]>
git.proxmox.com Git - pve-firewall.git/blob - test/fwtester.pl
16 sub print_usage_and_exit
{
17 die "usage: $0 [--debug] [testfile [testid]]\n";
20 if (!GetOptions
('debug' => \
$debug)) {
21 print_usage_and_exit
();
24 my $testfilename = shift;
38 my ($devre, $dev) = @_;
40 $devre =~ s/\+$/\.\*/;
41 return ($dev =~ m/^${devre}$/) ?
1 : 0;
45 my ($chain, $rule, $pkg) = @_;
47 $rule =~ s/^-A $chain // || die "got strange rule: $rule";
49 if ($rule =~ s/^-m conntrack\s*//) {
50 return undef; # simply ignore
53 if ($rule =~ s/^-m addrtype\s*//) {
54 return undef; # simply ignore
57 if ($rule =~ s/^-i (\S+)\s*//) {
59 die "missing iface_in" if !$pkg->{iface_in
};
60 return undef if !nf_dev_match
($devre, $pkg->{iface_in
});
62 if ($rule =~ s/^-o (\S+)\s*//) {
64 die "missing iface_out" if !$pkg->{iface_out
};
65 return undef if !nf_dev_match
($devre, $pkg->{iface_out
});
68 if ($rule =~ s/^-p (tcp|udp)\s*//) {
69 die "missing proto" if !$pkg->{proto
};
70 return undef if $pkg->{proto
} ne $1; # no match
73 if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
74 die "missing dport" if !$pkg->{dport
};
75 return undef if ($pkg->{dport
} < $1) || ($pkg->{dport
} > $2); # no match
78 if ($rule =~ s/^--dport (\d+)\s*//) {
79 die "missing dport" if !$pkg->{dport
};
80 return undef if $pkg->{dport
} != $1; # no match
83 if ($rule =~ s/^-s (\S+)\s*//) {
84 die "missing source" if !$pkg->{source
};
85 return undef if $pkg->{source
} ne $1; # no match
88 if ($rule =~ s/^-d (\S+)\s*//) {
89 die "missing destination" if !$pkg->{dest
};
90 return undef if $pkg->{dest
} ne $1; # no match
93 if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
94 die "missing source mac" if !$pkg->{mac_source
};
95 return undef if $pkg->{mac_source
} eq $1; # no match
98 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
100 return undef if !$pkg->{physdev_in
};
101 return undef if !nf_dev_match
($devre, $pkg->{physdev_in
});
104 if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
106 return undef if !$pkg->{physdev_out
};
107 return undef if !nf_dev_match
($devre, $pkg->{physdev_out
});
110 if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
115 if ($rule =~ s/^-j (\S+)\s*$//) {
119 if ($rule =~ s/^-g (\S+)\s*$//) {
123 die "unable to parse rule: $rule";
126 sub ruleset_simulate_chain
{
127 my ($ruleset, $chain, $pkg) = @_;
129 add_trace
("ENTER chain $chain\n");
133 if ($chain eq 'PVEFW-Drop') {
134 add_trace
("LEAVE chain $chain\n");
135 return ('DROP', $counter);
137 if ($chain eq 'PVEFW-reject') {
138 add_trace
("LEAVE chain $chain\n");
139 return ('REJECT', $counter);
142 if ($chain eq 'PVEFW-tcpflags') {
143 add_trace
("LEAVE chain $chain\n");
144 return (undef, $counter);
147 my $rules = $ruleset->{$chain} ||
148 die "no such chain '$chain'";
150 foreach my $rule (@$rules) {
152 my ($goto, $action) = rule_match
($chain, $rule, $pkg);
153 if (!defined($action)) {
154 add_trace
("SKIP: $rule\n");
157 add_trace
("MATCH: $rule\n");
159 if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
160 add_trace
("TERMINATE chain $chain: $action\n");
161 return ($action, $counter);
162 } elsif ($action eq 'RETURN') {
163 add_trace
("RETURN FROM chain $chain\n");
167 add_trace
("LEAVE chain $chain - goto $action\n");
168 return ruleset_simulate_chain
($ruleset, $action, $pkg)
170 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
172 my ($act, $ctr) = ruleset_simulate_chain
($ruleset, $action, $pkg);
174 return ($act, $counter) if $act;
175 add_trace
("CONTINUE chain $chain\n");
180 add_trace
("LEAVE chain $chain\n");
181 if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
182 return ('ACCEPT', $counter); # default policy
185 return (undef, $counter);
193 while (my ($k,$v) = each %$pkg) {
200 # Try to simulate packet traversal inside kernel. This invokes iptable
201 # checks several times.
203 my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
205 my $route_state = $start_state;
209 my $ipt_invocation_counter = 0;
210 my $rule_check_counter = 0;
212 while ($route_state ne $target->{iface
}) {
215 my $next_route_state;
218 $pkg->{iface_in
} = $pkg->{iface_out
} = undef;
219 $pkg->{physdev_in
} = $pkg->{physdev_out
} = undef;
221 if ($route_state eq 'from-bport') {
222 $next_route_state = $from_info->{bridge
} || die 'internal error';
223 $next_physdev_in = $from_info->{iface
} || die 'internal error';
224 } elsif ($route_state eq 'host') {
226 if ($target->{type
} eq 'bport') {
227 $pkg->{iface_in
} = 'lo';
228 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
229 $chain = 'PVEFW-OUTPUT';
230 $next_route_state = $target->{iface
} || die 'internal error';
231 } elsif ($target->{type
} eq 'ct') {
232 $pkg->{iface_in
} = 'lo';
233 $pkg->{iface_out
} = 'venet0';
234 $chain = 'PVEFW-OUTPUT';
235 $next_route_state = 'venet-in';
236 } elsif ($target->{type
} eq 'vm') {
237 $pkg->{iface_in
} = 'lo';
238 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
239 $chain = 'PVEFW-OUTPUT';
240 $next_route_state = 'fwbr-in';
245 } elsif ($route_state eq 'venet-out') {
247 if ($target->{type
} eq 'host') {
249 $chain = 'PVEFW-INPUT';
250 $pkg->{iface_in
} = 'venet0';
251 $pkg->{iface_out
} = 'lo';
252 $next_route_state = 'host';
254 } elsif ($target->{type
} eq 'bport') {
256 $chain = 'PVEFW-FORWARD';
257 $pkg->{iface_in
} = 'venet0';
258 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
259 $next_route_state = $target->{iface
} || die 'internal error';
261 } elsif ($target->{type
} eq 'vm') {
263 $chain = 'PVEFW-FORWARD';
264 $pkg->{iface_in
} = 'venet0';
265 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
266 $next_route_state = 'fwbr-in';
268 } elsif ($target->{type
} eq 'ct') {
270 $chain = 'PVEFW-FORWARD';
271 $pkg->{iface_in
} = 'venet0';
272 $pkg->{iface_out
} = 'venet0';
273 $next_route_state = 'venet-in';
279 } elsif ($route_state eq 'fwbr-out') {
281 $chain = 'PVEFW-FORWARD';
282 $next_route_state = $from_info->{bridge
} || die 'internal error';
283 $next_physdev_in = $from_info->{fwpr
} || die 'internal error';
284 $pkg->{iface_in
} = $from_info->{fwbr
} || die 'internal error';
285 $pkg->{iface_out
} = $from_info->{fwbr
} || die 'internal error';
286 $pkg->{physdev_in
} = $from_info->{tapdev
} || die 'internal error';
287 $pkg->{physdev_out
} = $from_info->{fwln
} || die 'internal error';
289 } elsif ($route_state eq 'fwbr-in') {
291 $chain = 'PVEFW-FORWARD';
292 $next_route_state = $target->{tapdev
};
293 $pkg->{iface_in
} = $target->{fwbr
} || die 'internal error';
294 $pkg->{iface_out
} = $target->{fwbr
} || die 'internal error';
295 $pkg->{physdev_in
} = $target->{fwln
} || die 'internal error';
296 $pkg->{physdev_out
} = $target->{tapdev
} || die 'internal error';
298 } elsif ($route_state =~ m/^vmbr\d+$/) {
300 die "missing physdev_in - internal error?" if !$physdev_in;
301 $pkg->{physdev_in
} = $physdev_in;
303 if ($target->{type
} eq 'host') {
305 $chain = 'PVEFW-INPUT';
306 $pkg->{iface_in
} = $route_state;
307 $pkg->{iface_out
} = 'lo';
308 $next_route_state = 'host';
310 } elsif ($target->{type
} eq 'bport') {
312 $chain = 'PVEFW-FORWARD';
313 $pkg->{iface_in
} = $route_state;
314 $pkg->{iface_out
} = $target->{bridge
} || die 'internal error';
315 # conditionally set physdev_out (same behavior as kernel)
316 if ($route_state eq $target->{bridge
}) {
317 $pkg->{physdev_out
} = $target->{iface
} || die 'internal error';
319 $next_route_state = $target->{iface
};
321 } elsif ($target->{type
} eq 'ct') {
323 $chain = 'PVEFW-FORWARD';
324 $pkg->{iface_in
} = $route_state;
325 $pkg->{iface_out
} = 'venet0';
326 $next_route_state = 'venet-in';
328 } elsif ($target->{type
} eq 'vm') {
330 $chain = 'PVEFW-FORWARD';
331 $pkg->{iface_in
} = $route_state;
332 $pkg->{iface_out
} = $target->{bridge
};
333 # conditionally set physdev_out (same behavior as kernel)
334 if ($route_state eq $target->{bridge
}) {
335 $pkg->{physdev_out
} = $target->{fwpr
} || die 'internal error';
337 $next_route_state = 'fwbr-in';
344 die "implement me $route_state";
347 die "internal error" if !defined($next_route_state);
350 add_trace
("IPT check at $route_state (chain $chain)\n");
351 add_trace
(Dumper
($pkg));
352 $ipt_invocation_counter++;
353 my ($res, $ctr) = ruleset_simulate_chain
($ruleset, $chain, $pkg);
354 $rule_check_counter += $ctr;
355 return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
358 $route_state = $next_route_state;
360 $physdev_in = $next_physdev_in;
363 return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
366 sub extract_ct_info
{
367 my ($vmdata, $vmid) = @_;
369 my $info = { type
=> 'ct', vmid
=> $vmid };
371 my $conf = $vmdata->{openvz
}->{$vmid} || die "no such CT '$vmid'";
372 if ($conf->{ip_address
}) {
373 $info->{ip_address
} = $conf->{ip_address
}->{value
};
380 sub extract_vm_info
{
381 my ($vmdata, $vmid) = @_;
383 my $info = { type
=> 'vm', vmid
=> $vmid };
385 my $conf = $vmdata->{qemu
}->{$vmid} || die "no such VM '$vmid'";
386 my $net = PVE
::QemuServer
::parse_net
($conf->{net0
});
387 $info->{macaddr
} = $net->{macaddr
} || die "unable to get mac address";
388 $info->{bridge
} = $net->{bridge
} || die "unable to get bridge";
389 $info->{fwbr
} = "fwbr${vmid}i0";
390 $info->{tapdev
} = "tap${vmid}i0";
391 $info->{fwln
} = "fwln${vmid}i0";
392 $info->{fwpr
} = "fwpr${vmid}p0";
397 sub simulate_firewall
{
398 my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
400 my $from = delete $test->{from
} || die "missing 'from' field";
401 my $to = delete $test->{to
} || die "missing 'to' field";
402 my $action = delete $test->{action
} || die "missing 'action'";
404 my $testid = delete $test->{id
};
406 die "from/to needs to be different" if $from eq $to;
416 while (my ($k,$v) = each %$test) {
417 die "unknown attribute '$k'\n" if !exists($pkg->{$k});
425 if ($from eq 'host') {
426 $from_info->{type
} = 'host';
427 $start_state = 'host';
428 } elsif ($from =~ m
|^(vmbr\d
+)/(\S
+)$|) {
429 $from_info->{type
} = 'bport';
430 $from_info->{bridge
} = $1;
431 $from_info->{iface
} = $2;
432 $start_state = 'from-bport';
433 } elsif ($from eq 'outside') {
434 $from_info->{type
} = 'bport';
435 $from_info->{bridge
} = 'vmbr0';
436 $from_info->{iface
} = 'eth0';
437 $start_state = 'from-bport';
438 } elsif ($from eq 'nfvm') {
439 $from_info->{type
} = 'bport';
440 $from_info->{bridge
} = 'vmbr0';
441 $from_info->{iface
} = 'tapXYZ';
442 $start_state = 'from-bport';
443 } elsif ($from =~ m/^ct(\d+)$/) {
445 $from_info = extract_ct_info
($vmdata, $vmid);
446 if ($from_info->{ip_address
}) {
447 $pkg->{source
} = $from_info->{ip_address
};
448 $start_state = 'venet-out';
452 } elsif ($from =~ m/^vm(\d+)$/) {
454 $from_info = extract_vm_info
($vmdata, $vmid);
455 $start_state = 'fwbr-out';
456 $pkg->{mac_source
} = $from_info->{macaddr
};
458 die "unable to parse \"from => '$from'\"\n";
464 $target->{type
} = 'host';
465 $target->{iface
} = 'host';
466 } elsif ($to =~ m
|^(vmbr\d
+)/(\S
+)$|) {
467 $target->{type
} = 'bport';
468 $target->{bridge
} = $1;
469 $target->{iface
} = $2;
470 } elsif ($to eq 'outside') {
471 $target->{type
} = 'bport';
472 $target->{bridge
} = 'vmbr0';
473 $target->{iface
} = 'eth0';
474 } elsif ($to eq 'nfvm') {
475 $target->{type
} = 'bport';
476 $target->{bridge
} = 'vmbr0';
477 $target->{iface
} = 'tapXYZ';
478 } elsif ($to =~ m/^ct(\d+)$/) {
480 $target = extract_ct_info
($vmdata, $vmid);
481 $target->{iface
} = 'venet-in';
483 if ($target->{ip_address
}) {
484 $pkg->{dest
} = $target->{ip_address
};
488 } elsif ($to =~ m/^vm(\d+)$/) {
490 $target = extract_vm_info
($vmdata, $vmid);
491 $target->{iface
} = $target->{tapdev
};
493 die "unable to parse \"to => '$to'\"\n";
496 my ($res, $ic, $rc) = route_packet
($ruleset, $ipset_ruleset, $pkg,
497 $from_info, $target, $start_state);
499 add_trace
("IPT statistics: invocation = $ic, checks = $rc\n");
501 die "test failed ($res != $action)\n" if $action ne $res;
507 my ($vmdata, $testdir, $testfile, $testid) = @_;
509 $testfile = 'tests' if !$testfile;
511 $vmdata->{testdir
} = $testdir;
513 my ($ruleset, $ipset_ruleset) =
514 PVE
::Firewall
::compile
(undef, undef, $vmdata);
516 my $filename = "$testdir/$testfile";
517 my $fh = IO
::File-
>new($filename) ||
518 die "unable to open '$filename' - $!\n";
521 while (defined(my $line = <$fh>)) {
522 next if $line =~ m/^\s*$/;
523 next if $line =~ m/^#.*$/;
524 if ($line =~ m/^\{.*\}\s*$/) {
525 my $test = eval $line;
527 next if defined($testid) && (!defined($test->{id
}) || ($testid ne $test->{id
}));
529 print Dumper
($ruleset) if $debug;
531 eval { simulate_firewall
($ruleset, $ipset_ruleset, $vmdata, $test); };
534 print Dumper
($ruleset) if !$debug;
536 print "$trace\n" if !$debug;
538 print "$filename line $.: $line";
540 print "test failed: $err\n";
549 die "no tests found\n" if $testcount <= 0;
551 print "PASS: $filename\n";
559 net0
=> "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0",
562 net0
=> "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0",
566 net0
=> "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1",
571 ip_address
=> { value
=> '10.0.200.1' },
574 ip_address
=> { value
=> '10.0.200.2' },
583 if (-d
$testfilename) {
584 $dir = $testfilename;
585 } elsif (-f
$testfilename) {
586 $dir = dirname
($testfilename);
587 $testfile = basename
($testfilename);
589 die "no such file/dir '$testfilename'\n";
592 run_tests
($vmdata, $dir, $testfile, $testid);
595 foreach my $dir (<test-
*>) {
597 run_tests
($vmdata, $dir);
601 print "OK - all tests passed\n";