]>
git.proxmox.com Git - pve-firewall.git/blob - src/PVE/FirewallSimulator.pm
1 package PVE
::FirewallSimulator
;
17 my $new_value = shift;
19 $debug = $new_value if defined($new_value);
42 $SIG{'__WARN__'} = sub {
51 my ($devre, $dev) = @_;
53 $devre =~ s/\+$/\.\*/;
54 return ($dev =~ m/^${devre}$/) ?
1 : 0;
58 my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
60 my $ipset = $ipset_ruleset->{$ipsetname};
61 die "no such ipset '$ipsetname'" if !$ipset;
63 my $ip = Net
::IP-
>new($ipaddr);
65 my $first = $ipset->[0];
66 if ($first =~ m/^create\s+\S+\s+list:/) {
67 foreach my $entry (@$ipset) {
68 next if $entry =~ m/^create/; # simply ignore
69 if ($entry =~ m/add \S+ (\S+)$/) {
70 return 1 if ipset_match
($ipset_ruleset, $1, $ipaddr);
76 } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
77 foreach my $entry (@$ipset) {
78 next if $entry =~ m/^create/; # simply ignore
79 if ($entry =~ m/add \S+ (\S+)$/) {
80 my $test = Net
::IP-
>new($1);
81 if ($test->overlaps($ip)) {
82 add_trace
("IPSET $ipsetname match $ipaddr\n");
91 die "unknown ipset type '$first' - not implemented\n";
98 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
100 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
102 while (length($rule)) {
104 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
107 return undef if $cstate eq 'INVALID'; # no match
108 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
110 next if $cstate =~ m/NEW/;
112 die "cstate test '$cstate' not implemented\n";
115 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
117 die "missing source address type (srctype)\n"
119 return undef if $atype ne $pkg->{srctype
};
122 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
124 die "missing destination address type (dsttype)\n"
126 return undef if $atype ne $pkg->{dsttype
};
129 if ($rule =~ s/^-i (\S+)\s*//) {
131 die "missing interface (iface_in)\n" if !$pkg->{iface_in
};
132 return undef if !nf_dev_match
($devre, $pkg->{iface_in
});
136 if ($rule =~ s/^-o (\S+)\s*//) {
138 die "missing interface (iface_out)\n" if !$pkg->{iface_out
};
139 return undef if !nf_dev_match
($devre, $pkg->{iface_out
});
143 if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
144 die "missing proto" if !$pkg->{proto
};
145 return undef if $pkg->{proto
} ne $1; # no match
149 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
150 die "missing dport" if !$pkg->{dport
};
151 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
155 if ($rule =~ s/^--dport (\d+)\s*//) {
156 die "missing dport" if !$pkg->{dport
};
157 return undef if $pkg->{dport
} != $1; # no match
161 if ($rule =~ s/^-s (\S+)\s*//) {
162 die "missing source" if !$pkg->{source
};
163 my $ip = Net
::IP-
>new($1);
164 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{source
})); # no match
168 if ($rule =~ s/^-d (\S+)\s*//) {
169 die "missing destination" if !$pkg->{dest
};
170 my $ip = Net
::IP-
>new($1);
171 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{dest
})); # no match
175 if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
176 die "missing source" if !$pkg->{source
};
180 return undef if ipset_match
($ipset_ruleset, $ipset_name, $pkg->{source
});
182 return undef if !ipset_match
($ipset_ruleset, $ipset_name, $pkg->{source
});
187 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
188 die "missing destination" if !$pkg->{dest
};
190 return undef if !ipset_match
($ipset_ruleset, $ipset_name, $pkg->{dest
});
194 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
195 die "missing source mac" if !$pkg->{mac_source
};
196 return undef if $pkg->{mac_source
} eq $1; # no match
200 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
202 return undef if !$pkg->{physdev_in
};
203 return undef if !nf_dev_match
($devre, $pkg->{physdev_in
});
207 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
209 return undef if !$pkg->{physdev_out
};
210 return undef if !nf_dev_match
($devre, $pkg->{physdev_out
});
214 if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
215 return undef if !defined($mark) || $mark != $1;
221 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
226 if ($rule =~ s/^-j (\S+)\s*$//) {
230 if ($rule =~ s/^-g (\S+)\s*$//) {
234 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
241 die "unable to parse rule: $rule";
244 sub ruleset_simulate_chain
{
245 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
247 add_trace
("ENTER chain $chain\n");
251 if ($chain eq 'PVEFW-Drop') {
252 add_trace
("LEAVE chain $chain\n");
253 return ('DROP', $counter);
255 if ($chain eq 'PVEFW-reject') {
256 add_trace
("LEAVE chain $chain\n");
257 return ('REJECT', $counter);
260 if ($chain eq 'PVEFW-tcpflags') {
261 add_trace
("LEAVE chain $chain\n");
262 return (undef, $counter);
265 my $rules = $ruleset->{$chain} ||
266 die "no such chain '$chain'";
268 foreach my $rule (@$rules) {
270 my ($goto, $action) = rule_match
($ipset_ruleset, $chain, $rule, $pkg);
271 if (!defined($action)) {
272 add_trace
("SKIP: $rule\n");
275 add_trace
("MATCH: $rule\n");
277 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
278 add_trace
("TERMINATE chain $chain: $action\n");
279 return ($action, $counter);
280 } elsif ($action eq 'RETURN') {
281 add_trace
("RETURN FROM chain $chain\n");
285 add_trace
("LEAVE chain $chain - goto $action\n");
286 return ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg)
288 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
290 my ($act, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg);
292 return ($act, $counter) if $act;
293 add_trace
("CONTINUE chain $chain\n");
298 add_trace
("LEAVE chain $chain\n");
299 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
300 return ('ACCEPT', $counter); # default policy
303 return (undef, $counter);
311 while (my ($k,$v) = each %$pkg) {
318 # Try to simulate packet traversal inside kernel. This invokes iptable
319 # checks several times.
321 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
323 $pkg->{ipversion
} = 4; # fixme: allow ipv6
325 my $route_state = $start_state;
329 my $ipt_invocation_counter = 0;
330 my $rule_check_counter = 0;
332 while ($route_state ne $target->{iface
}) {
335 my $next_route_state;
338 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
339 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
341 if ($route_state eq 'from-bport') {
342 $next_route_state = $from_info->{bridge
} || die 'internal error';
343 $next_physdev_in = $from_info->{iface
} || die 'internal error';
344 } elsif ($route_state eq 'host') {
346 if ($target->{type
} eq 'bport') {
347 $pkg->{iface_in
} = 'lo';
348 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
349 $chain = 'PVEFW-OUTPUT';
350 $next_route_state = $target->{iface
} || die 'internal error';
351 } elsif ($target->{type
} eq 'vm' || $target->{type
} eq 'ct') {
352 $pkg->{iface_in
} = 'lo';
353 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
354 $chain = 'PVEFW-OUTPUT';
355 $next_route_state = 'fwbr-in';
360 } elsif ($route_state eq 'fwbr-out') {
362 $chain = 'PVEFW-FORWARD';
363 $next_route_state = $from_info->{bridge
} || die 'internal error';
364 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
365 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
366 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
367 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
368 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
370 } elsif ($route_state eq 'fwbr-in') {
372 $chain = 'PVEFW-FORWARD';
373 $next_route_state = $target->{tapdev
};
374 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
375 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
376 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
377 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
379 } elsif ($route_state =~ m/^vmbr\d+$/) {
381 die "missing physdev_in - internal error?" if !$physdev_in;
382 $pkg->{physdev_in
} = $physdev_in;
384 if ($target->{type
} eq 'host') {
386 $chain = 'PVEFW-INPUT';
387 $pkg->{iface_in
} = $route_state;
388 $pkg->{iface_out
} = 'lo';
389 $next_route_state = 'host';
391 } elsif ($target->{type
} eq 'bport') {
393 $chain = 'PVEFW-FORWARD';
394 $pkg->{iface_in
} = $route_state;
395 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
396 # conditionally set physdev_out (same behavior as kernel)
397 if ($route_state eq $target->{bridge
}) {
398 $pkg->{physdev_out
} = $target->{iface
} || die 'internal error';
400 $next_route_state = $target->{iface
};
402 } elsif ($target->{type
} eq 'vm' || $target->{type
} eq 'ct') {
404 $chain = 'PVEFW-FORWARD';
405 $pkg->{iface_in
} = $route_state;
406 $pkg->{iface_out
} = $target->{bridge
};
407 # conditionally set physdev_out (same behavior as kernel)
408 if ($route_state eq $target->{bridge
}) {
409 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
411 $next_route_state = 'fwbr-in';
418 die "implement me $route_state";
421 die "internal error" if !defined($next_route_state);
424 add_trace
("IPT check at $route_state (chain $chain)\n");
425 add_trace
(Dumper
($pkg));
426 $ipt_invocation_counter++;
427 my ($res, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $chain, $pkg);
428 $rule_check_counter += $ctr;
429 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
432 $route_state = $next_route_state;
434 $physdev_in = $next_physdev_in;
437 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
440 sub extract_ct_info
{
441 my ($vmdata, $vmid, $netnum) = @_;
443 my $info = { type
=> 'ct', vmid
=> $vmid };
445 my $conf = $vmdata->{lxc
}->{$vmid} || die "no such CT '$vmid'";
446 my $net = PVE
::LXC
::Config-
>parse_lxc_network($conf->{"net$netnum"});
447 $info->{macaddr
} = $net->{hwaddr
} || die "unable to get mac address";
448 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
449 $info->{fwbr
} = "fwbr${vmid}i$netnum";
450 $info->{tapdev
} = "veth${vmid}i$netnum";
451 $info->{fwln
} = "fwln${vmid}i$netnum";
452 $info->{fwpr
} = "fwpr${vmid}p$netnum";
453 $info->{ip_address
} = $net->{ip
} || die "unable to get ip address";
458 sub extract_vm_info
{
459 my ($vmdata, $vmid, $netnum) = @_;
461 my $info = { type
=> 'vm', vmid
=> $vmid };
463 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
464 my $net = PVE
::QemuServer
::parse_net
($conf->{"net$netnum"});
465 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
466 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
467 $info->{fwbr
} = "fwbr${vmid}i$netnum";
468 $info->{tapdev
} = "tap${vmid}i$netnum";
469 $info->{fwln
} = "fwln${vmid}i$netnum";
470 $info->{fwpr
} = "fwpr${vmid}p$netnum";
475 sub simulate_firewall
{
476 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
478 my $from = $test->{from
} || die "missing 'from' field";
479 my $to = $test->{to
} || die "missing 'to' field";
480 my $action = $test->{action
} || die "missing 'action'";
482 my $testid = $test->{id
};
484 die "from/to needs to be different" if $from eq $to;
492 srctype
=> 'UNICAST',
493 dsttype
=> 'UNICAST',
496 while (my ($k,$v) = each %$test) {
497 next if $k eq 'from';
499 next if $k eq 'action';
501 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
509 if ($from eq 'host') {
510 $from_info->{type
} = 'host';
511 $start_state = 'host';
512 $pkg->{source
} = $host_ip if !defined($pkg->{source
});
513 } elsif ($from =~ m
|^(vmbr\d
+)/(\S
+)$|) {
514 $from_info->{type
} = 'bport';
515 $from_info->{bridge
} = $1;
516 $from_info->{iface
} = $2;
517 $start_state = 'from-bport';
518 } elsif ($from eq 'outside') {
519 $from_info->{type
} = 'bport';
520 $from_info->{bridge
} = 'vmbr0';
521 $from_info->{iface
} = 'eth0';
522 $start_state = 'from-bport';
523 } elsif ($from eq 'nfvm') {
524 $from_info->{type
} = 'bport';
525 $from_info->{bridge
} = 'vmbr0';
526 $from_info->{iface
} = 'tapXYZ';
527 $start_state = 'from-bport';
528 } elsif ($from =~ m/^ct(\d+)$/) {
530 $from_info = extract_ct_info
($vmdata, $vmid, 0);
531 $start_state = 'fwbr-out';
532 $pkg->{mac_source
} = $from_info->{macaddr
};
533 } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
535 my $netnum = $3 || 0;
536 $from_info = extract_vm_info
($vmdata, $vmid, $netnum);
537 $start_state = 'fwbr-out';
538 $pkg->{mac_source
} = $from_info->{macaddr
};
540 die "unable to parse \"from => '$from'\"\n";
546 $target->{type
} = 'host';
547 $target->{iface
} = 'host';
548 $pkg->{dest
} = $host_ip if !defined($pkg->{dest
});
549 } elsif ($to =~ m
|^(vmbr\d
+)/(\S
+)$|) {
550 $target->{type
} = 'bport';
551 $target->{bridge
} = $1;
552 $target->{iface
} = $2;
553 } elsif ($to eq 'outside') {
554 $target->{type
} = 'bport';
555 $target->{bridge
} = 'vmbr0';
556 $target->{iface
} = 'eth0';
557 } elsif ($to eq 'nfvm') {
558 $target->{type
} = 'bport';
559 $target->{bridge
} = 'vmbr0';
560 $target->{iface
} = 'tapXYZ';
561 } elsif ($to =~ m/^ct(\d+)$/) {
563 $target = extract_ct_info
($vmdata, $vmid, 0);
564 $target->{iface
} = $target->{tapdev
};
565 } elsif ($to =~ m/^vm(\d+)$/) {
567 $target = extract_vm_info
($vmdata, $vmid, 0);
568 $target->{iface
} = $target->{tapdev
};
570 die "unable to parse \"to => '$to'\"\n";
573 $pkg->{source
} = '100.100.1.2' if !defined($pkg->{source
});
574 $pkg->{dest
} = '100.200.3.4' if !defined($pkg->{dest
});
576 my ($res, $ic, $rc) = route_packet
($ruleset, $ipset_ruleset, $pkg,
577 $from_info, $target, $start_state);
579 add_trace
("IPT statistics: invocation = $ic, checks = $rc\n");
581 return $res if $action eq 'QUERY';
583 die "test failed ($res != $action)\n" if $action ne $res;