test/fwtester.pl

   1 #!/usr/bin/perl
   2
   3 use lib '../src';
   4 use strict;
   5 use warnings;
   6 use Data::Dumper;
   7 use PVE::Firewall;
   8 use Getopt::Long;
   9 use File::Basename;
  10 use Net::IP;
  11
  12 my $mark;
  13 my $trace;
  14
  15 my $debug = 0;
  16
  17 sub print_usage_and_exit {
  18     die "usage: $0 [--debug] [testfile [testid]]\n";
  19 }
  20
  21 if (!GetOptions ('debug' => \$debug)) {
  22     print_usage_and_exit();
  23 }
  24
  25 my $testfilename = shift;
  26 my $testid = shift;
  27
  28 sub add_trace {
  29     my ($text) = @_;
  30
  31     if ($debug) {
  32         print $text;
  33     } else {
  34         $trace .= $text;
  35     }
  36 }
  37
  38 sub nf_dev_match {
  39     my ($devre, $dev) = @_;
  40
  41     $devre =~ s/\+$/\.\*/;
  42     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  43 }
  44
  45 sub rule_match {
  46     my ($chain, $rule, $pkg) = @_;
  47
  48     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
  49
  50     while (length($rule)) {
  51
  52         if ($rule =~ s/^-m conntrack\s*//) {
  53             return undef; # simply ignore
  54         }
  55
  56         if ($rule =~ s/^-m addrtype\s*//) {
  57             return undef; # simply ignore
  58         }
  59
  60         if ($rule =~ s/^-i (\S+)\s*//) {
  61             my $devre = $1;
  62             die "missing iface_in" if !$pkg->{iface_in};
  63             return undef if !nf_dev_match($devre, $pkg->{iface_in});
  64             next;
  65         }
  66
  67         if ($rule =~ s/^-o (\S+)\s*//) {
  68             my $devre = $1;
  69             die "missing iface_out" if !$pkg->{iface_out};
  70             return undef if !nf_dev_match($devre, $pkg->{iface_out});
  71             next;
  72         }
  73
  74         if ($rule =~ s/^-p (tcp|udp)\s*//) {
  75             die "missing proto" if !$pkg->{proto};
  76             return undef if $pkg->{proto} ne $1; # no match
  77             next;
  78         }
  79
  80         if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
  81             die "missing dport" if !$pkg->{dport};
  82             return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
  83             next;
  84         }
  85
  86         if ($rule =~ s/^--dport (\d+)\s*//) {
  87             die "missing dport" if !$pkg->{dport};
  88             return undef if $pkg->{dport} != $1; # no match
  89             next;
  90         }
  91
  92         if ($rule =~ s/^-s (\S+)\s*//) {
  93             die "missing source" if !$pkg->{source};
  94             my $ip = Net::IP->new($1);
  95             return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
  96             next;
  97         }
  98
  99         if ($rule =~ s/^-d (\S+)\s*//) {
 100             die "missing destination" if !$pkg->{dest};
 101             my $ip = Net::IP->new($1);
 102             return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
 103             next;
 104         }
 105
 106         if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
 107             die "missing source mac" if !$pkg->{mac_source};
 108             return undef if $pkg->{mac_source} eq $1; # no match
 109             next;
 110         }
 111
 112         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
 113             my $devre = $1;
 114             return undef if !$pkg->{physdev_in};
 115             return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 116             next;
 117         }
 118
 119         if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 120             my $devre = $1;
 121             return undef if !$pkg->{physdev_out};
 122             return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 123             next;
 124         }
 125
 126         if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
 127             return undef if !defined($mark) || $mark != $1;
 128             next;
 129         }
 130
 131         # final actions
 132         if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
 133             $mark = $1;
 134             return undef;
 135         }
 136
 137         if ($rule =~ s/^-j (\S+)\s*$//) {
 138             return (0, $1);
 139         }
 140
 141         if ($rule =~ s/^-g (\S+)\s*$//) {
 142             return (1, $1);
 143         }
 144
 145         last;
 146     }
 147
 148     die "unable to parse rule: $rule";
 149 }
 150
 151 sub ruleset_simulate_chain {
 152     my ($ruleset, $chain, $pkg) = @_;
 153
 154     add_trace("ENTER chain $chain\n");
 155
 156     my $counter = 0;
 157
 158     if ($chain eq 'PVEFW-Drop') {
 159         add_trace("LEAVE chain $chain\n");
 160         return ('DROP', $counter);
 161     }
 162     if ($chain eq 'PVEFW-reject') {
 163         add_trace("LEAVE chain $chain\n");
 164         return ('REJECT', $counter);
 165     }
 166
 167     if ($chain eq 'PVEFW-tcpflags') {
 168         add_trace("LEAVE chain $chain\n");
 169         return (undef, $counter);
 170     }
 171
 172     my $rules = $ruleset->{$chain} ||
 173         die "no such chain '$chain'";
 174
 175     foreach my $rule (@$rules) {
 176         $counter++;
 177         my ($goto, $action) = rule_match($chain, $rule, $pkg);
 178         if (!defined($action)) {
 179             add_trace("SKIP: $rule\n");
 180             next;
 181         }
 182         add_trace("MATCH: $rule\n");
 183
 184         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 185             add_trace("TERMINATE chain $chain: $action\n");
 186             return ($action, $counter);
 187         } elsif ($action eq 'RETURN') {
 188             add_trace("RETURN FROM chain $chain\n");
 189             last;
 190         } else {
 191             if ($goto) {
 192                 add_trace("LEAVE chain $chain - goto $action\n");
 193                 return ruleset_simulate_chain($ruleset, $action, $pkg)
 194                 #$chain = $action;
 195                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 196             } else {
 197                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $action, $pkg);
 198                 $counter += $ctr;
 199                 return ($act, $counter) if $act;
 200                 add_trace("CONTINUE chain $chain\n");
 201             }
 202         }
 203     }
 204
 205     add_trace("LEAVE chain $chain\n");
 206     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 207         return ('ACCEPT', $counter); # default policy
 208     }
 209
 210     return (undef, $counter);
 211 }
 212
 213 sub copy_packet {
 214     my ($pkg) = @_;
 215
 216     my $res = {};
 217
 218     while (my ($k,$v) = each %$pkg) {
 219         $res->{$k} = $v;
 220     }
 221
 222     return $res;
 223 }
 224
 225 # Try to simulate packet traversal inside kernel. This invokes iptable
 226 # checks several times.
 227 sub route_packet {
 228     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 229
 230     my $route_state = $start_state;
 231
 232     my $physdev_in;
 233
 234     my $ipt_invocation_counter = 0;
 235     my $rule_check_counter = 0;
 236
 237     while ($route_state ne $target->{iface}) {
 238
 239         my $chain;
 240         my $next_route_state;
 241         my $next_physdev_in;
 242
 243         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 244         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 245
 246         if ($route_state eq 'from-bport') {
 247             $next_route_state = $from_info->{bridge} || die 'internal error';
 248             $next_physdev_in = $from_info->{iface} || die 'internal error';
 249         } elsif ($route_state eq 'host') {
 250
 251             if ($target->{type} eq 'bport') {
 252                 $pkg->{iface_in} = 'lo';
 253                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 254                 $chain = 'PVEFW-OUTPUT';
 255                 $next_route_state = $target->{iface} || die 'internal error';
 256             } elsif ($target->{type} eq 'ct') {
 257                 $pkg->{iface_in} = 'lo';
 258                 $pkg->{iface_out} = 'venet0';
 259                 $chain = 'PVEFW-OUTPUT';
 260                 $next_route_state = 'venet-in';
 261             } elsif ($target->{type} eq 'vm') {
 262                 $pkg->{iface_in} = 'lo';
 263                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 264                 $chain = 'PVEFW-OUTPUT';
 265                 $next_route_state = 'fwbr-in';
 266             } else {
 267                 die "implement me";
 268             }
 269
 270         } elsif ($route_state eq 'venet-out') {
 271
 272             if ($target->{type} eq 'host') {
 273
 274                 $chain = 'PVEFW-INPUT';
 275                 $pkg->{iface_in} = 'venet0';
 276                 $pkg->{iface_out} = 'lo';
 277                 $next_route_state = 'host';
 278
 279             } elsif ($target->{type} eq 'bport') {
 280
 281                 $chain = 'PVEFW-FORWARD';
 282                 $pkg->{iface_in} = 'venet0';
 283                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 284                 $next_route_state = $target->{iface} || die 'internal error';
 285
 286             } elsif ($target->{type} eq 'vm') {
 287
 288                 $chain = 'PVEFW-FORWARD';
 289                 $pkg->{iface_in} = 'venet0';
 290                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 291                 $next_route_state = 'fwbr-in';
 292
 293             } elsif ($target->{type} eq 'ct') {
 294
 295                 $chain = 'PVEFW-FORWARD';
 296                 $pkg->{iface_in} = 'venet0';
 297                 $pkg->{iface_out} = 'venet0';
 298                 $next_route_state = 'venet-in';
 299
 300             } else {
 301                 die "implement me";
 302             }
 303
 304         } elsif ($route_state eq 'fwbr-out') {
 305
 306             $chain = 'PVEFW-FORWARD';
 307             $next_route_state = $from_info->{bridge} || die 'internal error';
 308             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 309             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 310             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 311             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 312             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 313
 314         } elsif ($route_state eq 'fwbr-in') {
 315
 316             $chain = 'PVEFW-FORWARD';
 317             $next_route_state = $target->{tapdev};
 318             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 319             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 320             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 321             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 322
 323         } elsif ($route_state =~ m/^vmbr\d+$/) {
 324
 325             die "missing physdev_in - internal error?" if !$physdev_in;
 326             $pkg->{physdev_in} = $physdev_in;
 327
 328             if ($target->{type} eq 'host') {
 329
 330                 $chain = 'PVEFW-INPUT';
 331                 $pkg->{iface_in} = $route_state;
 332                 $pkg->{iface_out} = 'lo';
 333                 $next_route_state = 'host';
 334
 335             } elsif ($target->{type} eq 'bport') {
 336
 337                 $chain = 'PVEFW-FORWARD';
 338                 $pkg->{iface_in} = $route_state;
 339                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 340                 # conditionally set physdev_out (same behavior as kernel)
 341                 if ($route_state eq $target->{bridge}) {
 342                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 343                 }
 344                 $next_route_state = $target->{iface};
 345
 346             } elsif ($target->{type} eq 'ct') {
 347
 348                 $chain = 'PVEFW-FORWARD';
 349                 $pkg->{iface_in} = $route_state;
 350                 $pkg->{iface_out} = 'venet0';
 351                 $next_route_state = 'venet-in';
 352
 353             } elsif ($target->{type} eq 'vm') {
 354
 355                 $chain = 'PVEFW-FORWARD';
 356                 $pkg->{iface_in} = $route_state;
 357                 $pkg->{iface_out} = $target->{bridge};
 358                 # conditionally set physdev_out (same behavior as kernel)
 359                 if ($route_state eq $target->{bridge}) {
 360                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 361                 }
 362                 $next_route_state = 'fwbr-in';
 363
 364             } else {
 365                 die "implement me";
 366             }
 367
 368         } else {
 369             die "implement me $route_state";
 370         }
 371
 372         die "internal error" if !defined($next_route_state);
 373
 374         if ($chain) {
 375             add_trace("IPT check at $route_state (chain $chain)\n");
 376             add_trace(Dumper($pkg));
 377             $ipt_invocation_counter++;
 378             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $chain, $pkg);
 379             $rule_check_counter += $ctr;
 380             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 381         }
 382
 383         $route_state = $next_route_state;
 384
 385         $physdev_in = $next_physdev_in;
 386     }
 387
 388     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 389 }
 390
 391 sub extract_ct_info {
 392     my ($vmdata, $vmid) = @_;
 393
 394     my $info = { type => 'ct', vmid => $vmid };
 395
 396     my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
 397     if ($conf->{ip_address}) {
 398         $info->{ip_address} = $conf->{ip_address}->{value};
 399     } else {
 400         die "implement me";
 401     }
 402     return $info;
 403 }
 404
 405 sub extract_vm_info {
 406     my ($vmdata, $vmid) = @_;
 407
 408     my $info = { type => 'vm', vmid => $vmid };
 409
 410     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 411     my $net = PVE::QemuServer::parse_net($conf->{net0});
 412     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 413     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 414     $info->{fwbr} = "fwbr${vmid}i0";
 415     $info->{tapdev} = "tap${vmid}i0";
 416     $info->{fwln} = "fwln${vmid}i0";
 417     $info->{fwpr} = "fwpr${vmid}p0";
 418
 419     return $info;
 420 }
 421
 422 sub simulate_firewall {
 423     my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
 424
 425     my $from = delete $test->{from} || die "missing 'from' field";
 426     my $to = delete $test->{to} || die "missing 'to' field";
 427     my $action = delete $test->{action} || die "missing 'action'";
 428
 429     my $testid = delete $test->{id};
 430
 431     die "from/to needs to be different" if $from eq $to;
 432
 433     my $pkg = {
 434         proto => 'tcp',
 435         sport => undef,
 436         dport => undef,
 437         source => undef,
 438         dest => undef,
 439     };
 440
 441     while (my ($k,$v) = each %$test) {
 442         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 443         $pkg->{$k} = $v;
 444     }
 445
 446     my $from_info = {};
 447
 448     my $start_state;
 449
 450     if ($from eq 'host') {
 451         $from_info->{type} = 'host';
 452         $start_state = 'host';
 453     } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
 454         $from_info->{type} = 'bport';
 455         $from_info->{bridge} = $1;
 456         $from_info->{iface} = $2;
 457         $start_state = 'from-bport';
 458     } elsif ($from eq 'outside') {
 459         $from_info->{type} = 'bport';
 460         $from_info->{bridge} = 'vmbr0';
 461         $from_info->{iface} = 'eth0';
 462         $start_state = 'from-bport';
 463     } elsif ($from eq 'nfvm') {
 464         $from_info->{type} = 'bport';
 465         $from_info->{bridge} = 'vmbr0';
 466         $from_info->{iface} = 'tapXYZ';
 467         $start_state = 'from-bport';
 468     } elsif ($from =~ m/^ct(\d+)$/) {
 469         my $vmid = $1;
 470         $from_info = extract_ct_info($vmdata, $vmid);
 471         if ($from_info->{ip_address}) {
 472             $pkg->{source} = $from_info->{ip_address};
 473             $start_state = 'venet-out';
 474         } else {
 475             die "implement me";
 476         }
 477     } elsif ($from =~ m/^vm(\d+)$/) {
 478         my $vmid = $1;
 479         $from_info = extract_vm_info($vmdata, $vmid);
 480         $start_state = 'fwbr-out';
 481         $pkg->{mac_source} = $from_info->{macaddr};
 482     } else {
 483         die "unable to parse \"from => '$from'\"\n";
 484     }
 485
 486     my $target;
 487
 488     if ($to eq 'host') {
 489         $target->{type} = 'host';
 490         $target->{iface} = 'host';
 491     } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
 492         $target->{type} = 'bport';
 493         $target->{bridge} = $1;
 494         $target->{iface} = $2;
 495     } elsif ($to eq 'outside') {
 496         $target->{type} = 'bport';
 497         $target->{bridge} = 'vmbr0';
 498         $target->{iface} = 'eth0';
 499      } elsif ($to eq 'nfvm') {
 500         $target->{type} = 'bport';
 501         $target->{bridge} = 'vmbr0';
 502         $target->{iface} = 'tapXYZ';
 503     } elsif ($to =~ m/^ct(\d+)$/) {
 504         my $vmid = $1;
 505         $target = extract_ct_info($vmdata, $vmid);
 506         $target->{iface} = 'venet-in';
 507
 508         if ($target->{ip_address}) {
 509             $pkg->{dest} = $target->{ip_address};
 510         } else {
 511             die "implement me";
 512         }
 513    } elsif ($to =~ m/^vm(\d+)$/) {
 514         my $vmid = $1;
 515         $target = extract_vm_info($vmdata, $vmid);
 516         $target->{iface} = $target->{tapdev};
 517     } else {
 518         die "unable to parse \"to => '$to'\"\n";
 519     }
 520
 521     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 522                                        $from_info, $target, $start_state);
 523
 524     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 525
 526     die "test failed ($res != $action)\n" if $action ne $res;
 527
 528     return undef;
 529 }
 530
 531 sub run_tests {
 532     my ($vmdata, $testdir, $testfile, $testid) = @_;
 533
 534     $testfile = 'tests' if !$testfile;
 535
 536     $vmdata->{testdir} = $testdir;
 537
 538     my ($ruleset, $ipset_ruleset) =
 539         PVE::Firewall::compile(undef, undef, $vmdata);
 540
 541     my $filename = "$testdir/$testfile";
 542     my $fh = IO::File->new($filename) ||
 543         die "unable to open '$filename' - $!\n";
 544
 545     my $testcount = 0;
 546     while (defined(my $line = <$fh>)) {
 547         next if $line =~ m/^\s*$/;
 548         next if $line =~ m/^#.*$/;
 549         if ($line =~ m/^\{.*\}\s*$/) {
 550             my $test = eval $line;
 551             die $@ if $@;
 552             next if defined($testid) && (!defined($test->{id}) || ($testid ne $test->{id}));
 553             $trace = '';
 554             print Dumper($ruleset) if $debug;
 555             $testcount++;
 556             eval { simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test); };
 557             if (my $err = $@) {
 558
 559                 print Dumper($ruleset) if !$debug;
 560
 561                 print "$trace\n" if !$debug;
 562
 563                 print "$filename line $.: $line";
 564
 565                 print "test failed: $err\n";
 566
 567                 exit(-1);
 568             }
 569         } else {
 570             die "parse error";
 571         }
 572     }
 573
 574     die "no tests found\n" if $testcount <= 0;
 575
 576     print "PASS: $filename\n";
 577
 578     return undef;
 579 }
 580
 581 my $vmdata = {
 582     qemu => {
 583         100 => {
 584             net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
 585         },
 586         101 => {
 587             net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
 588         },
 589         # on bridge vmbr1
 590         110 => {
 591             net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
 592         },
 593     },
 594     openvz => {
 595         200 => {
 596             ip_address => { value => '10.0.200.1' },
 597         },
 598         201 => {
 599             ip_address => { value => '10.0.200.2' },
 600         },
 601     },
 602 };
 603
 604 if ($testfilename) {
 605     my $testfile;
 606     my $dir;
 607
 608     if (-d $testfilename) {
 609         $dir = $testfilename;
 610     } elsif (-f $testfilename) {
 611         $dir = dirname($testfilename);
 612         $testfile = basename($testfilename);
 613     } else {
 614         die "no such file/dir '$testfilename'\n";
 615     }
 616
 617     run_tests($vmdata, $dir, $testfile, $testid);
 618
 619 } else {
 620     foreach my $dir (<test-*>) {
 621         next if ! -d $dir;
 622         run_tests($vmdata, $dir);
 623     }
 624 }
 625
 626 print "OK - all tests passed\n";
 627
 628 exit(0);