src/PVE/FirewallSimulator.pm

   1 package PVE::FirewallSimulator;
   2
   3 use strict;
   4 use warnings;
   5 use Data::Dumper;
   6 use PVE::Firewall;
   7 use File::Basename;
   8 use Net::IP;
   9 use PVE::LXC;
  10 use PVE::QemuServer;
  11
  12 my $mark;
  13 my $trace;
  14 my $debug = 0;
  15
  16 sub debug {
  17     my $new_value = shift;
  18
  19     $debug = $new_value if defined($new_value);
  20
  21     return $debug;
  22 }
  23
  24 sub reset_trace {
  25     $trace = '';
  26 }
  27
  28 sub get_trace {
  29     return $trace;
  30 }
  31
  32 sub add_trace {
  33     my ($text) = @_;
  34
  35     if ($debug) {
  36         print $text;
  37     } else {
  38         $trace .= $text;
  39     }
  40 }
  41
  42 $SIG{'__WARN__'} = sub {
  43     my $err = $@;
  44     my $t = $_[0];
  45     chomp $t;
  46     add_trace("$t\n");
  47     $@ = $err;
  48 };
  49
  50 sub nf_dev_match {
  51     my ($devre, $dev) = @_;
  52
  53     $devre =~ s/\+$/\.\*/;
  54     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  55 }
  56
  57 sub ipset_match {
  58     my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
  59
  60     my $ipset = $ipset_ruleset->{$ipsetname};
  61     die "no such ipset '$ipsetname'" if !$ipset;
  62
  63     my $ip = Net::IP->new($ipaddr);
  64
  65     my $first = $ipset->[0];
  66     if ($first =~ m/^create\s+\S+\s+list:/) {
  67         foreach my $entry (@$ipset) {
  68             next if $entry =~ m/^create/; # simply ignore
  69             if ($entry =~ m/add \S+ (\S+)$/) {
  70                 return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
  71             } else {
  72                 die "implement me";
  73             }
  74         }
  75         return 0;
  76     } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
  77         foreach my $entry (@$ipset) {
  78             next if $entry =~ m/^create/; # simply ignore
  79             if ($entry =~ m/add \S+ (\S+)$/) {
  80                 my $test = Net::IP->new($1);
  81                 if ($test->overlaps($ip)) {
  82                     add_trace("IPSET $ipsetname match $ipaddr\n");
  83                     return 1;
  84                 }
  85             } else {
  86                 die "implement me";
  87             }
  88         }
  89         return 0;
  90     } else {
  91         die "unknown ipset type '$first' - not implemented\n";
  92     }
  93
  94     return 0;
  95 }
  96
  97 sub rule_match {
  98     my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
  99
 100     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
 101
 102     while (length($rule)) {
 103
 104         if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
 105             my $cstate = $1;
 106
 107             return undef if $cstate eq 'INVALID'; # no match
 108             return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
 109
 110             next if $cstate =~ m/NEW/;
 111
 112             die "cstate test '$cstate' not implemented\n";
 113         }
 114
 115         if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
 116             my $atype = $1;
 117             die "missing source address type (srctype)\n"
 118                 if !$pkg->{srctype};
 119             return undef if $atype ne $pkg->{srctype};
 120         }
 121
 122         if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
 123             my $atype = $1;
 124             die "missing destination address type (dsttype)\n"
 125                 if !$pkg->{dsttype};
 126             return undef if $atype ne $pkg->{dsttype};
 127         }
 128
 129         if ($rule =~ s/^-i (\S+)\s*//) {
 130             my $devre = $1;
 131             die "missing interface (iface_in)\n" if !$pkg->{iface_in};
 132             return undef if !nf_dev_match($devre, $pkg->{iface_in});
 133             next;
 134         }
 135
 136         if ($rule =~ s/^-o (\S+)\s*//) {
 137             my $devre = $1;
 138             die "missing interface (iface_out)\n" if !$pkg->{iface_out};
 139             return undef if !nf_dev_match($devre, $pkg->{iface_out});
 140             next;
 141         }
 142
 143         if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
 144             die "missing proto" if !$pkg->{proto};
 145             return undef if $pkg->{proto} ne $1; # no match
 146             next;
 147         }
 148
 149         if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
 150             die "missing dport" if !$pkg->{dport};
 151             return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
 152             next;
 153         }
 154
 155         if ($rule =~ s/^--dport (\d+)\s*//) {
 156             die "missing dport" if !$pkg->{dport};
 157             return undef if $pkg->{dport} != $1; # no match
 158             next;
 159         }
 160
 161         if ($rule =~ s/^-s (\S+)\s*//) {
 162             die "missing source" if !$pkg->{source};
 163             my $ip = Net::IP->new($1);
 164             return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
 165             next;
 166         }
 167
 168         if ($rule =~ s/^-d (\S+)\s*//) {
 169             die "missing destination" if !$pkg->{dest};
 170             my $ip = Net::IP->new($1);
 171             return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
 172             next;
 173         }
 174
 175         if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
 176             die "missing source" if !$pkg->{source};
 177             my $neg = $1;
 178             my $ipset_name = $2;
 179             if ($neg) {
 180                 return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 181             } else {
 182                 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 183             }
 184             next;
 185         }
 186
 187         if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
 188             die "missing destination" if !$pkg->{dest};
 189             my $ipset_name = $1;
 190             return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
 191             next;
 192         }
 193
 194         if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
 195             die "missing source mac" if !$pkg->{mac_source};
 196             return undef if $pkg->{mac_source} eq $1; # no match
 197             next;
 198         }
 199
 200         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
 201             my $devre = $1;
 202             return undef if !$pkg->{physdev_in};
 203             return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 204             next;
 205         }
 206
 207         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 208             my $devre = $1;
 209             return undef if !$pkg->{physdev_out};
 210             return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 211             next;
 212         }
 213
 214         if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
 215             return undef if !defined($mark) || $mark != $1;
 216             next;
 217         }
 218
 219         # final actions
 220
 221         if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
 222             $mark = $1;
 223             return undef;
 224         }
 225
 226         if ($rule =~ s/^-j (\S+)\s*$//) {
 227             return (0, $1);
 228         }
 229
 230         if ($rule =~ s/^-g (\S+)\s*$//) {
 231             return (1, $1);
 232         }
 233
 234         if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
 235             return undef;
 236         }
 237
 238         last;
 239     }
 240
 241     die "unable to parse rule: $rule";
 242 }
 243
 244 sub ruleset_simulate_chain {
 245     my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
 246
 247     add_trace("ENTER chain $chain\n");
 248
 249     my $counter = 0;
 250
 251     if ($chain eq 'PVEFW-Drop') {
 252         add_trace("LEAVE chain $chain\n");
 253         return ('DROP', $counter);
 254     }
 255     if ($chain eq 'PVEFW-reject') {
 256         add_trace("LEAVE chain $chain\n");
 257         return ('REJECT', $counter);
 258     }
 259
 260     if ($chain eq 'PVEFW-tcpflags') {
 261         add_trace("LEAVE chain $chain\n");
 262         return (undef, $counter);
 263     }
 264
 265     my $rules = $ruleset->{$chain} ||
 266         die "no such chain '$chain'";
 267
 268     foreach my $rule (@$rules) {
 269         $counter++;
 270         my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
 271         if (!defined($action)) {
 272             add_trace("SKIP: $rule\n");
 273             next;
 274         }
 275         add_trace("MATCH: $rule\n");
 276
 277         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 278             add_trace("TERMINATE chain $chain: $action\n");
 279             return ($action, $counter);
 280         } elsif ($action eq 'RETURN') {
 281             add_trace("RETURN FROM chain $chain\n");
 282             last;
 283         } else {
 284             if ($goto) {
 285                 add_trace("LEAVE chain $chain - goto $action\n");
 286                 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
 287                 #$chain = $action;
 288                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 289             } else {
 290                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
 291                 $counter += $ctr;
 292                 return ($act, $counter) if $act;
 293                 add_trace("CONTINUE chain $chain\n");
 294             }
 295         }
 296     }
 297
 298     add_trace("LEAVE chain $chain\n");
 299     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 300         return ('ACCEPT', $counter); # default policy
 301     }
 302
 303     return (undef, $counter);
 304 }
 305
 306 sub copy_packet {
 307     my ($pkg) = @_;
 308
 309     my $res = {};
 310
 311     while (my ($k,$v) = each %$pkg) {
 312         $res->{$k} = $v;
 313     }
 314
 315     return $res;
 316 }
 317
 318 # Try to simulate packet traversal inside kernel. This invokes iptable
 319 # checks several times.
 320 sub route_packet {
 321     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 322
 323     $pkg->{ipversion} = 4; # fixme: allow ipv6
 324
 325     my $route_state = $start_state;
 326
 327     my $physdev_in;
 328
 329     my $ipt_invocation_counter = 0;
 330     my $rule_check_counter = 0;
 331
 332     while ($route_state ne $target->{iface}) {
 333
 334         my $chain;
 335         my $next_route_state;
 336         my $next_physdev_in;
 337
 338         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 339         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 340
 341         if ($route_state eq 'from-bport') {
 342             $next_route_state = $from_info->{bridge} || die 'internal error';
 343             $next_physdev_in = $from_info->{iface} || die 'internal error';
 344         } elsif ($route_state eq 'host') {
 345
 346             if ($target->{type} eq 'bport') {
 347                 $pkg->{iface_in} = 'lo';
 348                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 349                 $chain = 'PVEFW-OUTPUT';
 350                 $next_route_state = $target->{iface} || die 'internal error';
 351             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 352                 $pkg->{iface_in} = 'lo';
 353                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 354                 $chain = 'PVEFW-OUTPUT';
 355                 $next_route_state = 'fwbr-in';
 356             } else {
 357                 die "implement me";
 358             }
 359
 360         } elsif ($route_state eq 'fwbr-out') {
 361
 362             $chain = 'PVEFW-FORWARD';
 363             $next_route_state = $from_info->{bridge} || die 'internal error';
 364             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 365             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 366             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 367             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 368             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 369
 370         } elsif ($route_state eq 'fwbr-in') {
 371
 372             $chain = 'PVEFW-FORWARD';
 373             $next_route_state = $target->{tapdev};
 374             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 375             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 376             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 377             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 378
 379         } elsif ($route_state =~ m/^vmbr\d+$/) {
 380
 381             die "missing physdev_in - internal error?" if !$physdev_in;
 382             $pkg->{physdev_in} = $physdev_in;
 383
 384             if ($target->{type} eq 'host') {
 385
 386                 $chain = 'PVEFW-INPUT';
 387                 $pkg->{iface_in} = $route_state;
 388                 $pkg->{iface_out} = 'lo';
 389                 $next_route_state = 'host';
 390
 391             } elsif ($target->{type} eq 'bport') {
 392
 393                 $chain = 'PVEFW-FORWARD';
 394                 $pkg->{iface_in} = $route_state;
 395                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 396                 # conditionally set physdev_out (same behavior as kernel)
 397                 if ($route_state eq $target->{bridge}) {
 398                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 399                 }
 400                 $next_route_state = $target->{iface};
 401
 402             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 403
 404                 $chain = 'PVEFW-FORWARD';
 405                 $pkg->{iface_in} = $route_state;
 406                 $pkg->{iface_out} = $target->{bridge};
 407                 # conditionally set physdev_out (same behavior as kernel)
 408                 if ($route_state eq $target->{bridge}) {
 409                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 410                 }
 411                 $next_route_state = 'fwbr-in';
 412
 413             } else {
 414                 die "implement me";
 415             }
 416
 417         } else {
 418             die "implement me $route_state";
 419         }
 420
 421         die "internal error" if !defined($next_route_state);
 422
 423         if ($chain) {
 424             add_trace("IPT check at $route_state (chain $chain)\n");
 425             add_trace(Dumper($pkg));
 426             $ipt_invocation_counter++;
 427             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
 428             $rule_check_counter += $ctr;
 429             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 430         }
 431
 432         $route_state = $next_route_state;
 433
 434         $physdev_in = $next_physdev_in;
 435     }
 436
 437     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 438 }
 439
 440 sub extract_ct_info {
 441     my ($vmdata, $vmid, $netnum) = @_;
 442
 443     my $info = { type => 'ct', vmid => $vmid };
 444
 445     my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
 446     my $net = PVE::LXC::parse_lxc_network($conf->{"net$netnum"});
 447     $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
 448     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 449     $info->{fwbr} = "fwbr${vmid}i$netnum";
 450     $info->{tapdev} = "veth${vmid}i$netnum";
 451     $info->{fwln} = "fwln${vmid}i$netnum";
 452     $info->{fwpr} = "fwpr${vmid}p$netnum";
 453     $info->{ip_address} = $net->{ip} || die "unable to get ip address";
 454
 455     return $info;
 456 }
 457
 458 sub extract_vm_info {
 459     my ($vmdata, $vmid, $netnum) = @_;
 460
 461     my $info = { type => 'vm', vmid => $vmid };
 462
 463     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 464     my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
 465     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 466     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 467     $info->{fwbr} = "fwbr${vmid}i$netnum";
 468     $info->{tapdev} = "tap${vmid}i$netnum";
 469     $info->{fwln} = "fwln${vmid}i$netnum";
 470     $info->{fwpr} = "fwpr${vmid}p$netnum";
 471
 472     return $info;
 473 }
 474
 475 sub simulate_firewall {
 476     my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
 477
 478     my $from = $test->{from} || die "missing 'from' field";
 479     my $to = $test->{to} || die "missing 'to' field";
 480     my $action = $test->{action} || die "missing 'action'";
 481
 482     my $testid = $test->{id};
 483
 484     die "from/to needs to be different" if $from eq $to;
 485
 486     my $pkg = {
 487         proto => 'tcp',
 488         sport => undef,
 489         dport => undef,
 490         source => undef,
 491         dest => undef,
 492         srctype => 'UNICAST',
 493         dsttype => 'UNICAST',
 494     };
 495
 496     while (my ($k,$v) = each %$test) {
 497         next if $k eq 'from';
 498         next if $k eq 'to';
 499         next if $k eq 'action';
 500         next if $k eq 'id';
 501         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 502         $pkg->{$k} = $v;
 503     }
 504
 505     my $from_info = {};
 506
 507     my $start_state;
 508
 509     if ($from eq 'host') {
 510         $from_info->{type} = 'host';
 511         $start_state = 'host';
 512         $pkg->{source} = $host_ip if !defined($pkg->{source});
 513     } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
 514         $from_info->{type} = 'bport';
 515         $from_info->{bridge} = $1;
 516         $from_info->{iface} = $2;
 517         $start_state = 'from-bport';
 518     } elsif ($from eq 'outside') {
 519         $from_info->{type} = 'bport';
 520         $from_info->{bridge} = 'vmbr0';
 521         $from_info->{iface} = 'eth0';
 522         $start_state = 'from-bport';
 523     } elsif ($from eq 'nfvm') {
 524         $from_info->{type} = 'bport';
 525         $from_info->{bridge} = 'vmbr0';
 526         $from_info->{iface} = 'tapXYZ';
 527         $start_state = 'from-bport';
 528     } elsif ($from =~ m/^ct(\d+)$/) {
 529         my $vmid = $1;
 530         $from_info = extract_ct_info($vmdata, $vmid, 0);
 531         $start_state = 'fwbr-out';
 532         $pkg->{mac_source} = $from_info->{macaddr};
 533     } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
 534         my $vmid = $1;
 535         my $netnum = $3 || 0;
 536         $from_info = extract_vm_info($vmdata, $vmid, $netnum);
 537         $start_state = 'fwbr-out';
 538         $pkg->{mac_source} = $from_info->{macaddr};
 539     } else {
 540         die "unable to parse \"from => '$from'\"\n";
 541     }
 542
 543     my $target;
 544
 545     if ($to eq 'host') {
 546         $target->{type} = 'host';
 547         $target->{iface} = 'host';
 548         $pkg->{dest} = $host_ip if !defined($pkg->{dest});
 549     } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
 550         $target->{type} = 'bport';
 551         $target->{bridge} = $1;
 552         $target->{iface} = $2;
 553     } elsif ($to eq 'outside') {
 554         $target->{type} = 'bport';
 555         $target->{bridge} = 'vmbr0';
 556         $target->{iface} = 'eth0';
 557      } elsif ($to eq 'nfvm') {
 558         $target->{type} = 'bport';
 559         $target->{bridge} = 'vmbr0';
 560         $target->{iface} = 'tapXYZ';
 561     } elsif ($to =~ m/^ct(\d+)$/) {
 562         my $vmid = $1;
 563         $target = extract_ct_info($vmdata, $vmid, 0);
 564         $target->{iface} = $target->{tapdev};
 565    } elsif ($to =~ m/^vm(\d+)$/) {
 566         my $vmid = $1;
 567         $target = extract_vm_info($vmdata, $vmid, 0);
 568         $target->{iface} = $target->{tapdev};
 569     } else {
 570         die "unable to parse \"to => '$to'\"\n";
 571     }
 572
 573     $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
 574     $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
 575
 576     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 577                                        $from_info, $target, $start_state);
 578
 579     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 580
 581     return $res if $action eq 'QUERY';
 582
 583     die "test failed ($res != $action)\n" if $action ne $res;
 584
 585     return undef;
 586 }
 587
 588 1;
 589