src/PVE/FirewallSimulator.pm

   1 package PVE::FirewallSimulator;
   2
   3 use strict;
   4 use warnings;
   5 use Data::Dumper;
   6 use PVE::Firewall;
   7 use File::Basename;
   8 use Net::IP;
   9
  10 use base 'Exporter';
  11 our @EXPORT_OK = qw(
  12 $bridge_name_pattern
  13 $bridge_interface_pattern
  14 );
  15
  16 # dynamically include PVE::QemuServer and PVE::LXC
  17 # to avoid dependency problems
  18 my $have_qemu_server;
  19 eval {
  20     require PVE::QemuServer;
  21     $have_qemu_server = 1;
  22 };
  23
  24 my $have_lxc;
  25 eval {
  26     require PVE::LXC;
  27     $have_lxc = 1;
  28 };
  29
  30 my $mark = 0;
  31 my $trace;
  32 my $debug = 0;
  33
  34 my $NUMBER_RE = qr/0x[0-9a-fA-F]+|\d+/;
  35
  36 our $bridge_name_pattern = '[a-zA-Z][a-zA-Z0-9]{0,9}';
  37 our $bridge_interface_pattern = "($bridge_name_pattern)/(\\S+)";
  38
  39 sub debug {
  40     my $new_value = shift;
  41     $debug = $new_value if defined($new_value);
  42     return $debug;
  43 }
  44
  45 sub reset_trace {
  46     $trace = '';
  47 }
  48
  49 sub get_trace {
  50     return $trace;
  51 }
  52
  53 sub add_trace {
  54     my ($text) = @_;
  55
  56     if ($debug) {
  57         print $text;
  58     } else {
  59         $trace .= $text;
  60     }
  61 }
  62
  63 $SIG{'__WARN__'} = sub {
  64     my $err = $@;
  65     my $t = $_[0];
  66     chomp $t;
  67     add_trace("$t\n");
  68     $@ = $err;
  69 };
  70
  71 sub nf_dev_match {
  72     my ($devre, $dev) = @_;
  73
  74     $devre =~ s/\+$/\.\*/;
  75     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  76 }
  77
  78 sub ipset_match {
  79     my ($ipset_ruleset, $ipsetname, $ipaddr) = @_;
  80
  81     my $ipset = $ipset_ruleset->{$ipsetname};
  82     die "no such ipset '$ipsetname'" if !$ipset;
  83
  84     my $ip = Net::IP->new($ipaddr);
  85
  86     my $first = $ipset->[0];
  87     if ($first =~ m/^create\s+\S+\s+list:/) {
  88         foreach my $entry (@$ipset) {
  89             next if $entry =~ m/^create/; # simply ignore
  90             if ($entry =~ m/add \S+ (\S+)$/) {
  91                 return 1 if ipset_match($ipset_ruleset, $1, $ipaddr);
  92             } else {
  93                 die "implement me";
  94             }
  95         }
  96         return 0;
  97     } elsif ($first =~ m/^create\s+\S+\s+hash:net/) {
  98         foreach my $entry (@$ipset) {
  99             next if $entry =~ m/^create/; # simply ignore
 100             if ($entry =~ m/add \S+ (\S+)$/) {
 101                 my $test = Net::IP->new($1);
 102                 if ($test->overlaps($ip)) {
 103                     add_trace("IPSET $ipsetname match $ipaddr\n");
 104                     return 1;
 105                 }
 106             } else {
 107                 die "implement me";
 108             }
 109         }
 110         return 0;
 111     } else {
 112         die "unknown ipset type '$first' - not implemented\n";
 113     }
 114
 115     return 0;
 116 }
 117
 118 sub rule_match {
 119     my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
 120
 121     $rule =~ s/^-A $chain +// || die "got strange rule: $rule";
 122
 123     while (length($rule)) {
 124
 125         if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
 126             my $cstate = $1;
 127
 128             return undef if $cstate eq 'INVALID'; # no match
 129             return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
 130
 131             next if $cstate =~ m/NEW/;
 132
 133             die "cstate test '$cstate' not implemented\n";
 134         }
 135
 136         if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
 137             my $atype = $1;
 138             die "missing source address type (srctype)\n"
 139                 if !$pkg->{srctype};
 140             return undef if $atype ne $pkg->{srctype};
 141         }
 142
 143         if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
 144             my $atype = $1;
 145             die "missing destination address type (dsttype)\n"
 146                 if !$pkg->{dsttype};
 147             return undef if $atype ne $pkg->{dsttype};
 148         }
 149
 150         if ($rule =~ s/^-m icmp(v6)? --icmp-type (\S+)\s*//) {
 151             my $icmpv6 = !!$1;
 152             my $icmptype = $2;
 153             die "missing destination address type (dsttype)\n" if !defined($pkg->{dport});
 154             return undef if $icmptype ne $pkg->{dport};
 155         }
 156
 157         if ($rule =~ s/^-i (\S+)\s*//) {
 158             my $devre = $1;
 159             die "missing interface (iface_in)\n" if !$pkg->{iface_in};
 160             return undef if !nf_dev_match($devre, $pkg->{iface_in});
 161             next;
 162         }
 163
 164         if ($rule =~ s/^-o (\S+)\s*//) {
 165             my $devre = $1;
 166             die "missing interface (iface_out)\n" if !$pkg->{iface_out};
 167             return undef if !nf_dev_match($devre, $pkg->{iface_out});
 168             next;
 169         }
 170
 171         if ($rule =~ s/^-p (tcp|udp|igmp|icmp)\s*//) {
 172             die "missing proto" if !$pkg->{proto};
 173             return undef if $pkg->{proto} ne $1; # no match
 174             next;
 175         }
 176
 177         if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
 178             die "missing dport" if !$pkg->{dport};
 179             return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
 180             next;
 181         }
 182
 183         if ($rule =~ s/^--dport (\d+)\s*//) {
 184             die "missing dport" if !$pkg->{dport};
 185             return undef if $pkg->{dport} != $1; # no match
 186             next;
 187         }
 188
 189         if ($rule =~ s/^-s (\S+)\s*//) {
 190             die "missing source" if !$pkg->{source};
 191             my $ip = Net::IP->new($1);
 192             return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
 193             next;
 194         }
 195
 196         if ($rule =~ s/^-d (\S+)\s*//) {
 197             die "missing destination" if !$pkg->{dest};
 198             my $ip = Net::IP->new($1);
 199             return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
 200             next;
 201         }
 202
 203         if ($rule =~ s/^-m set (!\s+)?--match-set (\S+) src\s*//) {
 204             die "missing source" if !$pkg->{source};
 205             my $neg = $1;
 206             my $ipset_name = $2;
 207             if ($neg) {
 208                 return undef if ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 209             } else {
 210                 return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{source});
 211             }
 212             next;
 213         }
 214
 215         if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
 216             die "missing destination" if !$pkg->{dest};
 217             my $ipset_name = $1;
 218             return undef if !ipset_match($ipset_ruleset, $ipset_name, $pkg->{dest});
 219             next;
 220         }
 221
 222         if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
 223             die "missing source mac" if !$pkg->{mac_source};
 224             return undef if $pkg->{mac_source} eq $1; # no match
 225             next;
 226         }
 227
 228         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
 229             my $devre = $1;
 230             return undef if !$pkg->{physdev_in};
 231             return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 232             next;
 233         }
 234
 235         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 236             my $devre = $1;
 237             return undef if !$pkg->{physdev_out};
 238             return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 239             next;
 240         }
 241
 242         if ($rule =~ s@^-m mark --mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*@@) {
 243             my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
 244             return undef if ($mark & $mask) != $value;
 245             next;
 246         }
 247
 248         # final actions
 249
 250         if ($rule =~ s@^-j MARK --set-mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*$@@) {
 251             my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
 252             $mark = ($mark & ~$mask) | $value;
 253             return undef;
 254         }
 255
 256         if ($rule =~ s/^-j (\S+)\s*$//) {
 257             return (0, $1);
 258         }
 259
 260         if ($rule =~ s/^-g (\S+)\s*$//) {
 261             return (1, $1);
 262         }
 263
 264         if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
 265             return undef;
 266         }
 267
 268         last;
 269     }
 270
 271     die "unable to parse rule: $rule";
 272 }
 273
 274 sub ruleset_simulate_chain {
 275     my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
 276
 277     add_trace("ENTER chain $chain\n");
 278
 279     my $counter = 0;
 280
 281     if ($chain eq 'PVEFW-Drop') {
 282         add_trace("LEAVE chain $chain\n");
 283         return ('DROP', $counter);
 284     }
 285     if ($chain eq 'PVEFW-reject') {
 286         add_trace("LEAVE chain $chain\n");
 287         return ('REJECT', $counter);
 288     }
 289
 290     if ($chain eq 'PVEFW-tcpflags') {
 291         add_trace("LEAVE chain $chain\n");
 292         return (undef, $counter);
 293     }
 294
 295     my $rules = $ruleset->{$chain} ||
 296         die "no such chain '$chain'";
 297
 298     foreach my $rule (@$rules) {
 299         $counter++;
 300         my ($goto, $action) = rule_match($ipset_ruleset, $chain, $rule, $pkg);
 301         if (!defined($action)) {
 302             add_trace("SKIP: $rule\n");
 303             next;
 304         }
 305         add_trace("MATCH: $rule\n");
 306
 307         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 308             add_trace("TERMINATE chain $chain: $action\n");
 309             return ($action, $counter);
 310         } elsif ($action eq 'RETURN') {
 311             add_trace("RETURN FROM chain $chain\n");
 312             last;
 313         } else {
 314             if ($goto) {
 315                 add_trace("LEAVE chain $chain - goto $action\n");
 316                 return ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg)
 317                 #$chain = $action;
 318                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 319             } else {
 320                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $action, $pkg);
 321                 $counter += $ctr;
 322                 return ($act, $counter) if $act;
 323                 add_trace("CONTINUE chain $chain\n");
 324             }
 325         }
 326     }
 327
 328     add_trace("LEAVE chain $chain\n");
 329     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 330         return ('ACCEPT', $counter); # default policy
 331     }
 332
 333     return (undef, $counter);
 334 }
 335
 336 sub copy_packet {
 337     my ($pkg) = @_;
 338
 339     my $res = {};
 340
 341     while (my ($k,$v) = each %$pkg) {
 342         $res->{$k} = $v;
 343     }
 344
 345     return $res;
 346 }
 347
 348 # Try to simulate packet traversal inside kernel. This invokes iptable
 349 # checks several times.
 350 sub route_packet {
 351     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 352
 353     $pkg->{ipversion} = 4; # fixme: allow ipv6
 354
 355     my $route_state = $start_state;
 356
 357     my $physdev_in;
 358
 359     my $ipt_invocation_counter = 0;
 360     my $rule_check_counter = 0;
 361
 362     while ($route_state ne $target->{iface}) {
 363
 364         my $chain;
 365         my $next_route_state;
 366         my $next_physdev_in;
 367
 368         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 369         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 370
 371         if ($route_state eq 'from-bport') {
 372             $next_route_state = $from_info->{bridge} || die 'internal error';
 373             $next_physdev_in = $from_info->{iface} || die 'internal error';
 374         } elsif ($route_state eq 'host') {
 375
 376             if ($target->{type} eq 'bport') {
 377                 $pkg->{iface_in} = 'lo';
 378                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 379                 $chain = 'PVEFW-OUTPUT';
 380                 $next_route_state = $target->{iface} || die 'internal error';
 381             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 382                 $pkg->{iface_in} = 'lo';
 383                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 384                 $chain = 'PVEFW-OUTPUT';
 385                 $next_route_state = 'fwbr-in';
 386             } else {
 387                 die "implement me";
 388             }
 389
 390         } elsif ($route_state eq 'fwbr-out') {
 391
 392             $chain = 'PVEFW-FORWARD';
 393             $next_route_state = $from_info->{bridge} || die 'internal error';
 394             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 395             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 396             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 397             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 398             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 399
 400         } elsif ($route_state eq 'fwbr-in') {
 401
 402             $chain = 'PVEFW-FORWARD';
 403             $next_route_state = $target->{tapdev};
 404             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 405             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 406             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 407             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 408
 409         } elsif ($route_state =~ m/^$bridge_name_pattern$/) {
 410
 411             die "missing physdev_in - internal error?" if !$physdev_in;
 412             $pkg->{physdev_in} = $physdev_in;
 413
 414             if ($target->{type} eq 'host') {
 415
 416                 $chain = 'PVEFW-INPUT';
 417                 $pkg->{iface_in} = $route_state;
 418                 $pkg->{iface_out} = 'lo';
 419                 $next_route_state = 'host';
 420
 421             } elsif ($target->{type} eq 'bport') {
 422
 423                 $chain = 'PVEFW-FORWARD';
 424                 $pkg->{iface_in} = $route_state;
 425                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 426                 # conditionally set physdev_out (same behavior as kernel)
 427                 if ($route_state eq $target->{bridge}) {
 428                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 429                 }
 430                 $next_route_state = $target->{iface};
 431
 432             } elsif ($target->{type} eq 'vm' || $target->{type} eq 'ct') {
 433
 434                 $chain = 'PVEFW-FORWARD';
 435                 $pkg->{iface_in} = $route_state;
 436                 $pkg->{iface_out} = $target->{bridge};
 437                 # conditionally set physdev_out (same behavior as kernel)
 438                 if ($route_state eq $target->{bridge}) {
 439                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 440                 }
 441                 $next_route_state = 'fwbr-in';
 442
 443             } else {
 444                 die "implement me";
 445             }
 446
 447         } else {
 448             die "implement me $route_state";
 449         }
 450
 451         die "internal error" if !defined($next_route_state);
 452
 453         if ($chain) {
 454             add_trace("IPT check at $route_state (chain $chain)\n");
 455             add_trace(Dumper($pkg));
 456             $ipt_invocation_counter++;
 457             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $ipset_ruleset, $chain, $pkg);
 458             $rule_check_counter += $ctr;
 459             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 460         }
 461
 462         $route_state = $next_route_state;
 463
 464         $physdev_in = $next_physdev_in;
 465     }
 466
 467     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 468 }
 469
 470 sub extract_ct_info {
 471     my ($vmdata, $vmid, $netnum) = @_;
 472
 473     my $info = { type => 'ct', vmid => $vmid };
 474
 475     my $conf = $vmdata->{lxc}->{$vmid} || die "no such CT '$vmid'";
 476     my $net = PVE::LXC::Config->parse_lxc_network($conf->{"net$netnum"});
 477     $info->{macaddr} = $net->{hwaddr} || die "unable to get mac address";
 478     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 479     $info->{fwbr} = "fwbr${vmid}i$netnum";
 480     $info->{tapdev} = "veth${vmid}i$netnum";
 481     $info->{fwln} = "fwln${vmid}i$netnum";
 482     $info->{fwpr} = "fwpr${vmid}p$netnum";
 483     $info->{ip_address} = $net->{ip} || die "unable to get ip address";
 484
 485     return $info;
 486 }
 487
 488 sub extract_vm_info {
 489     my ($vmdata, $vmid, $netnum) = @_;
 490
 491     my $info = { type => 'vm', vmid => $vmid };
 492
 493     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 494     my $net = PVE::QemuServer::parse_net($conf->{"net$netnum"});
 495     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 496     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 497     $info->{fwbr} = "fwbr${vmid}i$netnum";
 498     $info->{tapdev} = "tap${vmid}i$netnum";
 499     $info->{fwln} = "fwln${vmid}i$netnum";
 500     $info->{fwpr} = "fwpr${vmid}p$netnum";
 501
 502     return $info;
 503 }
 504
 505 sub simulate_firewall {
 506     my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
 507
 508     my $from = $test->{from} || die "missing 'from' field";
 509     my $to = $test->{to} || die "missing 'to' field";
 510     my $action = $test->{action} || die "missing 'action'";
 511
 512     my $testid = $test->{id};
 513
 514     die "from/to needs to be different" if $from eq $to;
 515
 516     my $pkg = {
 517         proto => 'tcp',
 518         sport => undef,
 519         dport => undef,
 520         source => undef,
 521         dest => undef,
 522         srctype => 'UNICAST',
 523         dsttype => 'UNICAST',
 524     };
 525
 526     while (my ($k,$v) = each %$test) {
 527         next if $k eq 'from';
 528         next if $k eq 'to';
 529         next if $k eq 'action';
 530         next if $k eq 'id';
 531         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 532         $pkg->{$k} = $v;
 533     }
 534
 535     my $from_info = {};
 536
 537     my $start_state;
 538
 539     if ($from eq 'host') {
 540         $from_info->{type} = 'host';
 541         $start_state = 'host';
 542         $pkg->{source} = $host_ip if !defined($pkg->{source});
 543     } elsif ($from eq 'outside') {
 544         $from_info->{type} = 'bport';
 545         $from_info->{bridge} = 'vmbr0';
 546         $from_info->{iface} = 'eth0';
 547         $start_state = 'from-bport';
 548     } elsif ($from eq 'nfvm') {
 549         $from_info->{type} = 'bport';
 550         $from_info->{bridge} = 'vmbr0';
 551         $from_info->{iface} = 'tapXYZ';
 552         $start_state = 'from-bport';
 553     } elsif ($from =~ m/^ct(\d+)$/) {
 554         return 'SKIPPED' if !$have_lxc;
 555         my $vmid = $1;
 556         $from_info = extract_ct_info($vmdata, $vmid, 0);
 557         $start_state = 'fwbr-out';
 558         $pkg->{mac_source} = $from_info->{macaddr};
 559     } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
 560         return 'SKIPPED' if !$have_qemu_server;
 561         my $vmid = $1;
 562         my $netnum = $3 || 0;
 563         $from_info = extract_vm_info($vmdata, $vmid, $netnum);
 564         $start_state = 'fwbr-out';
 565         $pkg->{mac_source} = $from_info->{macaddr};
 566     } elsif ($from =~ m|^$bridge_interface_pattern$|) {
 567         $from_info->{type} = 'bport';
 568         $from_info->{bridge} = $1;
 569         $from_info->{iface} = $2;
 570         $start_state = 'from-bport';
 571     } else {
 572         die "unable to parse \"from => '$from'\"\n";
 573     }
 574
 575     my $target;
 576
 577     if ($to eq 'host') {
 578         $target->{type} = 'host';
 579         $target->{iface} = 'host';
 580         $pkg->{dest} = $host_ip if !defined($pkg->{dest});
 581     } elsif ($to eq 'outside') {
 582         $target->{type} = 'bport';
 583         $target->{bridge} = 'vmbr0';
 584         $target->{iface} = 'eth0';
 585      } elsif ($to eq 'nfvm') {
 586         $target->{type} = 'bport';
 587         $target->{bridge} = 'vmbr0';
 588         $target->{iface} = 'tapXYZ';
 589     } elsif ($to =~ m/^ct(\d+)$/) {
 590         return 'SKIPPED' if !$have_lxc;
 591         my $vmid = $1;
 592         $target = extract_ct_info($vmdata, $vmid, 0);
 593         $target->{iface} = $target->{tapdev};
 594    } elsif ($to =~ m/^vm(\d+)$/) {
 595         return 'SKIPPED' if !$have_qemu_server;
 596         my $vmid = $1;
 597         $target = extract_vm_info($vmdata, $vmid, 0);
 598         $target->{iface} = $target->{tapdev};
 599     } elsif ($to =~ m|^$bridge_interface_pattern$|) {
 600         $target->{type} = 'bport';
 601         $target->{bridge} = $1;
 602         $target->{iface} = $2;
 603     } else {
 604         die "unable to parse \"to => '$to'\"\n";
 605     }
 606
 607     $pkg->{source} = '100.100.1.2' if !defined($pkg->{source});
 608     $pkg->{dest} = '100.200.3.4' if !defined($pkg->{dest});
 609
 610     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 611                                        $from_info, $target, $start_state);
 612
 613     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 614
 615     return $res if $action eq 'QUERY';
 616
 617     die "test failed ($res != $action)\n" if $action ne $res;
 618
 619     return undef;
 620 }
 621
 622 1;
 623