]>
git.proxmox.com Git - pve-firewall.git/blob - test/fwtester.pl
17 sub print_usage_and_exit
{
18 die "usage: $0 [--debug] [testfile [testid]]\n";
21 if (!GetOptions
('debug' => \
$debug)) {
22 print_usage_and_exit
();
25 my $testfilename = shift;
39 my ($devre, $dev) = @_;
41 $devre =~ s/\+$/\.\*/;
42 return ($dev =~ m/^${devre}$/) ?
1 : 0;
46 my ($chain, $rule, $pkg) = @_;
48 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
50 while (length($rule)) {
52 if ($rule =~ s/^-m conntrack\s*//) {
53 return undef; # simply ignore
56 if ($rule =~ s/^-m addrtype\s*//) {
57 return undef; # simply ignore
60 if ($rule =~ s/^-i (\S+)\s*//) {
62 die "missing iface_in" if !$pkg->{iface_in
};
63 return undef if !nf_dev_match
($devre, $pkg->{iface_in
});
67 if ($rule =~ s/^-o (\S+)\s*//) {
69 die "missing iface_out" if !$pkg->{iface_out
};
70 return undef if !nf_dev_match
($devre, $pkg->{iface_out
});
74 if ($rule =~ s/^-p (tcp|udp)\s*//) {
75 die "missing proto" if !$pkg->{proto
};
76 return undef if $pkg->{proto
} ne $1; # no match
80 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
81 die "missing dport" if !$pkg->{dport
};
82 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
86 if ($rule =~ s/^--dport (\d+)\s*//) {
87 die "missing dport" if !$pkg->{dport
};
88 return undef if $pkg->{dport
} != $1; # no match
92 if ($rule =~ s/^-s (\S+)\s*//) {
93 die "missing source" if !$pkg->{source
};
94 my $ip = Net
::IP-
>new($1);
95 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{source
})); # no match
99 if ($rule =~ s/^-d (\S+)\s*//) {
100 die "missing destination" if !$pkg->{dest
};
101 my $ip = Net
::IP-
>new($1);
102 return undef if !$ip->overlaps(Net
::IP-
>new($pkg->{dest
})); # no match
106 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
107 die "missing source mac" if !$pkg->{mac_source
};
108 return undef if $pkg->{mac_source
} eq $1; # no match
112 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
114 return undef if !$pkg->{physdev_in
};
115 return undef if !nf_dev_match
($devre, $pkg->{physdev_in
});
119 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
121 return undef if !$pkg->{physdev_out
};
122 return undef if !nf_dev_match
($devre, $pkg->{physdev_out
});
126 if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
127 return undef if !defined($mark) || $mark != $1;
132 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
137 if ($rule =~ s/^-j (\S+)\s*$//) {
141 if ($rule =~ s/^-g (\S+)\s*$//) {
148 die "unable to parse rule: $rule";
151 sub ruleset_simulate_chain
{
152 my ($ruleset, $chain, $pkg) = @_;
154 add_trace
("ENTER chain $chain\n");
158 if ($chain eq 'PVEFW-Drop') {
159 add_trace
("LEAVE chain $chain\n");
160 return ('DROP', $counter);
162 if ($chain eq 'PVEFW-reject') {
163 add_trace
("LEAVE chain $chain\n");
164 return ('REJECT', $counter);
167 if ($chain eq 'PVEFW-tcpflags') {
168 add_trace
("LEAVE chain $chain\n");
169 return (undef, $counter);
172 my $rules = $ruleset->{$chain} ||
173 die "no such chain '$chain'";
175 foreach my $rule (@$rules) {
177 my ($goto, $action) = rule_match
($chain, $rule, $pkg);
178 if (!defined($action)) {
179 add_trace
("SKIP: $rule\n");
182 add_trace
("MATCH: $rule\n");
184 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
185 add_trace
("TERMINATE chain $chain: $action\n");
186 return ($action, $counter);
187 } elsif ($action eq 'RETURN') {
188 add_trace
("RETURN FROM chain $chain\n");
192 add_trace
("LEAVE chain $chain - goto $action\n");
193 return ruleset_simulate_chain
($ruleset, $action, $pkg)
195 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
197 my ($act, $ctr) = ruleset_simulate_chain
($ruleset, $action, $pkg);
199 return ($act, $counter) if $act;
200 add_trace
("CONTINUE chain $chain\n");
205 add_trace
("LEAVE chain $chain\n");
206 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
207 return ('ACCEPT', $counter); # default policy
210 return (undef, $counter);
218 while (my ($k,$v) = each %$pkg) {
225 # Try to simulate packet traversal inside kernel. This invokes iptable
226 # checks several times.
228 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
230 my $route_state = $start_state;
234 my $ipt_invocation_counter = 0;
235 my $rule_check_counter = 0;
237 while ($route_state ne $target->{iface
}) {
240 my $next_route_state;
243 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
244 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
246 if ($route_state eq 'from-bport') {
247 $next_route_state = $from_info->{bridge
} || die 'internal error';
248 $next_physdev_in = $from_info->{iface
} || die 'internal error';
249 } elsif ($route_state eq 'host') {
251 if ($target->{type
} eq 'bport') {
252 $pkg->{iface_in
} = 'lo';
253 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
254 $chain = 'PVEFW-OUTPUT';
255 $next_route_state = $target->{iface
} || die 'internal error';
256 } elsif ($target->{type
} eq 'ct') {
257 $pkg->{iface_in
} = 'lo';
258 $pkg->{iface_out
} = 'venet0';
259 $chain = 'PVEFW-OUTPUT';
260 $next_route_state = 'venet-in';
261 } elsif ($target->{type
} eq 'vm') {
262 $pkg->{iface_in
} = 'lo';
263 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
264 $chain = 'PVEFW-OUTPUT';
265 $next_route_state = 'fwbr-in';
270 } elsif ($route_state eq 'venet-out') {
272 if ($target->{type
} eq 'host') {
274 $chain = 'PVEFW-INPUT';
275 $pkg->{iface_in
} = 'venet0';
276 $pkg->{iface_out
} = 'lo';
277 $next_route_state = 'host';
279 } elsif ($target->{type
} eq 'bport') {
281 $chain = 'PVEFW-FORWARD';
282 $pkg->{iface_in
} = 'venet0';
283 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
284 $next_route_state = $target->{iface
} || die 'internal error';
286 } elsif ($target->{type
} eq 'vm') {
288 $chain = 'PVEFW-FORWARD';
289 $pkg->{iface_in
} = 'venet0';
290 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
291 $next_route_state = 'fwbr-in';
293 } elsif ($target->{type
} eq 'ct') {
295 $chain = 'PVEFW-FORWARD';
296 $pkg->{iface_in
} = 'venet0';
297 $pkg->{iface_out
} = 'venet0';
298 $next_route_state = 'venet-in';
304 } elsif ($route_state eq 'fwbr-out') {
306 $chain = 'PVEFW-FORWARD';
307 $next_route_state = $from_info->{bridge
} || die 'internal error';
308 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
309 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
310 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
311 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
312 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
314 } elsif ($route_state eq 'fwbr-in') {
316 $chain = 'PVEFW-FORWARD';
317 $next_route_state = $target->{tapdev
};
318 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
319 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
320 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
321 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
323 } elsif ($route_state =~ m/^vmbr\d+$/) {
325 die "missing physdev_in - internal error?" if !$physdev_in;
326 $pkg->{physdev_in
} = $physdev_in;
328 if ($target->{type
} eq 'host') {
330 $chain = 'PVEFW-INPUT';
331 $pkg->{iface_in
} = $route_state;
332 $pkg->{iface_out
} = 'lo';
333 $next_route_state = 'host';
335 } elsif ($target->{type
} eq 'bport') {
337 $chain = 'PVEFW-FORWARD';
338 $pkg->{iface_in
} = $route_state;
339 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
340 # conditionally set physdev_out (same behavior as kernel)
341 if ($route_state eq $target->{bridge
}) {
342 $pkg->{physdev_out
} = $target->{iface
} || die 'internal error';
344 $next_route_state = $target->{iface
};
346 } elsif ($target->{type
} eq 'ct') {
348 $chain = 'PVEFW-FORWARD';
349 $pkg->{iface_in
} = $route_state;
350 $pkg->{iface_out
} = 'venet0';
351 $next_route_state = 'venet-in';
353 } elsif ($target->{type
} eq 'vm') {
355 $chain = 'PVEFW-FORWARD';
356 $pkg->{iface_in
} = $route_state;
357 $pkg->{iface_out
} = $target->{bridge
};
358 # conditionally set physdev_out (same behavior as kernel)
359 if ($route_state eq $target->{bridge
}) {
360 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
362 $next_route_state = 'fwbr-in';
369 die "implement me $route_state";
372 die "internal error" if !defined($next_route_state);
375 add_trace
("IPT check at $route_state (chain $chain)\n");
376 add_trace
(Dumper
($pkg));
377 $ipt_invocation_counter++;
378 my ($res, $ctr) = ruleset_simulate_chain
($ruleset, $chain, $pkg);
379 $rule_check_counter += $ctr;
380 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
383 $route_state = $next_route_state;
385 $physdev_in = $next_physdev_in;
388 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
391 sub extract_ct_info
{
392 my ($vmdata, $vmid) = @_;
394 my $info = { type
=> 'ct', vmid
=> $vmid };
396 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
397 if ($conf->{ip_address
}) {
398 $info->{ip_address
} = $conf->{ip_address
}->{value
};
405 sub extract_vm_info
{
406 my ($vmdata, $vmid) = @_;
408 my $info = { type
=> 'vm', vmid
=> $vmid };
410 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
411 my $net = PVE
::QemuServer
::parse_net
($conf->{net0
});
412 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
413 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
414 $info->{fwbr
} = "fwbr${vmid}i0";
415 $info->{tapdev
} = "tap${vmid}i0";
416 $info->{fwln
} = "fwln${vmid}i0";
417 $info->{fwpr
} = "fwpr${vmid}p0";
422 sub simulate_firewall
{
423 my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
425 my $from = $test->{from
} || die "missing 'from' field";
426 my $to = $test->{to
} || die "missing 'to' field";
427 my $action = $test->{action
} || die "missing 'action'";
429 my $testid = $test->{id
};
431 die "from/to needs to be different" if $from eq $to;
441 while (my ($k,$v) = each %$test) {
442 next if $k eq 'from';
444 next if $k eq 'action';
446 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
454 if ($from eq 'host') {
455 $from_info->{type
} = 'host';
456 $start_state = 'host';
457 } elsif ($from =~ m
|^(vmbr\d
+)/(\S
+)$|) {
458 $from_info->{type
} = 'bport';
459 $from_info->{bridge
} = $1;
460 $from_info->{iface
} = $2;
461 $start_state = 'from-bport';
462 } elsif ($from eq 'outside') {
463 $from_info->{type
} = 'bport';
464 $from_info->{bridge
} = 'vmbr0';
465 $from_info->{iface
} = 'eth0';
466 $start_state = 'from-bport';
467 } elsif ($from eq 'nfvm') {
468 $from_info->{type
} = 'bport';
469 $from_info->{bridge
} = 'vmbr0';
470 $from_info->{iface
} = 'tapXYZ';
471 $start_state = 'from-bport';
472 } elsif ($from =~ m/^ct(\d+)$/) {
474 $from_info = extract_ct_info
($vmdata, $vmid);
475 if ($from_info->{ip_address
}) {
476 $pkg->{source
} = $from_info->{ip_address
} if !defined($pkg->{source
});
477 $start_state = 'venet-out';
481 } elsif ($from =~ m/^vm(\d+)$/) {
483 $from_info = extract_vm_info
($vmdata, $vmid);
484 $start_state = 'fwbr-out';
485 $pkg->{mac_source
} = $from_info->{macaddr
};
487 die "unable to parse \"from => '$from'\"\n";
493 $target->{type
} = 'host';
494 $target->{iface
} = 'host';
495 } elsif ($to =~ m
|^(vmbr\d
+)/(\S
+)$|) {
496 $target->{type
} = 'bport';
497 $target->{bridge
} = $1;
498 $target->{iface
} = $2;
499 } elsif ($to eq 'outside') {
500 $target->{type
} = 'bport';
501 $target->{bridge
} = 'vmbr0';
502 $target->{iface
} = 'eth0';
503 } elsif ($to eq 'nfvm') {
504 $target->{type
} = 'bport';
505 $target->{bridge
} = 'vmbr0';
506 $target->{iface
} = 'tapXYZ';
507 } elsif ($to =~ m/^ct(\d+)$/) {
509 $target = extract_ct_info
($vmdata, $vmid);
510 $target->{iface
} = 'venet-in';
512 if ($target->{ip_address
}) {
513 $pkg->{dest
} = $target->{ip_address
};
517 } elsif ($to =~ m/^vm(\d+)$/) {
519 $target = extract_vm_info
($vmdata, $vmid);
520 $target->{iface
} = $target->{tapdev
};
522 die "unable to parse \"to => '$to'\"\n";
525 my ($res, $ic, $rc) = route_packet
($ruleset, $ipset_ruleset, $pkg,
526 $from_info, $target, $start_state);
528 add_trace
("IPT statistics: invocation = $ic, checks = $rc\n");
530 die "test failed ($res != $action)\n" if $action ne $res;
536 my ($vmdata, $testdir, $testfile, $testid) = @_;
538 $testfile = 'tests' if !$testfile;
540 $vmdata->{testdir
} = $testdir;
542 my ($ruleset, $ipset_ruleset) =
543 PVE
::Firewall
::compile
(undef, undef, $vmdata);
545 my $filename = "$testdir/$testfile";
546 my $fh = IO
::File-
>new($filename) ||
547 die "unable to open '$filename' - $!\n";
550 while (defined(my $line = <$fh>)) {
551 next if $line =~ m/^\s*$/;
552 next if $line =~ m/^#.*$/;
553 if ($line =~ m/^\{.*\}\s*$/) {
554 my $test = eval $line;
556 next if defined($testid) && (!defined($test->{id
}) || ($testid ne $test->{id
}));
558 print Dumper
($ruleset) if $debug;
561 my @test_zones = qw(host outside nfvm vm100 ct200);
562 if (!defined($test->{from
}) && !defined($test->{to
})) {
563 die "missing zone speification (from, to)\n";
564 } elsif (!defined($test->{to
})) {
565 foreach my $zone (@test_zones) {
566 next if $zone eq $test->{from
};
568 add_trace
("Set Zone: to => '$zone'\n");
569 simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test);
571 } elsif (!defined($test->{from
})) {
572 foreach my $zone (@test_zones) {
573 next if $zone eq $test->{to
};
574 $test->{from
} = $zone;
575 add_trace
("Set Zone: from => '$zone'\n");
576 simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test);
579 simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test);
584 print Dumper
($ruleset) if !$debug;
586 print "$trace\n" if !$debug;
588 print "$filename line $.: $line";
590 print "test failed: $err\n";
599 die "no tests found\n" if $testcount <= 0;
601 print "PASS: $filename\n";
609 net0
=> "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
612 net0
=> "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
616 net0
=> "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
621 ip_address
=> { value
=> '10.0.200.1' },
624 ip_address
=> { value
=> '10.0.200.2' },
633 if (-d
$testfilename) {
634 $dir = $testfilename;
635 } elsif (-f
$testfilename) {
636 $dir = dirname
($testfilename);
637 $testfile = basename
($testfilename);
639 die "no such file/dir '$testfilename'\n";
642 run_tests
($vmdata, $dir, $testfile, $testid);
645 foreach my $dir (<test-
*>) {
647 run_tests
($vmdata, $dir);
651 print "OK - all tests passed\n";