]>
git.proxmox.com Git - pve-firewall.git/blob - src/PVE/FirewallSimulator.pm
1 package PVE
::FirewallSimulator
;
15 my $new_value = shift;
17 $debug = $new_value if defined($new_value);
41 my ($devre, $dev) = @_;
43 $devre =~ s/\+$/\.\*/;
44 return ($dev =~ m/^${devre}$/) ?
1 : 0;
48 my ($ipsetname, $ipset, $ipaddr) = @_;
50 my $ip = Net
::IP-
>new($ipaddr);
52 foreach my $entry (@$ipset) {
53 next if $entry =~ m/^create/; # simply ignore
54 if ($entry =~ m/add \S+ (\S+)$/) {
55 my $test = Net
::IP-
>new($1);
56 if ($test->overlaps($ip)) {
57 add_trace
("IPSET $ipsetname match $ipaddr\n");
69 my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
71 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
73 while (length($rule)) {
75 if ($rule =~ s/^-m conntrack --ctstate (\S+)\s*//) {
78 return undef if $cstate eq 'INVALID'; # no match
79 return undef if $cstate eq 'RELATED,ESTABLISHED'; # no match
81 next if $cstate =~ m/NEW/;
83 die "cstate test '$cstate' not implemented\n";
86 if ($rule =~ s/^-m addrtype --src-type (\S+)\s*//) {
88 die "missing source address type (srctype)\n"
90 return undef if $atype ne $pkg->{srctype
};
93 if ($rule =~ s/^-m addrtype --dst-type (\S+)\s*//) {
95 die "missing destination address type (dsttype)\n"
97 return undef if $atype ne $pkg->{dsttype
};
100 if ($rule =~ s/^-i (\S+)\s*//) {
102 die "missing interface (iface_in)\n" if !$pkg->{iface_in
};
103 return undef if !nf_dev_match
($devre, $pkg->{iface_in
});
107 if ($rule =~ s/^-o (\S+)\s*//) {
109 die "missing interface (iface_out)\n" if !$pkg->{iface_out
};
110 return undef if !nf_dev_match
($devre, $pkg->{iface_out
});
114 if ($rule =~ s/^-p (tcp|udp)\s*//) {
115 die "missing proto" if !$pkg->{proto
};
116 return undef if $pkg->{proto
} ne $1; # no match
120 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
121 die "missing dport" if !$pkg->{dport
};
122 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
126 if ($rule =~ s/^--dport (\d+)\s*//) {
127 die "missing dport" if !$pkg->{dport
};
128 return undef if $pkg->{dport
} != $1; # no match
132 if ($rule =~ s/^-s (\S+)\s*//) {
133 die "missing source" if !$pkg->{source
};
134 my $ip = Net
::IP-
>new($1);
135 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{source
})); # no match
139 if ($rule =~ s/^-d (\S+)\s*//) {
140 die "missing destination" if !$pkg->{dest
};
141 my $ip = Net
::IP-
>new($1);
142 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{dest
})); # no match
146 if ($rule =~ s/^-m set --match-set (\S+) src\s*//) {
147 die "missing source" if !$pkg->{source
};
148 my $ipset = $ipset_ruleset->{$1};
149 die "no such ip set '$1'" if !$ipset;
150 return undef if !ipset_match
($1, $ipset, $pkg->{source
});
154 if ($rule =~ s/^-m set --match-set (\S+) dst\s*//) {
155 die "missing destination" if !$pkg->{dest
};
156 my $ipset = $ipset_ruleset->{$1};
157 die "no such ip set '$1'" if !$ipset;
158 return undef if !ipset_match
($1, $ipset, $pkg->{dest
});
162 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
163 die "missing source mac" if !$pkg->{mac_source
};
164 return undef if $pkg->{mac_source
} eq $1; # no match
168 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
170 return undef if !$pkg->{physdev_in
};
171 return undef if !nf_dev_match
($devre, $pkg->{physdev_in
});
175 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
177 return undef if !$pkg->{physdev_out
};
178 return undef if !nf_dev_match
($devre, $pkg->{physdev_out
});
182 if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
183 return undef if !defined($mark) || $mark != $1;
189 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
194 if ($rule =~ s/^-j (\S+)\s*$//) {
198 if ($rule =~ s/^-g (\S+)\s*$//) {
202 if ($rule =~ s/^-j NFLOG --nflog-prefix \"[^\"]+\"$//) {
209 die "unable to parse rule: $rule";
212 sub ruleset_simulate_chain
{
213 my ($ruleset, $ipset_ruleset, $chain, $pkg) = @_;
215 add_trace
("ENTER chain $chain\n");
219 if ($chain eq 'PVEFW-Drop') {
220 add_trace
("LEAVE chain $chain\n");
221 return ('DROP', $counter);
223 if ($chain eq 'PVEFW-reject') {
224 add_trace
("LEAVE chain $chain\n");
225 return ('REJECT', $counter);
228 if ($chain eq 'PVEFW-tcpflags') {
229 add_trace
("LEAVE chain $chain\n");
230 return (undef, $counter);
233 my $rules = $ruleset->{$chain} ||
234 die "no such chain '$chain'";
236 foreach my $rule (@$rules) {
238 my ($goto, $action) = rule_match
($ipset_ruleset, $chain, $rule, $pkg);
239 if (!defined($action)) {
240 add_trace
("SKIP: $rule\n");
243 add_trace
("MATCH: $rule\n");
245 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
246 add_trace
("TERMINATE chain $chain: $action\n");
247 return ($action, $counter);
248 } elsif ($action eq 'RETURN') {
249 add_trace
("RETURN FROM chain $chain\n");
253 add_trace
("LEAVE chain $chain - goto $action\n");
254 return ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg)
256 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
258 my ($act, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $action, $pkg);
260 return ($act, $counter) if $act;
261 add_trace
("CONTINUE chain $chain\n");
266 add_trace
("LEAVE chain $chain\n");
267 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
268 return ('ACCEPT', $counter); # default policy
271 return (undef, $counter);
279 while (my ($k,$v) = each %$pkg) {
286 # Try to simulate packet traversal inside kernel. This invokes iptable
287 # checks several times.
289 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
291 my $route_state = $start_state;
295 my $ipt_invocation_counter = 0;
296 my $rule_check_counter = 0;
298 while ($route_state ne $target->{iface
}) {
301 my $next_route_state;
304 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
305 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
307 if ($route_state eq 'from-bport') {
308 $next_route_state = $from_info->{bridge
} || die 'internal error';
309 $next_physdev_in = $from_info->{iface
} || die 'internal error';
310 } elsif ($route_state eq 'host') {
312 if ($target->{type
} eq 'bport') {
313 $pkg->{iface_in
} = 'lo';
314 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
315 $chain = 'PVEFW-OUTPUT';
316 $next_route_state = $target->{iface
} || die 'internal error';
317 } elsif ($target->{type
} eq 'ct') {
318 $pkg->{iface_in
} = 'lo';
319 $pkg->{iface_out
} = 'venet0';
320 $chain = 'PVEFW-OUTPUT';
321 $next_route_state = 'venet-in';
322 } elsif ($target->{type
} eq 'vm') {
323 $pkg->{iface_in
} = 'lo';
324 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
325 $chain = 'PVEFW-OUTPUT';
326 $next_route_state = 'fwbr-in';
331 } elsif ($route_state eq 'venet-out') {
333 if ($target->{type
} eq 'host') {
335 $chain = 'PVEFW-INPUT';
336 $pkg->{iface_in
} = 'venet0';
337 $pkg->{iface_out
} = 'lo';
338 $next_route_state = 'host';
340 } elsif ($target->{type
} eq 'bport') {
342 $chain = 'PVEFW-FORWARD';
343 $pkg->{iface_in
} = 'venet0';
344 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
345 $next_route_state = $target->{iface
} || die 'internal error';
347 } elsif ($target->{type
} eq 'vm') {
349 $chain = 'PVEFW-FORWARD';
350 $pkg->{iface_in
} = 'venet0';
351 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
352 $next_route_state = 'fwbr-in';
354 } elsif ($target->{type
} eq 'ct') {
356 $chain = 'PVEFW-FORWARD';
357 $pkg->{iface_in
} = 'venet0';
358 $pkg->{iface_out
} = 'venet0';
359 $next_route_state = 'venet-in';
365 } elsif ($route_state eq 'fwbr-out') {
367 $chain = 'PVEFW-FORWARD';
368 $next_route_state = $from_info->{bridge
} || die 'internal error';
369 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
370 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
371 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
372 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
373 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
375 } elsif ($route_state eq 'fwbr-in') {
377 $chain = 'PVEFW-FORWARD';
378 $next_route_state = $target->{tapdev
};
379 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
380 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
381 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
382 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
384 } elsif ($route_state =~ m/^vmbr\d+$/) {
386 die "missing physdev_in - internal error?" if !$physdev_in;
387 $pkg->{physdev_in
} = $physdev_in;
389 if ($target->{type
} eq 'host') {
391 $chain = 'PVEFW-INPUT';
392 $pkg->{iface_in
} = $route_state;
393 $pkg->{iface_out
} = 'lo';
394 $next_route_state = 'host';
396 } elsif ($target->{type
} eq 'bport') {
398 $chain = 'PVEFW-FORWARD';
399 $pkg->{iface_in
} = $route_state;
400 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
401 # conditionally set physdev_out (same behavior as kernel)
402 if ($route_state eq $target->{bridge
}) {
403 $pkg->{physdev_out
} = $target->{iface
} || die 'internal error';
405 $next_route_state = $target->{iface
};
407 } elsif ($target->{type
} eq 'ct') {
409 $chain = 'PVEFW-FORWARD';
410 $pkg->{iface_in
} = $route_state;
411 $pkg->{iface_out
} = 'venet0';
412 $next_route_state = 'venet-in';
414 } elsif ($target->{type
} eq 'vm') {
416 $chain = 'PVEFW-FORWARD';
417 $pkg->{iface_in
} = $route_state;
418 $pkg->{iface_out
} = $target->{bridge
};
419 # conditionally set physdev_out (same behavior as kernel)
420 if ($route_state eq $target->{bridge
}) {
421 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
423 $next_route_state = 'fwbr-in';
430 die "implement me $route_state";
433 die "internal error" if !defined($next_route_state);
436 add_trace
("IPT check at $route_state (chain $chain)\n");
437 add_trace
(Dumper
($pkg));
438 $ipt_invocation_counter++;
439 my ($res, $ctr) = ruleset_simulate_chain
($ruleset, $ipset_ruleset, $chain, $pkg);
440 $rule_check_counter += $ctr;
441 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
444 $route_state = $next_route_state;
446 $physdev_in = $next_physdev_in;
449 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
452 sub extract_ct_info
{
453 my ($vmdata, $vmid) = @_;
455 my $info = { type
=> 'ct', vmid
=> $vmid };
457 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
458 if ($conf->{ip_address
}) {
459 $info->{ip_address
} = $conf->{ip_address
}->{value
};
466 sub extract_vm_info
{
467 my ($vmdata, $vmid) = @_;
469 my $info = { type
=> 'vm', vmid
=> $vmid };
471 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
472 my $net = PVE
::QemuServer
::parse_net
($conf->{net0
});
473 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
474 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
475 $info->{fwbr
} = "fwbr${vmid}i0";
476 $info->{tapdev
} = "tap${vmid}i0";
477 $info->{fwln
} = "fwln${vmid}i0";
478 $info->{fwpr
} = "fwpr${vmid}p0";
483 sub simulate_firewall
{
484 my ($ruleset, $ipset_ruleset, $host_ip, $vmdata, $test) = @_;
486 my $from = $test->{from
} || die "missing 'from' field";
487 my $to = $test->{to
} || die "missing 'to' field";
488 my $action = $test->{action
} || die "missing 'action'";
490 my $testid = $test->{id
};
492 die "from/to needs to be different" if $from eq $to;
500 srctype
=> 'UNICAST',
501 dsttype
=> 'UNICAST',
504 while (my ($k,$v) = each %$test) {
505 next if $k eq 'from';
507 next if $k eq 'action';
509 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
517 if ($from eq 'host') {
518 $from_info->{type
} = 'host';
519 $start_state = 'host';
520 $pkg->{source
} = $host_ip if !defined($pkg->{source
});
521 } elsif ($from =~ m
|^(vmbr\d
+)/(\S
+)$|) {
522 $from_info->{type
} = 'bport';
523 $from_info->{bridge
} = $1;
524 $from_info->{iface
} = $2;
525 $start_state = 'from-bport';
526 } elsif ($from eq 'outside') {
527 $from_info->{type
} = 'bport';
528 $from_info->{bridge
} = 'vmbr0';
529 $from_info->{iface
} = 'eth0';
530 $start_state = 'from-bport';
531 } elsif ($from eq 'nfvm') {
532 $from_info->{type
} = 'bport';
533 $from_info->{bridge
} = 'vmbr0';
534 $from_info->{iface
} = 'tapXYZ';
535 $start_state = 'from-bport';
536 } elsif ($from =~ m/^ct(\d+)$/) {
538 $from_info = extract_ct_info
($vmdata, $vmid);
539 if ($from_info->{ip_address
}) {
540 $pkg->{source
} = $from_info->{ip_address
} if !defined($pkg->{source
});
541 $start_state = 'venet-out';
545 } elsif ($from =~ m/^vm(\d+)$/) {
547 $from_info = extract_vm_info
($vmdata, $vmid);
548 $start_state = 'fwbr-out';
549 $pkg->{mac_source
} = $from_info->{macaddr
};
551 die "unable to parse \"from => '$from'\"\n";
557 $target->{type
} = 'host';
558 $target->{iface
} = 'host';
559 $pkg->{dest
} = $host_ip if !defined($pkg->{dest
});
560 } elsif ($to =~ m
|^(vmbr\d
+)/(\S
+)$|) {
561 $target->{type
} = 'bport';
562 $target->{bridge
} = $1;
563 $target->{iface
} = $2;
564 } elsif ($to eq 'outside') {
565 $target->{type
} = 'bport';
566 $target->{bridge
} = 'vmbr0';
567 $target->{iface
} = 'eth0';
568 } elsif ($to eq 'nfvm') {
569 $target->{type
} = 'bport';
570 $target->{bridge
} = 'vmbr0';
571 $target->{iface
} = 'tapXYZ';
572 } elsif ($to =~ m/^ct(\d+)$/) {
574 $target = extract_ct_info
($vmdata, $vmid);
575 $target->{iface
} = 'venet-in';
577 if ($target->{ip_address
}) {
578 $pkg->{dest
} = $target->{ip_address
};
582 } elsif ($to =~ m/^vm(\d+)$/) {
584 $target = extract_vm_info
($vmdata, $vmid);
585 $target->{iface
} = $target->{tapdev
};
587 die "unable to parse \"to => '$to'\"\n";
590 $pkg->{source
} = '100.100.1.2' if !defined($pkg->{source
});
591 $pkg->{dest
} = '100.200.3.4' if !defined($pkg->{dest
});
593 my ($res, $ic, $rc) = route_packet
($ruleset, $ipset_ruleset, $pkg,
594 $from_info, $target, $start_state);
596 add_trace
("IPT statistics: invocation = $ic, checks = $rc\n");
598 return $res if $action eq 'QUERY';
600 die "test failed ($res != $action)\n" if $action ne $res;