src/PVE/FirewallSimulator.pm

   1 package PVE::FirewallSimulator;
   2
   3 use strict;
   4 use warnings;
   5 use Data::Dumper;
   6 use PVE::Firewall;
   7 use File::Basename;
   8 use Net::IP;
   9 use PVE::LXC;
  10 use PVE::QemuServer;
  11
  12 my $mark;
  13 my $trace;
  14 my $debug = 0;
  15
  16 my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
  17
  18 sub debug {
  19     my $new_value = shift;
  20
  21     $debug = $new_value if defined($new_value);
  22
  23     return $debug;
  24 }
  25
  26 sub reset_trace {
  27     $trace = '';
  28 }
  29
  30 sub get_trace {
  31     return $trace;
  32 }
  33
  34 sub add_trace {
  35     my ($text) = @_;
  36
  37     if ($debug) {
  38         print $text;
  39     } else {
  40         $trace .= $text;
  41     }
  42 }
  43
  44 $SIG{'__WARN__'} = sub {
  45     my $err = $@;
  46     my $t = $_[0];
  47     chomp $t;
  48     add_trace("$t\n");
  49     $@ = $err;
  50 };
  51
  52 sub nf_dev_match {
  53     my ($devre, $dev) = @_;
  54
  55     $devre =~ s/\+$/\.\*/;
  56     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  57 }
  58
  59 sub ipset_match {
  60     my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
  61
  62     my $ipset = $ipset_ruleset->{$ipsetname};
  63     die "no such ipset '$ipsetname'" if !$ipset;
  64
  65     my $ip = Net::IP->new($ipaddr);
  66
  67     my $first = $ipset->[0];
  68     if ($first =~ m/^create\s+\S+\s+list:/) {
  69         foreach my $entry (@$ipset) {
  70             next if $entry =~ m/^create/; # simply ignore
  71             if ($entry =~ m/add \S+ (\S+)$/) {
  72                 return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
  73             } else {
  74                 die "implement me";
  75             }
  76         }
  77         return 0;
  78     } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
  79         foreach my $entry (@$ipset) {
  80             next if $entry =~ m/^create/; # simply ignore
  81             if ($entry =~ m/add \S+ (\S+)$/) {
  82                 my $test = Net::IP->new($1);
  83                 if ($test->overlaps($ip)) {
  84                     add_trace("IPSET $ipsetname match $ipaddr\n");
  85                     return 1;
  86                 }
  87             } else {
  88                 die "implement me";
  89             }
  90         }
  91         return 0;
  92     } else {
  93         die "unknown ipset type '$first' - not implemented\n";
  94     }
  95
  96     return 0;
  97 }
  98
  99 sub rule_match {
 100     my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
 101
 102     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
 103
 104     while (length($rule)) {
 105
 106         if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
 107             my $cstate = $1;
 108
 109             return undef if $cstate eq 'INVALID'; # no match
 110             return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
 111
 112             next if $cstate =~ m/NEW/;
 113
 114             die "cstate test '$cstate' not implemented\n";
 115         }
 116
 117         if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
 118             my $atype = $1;
 119             die "missing source address type (srctype)\n"
 120                 if !$pkg->{srctype};
 121             return undef if $atype ne $pkg->{srctype};
 122         }
 123
 124         if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
 125             my $atype = $1;
 126             die "missing destination address type (dsttype)\n"
 127                 if !$pkg->{dsttype};
 128             return undef if $atype ne $pkg->{dsttype};
 129         }
 130
 131         if ($rule =~ s/^-i (\S+)\s*//) {
 132             my $devre = $1;
 133             die "missing interface (iface_in)\n" if !$pkg->{iface_in};
 134             return undef if !nf_dev_match($devre, $pkg->{iface_in});
 135             next;
 136         }
 137
 138         if ($rule =~ s/^-o (\S+)\s*//) {
 139             my $devre = $1;
 140             die "missing interface (iface_out)\n" if !$pkg->{iface_out};
 141             return undef if !nf_dev_match($devre, $pkg->{iface_out});
 142             next;
 143         }
 144
 145         if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
 146             die "missing proto" if !$pkg->{proto};
 147             return undef if $pkg->{proto} ne $1; # no match
 148             next;
 149         }
 150
 151         if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
 152             die "missing dport" if !$pkg->{dport};
 153             return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
 154             next;
 155         }
 156
 157         if ($rule =~ s/^--dport (\d+)\s*//) {
 158             die "missing dport" if !$pkg->{dport};
 159             return undef if $pkg->{dport} != $1; # no match
 160             next;
 161         }
 162
 163         if ($rule =~ s/^-s (\S+)\s*//) {
 164             die "missing source" if !$pkg->{source};
 165             my $ip = Net::IP->new($1);
 166             return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
 167             next;
 168         }
 169
 170         if ($rule =~ s/^-d (\S+)\s*//) {
 171             die "missing destination" if !$pkg->{dest};
 172             my $ip = Net::IP->new($1);
 173             return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
 174             next;
 175         }
 176
 177         if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
 178             die "missing source" if !$pkg->{source};
 179             my $neg = $1;
 180             my $ipset_name = $2;
 181             if ($neg) {
 182                 return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 183             } else {
 184                 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 185             }
 186             next;
 187         }
 188
 189         if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
 190             die "missing destination" if !$pkg->{dest};
 191             my $ipset_name = $1;
 192             return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
 193             next;
 194         }
 195
 196         if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
 197             die "missing source mac" if !$pkg->{mac_source};
 198             return undef if $pkg->{mac_source} eq $1; # no match
 199             next;
 200         }
 201
 202         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
 203             my $devre = $1;
 204             return undef if !$pkg->{physdev_in};
 205             return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 206             next;
 207         }
 208
 209         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 210             my $devre = $1;
 211             return undef if !$pkg->{physdev_out};
 212             return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 213             next;
 214         }
 215
 216         if ($rule =~ s@^-m mark --mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*@@) {
 217             my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
 218             return undef if !defined($mark) || ($mark & $mask) != $value;
 219             next;
 220         }
 221
 222         # final actions
 223
 224         if ($rule =~ s@^-j MARK --set-mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*$@@) {
 225             my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
 226             $mark = ($mark & ~$mask) | $value;
 227             return undef;
 228         }
 229
 230         if ($rule =~ s/^-j (\S+)\s*$//) {
 231             return (0, $1);
 232         }
 233
 234         if ($rule =~ s/^-g (\S+)\s*$//) {
 235             return (1, $1);
 236         }
 237
 238         if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
 239             return undef;
 240         }
 241
 242         last;
 243     }
 244
 245     die "unable to parse rule: $rule";
 246 }
 247
 248 sub ruleset_simulate_chain {
 249     my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
 250
 251     add_trace("ENTER chain $chain\n");
 252
 253     my $counter = 0;
 254
 255     if ($chain eq 'PVEFW-Drop') {
 256         add_trace("LEAVE chain $chain\n");
 257         return ('DROP', $counter);
 258     }
 259     if ($chain eq 'PVEFW-reject') {
 260         add_trace("LEAVE chain $chain\n");
 261         return ('REJECT', $counter);
 262     }
 263
 264     if ($chain eq 'PVEFW-tcpflags') {
 265         add_trace("LEAVE chain $chain\n");
 266         return (undef, $counter);
 267     }
 268
 269     my $rules = $ruleset->{$chain} ||
 270         die "no such chain '$chain'";
 271
 272     foreach my $rule (@$rules) {
 273         $counter++;
 274         my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
 275         if (!defined($action)) {
 276             add_trace("SKIP: $rule\n");
 277             next;
 278         }
 279         add_trace("MATCH: $rule\n");
 280
 281         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 282             add_trace("TERMINATE chain $chain: $action\n");
 283             return ($action, $counter);
 284         } elsif ($action eq 'RETURN') {
 285             add_trace("RETURN FROM chain $chain\n");
 286             last;
 287         } else {
 288             if ($goto) {
 289                 add_trace("LEAVE chain $chain - goto $action\n");
 290                 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
 291                 #$chain = $action;
 292                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 293             } else {
 294                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
 295                 $counter += $ctr;
 296                 return ($act, $counter) if $act;
 297                 add_trace("CONTINUE chain $chain\n");
 298             }
 299         }
 300     }
 301
 302     add_trace("LEAVE chain $chain\n");
 303     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 304         return ('ACCEPT', $counter); # default policy
 305     }
 306
 307     return (undef, $counter);
 308 }
 309
 310 sub copy_packet {
 311     my ($pkg) = @_;
 312
 313     my $res = {};
 314
 315     while (my ($k,$v) = each %$pkg) {
 316         $res->{$k} = $v;
 317     }
 318
 319     return $res;
 320 }
 321
 322 # Try to simulate packet traversal inside kernel. This invokes iptable
 323 # checks several times.
 324 sub route_packet {
 325     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 326
 327     $pkg->{ipversion} = 4; # fixme: allow ipv6
 328
 329     my $route_state = $start_state;
 330
 331     my $physdev_in;
 332
 333     my $ipt_invocation_counter = 0;
 334     my $rule_check_counter = 0;
 335
 336     while ($route_state ne $target->{iface}) {
 337
 338         my $chain;
 339         my $next_route_state;
 340         my $next_physdev_in;
 341
 342         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 343         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 344
 345         if ($route_state eq 'from-bport') {
 346             $next_route_state = $from_info->{bridge} || die 'internal error';
 347             $next_physdev_in = $from_info->{iface} || die 'internal error';
 348         } elsif ($route_state eq 'host') {
 349
 350             if ($target->{type} eq 'bport') {
 351                 $pkg->{iface_in} = 'lo';
 352                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 353                 $chain = 'PVEFW-OUTPUT';
 354                 $next_route_state = $target->{iface} || die 'internal error';
 355             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 356                 $pkg->{iface_in} = 'lo';
 357                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 358                 $chain = 'PVEFW-OUTPUT';
 359                 $next_route_state = 'fwbr-in';
 360             } else {
 361                 die "implement me";
 362             }
 363
 364         } elsif ($route_state eq 'fwbr-out') {
 365
 366             $chain = 'PVEFW-FORWARD';
 367             $next_route_state = $from_info->{bridge} || die 'internal error';
 368             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 369             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 370             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 371             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 372             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 373
 374         } elsif ($route_state eq 'fwbr-in') {
 375
 376             $chain = 'PVEFW-FORWARD';
 377             $next_route_state = $target->{tapdev};
 378             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 379             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 380             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 381             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 382
 383         } elsif ($route_state =~ m/^vmbr\d+$/) {
 384
 385             die "missing physdev_in - internal error?" if !$physdev_in;
 386             $pkg->{physdev_in} = $physdev_in;
 387
 388             if ($target->{type} eq 'host') {
 389
 390                 $chain = 'PVEFW-INPUT';
 391                 $pkg->{iface_in} = $route_state;
 392                 $pkg->{iface_out} = 'lo';
 393                 $next_route_state = 'host';
 394
 395             } elsif ($target->{type} eq 'bport') {
 396
 397                 $chain = 'PVEFW-FORWARD';
 398                 $pkg->{iface_in} = $route_state;
 399                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 400                 # conditionally set physdev_out (same behavior as kernel)
 401                 if ($route_state eq $target->{bridge}) {
 402                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 403                 }
 404                 $next_route_state = $target->{iface};
 405
 406             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 407
 408                 $chain = 'PVEFW-FORWARD';
 409                 $pkg->{iface_in} = $route_state;
 410                 $pkg->{iface_out} = $target->{bridge};
 411                 # conditionally set physdev_out (same behavior as kernel)
 412                 if ($route_state eq $target->{bridge}) {
 413                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 414                 }
 415                 $next_route_state = 'fwbr-in';
 416
 417             } else {
 418                 die "implement me";
 419             }
 420
 421         } else {
 422             die "implement me $route_state";
 423         }
 424
 425         die "internal error" if !defined($next_route_state);
 426
 427         if ($chain) {
 428             add_trace("IPT check at $route_state (chain $chain)\n");
 429             add_trace(Dumper($pkg));
 430             $ipt_invocation_counter++;
 431             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
 432             $rule_check_counter += $ctr;
 433             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 434         }
 435
 436         $route_state = $next_route_state;
 437
 438         $physdev_in = $next_physdev_in;
 439     }
 440
 441     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 442 }
 443
 444 sub extract_ct_info {
 445     my ($vmdata, $vmid, $netnum) = @_;
 446
 447     my $info = { type => 'ct', vmid => $vmid };
 448
 449     my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
 450     my $net = PVE::LXC::Config->parse_lxc_network($conf->{"net$netnum"});
 451     $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
 452     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 453     $info->{fwbr} = "fwbr${vmid}i$netnum";
 454     $info->{tapdev} = "veth${vmid}i$netnum";
 455     $info->{fwln} = "fwln${vmid}i$netnum";
 456     $info->{fwpr} = "fwpr${vmid}p$netnum";
 457     $info->{ip_address} = $net->{ip} || die "unable to get ip address";
 458
 459     return $info;
 460 }
 461
 462 sub extract_vm_info {
 463     my ($vmdata, $vmid, $netnum) = @_;
 464
 465     my $info = { type => 'vm', vmid => $vmid };
 466
 467     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 468     my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
 469     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 470     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 471     $info->{fwbr} = "fwbr${vmid}i$netnum";
 472     $info->{tapdev} = "tap${vmid}i$netnum";
 473     $info->{fwln} = "fwln${vmid}i$netnum";
 474     $info->{fwpr} = "fwpr${vmid}p$netnum";
 475
 476     return $info;
 477 }
 478
 479 sub simulate_firewall {
 480     my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
 481
 482     my $from = $test->{from} || die "missing 'from' field";
 483     my $to = $test->{to} || die "missing 'to' field";
 484     my $action = $test->{action} || die "missing 'action'";
 485
 486     my $testid = $test->{id};
 487
 488     die "from/to needs to be different" if $from eq $to;
 489
 490     my $pkg = {
 491         proto => 'tcp',
 492         sport => undef,
 493         dport => undef,
 494         source => undef,
 495         dest => undef,
 496         srctype => 'UNICAST',
 497         dsttype => 'UNICAST',
 498     };
 499
 500     while (my ($k,$v) = each %$test) {
 501         next if $k eq 'from';
 502         next if $k eq 'to';
 503         next if $k eq 'action';
 504         next if $k eq 'id';
 505         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 506         $pkg->{$k} = $v;
 507     }
 508
 509     my $from_info = {};
 510
 511     my $start_state;
 512
 513     if ($from eq 'host') {
 514         $from_info->{type} = 'host';
 515         $start_state = 'host';
 516         $pkg->{source} = $host_ip if !defined($pkg->{source});
 517     } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
 518         $from_info->{type} = 'bport';
 519         $from_info->{bridge} = $1;
 520         $from_info->{iface} = $2;
 521         $start_state = 'from-bport';
 522     } elsif ($from eq 'outside') {
 523         $from_info->{type} = 'bport';
 524         $from_info->{bridge} = 'vmbr0';
 525         $from_info->{iface} = 'eth0';
 526         $start_state = 'from-bport';
 527     } elsif ($from eq 'nfvm') {
 528         $from_info->{type} = 'bport';
 529         $from_info->{bridge} = 'vmbr0';
 530         $from_info->{iface} = 'tapXYZ';
 531         $start_state = 'from-bport';
 532     } elsif ($from =~ m/^ct(\d+)$/) {
 533         my $vmid = $1;
 534         $from_info = extract_ct_info($vmdata, $vmid, 0);
 535         $start_state = 'fwbr-out';
 536         $pkg->{mac_source} = $from_info->{macaddr};
 537     } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
 538         my $vmid = $1;
 539         my $netnum = $3 || 0;
 540         $from_info = extract_vm_info($vmdata, $vmid, $netnum);
 541         $start_state = 'fwbr-out';
 542         $pkg->{mac_source} = $from_info->{macaddr};
 543     } else {
 544         die "unable to parse \"from => '$from'\"\n";
 545     }
 546
 547     my $target;
 548
 549     if ($to eq 'host') {
 550         $target->{type} = 'host';
 551         $target->{iface} = 'host';
 552         $pkg->{dest} = $host_ip if !defined($pkg->{dest});
 553     } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
 554         $target->{type} = 'bport';
 555         $target->{bridge} = $1;
 556         $target->{iface} = $2;
 557     } elsif ($to eq 'outside') {
 558         $target->{type} = 'bport';
 559         $target->{bridge} = 'vmbr0';
 560         $target->{iface} = 'eth0';
 561      } elsif ($to eq 'nfvm') {
 562         $target->{type} = 'bport';
 563         $target->{bridge} = 'vmbr0';
 564         $target->{iface} = 'tapXYZ';
 565     } elsif ($to =~ m/^ct(\d+)$/) {
 566         my $vmid = $1;
 567         $target = extract_ct_info($vmdata, $vmid, 0);
 568         $target->{iface} = $target->{tapdev};
 569    } elsif ($to =~ m/^vm(\d+)$/) {
 570         my $vmid = $1;
 571         $target = extract_vm_info($vmdata, $vmid, 0);
 572         $target->{iface} = $target->{tapdev};
 573     } else {
 574         die "unable to parse \"to => '$to'\"\n";
 575     }
 576
 577     $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
 578     $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
 579
 580     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 581                                        $from_info, $target, $start_state);
 582
 583     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 584
 585     return $res if $action eq 'QUERY';
 586
 587     die "test failed ($res != $action)\n" if $action ne $res;
 588
 589     return undef;
 590 }
 591
 592 1;
 593