src/PVE/Service/pve_firewall.pm

   1 package PVE::Service::pve_firewall;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::SafeSyslog;
   6 use PVE::Daemon;
   7
   8 use Time::HiRes qw (gettimeofday);
   9 use PVE::Tools qw(dir_glob_foreach file_read_firstline);
  10 use PVE::ProcFSTools;
  11 use PVE::INotify;
  12 use PVE::Cluster qw(cfs_read_file);
  13 use PVE::Corosync;
  14 use PVE::RPCEnvironment;
  15 use PVE::CLIHandler;
  16 use PVE::Firewall;
  17 use PVE::FirewallSimulator;
  18 use Data::Dumper;
  19
  20 use base qw(PVE::Daemon);
  21
  22 my $cmdline = [$0, @ARGV];
  23
  24 my %daemon_options = (restart_on_error => 5, stop_wait_time => 5);
  25
  26 my $daemon = __PACKAGE__->new('pve-firewall', $cmdline, %daemon_options);
  27
  28 my $nodename = PVE::INotify::nodename();
  29
  30 sub init {
  31
  32     PVE::Cluster::cfs_update();
  33
  34     PVE::Firewall::init();
  35 }
  36
  37 my $restart_request = 0;
  38 my $next_update = 0;
  39
  40 my $cycle = 0;
  41 my $updatetime = 10;
  42
  43 my $initial_memory_usage;
  44
  45 sub shutdown {
  46     my ($self) = @_;
  47
  48     syslog('info' , "server closing");
  49
  50     # wait for children
  51     1 while (waitpid(-1, POSIX::WNOHANG()) > 0);
  52
  53     syslog('info' , "clear firewall rules");
  54
  55     eval { PVE::Firewall::remove_pvefw_chains(); };
  56     warn $@ if $@;
  57
  58     $self->exit_daemon(0);
  59 }
  60
  61 sub hup {
  62     my ($self) = @_;
  63
  64     $restart_request = 1;
  65 }
  66
  67 sub run {
  68     my ($self) = @_;
  69
  70     local $SIG{'__WARN__'} = 'IGNORE'; # do not fill up logs
  71
  72     for (;;) { # forever
  73
  74         $next_update = time() + $updatetime;
  75
  76         my ($ccsec, $cusec) = gettimeofday ();
  77         eval {
  78             PVE::Cluster::cfs_update();
  79             PVE::Firewall::update();
  80         };
  81         my $err = $@;
  82
  83         if ($err) {
  84             syslog('err', "status update error: $err");
  85         }
  86
  87         my ($ccsec_end, $cusec_end) = gettimeofday ();
  88         my $cptime = ($ccsec_end-$ccsec) + ($cusec_end - $cusec)/1000000;
  89
  90         syslog('info', sprintf("firewall update time (%.3f seconds)", $cptime))
  91             if ($cptime > 5);
  92
  93         $cycle++;
  94
  95         my $mem = PVE::ProcFSTools::read_memory_usage();
  96
  97         if (!defined($initial_memory_usage) || ($cycle < 10)) {
  98             $initial_memory_usage = $mem->{resident};
  99         } else {
 100             my $diff = $mem->{resident} - $initial_memory_usage;
 101             if ($diff > 5*1024*1024) {
 102                 syslog ('info', "restarting server after $cycle cycles to " .
 103                         "reduce memory usage (free $mem->{resident} ($diff) bytes)");
 104                 $self->restart_daemon();
 105             }
 106         }
 107
 108         my $wcount = 0;
 109         while ((time() < $next_update) &&
 110                ($wcount < $updatetime) && # protect against time wrap
 111                !$restart_request) { $wcount++; sleep (1); };
 112
 113         $self->restart_daemon() if $restart_request;
 114     }
 115 }
 116
 117 $daemon->register_start_command("Start the Proxmox VE firewall service.");
 118 $daemon->register_restart_command(1, "Restart the Proxmox VE firewall service.");
 119 $daemon->register_stop_command("Stop firewall. This removes all Proxmox VE " .
 120                                "related iptable rules. " .
 121                                "The host is unprotected afterwards.");
 122
 123 __PACKAGE__->register_method ({
 124     name => 'status',
 125     path => 'status',
 126     method => 'GET',
 127     description => "Get firewall status.",
 128     parameters => {
 129         additionalProperties => 0,
 130         properties => {},
 131     },
 132     returns => {
 133         type => 'object',
 134         additionalProperties => 0,
 135         properties => {
 136             status => {
 137                 type => 'string',
 138                 enum => ['unknown', 'stopped', 'running'],
 139             },
 140             enable => {
 141                 description => "Firewall is enabled (in 'cluster.fw')",
 142                 type => 'boolean',
 143             },
 144             changes => {
 145                 description => "Set when there are pending changes.",
 146                 type => 'boolean',
 147                 optional => 1,
 148             }
 149         },
 150     },
 151     code => sub {
 152         my ($param) = @_;
 153
 154         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 155
 156         my $code = sub {
 157
 158             my $status = $daemon->running() ? 'running' : 'stopped';
 159
 160             my $res = { status => $status };
 161
 162             PVE::Firewall::set_verbose(1); # show syntax errors
 163
 164             my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
 165             $res->{enable} = $cluster_conf->{options}->{enable} ? 1 : 0;
 166
 167             if ($status eq 'running') {
 168
 169                 my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
 170
 171                 PVE::Firewall::set_verbose(0); # do not show iptables details
 172                 my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
 173                 my ($test, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{filter});
 174                 my (undef, $ruleset_changesv6) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{filter}, "ip6tables");
 175                 my (undef, $ruleset_changes_raw) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{raw}, undef, 'raw');
 176                 my (undef, $ruleset_changesv6_raw) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{raw}, "ip6tables", 'raw');
 177                 my (undef, $ebtables_changes) = PVE::Firewall::get_ebtables_cmdlist($ebtables_ruleset);
 178
 179                 $res->{changes} = ($ipset_changes || $ruleset_changes || $ruleset_changesv6 || $ebtables_changes || $ruleset_changes_raw || $ruleset_changesv6_raw) ? 1 : 0;
 180             }
 181
 182             return $res;
 183         };
 184
 185         return PVE::Firewall::run_locked($code);
 186     }});
 187
 188 __PACKAGE__->register_method ({
 189     name => 'compile',
 190     path => 'compile',
 191     method => 'GET',
 192     description => "Compile and print firewall rules. This is useful for testing.",
 193     parameters => {
 194         additionalProperties => 0,
 195         properties => {},
 196     },
 197     returns => { type => 'null' },
 198
 199     code => sub {
 200         my ($param) = @_;
 201
 202         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 203
 204         my $code = sub {
 205
 206             PVE::Firewall::set_verbose(1);
 207
 208             my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
 209             my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
 210
 211             print "ipset cmdlist:\n";
 212             my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
 213
 214             print "\niptables cmdlist:\n";
 215             my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{filter});
 216
 217             print "\nip6tables cmdlist:\n";
 218             my (undef, $ruleset_changesv6) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{filter}, "ip6tables");
 219
 220             print "\nebtables cmdlist:\n";
 221             my (undef, $ebtables_changes) = PVE::Firewall::get_ebtables_cmdlist($ebtables_ruleset);
 222
 223             print "\niptables table raw cmdlist:\n";
 224             my (undef, $ruleset_changes_raw) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{raw}, undef, 'raw');
 225
 226             print "\nip6tables table raw cmdlist:\n";
 227             my (undef, $ruleset_changesv6_raw) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{raw}, "ip6tables", 'raw');
 228
 229
 230             if ($ipset_changes || $ruleset_changes || $ruleset_changesv6 || $ebtables_changes || $ruleset_changes_raw || $ruleset_changesv6_raw) {
 231                 print "detected changes\n";
 232             } else {
 233                 print "no changes\n";
 234             }
 235             if (!$cluster_conf->{options}->{enable}) {
 236                 print "firewall disabled\n";
 237             }
 238         };
 239
 240         PVE::Firewall::run_locked($code);
 241
 242         return undef;
 243     }});
 244
 245 __PACKAGE__->register_method ({
 246     name => 'localnet',
 247     path => 'localnet',
 248     method => 'GET',
 249     description => "Print information about local network.",
 250     parameters => {
 251         additionalProperties => 0,
 252         properties => {},
 253     },
 254     returns => { type => 'null' },
 255     code => sub {
 256         my ($param) = @_;
 257
 258         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 259
 260         my $nodename = PVE::INotify::nodename();
 261         print "local hostname: $nodename\n";
 262
 263         my $ip = PVE::Cluster::remote_node_ip($nodename);
 264         print "local IP address: $ip\n";
 265
 266         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 267
 268         my $localnet = PVE::Firewall::local_network() || '127.0.0.0/8';
 269         print "network auto detect: $localnet\n";
 270         if ($cluster_conf->{aliases}->{local_network}) {
 271             print "using user defined local_network: $cluster_conf->{aliases}->{local_network}->{cidr}\n";
 272         } else {
 273             print "using detected local_network: $localnet\n";
 274         }
 275
 276         if (PVE::Corosync::check_conf_exists(1)) {
 277             my $corosync_conf = PVE::Cluster::cfs_read_file("corosync.conf");
 278             my $corosync_node_found = 0;
 279
 280             print "\naccepting corosync traffic from/to:\n";
 281
 282             PVE::Corosync::for_all_corosync_addresses($corosync_conf, undef, sub {
 283                 my ($curr_node_name, $curr_node_ip, undef, $key) = @_;
 284
 285                 return if $curr_node_name eq $nodename;
 286
 287                 $corosync_node_found = 1;
 288
 289                 $key =~ m/(?:ring|link)(\d+)_addr/;
 290                 print " - $curr_node_name: $curr_node_ip (link: $1)\n";
 291             });
 292
 293             if (!$corosync_node_found) {
 294                 print " - no nodes found\n";
 295             }
 296         }
 297
 298         return undef;
 299     }});
 300
 301 __PACKAGE__->register_method ({
 302     name => 'simulate',
 303     path => 'simulate',
 304     method => 'GET',
 305     description => "Simulate firewall rules. This does not simulate kernel 'routing' table. Instead, this simply assumes that routing from source zone to destination zone is possible.",
 306     parameters => {
 307         additionalProperties => 0,
 308         properties => {
 309             verbose => {
 310                 description => "Verbose output.",
 311                 type => 'boolean',
 312                 optional => 1,
 313                 default => 0,
 314             },
 315             from => {
 316                 description => "Source zone.",
 317                 type => 'string',
 318                 pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
 319                 optional => 1,
 320                 default => 'outside',
 321             },
 322             to => {
 323                 description => "Destination zone.",
 324                 type => 'string',
 325                 pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
 326                 optional => 1,
 327                 default => 'host',
 328             },
 329             protocol => {
 330                 description => "Protocol.",
 331                 type => 'string',
 332                 pattern => '(tcp|udp)',
 333                 optional => 1,
 334                 default => 'tcp',
 335             },
 336             dport => {
 337                 description => "Destination port.",
 338                 type => 'integer',
 339                 minValue => 1,
 340                 maxValue => 65535,
 341                 optional => 1,
 342             },
 343             sport => {
 344                 description => "Source port.",
 345                 type => 'integer',
 346                 minValue => 1,
 347                 maxValue => 65535,
 348                 optional => 1,
 349             },
 350             source => {
 351                 description => "Source IP address.",
 352                 type => 'string', format => 'ipv4',
 353                 optional => 1,
 354             },
 355             dest => {
 356                 description => "Destination IP address.",
 357                 type => 'string', format => 'ipv4',
 358                 optional => 1,
 359             },
 360         },
 361     },
 362     returns => { type => 'null' },
 363     code => sub {
 364         my ($param) = @_;
 365
 366         local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 367
 368         PVE::Firewall::set_verbose($param->{verbose});
 369
 370         my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile();
 371
 372         PVE::FirewallSimulator::debug();
 373
 374         my $host_ip = PVE::Cluster::remote_node_ip($nodename);
 375
 376         PVE::FirewallSimulator::reset_trace();
 377         print Dumper($ruleset->{filter}) if $param->{verbose};
 378         print Dumper($ruleset->{raw}) if $param->{verbose};
 379
 380         my $test = {
 381             from => $param->{from},
 382             to => $param->{to},
 383             proto => $param->{protocol} || 'tcp',
 384             source => $param->{source},
 385             dest => $param->{dest},
 386             dport => $param->{dport},
 387             sport => $param->{sport},
 388         };
 389
 390         if (!defined($test->{to})) {
 391             $test->{to} = 'host';
 392             PVE::FirewallSimulator::add_trace("Set Zone: to => '$test->{to}'\n");
 393         }
 394         if (!defined($test->{from})) {
 395             $test->{from} = 'outside',
 396             PVE::FirewallSimulator::add_trace("Set Zone: from => '$test->{from}'\n");
 397         }
 398
 399         my $vmdata = PVE::Firewall::read_local_vm_config();
 400
 401         print "Test packet:\n";
 402
 403         foreach my $k (qw(from to proto source dest dport sport)) {
 404             printf("  %-8s: %s\n", $k, $test->{$k}) if defined($test->{$k});
 405         }
 406
 407         $test->{action} = 'QUERY';
 408
 409         my $res = PVE::FirewallSimulator::simulate_firewall($ruleset->{filter}, $ipset_ruleset,
 410                                                             $host_ip, $vmdata, $test);
 411
 412         print "ACTION: $res\n";
 413
 414         return undef;
 415     }});
 416
 417 our $cmddef = {
 418     start => [ __PACKAGE__, 'start', []],
 419     restart => [ __PACKAGE__, 'restart', []],
 420     stop => [ __PACKAGE__, 'stop', []],
 421     compile => [ __PACKAGE__, 'compile', []],
 422     simulate => [ __PACKAGE__, 'simulate', []],
 423     localnet => [ __PACKAGE__, 'localnet', []],
 424     status => [ __PACKAGE__, 'status', [], undef, sub {
 425         my $res = shift;
 426         my $status = ($res->{enable} ? "enabled" : "disabled") . '/' . $res->{status};
 427
 428         if ($res->{changes}) {
 429             print "Status: $status (pending changes)\n";
 430         } else {
 431             print "Status: $status\n";
 432         }
 433     }],
 434  };
 435
 436 1;