error";
  34
  35     my $dest = "$zid:$tap";
  36
  37     if ($rule->{dest}) {
  38         $dest .= ":$rule->{dest}";
  39     }
  40
  41     my $action = $rule->{service} ?
  42         "$rule->{service}($rule->{action})" : $rule->{action};
  43
  44     my $sources = [];
  45
  46     if (!$rule->{source}) {
  47         push @$sources, 'all';
  48     } elsif ($zoneinfo->{$zone}->{type} eq 'bport') {
  49         my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error";
  50         my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
  51
  52         # using 'all' does not work, so we create one rule for
  53         # each related zone on the same bridge
  54         push @$sources, "${zoneref}:$rule->{source}";
  55         foreach my $z (keys %$zoneinfo) {
  56             next if $z eq $zone;
  57             next if !$zoneinfo->{$z}->{bridge_zone};
  58             next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone;
  59             $zoneref = $zoneinfo->{$z}->{zoneref} || die "internal error";
  60             push @$sources, "${zoneref}:$rule->{source}";
  61         }
  62     } else {
  63         push @$sources, "all:$rule->{source}";
  64     }
  65
  66     my $out = '';
  67
  68     foreach my $source (@$sources) {
  69         $out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-',
  70                         $rule->{dport} || '-', $rule->{sport} || '-');
  71     }
  72
  73     return $out;
  74 };
  75
  76 my $generate_output_rule = sub {
  77     my ($zoneinfo, $rule, $net, $netid) = @_;
  78
  79     my $zone = $net->{zone} || die "internal error";
  80     my $zid = $zoneinfo->{$zone}->{zoneref} || die "internal error";
  81     my $tap = $net->{tap} || die "internal error";
  82
  83     my $action = $rule->{service} ?
  84         "$rule->{service}($rule->{action})" : $rule->{action};
  85
  86     my $dest;
  87
  88     if (!$rule->{dest}) {
  89         $dest = 'all';
  90     } else {
  91         $dest = "all:$rule->{dest}";
  92     }
  93
  94     return sprintf($rule_format, $action, "$zid:$tap", $dest,
  95                    $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-');
  96 };
  97
  98 # we need complete VM configuration of all VMs (openvz/qemu)
  99 # in vmdata
 100
 101 my $compile_shorewall = sub {
 102     my ($targetdir, $vmdata, $rules) = @_;
 103
 104     # remove existing data ?
 105     foreach my $file (qw(params zones rules interfaces  maclist  policy)) {
 106         unlink "$targetdir/$file";
 107     }
 108
 109     my $netinfo;
 110
 111     my $zoneinfo = {
 112         fw => { type => 'firewall' },
 113     };
 114
 115     my $maclist = {};
 116
 117     my $register_bridge;
 118
 119     $register_bridge = sub {
 120         my ($bridge, $vlan) = @_;
 121
 122         my $zone =  'z' . $bridge;
 123
 124         return $zone if $zoneinfo->{$zone};
 125
 126         my $ext_zone = "z${bridge}ext";
 127
 128         $zoneinfo->{$zone} = {
 129             type => 'bridge',
 130             bridge => $bridge,
 131             bridge_ext_zone => $ext_zone,
 132         };
 133
 134         # physical input devices
 135         my $dir = "/sys/class/net/$bridge/brif";
 136         my $physical = {};
 137         PVE::Tools::dir_glob_foreach($dir, '((eth|bond).+)', sub {
 138             my ($slave) = @_;
 139             $physical->{$slave} = 1;
 140         });
 141
 142         $zoneinfo->{$ext_zone} = {
 143             type => 'bport',
 144             bridge_zone => $zone,
 145             ifaces => $physical,
 146         };
 147
 148         return &$register_bridge("${bridge}v${vlan}") if defined($vlan);
 149
 150         return $zone;
 151     };
 152
 153     my $register_bridge_port = sub {
 154         my ($bridge, $vlan, $vmzone, $tap) = @_;
 155
 156         my $bridge_zone = &$register_bridge($bridge, $vlan);
 157         my $zone = $bridge_zone . $vmzone;
 158
 159         if (!$zoneinfo->{$zone}) {
 160             $zoneinfo->{$zone} = {
 161                 type => 'bport',
 162                 bridge_zone => $bridge_zone,
 163                 ifaces => {},
 164             };
 165         }
 166
 167         $zoneinfo->{$zone}->{ifaces}->{$tap} = 1;
 168
 169         return $zone;
 170     };
 171
 172     foreach my $vmid (keys %{$vmdata->{qemu}}) {
 173         $netinfo->{$vmid} = {};
 174         my $conf = $vmdata->{qemu}->{$vmid};
 175         foreach my $opt (keys %$conf) {
 176             next if $opt !~ m/^net(\d+)$/;
 177             my $netnum = $1;
 178             my $net = PVE::QemuServer::parse_net($conf->{$opt});
 179             next if !$net;
 180             die "implement me" if !$net->{bridge};
 181
 182             my $vmzone = $conf->{zone} || "vm$vmid";
 183             $net->{tap} = "tap${vmid}i${netnum}";
 184             $maclist->{$net->{tap}} = $net->{macaddr} || die "internal error";
 185             $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap});
 186             $netinfo->{$vmid}->{$opt} = $net;
 187         }
 188     }
 189
 190     #print Dumper($netinfo);
 191
 192     # NOTE: zone names have length limit, so we need to
 193     # translate them into shorter names
 194
 195     my $zoneid = 0;
 196     my $zonemap = { fw => 'fw' };
 197
 198     my $lookup_zonename = sub {
 199         my ($zone) = @_;
 200
 201         return $zonemap->{$zone} if defined($zonemap->{$zone});
 202         $zonemap->{$zone} = 'z' . $zoneid++;
 203
 204         return $zonemap->{$zone};
 205     };
 206
 207     foreach my $z (sort keys %$zoneinfo) {
 208         $zoneinfo->{$z}->{id} = &$lookup_zonename($z);
 209         $zoneinfo->{$z}->{zonevar} = uc($z);
 210         $zoneinfo->{$z}->{zoneref} = '$' . $zoneinfo->{$z}->{zonevar};
 211     }
 212
 213     my $out;
 214
 215     # dump params file
 216     $out = "# PVE zones\n";
 217     foreach my $z (sort keys %$zoneinfo) {
 218         $out .= "$zoneinfo->{$z}->{zonevar}=$zoneinfo->{$z}->{id}\n";
 219     }
 220     PVE::Tools::file_set_contents("$targetdir/params", $out);
 221
 222     # dump zone file
 223
 224     my $format = "%-30s %-10s %-15s\n";
 225     $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS');
 226
 227     foreach my $z (sort keys %$zoneinfo) {
 228         my $zid = $zoneinfo->{$z}->{zoneref};
 229         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 230             $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, '');
 231         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 232             $out .= sprintf($format, $zid, 'ipv4', '');
 233         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 234             my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 235             my $bzid = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error";
 236             $out .= sprintf($format, "$zid:$bzid", 'bport', '');
 237         } else {
 238             die "internal error";
 239         }
 240     }
 241
 242     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 243
 244     PVE::Tools::file_set_contents("$targetdir/zones", $out);
 245
 246     # dump interfaces
 247
 248     $format = "%-25s %-20s %-10s %-15s\n";
 249     $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS');
 250
 251     my $maclist_format = "%-15s %-15s %-15s\n";
 252     my $macs = sprintf($maclist_format, '#DISPOSITION', 'INTERFACE', 'MACZONE');
 253
 254     foreach my $z (sort keys %$zoneinfo) {
 255         my $zid = $zoneinfo->{$z}->{zoneref};
 256         if ($zoneinfo->{$z}->{type} eq 'firewall') {
 257             # do nothing;
 258         } elsif ($zoneinfo->{$z}->{type} eq 'bridge') {
 259             my $bridge = $zoneinfo->{$z}->{bridge} || die "internal error";
 260             $out .= sprintf($format, $zid, $bridge, 'detect', 'bridge,optional');
 261         } elsif ($zoneinfo->{$z}->{type} eq 'bport') {
 262             my $ifaces = $zoneinfo->{$z}->{ifaces};
 263             foreach my $iface (sort keys %$ifaces) {
 264                 my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error";
 265                 my $bridge = $zoneinfo->{$bridge_zone}->{bridge} || die "internal error";
 266                 my $iftxt = "$bridge:$iface";
 267
 268                 if ($maclist->{$iface}) {
 269                     $out .= sprintf($format, $zid, $iftxt, '-', 'maclist');
 270                     $macs .= sprintf($maclist_format, 'ACCEPT', $iface, $maclist->{$iface});
 271                 } else {
 272                     $out .= sprintf($format, $zid, $iftxt, '-', '');
 273                 }
 274             }
 275         } else {
 276             die "internal error";
 277         }
 278     }
 279
 280     $out .= sprintf("#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE\n");
 281
 282     PVE::Tools::file_set_contents("$targetdir/interfaces", $out);
 283
 284     # dump maclist
 285     PVE::Tools::file_set_contents("$targetdir/maclist", $macs);
 286
 287     # dump policy
 288
 289     $format = "%-15s %-15s %-15s %s\n";
 290     $out = sprintf($format, '#SOURCE', 'DEST', 'POLICY', 'LOG');
 291     $out .= sprintf($format, 'fw', 'all', 'ACCEPT', '');
 292
 293     # we need to disable intra-zone traffic on bridges. Else traffic
 294     # from untracked interfaces simply pass the firewall
 295     foreach my $z (sort keys %$zoneinfo) {
 296         my $zid = $zoneinfo->{$z}->{zoneref};
 297         if ($zoneinfo->{$z}->{type} eq 'bridge') {
 298             $out .= sprintf($format, $zid, $zid, 'REJECT', 'info');
 299         }
 300     }
 301     $out .= sprintf($format, 'all', 'all', 'REJECT', 'info');
 302
 303     PVE::Tools::file_set_contents("$targetdir/policy", $out);
 304
 305     # dump rules
 306     $out = '';
 307
 308     $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT');
 309     foreach my $vmid (sort keys %$rules) {
 310         my $inrules = $rules->{$vmid}->{in};
 311         my $outrules = $rules->{$vmid}->{out};
 312
 313         if (scalar(@$inrules)) {
 314             $out .= "# IN to VM $vmid\n";
 315             foreach my $rule (@$inrules) {
 316                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 317                     my $net = $netinfo->{$vmid}->{$netid};
 318                     next if $rule->{iface} && $rule->{iface} ne $netid;
 319                     $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid);
 320                 }
 321             }
 322         }
 323
 324         if (scalar(@$outrules)) {
 325             $out .= "# OUT from VM $vmid\n";
 326             foreach my $rule (@$outrules) {
 327                 foreach my $netid (keys %{$netinfo->{$vmid}}) {
 328                     my $net = $netinfo->{$vmid}->{$netid};
 329                     next if $rule->{iface} && $rule->{iface} ne $netid;
 330                     $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid);
 331                 }
 332             }
 333         }
 334     }
 335
 336     PVE::Tools::file_set_contents("$targetdir/rules", $out);
 337 };
 338
 339
 340 sub parse_fw_rules {
 341     my ($filename, $fh) = @_;
 342
 343     my $section;
 344
 345     my $res = { in => [], out => [] };
 346
 347     my $macros = PVE::Firewall::get_shorewall_macros();
 348
 349     while (defined(my $line = <$fh>)) {
 350         next if $line =~ m/^#/;
 351         next if $line =~ m/^\s*$/;
 352
 353         if ($line =~ m/^\[(in|out)\]\s*$/i) {
 354             $section = lc($1);
 355             next;
 356         }
 357         next if !$section;
 358
 359         my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
 360             split(/\s+/, $line);
 361
 362         if (!$action) {
 363             warn "skip incomplete line\n";
 364             next;
 365         }
 366
 367         my $service;
 368         if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) {
 369             # OK
 370         } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
 371             ($service, $action) = ($1, $2);
 372             if (!$macros->{$service}) {
 373                 warn "unknown service '$service'\n";
 374                 next;
 375             }
 376         } else {
 377             warn "unknown action '$action'\n";
 378             next;
 379         }
 380
 381         $iface = undef if $iface && $iface eq '-';
 382         if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
 383             warn "unknown interface '$iface'\n";
 384             next;
 385         }
 386
 387         $proto = undef if $proto && $proto eq '-';
 388         if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) {
 389             warn "unknown protokol '$proto'\n";
 390             next;
 391         }
 392
 393         $source = undef if $source && $source eq '-';
 394
 395 #       if ($source !~ m/^(XYZ)$/) {
 396 #           warn "unknown source '$source'\n";
 397 #           next;
 398 #       }
 399
 400         $dest = undef if $dest && $dest eq '-';
 401 #       if ($dest !~ m/^XYZ)$/) {
 402 #           warn "unknown destination '$dest'\n";
 403 #           next;
 404 #       }
 405
 406         $dport = undef if $dport && $dport eq '-';
 407         $sport = undef if $sport && $sport eq '-';
 408
 409         my $rule = {
 410             action => $action,
 411             service => $service,
 412             iface => $iface,
 413             source => $source,
 414             dest => $dest,
 415             proto => $proto,
 416             dport => $dport,
 417             sport => $sport,
 418         };
 419
 420         push @{$res->{$section}}, $rule;
 421     }
 422
 423     return $res;
 424 }
 425
 426 sub read_local_vm_config {
 427
 428     my $openvz = {};
 429
 430     my $qemu = {};
 431
 432     my $list = PVE::QemuServer::config_list();
 433
 434     foreach my $vmid (keys %$list) {
 435         #next if !($vmid eq '100' || $vmid eq '102');
 436         my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
 437         if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
 438             $qemu->{$vmid} = $conf;
 439         }
 440     }
 441
 442     my $vmdata = { openvz => $openvz, qemu => $qemu };
 443
 444     return $vmdata;
 445 };
 446
 447 sub read_vm_firewall_rules {
 448     my ($vmdata) = @_;
 449     my $rules = {};
 450     foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
 451         my $filename = "/etc/pve/firewall/$vmid.fw";
 452         my $fh = IO::File->new($filename, O_RDONLY);
 453         next if !$fh;
 454
 455         $rules->{$vmid} = parse_fw_rules($filename, $fh);
 456     }
 457
 458     return $rules;
 459 }
 460
 461 sub compile {
 462
 463     my $vmdata = read_local_vm_config();
 464     my $rules = read_vm_firewall_rules($vmdata);
 465
 466     # print Dumper($vmdata);
 467
 468     my $swdir = '/etc/shorewall';
 469     mkdir $swdir;
 470
 471     &$compile_shorewall($swdir, $vmdata, $rules);
 472
 473     PVE::Tools::run_command(['shorewall', 'compile']);
 474 }
 475
 476 sub compile_and_start {
 477     my ($restart) = @_;
 478
 479     compile();
 480
 481     PVE::Tools::run_command(['shorewall', $restart ? 'restart' : 'start']);
 482 }
 483
 484
 485 1;