src/PVE/Service/pve_firewall.pm

   1 package PVE::Service::pve_firewall;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::SafeSyslog;
   6 use PVE::Daemon;
   7
   8 use Time::HiRes qw (gettimeofday);
   9 use PVE::Tools qw(dir_glob_foreach file_read_firstline);
  10 use PVE::ProcFSTools;
  11 use PVE::INotify;
  12 use PVE::Cluster qw(cfs_read_file);
  13 use PVE::Corosync;
  14 use PVE::RPCEnvironment;
  15 use PVE::CLIHandler;
  16 use PVE::Firewall;
  17 use PVE::FirewallSimulator;
  18 use Data::Dumper;
  19
  20 use base qw(PVE::Daemon);
  21
  22 my $cmdline = [$0, @ARGV];
  23
  24 my %daemon_options = (restart_on_error => 5, stop_wait_time => 5);
  25
  26 my $daemon = __PACKAGE__->new('pve-firewall', $cmdline, %daemon_options);
  27
  28 my $nodename = PVE::INotify::nodename();
  29
  30 sub init {
  31
  32     PVE::Cluster::cfs_update();
  33
  34     PVE::Firewall::init();
  35 }
  36
  37 my $restart_request = 0;
  38 my $next_update = 0;
  39
  40 my $cycle = 0;
  41 my $updatetime = 10;
  42
  43 my $initial_memory_usage;
  44
  45 sub shutdown {
  46     my ($self) = @_;
  47
  48     syslog('info' , "server closing");
  49
  50     # wait for children
  51     1 while (waitpid(-1, POSIX::WNOHANG()) > 0);
  52
  53     syslog('info' , "clear firewall rules");
  54
  55     eval { PVE::Firewall::remove_pvefw_chains(); };
  56     warn $@ if $@;
  57
  58     $self->exit_daemon(0);
  59 }
  60
  61 sub hup {
  62     my ($self) = @_;
  63
  64     $restart_request = 1;
  65 }
  66
  67 sub run {
  68     my ($self) = @_;
  69
  70     local $SIG{'__WARN__'} = 'IGNORE'; # do not fill up logs
  71
  72     for (;;) { # forever
  73
  74         $next_update = time() + $updatetime;
  75
  76         my ($ccsec, $cusec) = gettimeofday ();
  77         eval {
  78             PVE::Cluster::cfs_update();
  79             PVE::Firewall::update();
  80         };
  81         my $err = $@;
  82
  83         if ($err) {
  84             syslog('err', "status update error: $err");
  85         }
  86
  87         my ($ccsec_end, $cusec_end) = gettimeofday ();
  88         my $cptime = ($ccsec_end-$ccsec) + ($cusec_end - $cusec)/1000000;
  89
  90         syslog('info', sprintf("firewall update time (%.3f seconds)", $cptime))
  91             if ($cptime > 5);
  92
  93         $cycle++;
  94
  95         my $mem = PVE::ProcFSTools::read_memory_usage();
  96
  97         if (!defined($initial_memory_usage) || ($cycle < 10)) {
  98             $initial_memory_usage = $mem->{resident};
  99         } else {
 100             my $diff = $mem->{resident} - $initial_memory_usage;
 101             if ($diff > 5*1024*1024) {
 102                 syslog ('info', "restarting server after $cycle cycles to " .
 103                         "reduce memory usage (free $mem->{resident} ($diff) bytes)");
 104                 $self->restart_daemon();
 105             }
 106         }
 107
 108         my $wcount = 0;
 109         while ((time() < $next_update) &&
 110                ($wcount < $updatetime) && # protect against time wrap
 111                !$restart_request) { $wcount++; sleep (1); };
 112
 113         $self->restart_daemon() if $restart_request;
 114     }
 115 }
 116
 117 $daemon->register_start_command("Start the Proxmox VE firewall service.");
 118 $daemon->register_restart_command(1, "Restart the Proxmox VE firewall service.");
 119 $daemon->register_stop_command("Stop firewall. This removes all Proxmox VE " .
 120                                "related iptable rules. " .
 121                                "The host is unprotected afterwards.");
 122
 123 __PACKAGE__->register_method ({
 124     name => 'status',
 125     path => 'status',
 126     method => 'GET',
 127     description => "Get firewall status.",
 128     parameters => {
 129         additionalProperties => 0,
 130         properties => {},
 131     },
 132     returns => {
 133         type => 'object',
 134         additionalProperties => 0,
 135         properties => {
 136             status => {
 137                 type => 'string',
 138                 enum => ['unknown', 'stopped', 'running'],
 139             },
 140             enable => {
 141                 description => "Firewall is enabled (in 'cluster.fw')",
 142                 type => 'boolean',
 143             },
 144             changes => {
 145                 description => "Set when there are pending changes.",
 146                 type => 'boolean',
 147                 optional => 1,
 148             }
 149         },
 150     },
 151     code => sub {
 152         my ($param) = @_;
 153
 154         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 155
 156         my $code = sub {
 157
 158             my $status = $daemon->running() ? 'running' : 'stopped';
 159
 160             my $res = { status => $status };
 161
 162             PVE::Firewall::set_verbose(1); # show syntax errors
 163
 164             my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
 165             $res->{enable} = $cluster_conf->{options}->{enable} ? 1 : 0;
 166
 167             if ($status eq 'running') {
 168
 169                 my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
 170
 171                 PVE::Firewall::set_verbose(0); # do not show iptables details
 172                 my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
 173                 my ($test, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset);
 174                 my (undef, $ruleset_changesv6) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6, "ip6tables");
 175                 my (undef, $ebtables_changes) = PVE::Firewall::get_ebtables_cmdlist($ebtables_ruleset);
 176
 177                 $res->{changes} = ($ipset_changes || $ruleset_changes || $ruleset_changesv6 || $ebtables_changes) ? 1 : 0;
 178             }
 179
 180             return $res;
 181         };
 182
 183         return PVE::Firewall::run_locked($code);
 184     }});
 185
 186 __PACKAGE__->register_method ({
 187     name => 'compile',
 188     path => 'compile',
 189     method => 'GET',
 190     description => "Compile and print firewall rules. This is useful for testing.",
 191     parameters => {
 192         additionalProperties => 0,
 193         properties => {},
 194     },
 195     returns => { type => 'null' },
 196
 197     code => sub {
 198         my ($param) = @_;
 199
 200         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 201
 202         my $code = sub {
 203
 204             PVE::Firewall::set_verbose(1);
 205
 206             my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
 207             my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
 208
 209             print "ipset cmdlist:\n";
 210             my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
 211
 212             print "\niptables cmdlist:\n";
 213             my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset);
 214
 215             print "\nip6tables cmdlist:\n";
 216             my (undef, $ruleset_changesv6) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6, "ip6tables");
 217
 218             print "\nebtables cmdlist:\n";
 219             my (undef, $ebtables_changes) = PVE::Firewall::get_ebtables_cmdlist($ebtables_ruleset);
 220
 221             if ($ipset_changes || $ruleset_changes || $ruleset_changesv6 || $ebtables_changes) {
 222                 print "detected changes\n";
 223             } else {
 224                 print "no changes\n";
 225             }
 226             if (!$cluster_conf->{options}->{enable}) {
 227                 print "firewall disabled\n";
 228             }
 229
 230         };
 231
 232         PVE::Firewall::run_locked($code);
 233
 234         return undef;
 235     }});
 236
 237 __PACKAGE__->register_method ({
 238     name => 'localnet',
 239     path => 'localnet',
 240     method => 'GET',
 241     description => "Print information about local network.",
 242     parameters => {
 243         additionalProperties => 0,
 244         properties => {},
 245     },
 246     returns => { type => 'null' },
 247     code => sub {
 248         my ($param) = @_;
 249
 250         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 251
 252         my $nodename = PVE::INotify::nodename();
 253         print "local hostname: $nodename\n";
 254
 255         my $ip = PVE::Cluster::remote_node_ip($nodename);
 256         print "local IP address: $ip\n";
 257
 258         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 259
 260         my $localnet = PVE::Firewall::local_network() || '127.0.0.0/8';
 261         print "network auto detect: $localnet\n";
 262         if ($cluster_conf->{aliases}->{local_network}) {
 263             print "using user defined local_network: $cluster_conf->{aliases}->{local_network}->{cidr}\n";
 264         } else {
 265             print "using detected local_network: $localnet\n";
 266         }
 267
 268         if (PVE::Corosync::check_conf_exists(1)) {
 269             my $corosync_conf = PVE::Cluster::cfs_read_file("corosync.conf");
 270             my $corosync_node_found = 0;
 271
 272             print "\naccepting corosync traffic from/to:\n";
 273
 274             PVE::Corosync::for_all_corosync_addresses($corosync_conf, undef, sub {
 275                 my ($curr_node_name, $curr_node_ip, undef, $key) = @_;
 276
 277                 $corosync_node_found = 1;
 278
 279                 $key =~ m/(?:ring|link)(\d+)_addr/;
 280                 print " - $curr_node_name: $curr_node_ip (link: $1)\n";
 281             });
 282
 283             if (!$corosync_node_found) {
 284                 print " - no nodes found\n";
 285             }
 286         }
 287
 288         return undef;
 289     }});
 290
 291 __PACKAGE__->register_method ({
 292     name => 'simulate',
 293     path => 'simulate',
 294     method => 'GET',
 295     description => "Simulate firewall rules. This does not simulate kernel 'routing' table. Instead, this simply assumes that routing from source zone to destination zone is possible.",
 296     parameters => {
 297         additionalProperties => 0,
 298         properties => {
 299             verbose => {
 300                 description => "Verbose output.",
 301                 type => 'boolean',
 302                 optional => 1,
 303                 default => 0,
 304             },
 305             from => {
 306                 description => "Source zone.",
 307                 type => 'string',
 308                 pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
 309                 optional => 1,
 310                 default => 'outside',
 311             },
 312             to => {
 313                 description => "Destination zone.",
 314                 type => 'string',
 315                 pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
 316                 optional => 1,
 317                 default => 'host',
 318             },
 319             protocol => {
 320                 description => "Protocol.",
 321                 type => 'string',
 322                 pattern => '(tcp|udp)',
 323                 optional => 1,
 324                 default => 'tcp',
 325             },
 326             dport => {
 327                 description => "Destination port.",
 328                 type => 'integer',
 329                 minValue => 1,
 330                 maxValue => 65535,
 331                 optional => 1,
 332             },
 333             sport => {
 334                 description => "Source port.",
 335                 type => 'integer',
 336                 minValue => 1,
 337                 maxValue => 65535,
 338                 optional => 1,
 339             },
 340             source => {
 341                 description => "Source IP address.",
 342                 type => 'string', format => 'ipv4',
 343                 optional => 1,
 344             },
 345             dest => {
 346                 description => "Destination IP address.",
 347                 type => 'string', format => 'ipv4',
 348                 optional => 1,
 349             },
 350         },
 351     },
 352     returns => { type => 'null' },
 353     code => sub {
 354         my ($param) = @_;
 355
 356         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 357
 358         PVE::Firewall::set_verbose($param->{verbose});
 359
 360         my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile();
 361
 362         PVE::FirewallSimulator::debug();
 363
 364         my $host_ip = PVE::Cluster::remote_node_ip($nodename);
 365
 366         PVE::FirewallSimulator::reset_trace();
 367         print Dumper($ruleset) if $param->{verbose};
 368
 369         my $test = {
 370             from => $param->{from},
 371             to => $param->{to},
 372             proto => $param->{protocol} || 'tcp',
 373             source => $param->{source},
 374             dest => $param->{dest},
 375             dport => $param->{dport},
 376             sport => $param->{sport},
 377         };
 378
 379         if (!defined($test->{to})) {
 380             $test->{to} = 'host';
 381             PVE::FirewallSimulator::add_trace("Set Zone: to => '$test->{to}'\n");
 382         }
 383         if (!defined($test->{from})) {
 384             $test->{from} = 'outside',
 385             PVE::FirewallSimulator::add_trace("Set Zone: from => '$test->{from}'\n");
 386         }
 387
 388         my $vmdata = PVE::Firewall::read_local_vm_config();
 389
 390         print "Test packet:\n";
 391
 392         foreach my $k (qw(from to proto source dest dport sport)) {
 393             printf("  %-8s: %s\n", $k, $test->{$k}) if defined($test->{$k});
 394         }
 395
 396         $test->{action} = 'QUERY';
 397
 398         my $res = PVE::FirewallSimulator::simulate_firewall($ruleset, $ipset_ruleset,
 399                                                             $host_ip, $vmdata, $test);
 400
 401         print "ACTION: $res\n";
 402
 403         return undef;
 404     }});
 405
 406 our $cmddef = {
 407     start => [ __PACKAGE__, 'start', []],
 408     restart => [ __PACKAGE__, 'restart', []],
 409     stop => [ __PACKAGE__, 'stop', []],
 410     compile => [ __PACKAGE__, 'compile', []],
 411     simulate => [ __PACKAGE__, 'simulate', []],
 412     localnet => [ __PACKAGE__, 'localnet', []],
 413     status => [ __PACKAGE__, 'status', [], undef, sub {
 414         my $res = shift;
 415         my $status = ($res->{enable} ? "enabled" : "disabled") . '/' . $res->{status};
 416
 417         if ($res->{changes}) {
 418             print "Status: $status (pending changes)\n";
 419         } else {
 420             print "Status: $status\n";
 421         }
 422     }],
 423  };
 424
 425 1;