src/PVE/FirewallSimulator.pm

   1 package PVE::FirewallSimulator;
   2
   3 use strict;
   4 use warnings;
   5 use Data::Dumper;
   6 use PVE::Firewall;
   7 use File::Basename;
   8 use Net::IP;
   9
  10 # dynamically include PVE::QemuServer and PVE::LXC
  11 # to avoid dependency problems
  12 my $have_qemu_server;
  13 eval {
  14     require PVE::QemuServer;
  15     $have_qemu_server = 1;
  16 };
  17
  18 my $have_lxc;
  19 eval {
  20     require PVE::LXC;
  21     $have_lxc = 1;
  22 };
  23
  24 my $mark = 0;
  25 my $trace;
  26 my $debug = 0;
  27
  28 my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
  29
  30 sub debug {
  31     my $new_value = shift;
  32     $debug = $new_value if defined($new_value);
  33     return $debug;
  34 }
  35
  36 sub reset_trace {
  37     $trace = '';
  38 }
  39
  40 sub get_trace {
  41     return $trace;
  42 }
  43
  44 sub add_trace {
  45     my ($text) = @_;
  46
  47     if ($debug) {
  48         print $text;
  49     } else {
  50         $trace .= $text;
  51     }
  52 }
  53
  54 $SIG{'__WARN__'} = sub {
  55     my $err = $@;
  56     my $t = $_[0];
  57     chomp $t;
  58     add_trace("$t\n");
  59     $@ = $err;
  60 };
  61
  62 sub nf_dev_match {
  63     my ($devre, $dev) = @_;
  64
  65     $devre =~ s/\+$/\.\*/;
  66     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  67 }
  68
  69 sub ipset_match {
  70     my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
  71
  72     my $ipset = $ipset_ruleset->{$ipsetname};
  73     die "no such ipset '$ipsetname'" if !$ipset;
  74
  75     my $ip = Net::IP->new($ipaddr);
  76
  77     my $first = $ipset->[0];
  78     if ($first =~ m/^create\s+\S+\s+list:/) {
  79         foreach my $entry (@$ipset) {
  80             next if $entry =~ m/^create/; # simply ignore
  81             if ($entry =~ m/add \S+ (\S+)$/) {
  82                 return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
  83             } else {
  84                 die "implement me";
  85             }
  86         }
  87         return 0;
  88     } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
  89         foreach my $entry (@$ipset) {
  90             next if $entry =~ m/^create/; # simply ignore
  91             if ($entry =~ m/add \S+ (\S+)$/) {
  92                 my $test = Net::IP->new($1);
  93                 if ($test->overlaps($ip)) {
  94                     add_trace("IPSET $ipsetname match $ipaddr\n");
  95                     return 1;
  96                 }
  97             } else {
  98                 die "implement me";
  99             }
 100         }
 101         return 0;
 102     } else {
 103         die "unknown ipset type '$first' - not implemented\n";
 104     }
 105
 106     return 0;
 107 }
 108
 109 sub rule_match {
 110     my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
 111
 112     $rule =~ s/^-A $chain +// || die "got strange rule: $rule";
 113
 114     while (length($rule)) {
 115
 116         if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
 117             my $cstate = $1;
 118
 119             return undef if $cstate eq 'INVALID'; # no match
 120             return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
 121
 122             next if $cstate =~ m/NEW/;
 123
 124             die "cstate test '$cstate' not implemented\n";
 125         }
 126
 127         if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
 128             my $atype = $1;
 129             die "missing source address type (srctype)\n"
 130                 if !$pkg->{srctype};
 131             return undef if $atype ne $pkg->{srctype};
 132         }
 133
 134         if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
 135             my $atype = $1;
 136             die "missing destination address type (dsttype)\n"
 137                 if !$pkg->{dsttype};
 138             return undef if $atype ne $pkg->{dsttype};
 139         }
 140
 141         if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
 142             my $icmpv6 = !!$1;
 143             my $icmptype = $2;
 144             die "missing destination address type (dsttype)\n" if !defined($pkg->{dport});
 145             return undef if $icmptype ne $pkg->{dport};
 146         }
 147
 148         if ($rule =~ s/^-i (\S+)\s*//) {
 149             my $devre = $1;
 150             die "missing interface (iface_in)\n" if !$pkg->{iface_in};
 151             return undef if !nf_dev_match($devre, $pkg->{iface_in});
 152             next;
 153         }
 154
 155         if ($rule =~ s/^-o (\S+)\s*//) {
 156             my $devre = $1;
 157             die "missing interface (iface_out)\n" if !$pkg->{iface_out};
 158             return undef if !nf_dev_match($devre, $pkg->{iface_out});
 159             next;
 160         }
 161
 162         if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
 163             die "missing proto" if !$pkg->{proto};
 164             return undef if $pkg->{proto} ne $1; # no match
 165             next;
 166         }
 167
 168         if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
 169             die "missing dport" if !$pkg->{dport};
 170             return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
 171             next;
 172         }
 173
 174         if ($rule =~ s/^--dport (\d+)\s*//) {
 175             die "missing dport" if !$pkg->{dport};
 176             return undef if $pkg->{dport} != $1; # no match
 177             next;
 178         }
 179
 180         if ($rule =~ s/^-s (\S+)\s*//) {
 181             die "missing source" if !$pkg->{source};
 182             my $ip = Net::IP->new($1);
 183             return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
 184             next;
 185         }
 186
 187         if ($rule =~ s/^-d (\S+)\s*//) {
 188             die "missing destination" if !$pkg->{dest};
 189             my $ip = Net::IP->new($1);
 190             return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
 191             next;
 192         }
 193
 194         if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
 195             die "missing source" if !$pkg->{source};
 196             my $neg = $1;
 197             my $ipset_name = $2;
 198             if ($neg) {
 199                 return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 200             } else {
 201                 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 202             }
 203             next;
 204         }
 205
 206         if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
 207             die "missing destination" if !$pkg->{dest};
 208             my $ipset_name = $1;
 209             return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
 210             next;
 211         }
 212
 213         if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
 214             die "missing source mac" if !$pkg->{mac_source};
 215             return undef if $pkg->{mac_source} eq $1; # no match
 216             next;
 217         }
 218
 219         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
 220             my $devre = $1;
 221             return undef if !$pkg->{physdev_in};
 222             return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 223             next;
 224         }
 225
 226         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 227             my $devre = $1;
 228             return undef if !$pkg->{physdev_out};
 229             return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 230             next;
 231         }
 232
 233         if ($rule =~ s@^-m mark --mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*@@) {
 234             my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
 235             return undef if ($mark & $mask) != $value;
 236             next;
 237         }
 238
 239         # final actions
 240
 241         if ($rule =~ s@^-j MARK --set-mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*$@@) {
 242             my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
 243             $mark = ($mark & ~$mask) | $value;
 244             return undef;
 245         }
 246
 247         if ($rule =~ s/^-j (\S+)\s*$//) {
 248             return (0, $1);
 249         }
 250
 251         if ($rule =~ s/^-g (\S+)\s*$//) {
 252             return (1, $1);
 253         }
 254
 255         if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
 256             return undef;
 257         }
 258
 259         last;
 260     }
 261
 262     die "unable to parse rule: $rule";
 263 }
 264
 265 sub ruleset_simulate_chain {
 266     my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
 267
 268     add_trace("ENTER chain $chain\n");
 269
 270     my $counter = 0;
 271
 272     if ($chain eq 'PVEFW-Drop') {
 273         add_trace("LEAVE chain $chain\n");
 274         return ('DROP', $counter);
 275     }
 276     if ($chain eq 'PVEFW-reject') {
 277         add_trace("LEAVE chain $chain\n");
 278         return ('REJECT', $counter);
 279     }
 280
 281     if ($chain eq 'PVEFW-tcpflags') {
 282         add_trace("LEAVE chain $chain\n");
 283         return (undef, $counter);
 284     }
 285
 286     my $rules = $ruleset->{$chain} ||
 287         die "no such chain '$chain'";
 288
 289     foreach my $rule (@$rules) {
 290         $counter++;
 291         my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
 292         if (!defined($action)) {
 293             add_trace("SKIP: $rule\n");
 294             next;
 295         }
 296         add_trace("MATCH: $rule\n");
 297
 298         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 299             add_trace("TERMINATE chain $chain: $action\n");
 300             return ($action, $counter);
 301         } elsif ($action eq 'RETURN') {
 302             add_trace("RETURN FROM chain $chain\n");
 303             last;
 304         } else {
 305             if ($goto) {
 306                 add_trace("LEAVE chain $chain - goto $action\n");
 307                 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
 308                 #$chain = $action;
 309                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 310             } else {
 311                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
 312                 $counter += $ctr;
 313                 return ($act, $counter) if $act;
 314                 add_trace("CONTINUE chain $chain\n");
 315             }
 316         }
 317     }
 318
 319     add_trace("LEAVE chain $chain\n");
 320     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 321         return ('ACCEPT', $counter); # default policy
 322     }
 323
 324     return (undef, $counter);
 325 }
 326
 327 sub copy_packet {
 328     my ($pkg) = @_;
 329
 330     my $res = {};
 331
 332     while (my ($k,$v) = each %$pkg) {
 333         $res->{$k} = $v;
 334     }
 335
 336     return $res;
 337 }
 338
 339 # Try to simulate packet traversal inside kernel. This invokes iptable
 340 # checks several times.
 341 sub route_packet {
 342     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 343
 344     $pkg->{ipversion} = 4; # fixme: allow ipv6
 345
 346     my $route_state = $start_state;
 347
 348     my $physdev_in;
 349
 350     my $ipt_invocation_counter = 0;
 351     my $rule_check_counter = 0;
 352
 353     while ($route_state ne $target->{iface}) {
 354
 355         my $chain;
 356         my $next_route_state;
 357         my $next_physdev_in;
 358
 359         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 360         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 361
 362         if ($route_state eq 'from-bport') {
 363             $next_route_state = $from_info->{bridge} || die 'internal error';
 364             $next_physdev_in = $from_info->{iface} || die 'internal error';
 365         } elsif ($route_state eq 'host') {
 366
 367             if ($target->{type} eq 'bport') {
 368                 $pkg->{iface_in} = 'lo';
 369                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 370                 $chain = 'PVEFW-OUTPUT';
 371                 $next_route_state = $target->{iface} || die 'internal error';
 372             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 373                 $pkg->{iface_in} = 'lo';
 374                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 375                 $chain = 'PVEFW-OUTPUT';
 376                 $next_route_state = 'fwbr-in';
 377             } else {
 378                 die "implement me";
 379             }
 380
 381         } elsif ($route_state eq 'fwbr-out') {
 382
 383             $chain = 'PVEFW-FORWARD';
 384             $next_route_state = $from_info->{bridge} || die 'internal error';
 385             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 386             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 387             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 388             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 389             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 390
 391         } elsif ($route_state eq 'fwbr-in') {
 392
 393             $chain = 'PVEFW-FORWARD';
 394             $next_route_state = $target->{tapdev};
 395             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 396             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 397             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 398             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 399
 400         } elsif ($route_state =~ m/^vmbr\d+$/) {
 401
 402             die "missing physdev_in - internal error?" if !$physdev_in;
 403             $pkg->{physdev_in} = $physdev_in;
 404
 405             if ($target->{type} eq 'host') {
 406
 407                 $chain = 'PVEFW-INPUT';
 408                 $pkg->{iface_in} = $route_state;
 409                 $pkg->{iface_out} = 'lo';
 410                 $next_route_state = 'host';
 411
 412             } elsif ($target->{type} eq 'bport') {
 413
 414                 $chain = 'PVEFW-FORWARD';
 415                 $pkg->{iface_in} = $route_state;
 416                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 417                 # conditionally set physdev_out (same behavior as kernel)
 418                 if ($route_state eq $target->{bridge}) {
 419                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 420                 }
 421                 $next_route_state = $target->{iface};
 422
 423             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 424
 425                 $chain = 'PVEFW-FORWARD';
 426                 $pkg->{iface_in} = $route_state;
 427                 $pkg->{iface_out} = $target->{bridge};
 428                 # conditionally set physdev_out (same behavior as kernel)
 429                 if ($route_state eq $target->{bridge}) {
 430                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 431                 }
 432                 $next_route_state = 'fwbr-in';
 433
 434             } else {
 435                 die "implement me";
 436             }
 437
 438         } else {
 439             die "implement me $route_state";
 440         }
 441
 442         die "internal error" if !defined($next_route_state);
 443
 444         if ($chain) {
 445             add_trace("IPT check at $route_state (chain $chain)\n");
 446             add_trace(Dumper($pkg));
 447             $ipt_invocation_counter++;
 448             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
 449             $rule_check_counter += $ctr;
 450             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 451         }
 452
 453         $route_state = $next_route_state;
 454
 455         $physdev_in = $next_physdev_in;
 456     }
 457
 458     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 459 }
 460
 461 sub extract_ct_info {
 462     my ($vmdata, $vmid, $netnum) = @_;
 463
 464     my $info = { type => 'ct', vmid => $vmid };
 465
 466     my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
 467     my $net = PVE::LXC::Config->parse_lxc_network($conf->{"net$netnum"});
 468     $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
 469     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 470     $info->{fwbr} = "fwbr${vmid}i$netnum";
 471     $info->{tapdev} = "veth${vmid}i$netnum";
 472     $info->{fwln} = "fwln${vmid}i$netnum";
 473     $info->{fwpr} = "fwpr${vmid}p$netnum";
 474     $info->{ip_address} = $net->{ip} || die "unable to get ip address";
 475
 476     return $info;
 477 }
 478
 479 sub extract_vm_info {
 480     my ($vmdata, $vmid, $netnum) = @_;
 481
 482     my $info = { type => 'vm', vmid => $vmid };
 483
 484     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 485     my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
 486     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 487     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 488     $info->{fwbr} = "fwbr${vmid}i$netnum";
 489     $info->{tapdev} = "tap${vmid}i$netnum";
 490     $info->{fwln} = "fwln${vmid}i$netnum";
 491     $info->{fwpr} = "fwpr${vmid}p$netnum";
 492
 493     return $info;
 494 }
 495
 496 sub simulate_firewall {
 497     my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
 498
 499     my $from = $test->{from} || die "missing 'from' field";
 500     my $to = $test->{to} || die "missing 'to' field";
 501     my $action = $test->{action} || die "missing 'action'";
 502
 503     my $testid = $test->{id};
 504
 505     die "from/to needs to be different" if $from eq $to;
 506
 507     my $pkg = {
 508         proto => 'tcp',
 509         sport => undef,
 510         dport => undef,
 511         source => undef,
 512         dest => undef,
 513         srctype => 'UNICAST',
 514         dsttype => 'UNICAST',
 515     };
 516
 517     while (my ($k,$v) = each %$test) {
 518         next if $k eq 'from';
 519         next if $k eq 'to';
 520         next if $k eq 'action';
 521         next if $k eq 'id';
 522         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 523         $pkg->{$k} = $v;
 524     }
 525
 526     my $from_info = {};
 527
 528     my $start_state;
 529
 530     if ($from eq 'host') {
 531         $from_info->{type} = 'host';
 532         $start_state = 'host';
 533         $pkg->{source} = $host_ip if !defined($pkg->{source});
 534     } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
 535         $from_info->{type} = 'bport';
 536         $from_info->{bridge} = $1;
 537         $from_info->{iface} = $2;
 538         $start_state = 'from-bport';
 539     } elsif ($from eq 'outside') {
 540         $from_info->{type} = 'bport';
 541         $from_info->{bridge} = 'vmbr0';
 542         $from_info->{iface} = 'eth0';
 543         $start_state = 'from-bport';
 544     } elsif ($from eq 'nfvm') {
 545         $from_info->{type} = 'bport';
 546         $from_info->{bridge} = 'vmbr0';
 547         $from_info->{iface} = 'tapXYZ';
 548         $start_state = 'from-bport';
 549     } elsif ($from =~ m/^ct(\d+)$/) {
 550         return 'SKIPPED' if !$have_lxc;
 551         my $vmid = $1;
 552         $from_info = extract_ct_info($vmdata, $vmid, 0);
 553         $start_state = 'fwbr-out';
 554         $pkg->{mac_source} = $from_info->{macaddr};
 555     } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
 556         return 'SKIPPED' if !$have_qemu_server;
 557         my $vmid = $1;
 558         my $netnum = $3 || 0;
 559         $from_info = extract_vm_info($vmdata, $vmid, $netnum);
 560         $start_state = 'fwbr-out';
 561         $pkg->{mac_source} = $from_info->{macaddr};
 562     } else {
 563         die "unable to parse \"from => '$from'\"\n";
 564     }
 565
 566     my $target;
 567
 568     if ($to eq 'host') {
 569         $target->{type} = 'host';
 570         $target->{iface} = 'host';
 571         $pkg->{dest} = $host_ip if !defined($pkg->{dest});
 572     } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
 573         $target->{type} = 'bport';
 574         $target->{bridge} = $1;
 575         $target->{iface} = $2;
 576     } elsif ($to eq 'outside') {
 577         $target->{type} = 'bport';
 578         $target->{bridge} = 'vmbr0';
 579         $target->{iface} = 'eth0';
 580      } elsif ($to eq 'nfvm') {
 581         $target->{type} = 'bport';
 582         $target->{bridge} = 'vmbr0';
 583         $target->{iface} = 'tapXYZ';
 584     } elsif ($to =~ m/^ct(\d+)$/) {
 585         return 'SKIPPED' if !$have_lxc;
 586         my $vmid = $1;
 587         $target = extract_ct_info($vmdata, $vmid, 0);
 588         $target->{iface} = $target->{tapdev};
 589    } elsif ($to =~ m/^vm(\d+)$/) {
 590         return 'SKIPPED' if !$have_qemu_server;
 591         my $vmid = $1;
 592         $target = extract_vm_info($vmdata, $vmid, 0);
 593         $target->{iface} = $target->{tapdev};
 594     } else {
 595         die "unable to parse \"to => '$to'\"\n";
 596     }
 597
 598     $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
 599     $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
 600
 601     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 602                                        $from_info, $target, $start_state);
 603
 604     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 605
 606     return $res if $action eq 'QUERY';
 607
 608     die "test failed ($res != $action)\n" if $action ne $res;
 609
 610     return undef;
 611 }
 612
 613 1;
 614