config defaults: macfilter defaults to on
[pve-firewall.git] / src / PVE / Service / pve_firewall.pm
1 package PVE::Service::pve_firewall;
2
3 use strict;
4 use warnings;
5 use PVE::SafeSyslog;
6 use PVE::Daemon;
7
8 use Time::HiRes qw (gettimeofday);
9 use PVE::Tools qw(dir_glob_foreach file_read_firstline);
10 use PVE::ProcFSTools;
11 use PVE::INotify;
12 use PVE::Cluster qw(cfs_read_file);
13 use PVE::Corosync;
14 use PVE::RPCEnvironment;
15 use PVE::CLIHandler;
16 use PVE::Firewall;
17 use PVE::FirewallSimulator;
18 use Data::Dumper;
19
20 use base qw(PVE::Daemon);
21
22 my $cmdline = [$0, @ARGV];
23
24 my %daemon_options = (restart_on_error => 5, stop_wait_time => 5);
25
26 my $daemon = __PACKAGE__->new('pve-firewall', $cmdline, %daemon_options);
27
28 my $nodename = PVE::INotify::nodename();
29
30 sub init {
31
32 PVE::Cluster::cfs_update();
33
34 PVE::Firewall::init();
35 }
36
37 my $restart_request = 0;
38 my $next_update = 0;
39
40 my $cycle = 0;
41 my $updatetime = 10;
42
43 my $initial_memory_usage;
44
45 sub shutdown {
46 my ($self) = @_;
47
48 syslog('info' , "server closing");
49
50 # wait for children
51 1 while (waitpid(-1, POSIX::WNOHANG()) > 0);
52
53 syslog('info' , "clear firewall rules");
54
55 eval { PVE::Firewall::remove_pvefw_chains(); };
56 warn $@ if $@;
57
58 $self->exit_daemon(0);
59 }
60
61 sub hup {
62 my ($self) = @_;
63
64 $restart_request = 1;
65 }
66
67 sub run {
68 my ($self) = @_;
69
70 local $SIG{'__WARN__'} = 'IGNORE'; # do not fill up logs
71
72 for (;;) { # forever
73
74 $next_update = time() + $updatetime;
75
76 my ($ccsec, $cusec) = gettimeofday ();
77 eval {
78 PVE::Cluster::cfs_update();
79 PVE::Firewall::update();
80 };
81 my $err = $@;
82
83 if ($err) {
84 syslog('err', "status update error: $err");
85 }
86
87 my ($ccsec_end, $cusec_end) = gettimeofday ();
88 my $cptime = ($ccsec_end-$ccsec) + ($cusec_end - $cusec)/1000000;
89
90 syslog('info', sprintf("firewall update time (%.3f seconds)", $cptime))
91 if ($cptime > 5);
92
93 $cycle++;
94
95 my $mem = PVE::ProcFSTools::read_memory_usage();
96
97 if (!defined($initial_memory_usage) || ($cycle < 10)) {
98 $initial_memory_usage = $mem->{resident};
99 } else {
100 my $diff = $mem->{resident} - $initial_memory_usage;
101 if ($diff > 5*1024*1024) {
102 syslog ('info', "restarting server after $cycle cycles to " .
103 "reduce memory usage (free $mem->{resident} ($diff) bytes)");
104 $self->restart_daemon();
105 }
106 }
107
108 my $wcount = 0;
109 while ((time() < $next_update) &&
110 ($wcount < $updatetime) && # protect against time wrap
111 !$restart_request) { $wcount++; sleep (1); };
112
113 $self->restart_daemon() if $restart_request;
114 }
115 }
116
117 $daemon->register_start_command("Start the Proxmox VE firewall service.");
118 $daemon->register_restart_command(1, "Restart the Proxmox VE firewall service.");
119 $daemon->register_stop_command("Stop firewall. This removes all Proxmox VE " .
120 "related iptable rules. " .
121 "The host is unprotected afterwards.");
122
123 __PACKAGE__->register_method ({
124 name => 'status',
125 path => 'status',
126 method => 'GET',
127 description => "Get firewall status.",
128 parameters => {
129 additionalProperties => 0,
130 properties => {},
131 },
132 returns => {
133 type => 'object',
134 additionalProperties => 0,
135 properties => {
136 status => {
137 type => 'string',
138 enum => ['unknown', 'stopped', 'running'],
139 },
140 enable => {
141 description => "Firewall is enabled (in 'cluster.fw')",
142 type => 'boolean',
143 },
144 changes => {
145 description => "Set when there are pending changes.",
146 type => 'boolean',
147 optional => 1,
148 }
149 },
150 },
151 code => sub {
152 my ($param) = @_;
153
154 local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
155
156 my $code = sub {
157
158 my $status = $daemon->running() ? 'running' : 'stopped';
159
160 my $res = { status => $status };
161
162 PVE::Firewall::set_verbose(1); # show syntax errors
163
164 my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
165 $res->{enable} = $cluster_conf->{options}->{enable} ? 1 : 0;
166
167 if ($status eq 'running') {
168
169 my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
170
171 PVE::Firewall::set_verbose(0); # do not show iptables details
172 my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
173 my ($test, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{filter});
174 my (undef, $ruleset_changesv6) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{filter}, "ip6tables");
175 my (undef, $ruleset_changes_raw) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{raw}, undef, 'raw');
176 my (undef, $ruleset_changesv6_raw) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{raw}, "ip6tables", 'raw');
177 my (undef, $ebtables_changes) = PVE::Firewall::get_ebtables_cmdlist($ebtables_ruleset);
178
179 $res->{changes} = ($ipset_changes || $ruleset_changes || $ruleset_changesv6 || $ebtables_changes || $ruleset_changes_raw || $ruleset_changesv6_raw) ? 1 : 0;
180 }
181
182 return $res;
183 };
184
185 return PVE::Firewall::run_locked($code);
186 }});
187
188 __PACKAGE__->register_method ({
189 name => 'compile',
190 path => 'compile',
191 method => 'GET',
192 description => "Compile and print firewall rules. This is useful for testing.",
193 parameters => {
194 additionalProperties => 0,
195 properties => {},
196 },
197 returns => { type => 'null' },
198
199 code => sub {
200 my ($param) = @_;
201
202 local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
203
204 my $code = sub {
205
206 PVE::Firewall::set_verbose(1);
207
208 my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
209 my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
210
211 print "ipset cmdlist:\n";
212 my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
213
214 print "\niptables cmdlist:\n";
215 my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{filter});
216
217 print "\nip6tables cmdlist:\n";
218 my (undef, $ruleset_changesv6) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{filter}, "ip6tables");
219
220 print "\nebtables cmdlist:\n";
221 my (undef, $ebtables_changes) = PVE::Firewall::get_ebtables_cmdlist($ebtables_ruleset);
222
223 print "\niptables table raw cmdlist:\n";
224 my (undef, $ruleset_changes_raw) = PVE::Firewall::get_ruleset_cmdlist($ruleset->{raw}, undef, 'raw');
225
226 print "\nip6tables table raw cmdlist:\n";
227 my (undef, $ruleset_changesv6_raw) = PVE::Firewall::get_ruleset_cmdlist($rulesetv6->{raw}, "ip6tables", 'raw');
228
229
230 if ($ipset_changes || $ruleset_changes || $ruleset_changesv6 || $ebtables_changes || $ruleset_changes_raw || $ruleset_changesv6_raw) {
231 print "detected changes\n";
232 } else {
233 print "no changes\n";
234 }
235 if (!$cluster_conf->{options}->{enable}) {
236 print "firewall disabled\n";
237 }
238 };
239
240 PVE::Firewall::run_locked($code);
241
242 return undef;
243 }});
244
245 __PACKAGE__->register_method ({
246 name => 'localnet',
247 path => 'localnet',
248 method => 'GET',
249 description => "Print information about local network.",
250 parameters => {
251 additionalProperties => 0,
252 properties => {},
253 },
254 returns => { type => 'null' },
255 code => sub {
256 my ($param) = @_;
257
258 local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
259
260 my $nodename = PVE::INotify::nodename();
261 print "local hostname: $nodename\n";
262
263 my $ip = PVE::Cluster::remote_node_ip($nodename);
264 print "local IP address: $ip\n";
265
266 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
267
268 my $localnet = PVE::Firewall::local_network() || '127.0.0.0/8';
269 print "network auto detect: $localnet\n";
270 if ($cluster_conf->{aliases}->{local_network}) {
271 print "using user defined local_network: $cluster_conf->{aliases}->{local_network}->{cidr}\n";
272 } else {
273 print "using detected local_network: $localnet\n";
274 }
275
276 if (PVE::Corosync::check_conf_exists(1)) {
277 my $corosync_conf = PVE::Cluster::cfs_read_file("corosync.conf");
278 my $corosync_node_found = 0;
279
280 print "\naccepting corosync traffic from/to:\n";
281
282 PVE::Corosync::for_all_corosync_addresses($corosync_conf, undef, sub {
283 my ($curr_node_name, $curr_node_ip, undef, $key) = @_;
284
285 return if $curr_node_name eq $nodename;
286
287 $corosync_node_found = 1;
288
289 $key =~ m/(?:ring|link)(\d+)_addr/;
290 print " - $curr_node_name: $curr_node_ip (link: $1)\n";
291 });
292
293 if (!$corosync_node_found) {
294 print " - no nodes found\n";
295 }
296 }
297
298 return undef;
299 }});
300
301 __PACKAGE__->register_method ({
302 name => 'simulate',
303 path => 'simulate',
304 method => 'GET',
305 description => "Simulate firewall rules. This does not simulate kernel 'routing' table. Instead, this simply assumes that routing from source zone to destination zone is possible.",
306 parameters => {
307 additionalProperties => 0,
308 properties => {
309 verbose => {
310 description => "Verbose output.",
311 type => 'boolean',
312 optional => 1,
313 default => 0,
314 },
315 from => {
316 description => "Source zone.",
317 type => 'string',
318 pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
319 optional => 1,
320 default => 'outside',
321 },
322 to => {
323 description => "Destination zone.",
324 type => 'string',
325 pattern => '(host|outside|vm\d+|ct\d+|vmbr\d+/\S+)',
326 optional => 1,
327 default => 'host',
328 },
329 protocol => {
330 description => "Protocol.",
331 type => 'string',
332 pattern => '(tcp|udp)',
333 optional => 1,
334 default => 'tcp',
335 },
336 dport => {
337 description => "Destination port.",
338 type => 'integer',
339 minValue => 1,
340 maxValue => 65535,
341 optional => 1,
342 },
343 sport => {
344 description => "Source port.",
345 type => 'integer',
346 minValue => 1,
347 maxValue => 65535,
348 optional => 1,
349 },
350 source => {
351 description => "Source IP address.",
352 type => 'string', format => 'ipv4',
353 optional => 1,
354 },
355 dest => {
356 description => "Destination IP address.",
357 type => 'string', format => 'ipv4',
358 optional => 1,
359 },
360 },
361 },
362 returns => { type => 'null' },
363 code => sub {
364 my ($param) = @_;
365
366 local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
367
368 PVE::Firewall::set_verbose($param->{verbose});
369
370 my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile();
371
372 PVE::FirewallSimulator::debug();
373
374 my $host_ip = PVE::Cluster::remote_node_ip($nodename);
375
376 PVE::FirewallSimulator::reset_trace();
377 print Dumper($ruleset->{filter}) if $param->{verbose};
378 print Dumper($ruleset->{raw}) if $param->{verbose};
379
380 my $test = {
381 from => $param->{from},
382 to => $param->{to},
383 proto => $param->{protocol} || 'tcp',
384 source => $param->{source},
385 dest => $param->{dest},
386 dport => $param->{dport},
387 sport => $param->{sport},
388 };
389
390 if (!defined($test->{to})) {
391 $test->{to} = 'host';
392 PVE::FirewallSimulator::add_trace("Set Zone: to => '$test->{to}'\n");
393 }
394 if (!defined($test->{from})) {
395 $test->{from} = 'outside',
396 PVE::FirewallSimulator::add_trace("Set Zone: from => '$test->{from}'\n");
397 }
398
399 my $vmdata = PVE::Firewall::read_local_vm_config();
400
401 print "Test packet:\n";
402
403 foreach my $k (qw(from to proto source dest dport sport)) {
404 printf(" %-8s: %s\n", $k, $test->{$k}) if defined($test->{$k});
405 }
406
407 $test->{action} = 'QUERY';
408
409 my $res = PVE::FirewallSimulator::simulate_firewall($ruleset->{filter}, $ipset_ruleset,
410 $host_ip, $vmdata, $test);
411
412 print "ACTION: $res\n";
413
414 return undef;
415 }});
416
417 our $cmddef = {
418 start => [ __PACKAGE__, 'start', []],
419 restart => [ __PACKAGE__, 'restart', []],
420 stop => [ __PACKAGE__, 'stop', []],
421 compile => [ __PACKAGE__, 'compile', []],
422 simulate => [ __PACKAGE__, 'simulate', []],
423 localnet => [ __PACKAGE__, 'localnet', []],
424 status => [ __PACKAGE__, 'status', [], undef, sub {
425 my $res = shift;
426 my $status = ($res->{enable} ? "enabled" : "disabled") . '/' . $res->{status};
427
428 if ($res->{changes}) {
429 print "Status: $status (pending changes)\n";
430 } else {
431 print "Status: $status\n";
432 }
433 }],
434 };
435
436 1;