]>
git.proxmox.com Git - pve-firewall.git/blob - test/fwtester.pl
25360769ca0fec6a694e7ce661809cacbf4f4aac
13 my ($chain, $rule, $pkg) = @_;
15 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
17 if ($rule =~ s/^-m conntrack\s*//) {
18 return undef; # simply ignore
21 if ($rule =~ s/^-m addrtype\s*//) {
22 return undef; # simply ignore
25 if ($rule =~ s/^-i (\S+)\s*//) {
26 die "missing iface_in" if !$pkg->{iface_in
};
27 return undef if $pkg->{iface_in
} ne $1; # no match
29 if ($rule =~ s/^-o (\S+)\s*//) {
30 die "missing iface_out" if !$pkg->{iface_out
};
31 return undef if $pkg->{iface_out
} ne $1; # no match
34 if ($rule =~ s/^-p (tcp|udp)\s*//) {
35 die "missing proto" if !$pkg->{proto
};
36 return undef if $pkg->{proto
} ne $1; # no match
39 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
40 die "missing dport" if !$pkg->{dport
};
41 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
44 if ($rule =~ s/^--dport (\d+)\s*//) {
45 die "missing dport" if !$pkg->{dport
};
46 return undef if $pkg->{dport
} != $1; # no match
49 if ($rule =~ s/^-s (\S+)\s*//) {
50 die "missing source" if !$pkg->{source
};
51 return undef if $pkg->{source
} ne $1; # no match
54 if ($rule =~ s/^-d (\S+)\s*//) {
55 die "missing destination" if !$pkg->{dest
};
56 return undef if $pkg->{dest
} ne $1; # no match
59 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
60 die "missing source mac" if !$pkg->{mac_source
};
61 return undef if $pkg->{mac_source
} eq $1; # no match
64 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
67 return undef if !$pkg->{physdev_in
};
68 return undef if $pkg->{physdev_in
} !~ m/^${devre}$/;
71 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
74 return undef if !$pkg->{physdev_out
};
75 return undef if $pkg->{physdev_out
} !~ m/^${devre}$/;
78 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
83 if ($rule =~ s/^-j (\S+)\s*$//) {
87 if ($rule =~ s/^-g (\S+)\s*$//) {
91 die "unable to parse rule: $rule";
94 sub ruleset_simulate_chain
{
95 my ($ruleset, $chain, $pkg) = @_;
97 $trace .= "ENTER chain $chain\n";
99 if ($chain eq 'PVEFW-Drop') {
100 $trace .= "LEAVE chain $chain\n";
103 if ($chain eq 'PVEFW-reject') {
104 $trace .= "LEAVE chain $chain\n";
108 if ($chain eq 'PVEFW-tcpflags') {
109 $trace .= "LEAVE chain $chain\n";
113 my $rules = $ruleset->{$chain} ||
114 die "no such chain '$chain'";
116 foreach my $rule (@$rules) {
117 my ($goto, $action) = rule_match
($chain, $rule, $pkg);
118 if (!defined($action)) {
119 $trace .= "SKIP: $rule\n";
122 $trace .= "MATCH: $rule\n";
124 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
125 $trace .= "TERMINATE chain $chain: $action\n";
127 } elsif ($action eq 'RETURN') {
128 $trace .= "RETURN FROM chain $chain\n";
132 $trace .= "LEAVE chain $chain - goto $action\n";
133 return ruleset_simulate_chain
($ruleset, $action, $pkg)
135 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
137 if ($action = ruleset_simulate_chain
($ruleset, $action, $pkg)) {
140 $trace .= "CONTINUE chain $chain\n";
145 $trace .= "LEAVE chain $chain\n";
146 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
147 return 'ACCEPT'; # default policy
158 while (my ($k,$v) = each %$pkg) {
166 sub simulate_firewall
{
167 my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
169 my $from = delete $test->{from
} || die "missing 'from' field";
170 my $to = delete $test->{to
} || die "missing 'to' field";
171 my $action = delete $test->{action
} || die "missing 'action'";
173 die "from/to needs to be different" if $from eq $to;
181 source
=> '10.11.12.13',
182 dest
=> '10.11.12.14',
185 while (my ($k,$v) = each %$test) {
191 if ($from eq 'host') {
192 $pre_test = ['PVEFW-OUTPUT', $pkg];
193 } elsif ($from =~ m/^ct(\d+)$/) {
195 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
196 if ($conf->{ip_address
}) {
197 $pkg->{source
} = $conf->{ip_address
}->{value
};
198 $pkg->{iface_in
} = 'venet0';
202 $pre_test = ['PVEFW-FORWARD', $pkg];
203 } elsif ($from =~ m/^vm(\d+)$/) {
205 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
206 my $net = PVE
::QemuServer
::parse_net
($conf->{net0
});
207 my $macaddr = $net->{macaddr
} || die "unable to get mac address";
208 $pkg->{iface_in
} = $net->{bridge
} || die "unable to get bridge";
209 $pkg->{mac_source
} = $macaddr;
210 my $brpkg = copy_packet
($pkg);
211 $brpkg->{physdev_in
} = "tap${vmid}i0";
212 $brpkg->{physdev_out
} = "fwln${vmid}i0";
213 $brpkg->{iface_in
} = $brpkg->{iface_out
} = "fwbr${vmid}i0";
214 $pre_test = ['PVEFW-FORWARD', $brpkg];
221 $post_test = ['PVEFW-INPUT', $pkg];
222 } elsif ($to =~ m/^ct(\d+)$/) {
224 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
225 if ($conf->{ip_address
}) {
226 $pkg->{dest
} = $conf->{ip_address
}->{value
};
227 $pkg->{iface_out
} = 'venet0';
231 $post_test = ['PVEFW-FORWARD', $pkg];
232 } elsif ($to =~ m/^vm(\d+)$/) {
234 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
235 my $net = PVE
::QemuServer
::parse_net
($conf->{net0
});
236 $pkg->{iface_out
} = $net->{bridge
} || die "unable to get bridge";
237 my $brpkg = copy_packet
($pkg);
238 $brpkg->{physdev_out
} = "tap${vmid}i0";
239 $brpkg->{physdev_in
} = "fwln${vmid}i0";
240 $brpkg->{iface_in
} = $brpkg->{iface_out
} = "fwbr${vmid}i0";
241 $post_test = ['PVEFW-FORWARD', $brpkg];
248 my ($chain, $testpkg) = @$pre_test;
249 $trace .= "PRE TEST $chain: " . Dumper
($testpkg);
250 $res = ruleset_simulate_chain
($ruleset, $chain, $testpkg);
251 if ($res ne 'ACCEPT') {
252 die "test failed ($res != $action)\n" if $action ne $res;
253 return undef; # sucess
258 my ($chain, $testpkg) = @$post_test;
259 $trace .= "POST TEST $chain: " . Dumper
($testpkg);
260 $res = ruleset_simulate_chain
($ruleset, $chain, $testpkg);
261 if ($res ne 'ACCEPT') {
262 die "test failed ($res != $action)\n" if $action ne $res;
263 return undef; # sucess
267 die "test failed ($res != $action)\n" if $action ne $res; # fixme: remove
273 my ($vmdata, $testdir) = @_;
275 $vmdata->{testdir
} = $testdir;
277 my ($ruleset, $ipset_ruleset) =
278 PVE
::Firewall
::compile
(undef, undef, $vmdata);
280 my $testfile = "$testdir/tests";
281 my $fh = IO
::File-
>new($testfile) ||
282 die "unable to open '$testfile' - $!\n";
284 while (defined(my $line = <$fh>)) {
285 next if $line =~ m/^\s*$/;
286 next if $line =~ m/^#.*$/;
287 if ($line =~ m/^\{.*\}\s*$/) {
288 my $test = eval $line;
291 eval { simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test); };
294 print Dumper
($ruleset);
298 print "$testfile line $.: $line";
300 print "test failed: $err\n";
309 print "PASS: $testfile\n";
317 net0
=> "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=0",
322 ip_address
=> { value
=> '10.0.200.1' },
327 foreach my $dir (<test-
*>) {
329 run_tests
($vmdata, $dir);
332 print "OK - all tests passed\n";