]>
git.proxmox.com Git - pve-firewall.git/blob - test/fwtester.pl
555e1516700ad15769450adbec98c4b27bff96cf
14 my $outside_iface = 'eth0';
15 my $outside_bridge = 'vmbr0';
19 sub print_usage_and_exit
{
20 die "usage: $0 [--debug] [testfile [testid]]\n";
23 if (!GetOptions
('debug' => \
$debug)) {
24 print_usage_and_exit
();
27 my $testfilename = shift;
41 my ($chain, $rule, $pkg) = @_;
43 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
45 if ($rule =~ s/^-m conntrack\s*//) {
46 return undef; # simply ignore
49 if ($rule =~ s/^-m addrtype\s*//) {
50 return undef; # simply ignore
53 if ($rule =~ s/^-i (\S+)\s*//) {
54 die "missing iface_in" if !$pkg->{iface_in
};
55 return undef if $pkg->{iface_in
} ne $1; # no match
57 if ($rule =~ s/^-o (\S+)\s*//) {
58 die "missing iface_out" if !$pkg->{iface_out
};
59 return undef if $pkg->{iface_out
} ne $1; # no match
62 if ($rule =~ s/^-p (tcp|udp)\s*//) {
63 die "missing proto" if !$pkg->{proto
};
64 return undef if $pkg->{proto
} ne $1; # no match
67 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
68 die "missing dport" if !$pkg->{dport
};
69 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
72 if ($rule =~ s/^--dport (\d+)\s*//) {
73 die "missing dport" if !$pkg->{dport
};
74 return undef if $pkg->{dport
} != $1; # no match
77 if ($rule =~ s/^-s (\S+)\s*//) {
78 die "missing source" if !$pkg->{source
};
79 return undef if $pkg->{source
} ne $1; # no match
82 if ($rule =~ s/^-d (\S+)\s*//) {
83 die "missing destination" if !$pkg->{dest
};
84 return undef if $pkg->{dest
} ne $1; # no match
87 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
88 die "missing source mac" if !$pkg->{mac_source
};
89 return undef if $pkg->{mac_source
} eq $1; # no match
92 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
95 return undef if !$pkg->{physdev_in
};
96 return undef if $pkg->{physdev_in
} !~ m/^${devre}$/;
99 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
101 $devre =~ s/\+/\.\*/;
102 return undef if !$pkg->{physdev_out
};
103 return undef if $pkg->{physdev_out
} !~ m/^${devre}$/;
106 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
111 if ($rule =~ s/^-j (\S+)\s*$//) {
115 if ($rule =~ s/^-g (\S+)\s*$//) {
119 die "unable to parse rule: $rule";
122 sub ruleset_simulate_chain
{
123 my ($ruleset, $chain, $pkg) = @_;
125 add_trace
("ENTER chain $chain\n");
127 if ($chain eq 'PVEFW-Drop') {
128 add_trace
("LEAVE chain $chain\n");
131 if ($chain eq 'PVEFW-reject') {
132 add_trace
("LEAVE chain $chain\n");
136 if ($chain eq 'PVEFW-tcpflags') {
137 add_trace
("LEAVE chain $chain\n");
141 my $rules = $ruleset->{$chain} ||
142 die "no such chain '$chain'";
144 foreach my $rule (@$rules) {
145 my ($goto, $action) = rule_match
($chain, $rule, $pkg);
146 if (!defined($action)) {
147 add_trace
("SKIP: $rule\n");
150 add_trace
("MATCH: $rule\n");
152 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
153 add_trace
("TERMINATE chain $chain: $action\n");
155 } elsif ($action eq 'RETURN') {
156 add_trace
("RETURN FROM chain $chain\n");
160 add_trace
("LEAVE chain $chain - goto $action\n");
161 return ruleset_simulate_chain
($ruleset, $action, $pkg)
163 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
165 if ($action = ruleset_simulate_chain
($ruleset, $action, $pkg)) {
168 add_trace
("CONTINUE chain $chain\n");
173 add_trace
("LEAVE chain $chain\n");
174 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
175 return 'ACCEPT'; # default policy
186 while (my ($k,$v) = each %$pkg) {
193 # Try to simulate packet traversal inside kernel. This invokes iptable
194 # checks several times.
196 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
198 my $route_state = $start_state;
202 while ($route_state ne $target->{iface
}) {
205 my $next_route_state;
208 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
209 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
211 if ($route_state eq 'from-outside') {
212 $next_route_state = $outside_bridge || die 'internal error';
213 $next_physdev_in = $outside_iface || die 'internal error';
214 } elsif ($route_state eq 'host') {
216 if ($target->{type
} eq 'outside') {
217 $pkg->{iface_in
} = 'lo';
218 $pkg->{iface_out
} = $outside_bridge;
219 $chain = 'PVEFW-OUTPUT';
220 $next_route_state = $outside_iface
221 } elsif ($target->{type
} eq 'ct') {
222 $pkg->{iface_in
} = 'lo';
223 $pkg->{iface_out
} = 'venet0';
224 $chain = 'PVEFW-OUTPUT';
225 $next_route_state = 'venet-in';
226 } elsif ($target->{type
} eq 'vm') {
227 $pkg->{iface_in
} = 'lo';
228 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
229 $chain = 'PVEFW-OUTPUT';
230 $next_route_state = 'fwbr-in';
235 } elsif ($route_state eq 'venet-out') {
237 if ($target->{type
} eq 'host') {
239 $chain = 'PVEFW-INPUT';
240 $pkg->{iface_in
} = 'venet0';
241 $pkg->{iface_out
} = 'lo';
242 $next_route_state = 'host';
244 } elsif ($target->{type
} eq 'outside') {
246 $chain = 'PVEFW-FORWARD';
247 $pkg->{iface_in
} = 'venet0';
248 $pkg->{iface_out
} = $outside_bridge;
249 $next_route_state = $outside_iface;
251 } elsif ($target->{type
} eq 'vm') {
253 $chain = 'PVEFW-FORWARD';
254 $pkg->{iface_in
} = 'venet0';
255 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
256 $next_route_state = 'fwbr-in';
258 } elsif ($target->{type
} eq 'ct') {
260 $chain = 'PVEFW-FORWARD';
261 $pkg->{iface_in
} = 'venet0';
262 $pkg->{iface_out
} = 'venet0';
263 $next_route_state = 'venet-in';
269 } elsif ($route_state eq 'fwbr-out') {
271 $chain = 'PVEFW-FORWARD';
272 $next_route_state = $from_info->{bridge
} || die 'internal error';
273 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
274 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
275 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
276 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
277 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
279 } elsif ($route_state eq 'fwbr-in') {
281 $chain = 'PVEFW-FORWARD';
282 $next_route_state = $target->{tapdev
};
283 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
284 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
285 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
286 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
288 } elsif ($route_state =~ m/^vmbr\d+$/) {
290 die "missing physdev_in - internal error?" if !$physdev_in;
292 if ($target->{type
} eq 'host') {
294 $chain = 'PVEFW-INPUT';
295 $pkg->{iface_in
} = $route_state;
296 $pkg->{iface_out
} = 'lo';
297 $next_route_state = 'host';
299 if ($route_state eq $outside_bridge) {
305 } elsif ($target->{type
} eq 'outside') {
307 $chain = 'PVEFW-FORWARD';
308 $pkg->{iface_in
} = $route_state;
309 $pkg->{iface_out
} = $outside_bridge;
310 $pkg->{physdev_in
} = $physdev_in;
311 # conditionally set physdev_out (same behavior as kernel)
312 if ($route_state eq $outside_bridge) {
313 $pkg->{physdev_out
} = $outside_iface || die 'internal error';
315 $next_route_state = $outside_iface;
317 } elsif ($target->{type
} eq 'ct') {
319 $chain = 'PVEFW-FORWARD';
320 $pkg->{iface_in
} = $route_state;
321 $pkg->{iface_out
} = 'venet0';
322 $next_route_state = 'venet-in';
324 } elsif ($target->{type
} eq 'vm') {
326 $chain = 'PVEFW-FORWARD';
327 $pkg->{iface_in
} = $route_state;
328 $pkg->{iface_out
} = $target->{bridge
};
329 $pkg->{physdev_in
} = $physdev_in;
330 # conditionally set physdev_out (same behavior as kernel)
331 if ($route_state eq $target->{bridge
}) {
332 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
334 $next_route_state = 'fwbr-in';
341 die "implement me $route_state";
344 die "internal error" if !defined($next_route_state);
347 add_trace
("IPT check at $route_state (chain $chain)\n");
348 add_trace
(Dumper
($pkg));
349 my $res = ruleset_simulate_chain
($ruleset, $chain, $pkg);
350 return $res if $res ne 'ACCEPT';
353 $route_state = $next_route_state;
355 $physdev_in = $next_physdev_in;
361 sub extract_ct_info
{
362 my ($vmdata, $vmid) = @_;
364 my $info = { type
=> 'ct', vmid
=> $vmid };
366 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
367 if ($conf->{ip_address
}) {
368 $info->{ip_address
} = $conf->{ip_address
}->{value
};
375 sub extract_vm_info
{
376 my ($vmdata, $vmid) = @_;
378 my $info = { type
=> 'vm', vmid
=> $vmid };
380 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
381 my $net = PVE
::QemuServer
::parse_net
($conf->{net0
});
382 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
383 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
384 $info->{fwbr
} = "fwbr${vmid}i0";
385 $info->{tapdev
} = "tap${vmid}i0";
386 $info->{fwln
} = "fwln${vmid}i0";
387 $info->{fwpr
} = "fwpr${vmid}p0";
392 sub simulate_firewall
{
393 my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
395 my $from = delete $test->{from
} || die "missing 'from' field";
396 my $to = delete $test->{to
} || die "missing 'to' field";
397 my $action = delete $test->{action
} || die "missing 'action'";
399 my $testid = delete $test->{id
};
401 die "from/to needs to be different" if $from eq $to;
411 while (my ($k,$v) = each %$test) {
412 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
420 if ($from eq 'host') {
421 $from_info->{type
} = 'host';
422 $start_state = 'host';
423 } elsif ($from eq 'outside') {
424 $from_info->{type
} = 'outside';
425 $start_state = 'from-outside';
426 } elsif ($from =~ m/^ct(\d+)$/) {
428 $from_info = extract_ct_info
($vmdata, $vmid);
429 if ($from_info->{ip_address
}) {
430 $pkg->{source
} = $from_info->{ip_address
};
431 $start_state = 'venet-out';
435 } elsif ($from =~ m/^vm(\d+)$/) {
437 $from_info = extract_vm_info
($vmdata, $vmid);
438 $start_state = 'fwbr-out';
439 $pkg->{mac_source
} = $from_info->{macaddr
};
447 $target->{type
} = 'host';
448 $target->{iface
} = 'host';
449 } elsif ($to eq 'outside') {
450 $target->{type
} = 'outside';
451 $target->{iface
} = $outside_iface;
452 } elsif ($to =~ m/^ct(\d+)$/) {
454 $target = extract_ct_info
($vmdata, $vmid);
455 $target->{iface
} = 'venet-in';
457 if ($target->{ip_address
}) {
458 $pkg->{dest
} = $target->{ip_address
};
462 } elsif ($to =~ m/^vm(\d+)$/) {
464 $target = extract_vm_info
($vmdata, $vmid);
465 $target->{iface
} = $target->{tapdev
};
470 my $res = route_packet
($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state);
472 die "test failed ($res != $action)\n" if $action ne $res;
478 my ($vmdata, $testdir, $testfile, $testid) = @_;
480 $testfile = 'tests' if !$testfile;
482 $vmdata->{testdir
} = $testdir;
484 my ($ruleset, $ipset_ruleset) =
485 PVE
::Firewall
::compile
(undef, undef, $vmdata);
487 my $filename = "$testdir/$testfile";
488 my $fh = IO
::File-
>new($filename) ||
489 die "unable to open '$filename' - $!\n";
492 while (defined(my $line = <$fh>)) {
493 next if $line =~ m/^\s*$/;
494 next if $line =~ m/^#.*$/;
495 if ($line =~ m/^\{.*\}\s*$/) {
496 my $test = eval $line;
498 next if defined($testid) && (!defined($test->{id
}) || ($testid ne $test->{id
}));
500 print Dumper
($ruleset) if $debug;
502 eval { simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test); };
505 print Dumper
($ruleset) if !$debug;
507 print "$trace\n" if !$debug;
509 print "$filename line $.: $line";
511 print "test failed: $err\n";
520 die "no tests found\n" if $testcount <= 0;
522 print "PASS: $filename\n";
530 net0
=> "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0",
533 net0
=> "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0",
537 net0
=> "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1",
542 ip_address
=> { value
=> '10.0.200.1' },
545 ip_address
=> { value
=> '10.0.200.2' },
554 if (-d
$testfilename) {
555 $dir = $testfilename;
556 } elsif (-f
$testfilename) {
557 $dir = dirname
($testfilename);
558 $testfile = basename
($testfilename);
560 die "no such file/dir '$testfilename'\n";
563 run_tests
($vmdata, $dir, $testfile, $testid);
566 foreach my $dir (<test-
*>) {
568 run_tests
($vmdata, $dir);
572 print "OK - all tests passed\n";