src/PVE/FirewallSimulator.pm

   1 package PVE::FirewallSimulator;
   2
   3 use strict;
   4 use warnings;
   5 use Data::Dumper;
   6 use PVE::Firewall;
   7 use File::Basename;
   8 use Net::IP;
   9
  10 my $mark;
  11 my $trace;
  12 my $debug = 0;
  13
  14 sub debug {
  15     my $new_value = shift;
  16
  17     $debug = $new_value if defined($new_value);
  18
  19     return $debug;
  20 }
  21
  22 sub reset_trace {
  23     $trace = '';
  24 }
  25
  26 sub get_trace {
  27     return $trace;
  28 }
  29
  30 sub add_trace {
  31     my ($text) = @_;
  32
  33     if ($debug) {
  34         print $text;
  35     } else {
  36         $trace .= $text;
  37     }
  38 }
  39
  40 sub nf_dev_match {
  41     my ($devre, $dev) = @_;
  42
  43     $devre =~ s/\+$/\.\*/;
  44     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  45 }
  46
  47 sub ipset_match {
  48     my ($ipsetname, $ipset, $ipaddr) = @_;
  49
  50     my $ip = Net::IP->new($ipaddr);
  51
  52     foreach my $entry (@$ipset) {
  53         next if $entry =~ m/^create/; # simply ignore
  54         if ($entry =~ m/add \S+ (\S+)$/) {
  55             my $test = Net::IP->new($1);
  56             if ($test->overlaps($ip)) {
  57                 add_trace("IPSET $ipsetname match $ipaddr\n");
  58                 return 1;
  59             }
  60         } else {
  61             die "implement me";
  62         }
  63     }
  64
  65     return 0;
  66 }
  67
  68 sub rule_match {
  69     my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
  70
  71     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
  72
  73     while (length($rule)) {
  74
  75         if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
  76             my $cstate = $1;
  77
  78             return undef if $cstate eq 'INVALID'; # no match
  79             return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
  80
  81             next if $cstate =~ m/NEW/;
  82
  83             die "please implement cstate test '$cstate'";
  84         }
  85
  86         if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
  87             my $atype = $1;
  88             die "missing srctype" if !$pkg->{srctype};
  89             return undef if $atype ne $pkg->{srctype};
  90         }
  91
  92         if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
  93             my $atype = $1;
  94             die "missing dsttype" if !$pkg->{dsttype};
  95             return undef if $atype ne $pkg->{dsttype};
  96         }
  97
  98         if ($rule =~ s/^-i (\S+)\s*//) {
  99             my $devre = $1;
 100             die "missing iface_in" if !$pkg->{iface_in};
 101             return undef if !nf_dev_match($devre, $pkg->{iface_in});
 102             next;
 103         }
 104
 105         if ($rule =~ s/^-o (\S+)\s*//) {
 106             my $devre = $1;
 107             die "missing iface_out" if !$pkg->{iface_out};
 108             return undef if !nf_dev_match($devre, $pkg->{iface_out});
 109             next;
 110         }
 111
 112         if ($rule =~ s/^-p (tcp|udp)\s*//) {
 113             die "missing proto" if !$pkg->{proto};
 114             return undef if $pkg->{proto} ne $1; # no match
 115             next;
 116         }
 117
 118         if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
 119             die "missing dport" if !$pkg->{dport};
 120             return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
 121             next;
 122         }
 123
 124         if ($rule =~ s/^--dport (\d+)\s*//) {
 125             die "missing dport" if !$pkg->{dport};
 126             return undef if $pkg->{dport} != $1; # no match
 127             next;
 128         }
 129
 130         if ($rule =~ s/^-s (\S+)\s*//) {
 131             die "missing source" if !$pkg->{source};
 132             my $ip = Net::IP->new($1);
 133             return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
 134             next;
 135         }
 136
 137         if ($rule =~ s/^-d (\S+)\s*//) {
 138             die "missing destination" if !$pkg->{dest};
 139             my $ip = Net::IP->new($1);
 140             return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
 141             next;
 142         }
 143
 144         if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
 145             die "missing source" if !$pkg->{source};
 146             my $ipset = $ipset_ruleset->{$1};
 147             die "no such ip set '$1'" if !$ipset;
 148             return undef if !ipset_match($1, $ipset, $pkg->{source});
 149             next;
 150         }
 151
 152         if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
 153             die "missing destination" if !$pkg->{dest};
 154             my $ipset = $ipset_ruleset->{$1};
 155             die "no such ip set '$1'" if !$ipset;
 156             return undef if !ipset_match($1, $ipset, $pkg->{dest});
 157             next;
 158         }
 159
 160         if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
 161             die "missing source mac" if !$pkg->{mac_source};
 162             return undef if $pkg->{mac_source} eq $1; # no match
 163             next;
 164         }
 165
 166         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
 167             my $devre = $1;
 168             return undef if !$pkg->{physdev_in};
 169             return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 170             next;
 171         }
 172
 173         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 174             my $devre = $1;
 175             return undef if !$pkg->{physdev_out};
 176             return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 177             next;
 178         }
 179
 180         if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
 181             return undef if !defined($mark) || $mark != $1;
 182             next;
 183         }
 184
 185         # final actions
 186
 187         if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
 188             $mark = $1;
 189             return undef;
 190         }
 191
 192         if ($rule =~ s/^-j (\S+)\s*$//) {
 193             return (0, $1);
 194         }
 195
 196         if ($rule =~ s/^-g (\S+)\s*$//) {
 197             return (1, $1);
 198         }
 199
 200         if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
 201             return undef;
 202         }
 203
 204         last;
 205     }
 206
 207     die "unable to parse rule: $rule";
 208 }
 209
 210 sub ruleset_simulate_chain {
 211     my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
 212
 213     add_trace("ENTER chain $chain\n");
 214
 215     my $counter = 0;
 216
 217     if ($chain eq 'PVEFW-Drop') {
 218         add_trace("LEAVE chain $chain\n");
 219         return ('DROP', $counter);
 220     }
 221     if ($chain eq 'PVEFW-reject') {
 222         add_trace("LEAVE chain $chain\n");
 223         return ('REJECT', $counter);
 224     }
 225
 226     if ($chain eq 'PVEFW-tcpflags') {
 227         add_trace("LEAVE chain $chain\n");
 228         return (undef, $counter);
 229     }
 230
 231     my $rules = $ruleset->{$chain} ||
 232         die "no such chain '$chain'";
 233
 234     foreach my $rule (@$rules) {
 235         $counter++;
 236         my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
 237         if (!defined($action)) {
 238             add_trace("SKIP: $rule\n");
 239             next;
 240         }
 241         add_trace("MATCH: $rule\n");
 242
 243         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 244             add_trace("TERMINATE chain $chain: $action\n");
 245             return ($action, $counter);
 246         } elsif ($action eq 'RETURN') {
 247             add_trace("RETURN FROM chain $chain\n");
 248             last;
 249         } else {
 250             if ($goto) {
 251                 add_trace("LEAVE chain $chain - goto $action\n");
 252                 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
 253                 #$chain = $action;
 254                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 255             } else {
 256                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
 257                 $counter += $ctr;
 258                 return ($act, $counter) if $act;
 259                 add_trace("CONTINUE chain $chain\n");
 260             }
 261         }
 262     }
 263
 264     add_trace("LEAVE chain $chain\n");
 265     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 266         return ('ACCEPT', $counter); # default policy
 267     }
 268
 269     return (undef, $counter);
 270 }
 271
 272 sub copy_packet {
 273     my ($pkg) = @_;
 274
 275     my $res = {};
 276
 277     while (my ($k,$v) = each %$pkg) {
 278         $res->{$k} = $v;
 279     }
 280
 281     return $res;
 282 }
 283
 284 # Try to simulate packet traversal inside kernel. This invokes iptable
 285 # checks several times.
 286 sub route_packet {
 287     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 288
 289     my $route_state = $start_state;
 290
 291     my $physdev_in;
 292
 293     my $ipt_invocation_counter = 0;
 294     my $rule_check_counter = 0;
 295
 296     while ($route_state ne $target->{iface}) {
 297
 298         my $chain;
 299         my $next_route_state;
 300         my $next_physdev_in;
 301
 302         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 303         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 304
 305         if ($route_state eq 'from-bport') {
 306             $next_route_state = $from_info->{bridge} || die 'internal error';
 307             $next_physdev_in = $from_info->{iface} || die 'internal error';
 308         } elsif ($route_state eq 'host') {
 309
 310             if ($target->{type} eq 'bport') {
 311                 $pkg->{iface_in} = 'lo';
 312                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 313                 $chain = 'PVEFW-OUTPUT';
 314                 $next_route_state = $target->{iface} || die 'internal error';
 315             } elsif ($target->{type} eq 'ct') {
 316                 $pkg->{iface_in} = 'lo';
 317                 $pkg->{iface_out} = 'venet0';
 318                 $chain = 'PVEFW-OUTPUT';
 319                 $next_route_state = 'venet-in';
 320             } elsif ($target->{type} eq 'vm') {
 321                 $pkg->{iface_in} = 'lo';
 322                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 323                 $chain = 'PVEFW-OUTPUT';
 324                 $next_route_state = 'fwbr-in';
 325             } else {
 326                 die "implement me";
 327             }
 328
 329         } elsif ($route_state eq 'venet-out') {
 330
 331             if ($target->{type} eq 'host') {
 332
 333                 $chain = 'PVEFW-INPUT';
 334                 $pkg->{iface_in} = 'venet0';
 335                 $pkg->{iface_out} = 'lo';
 336                 $next_route_state = 'host';
 337
 338             } elsif ($target->{type} eq 'bport') {
 339
 340                 $chain = 'PVEFW-FORWARD';
 341                 $pkg->{iface_in} = 'venet0';
 342                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 343                 $next_route_state = $target->{iface} || die 'internal error';
 344
 345             } elsif ($target->{type} eq 'vm') {
 346
 347                 $chain = 'PVEFW-FORWARD';
 348                 $pkg->{iface_in} = 'venet0';
 349                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 350                 $next_route_state = 'fwbr-in';
 351
 352             } elsif ($target->{type} eq 'ct') {
 353
 354                 $chain = 'PVEFW-FORWARD';
 355                 $pkg->{iface_in} = 'venet0';
 356                 $pkg->{iface_out} = 'venet0';
 357                 $next_route_state = 'venet-in';
 358
 359             } else {
 360                 die "implement me";
 361             }
 362
 363         } elsif ($route_state eq 'fwbr-out') {
 364
 365             $chain = 'PVEFW-FORWARD';
 366             $next_route_state = $from_info->{bridge} || die 'internal error';
 367             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 368             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 369             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 370             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 371             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 372
 373         } elsif ($route_state eq 'fwbr-in') {
 374
 375             $chain = 'PVEFW-FORWARD';
 376             $next_route_state = $target->{tapdev};
 377             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 378             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 379             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 380             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 381
 382         } elsif ($route_state =~ m/^vmbr\d+$/) {
 383
 384             die "missing physdev_in - internal error?" if !$physdev_in;
 385             $pkg->{physdev_in} = $physdev_in;
 386
 387             if ($target->{type} eq 'host') {
 388
 389                 $chain = 'PVEFW-INPUT';
 390                 $pkg->{iface_in} = $route_state;
 391                 $pkg->{iface_out} = 'lo';
 392                 $next_route_state = 'host';
 393
 394             } elsif ($target->{type} eq 'bport') {
 395
 396                 $chain = 'PVEFW-FORWARD';
 397                 $pkg->{iface_in} = $route_state;
 398                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 399                 # conditionally set physdev_out (same behavior as kernel)
 400                 if ($route_state eq $target->{bridge}) {
 401                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 402                 }
 403                 $next_route_state = $target->{iface};
 404
 405             } elsif ($target->{type} eq 'ct') {
 406
 407                 $chain = 'PVEFW-FORWARD';
 408                 $pkg->{iface_in} = $route_state;
 409                 $pkg->{iface_out} = 'venet0';
 410                 $next_route_state = 'venet-in';
 411
 412             } elsif ($target->{type} eq 'vm') {
 413
 414                 $chain = 'PVEFW-FORWARD';
 415                 $pkg->{iface_in} = $route_state;
 416                 $pkg->{iface_out} = $target->{bridge};
 417                 # conditionally set physdev_out (same behavior as kernel)
 418                 if ($route_state eq $target->{bridge}) {
 419                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 420                 }
 421                 $next_route_state = 'fwbr-in';
 422
 423             } else {
 424                 die "implement me";
 425             }
 426
 427         } else {
 428             die "implement me $route_state";
 429         }
 430
 431         die "internal error" if !defined($next_route_state);
 432
 433         if ($chain) {
 434             add_trace("IPT check at $route_state (chain $chain)\n");
 435             add_trace(Dumper($pkg));
 436             $ipt_invocation_counter++;
 437             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
 438             $rule_check_counter += $ctr;
 439             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 440         }
 441
 442         $route_state = $next_route_state;
 443
 444         $physdev_in = $next_physdev_in;
 445     }
 446
 447     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 448 }
 449
 450 sub extract_ct_info {
 451     my ($vmdata, $vmid) = @_;
 452
 453     my $info = { type => 'ct', vmid => $vmid };
 454
 455     my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
 456     if ($conf->{ip_address}) {
 457         $info->{ip_address} = $conf->{ip_address}->{value};
 458     } else {
 459         die "implement me";
 460     }
 461     return $info;
 462 }
 463
 464 sub extract_vm_info {
 465     my ($vmdata, $vmid) = @_;
 466
 467     my $info = { type => 'vm', vmid => $vmid };
 468
 469     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 470     my $net = PVE::QemuServer::parse_net($conf->{net0});
 471     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 472     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 473     $info->{fwbr} = "fwbr${vmid}i0";
 474     $info->{tapdev} = "tap${vmid}i0";
 475     $info->{fwln} = "fwln${vmid}i0";
 476     $info->{fwpr} = "fwpr${vmid}p0";
 477
 478     return $info;
 479 }
 480
 481 sub simulate_firewall {
 482     my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
 483
 484     my $from = $test->{from} || die "missing 'from' field";
 485     my $to = $test->{to} || die "missing 'to' field";
 486     my $action = $test->{action} || die "missing 'action'";
 487
 488     my $testid = $test->{id};
 489
 490     die "from/to needs to be different" if $from eq $to;
 491
 492     my $pkg = {
 493         proto => 'tcp',
 494         sport => undef,
 495         dport => undef,
 496         source => undef,
 497         dest => undef,
 498         srctype => 'UNICAST',
 499         dsttype => 'UNICAST',
 500     };
 501
 502     while (my ($k,$v) = each %$test) {
 503         next if $k eq 'from';
 504         next if $k eq 'to';
 505         next if $k eq 'action';
 506         next if $k eq 'id';
 507         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 508         $pkg->{$k} = $v;
 509     }
 510
 511     my $from_info = {};
 512
 513     my $start_state;
 514
 515     if ($from eq 'host') {
 516         $from_info->{type} = 'host';
 517         $start_state = 'host';
 518         $pkg->{source} = $host_ip if !defined($pkg->{source});
 519     } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
 520         $from_info->{type} = 'bport';
 521         $from_info->{bridge} = $1;
 522         $from_info->{iface} = $2;
 523         $start_state = 'from-bport';
 524     } elsif ($from eq 'outside') {
 525         $from_info->{type} = 'bport';
 526         $from_info->{bridge} = 'vmbr0';
 527         $from_info->{iface} = 'eth0';
 528         $start_state = 'from-bport';
 529     } elsif ($from eq 'nfvm') {
 530         $from_info->{type} = 'bport';
 531         $from_info->{bridge} = 'vmbr0';
 532         $from_info->{iface} = 'tapXYZ';
 533         $start_state = 'from-bport';
 534     } elsif ($from =~ m/^ct(\d+)$/) {
 535         my $vmid = $1;
 536         $from_info = extract_ct_info($vmdata, $vmid);
 537         if ($from_info->{ip_address}) {
 538             $pkg->{source} = $from_info->{ip_address} if !defined($pkg->{source});
 539             $start_state = 'venet-out';
 540         } else {
 541             die "implement me";
 542         }
 543     } elsif ($from =~ m/^vm(\d+)$/) {
 544         my $vmid = $1;
 545         $from_info = extract_vm_info($vmdata, $vmid);
 546         $start_state = 'fwbr-out';
 547         $pkg->{mac_source} = $from_info->{macaddr};
 548     } else {
 549         die "unable to parse \"from => '$from'\"\n";
 550     }
 551
 552     my $target;
 553
 554     if ($to eq 'host') {
 555         $target->{type} = 'host';
 556         $target->{iface} = 'host';
 557         $pkg->{dest} = $host_ip if !defined($pkg->{dest});
 558     } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
 559         $target->{type} = 'bport';
 560         $target->{bridge} = $1;
 561         $target->{iface} = $2;
 562     } elsif ($to eq 'outside') {
 563         $target->{type} = 'bport';
 564         $target->{bridge} = 'vmbr0';
 565         $target->{iface} = 'eth0';
 566      } elsif ($to eq 'nfvm') {
 567         $target->{type} = 'bport';
 568         $target->{bridge} = 'vmbr0';
 569         $target->{iface} = 'tapXYZ';
 570     } elsif ($to =~ m/^ct(\d+)$/) {
 571         my $vmid = $1;
 572         $target = extract_ct_info($vmdata, $vmid);
 573         $target->{iface} = 'venet-in';
 574
 575         if ($target->{ip_address}) {
 576             $pkg->{dest} = $target->{ip_address};
 577         } else {
 578             die "implement me";
 579         }
 580    } elsif ($to =~ m/^vm(\d+)$/) {
 581         my $vmid = $1;
 582         $target = extract_vm_info($vmdata, $vmid);
 583         $target->{iface} = $target->{tapdev};
 584     } else {
 585         die "unable to parse \"to => '$to'\"\n";
 586     }
 587
 588     $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
 589     $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
 590
 591     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 592                                        $from_info, $target, $start_state);
 593
 594     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 595
 596     return $res if $action eq 'QUERY';
 597
 598     die "test failed ($res != $action)\n" if $action ne $res;
 599
 600     return undef;
 601 }
 602
 603 1;
 604