test/fwtester.pl

   1 #!/usr/bin/perl
   2
   3 use lib '../src';
   4 use strict;
   5 use warnings;
   6 use Data::Dumper;
   7 use PVE::Firewall;
   8
   9 my $mark;
  10 my $trace;
  11
  12 my $debug = 0;
  13
  14 sub add_trace {
  15     my ($text) = @_;
  16
  17     if ($debug) {
  18         print $text;
  19     } else {
  20         $trace .= $text;
  21     }
  22 }
  23
  24 sub rule_match {
  25     my ($chain, $rule, $pkg) = @_;
  26
  27     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
  28
  29     if ($rule =~ s/^-m conntrack\s*//) {
  30         return undef; # simply ignore
  31     }
  32
  33     if ($rule =~ s/^-m addrtype\s*//) {
  34         return undef; # simply ignore
  35     }
  36
  37     if ($rule =~ s/^-i (\S+)\s*//) {
  38         die "missing iface_in" if !$pkg->{iface_in};
  39         return undef if $pkg->{iface_in} ne $1; # no match
  40     }
  41     if ($rule =~ s/^-o (\S+)\s*//) {
  42         die "missing iface_out" if !$pkg->{iface_out};
  43         return undef if $pkg->{iface_out} ne $1; # no match
  44     }
  45
  46     if ($rule =~ s/^-p (tcp|udp)\s*//) {
  47         die "missing proto" if !$pkg->{proto};
  48         return undef if $pkg->{proto} ne $1; # no match
  49     }
  50
  51     if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
  52         die "missing dport" if !$pkg->{dport};
  53         return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
  54     }
  55
  56     if ($rule =~ s/^--dport (\d+)\s*//) {
  57         die "missing dport" if !$pkg->{dport};
  58         return undef if $pkg->{dport} != $1; # no match
  59     }
  60
  61     if ($rule =~ s/^-s (\S+)\s*//) {
  62         die "missing source" if !$pkg->{source};
  63         return undef if $pkg->{source} ne $1; # no match
  64     }
  65
  66     if ($rule =~ s/^-d (\S+)\s*//) {
  67         die "missing destination" if !$pkg->{dest};
  68         return undef if $pkg->{dest} ne $1; # no match
  69     }
  70
  71     if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
  72         die "missing source mac" if !$pkg->{mac_source};
  73         return undef if $pkg->{mac_source} eq $1; # no match
  74     }
  75
  76     if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
  77         my $devre = $1;
  78         $devre =~ s/\+/\.\*/;
  79         return undef if !$pkg->{physdev_in};
  80         return undef if $pkg->{physdev_in} !~ m/^${devre}$/;
  81     }
  82
  83     if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
  84         my $devre = $1;
  85         $devre =~ s/\+/\.\*/;
  86         return undef if !$pkg->{physdev_out};
  87         return undef if $pkg->{physdev_out} !~ m/^${devre}$/;
  88     }
  89
  90     if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
  91         $mark = $1;
  92         return undef;
  93     }
  94
  95     if ($rule =~ s/^-j (\S+)\s*$//) {
  96         return (0, $1);
  97     }
  98
  99     if ($rule =~ s/^-g (\S+)\s*$//) {
 100         return (1, $1);
 101     }
 102
 103     die "unable to parse rule: $rule";
 104 }
 105
 106 sub ruleset_simulate_chain {
 107     my ($ruleset, $chain, $pkg) = @_;
 108
 109     add_trace("ENTER chain $chain\n");
 110
 111     if ($chain eq 'PVEFW-Drop') {
 112         add_trace("LEAVE chain $chain\n");
 113         return 'DROP';
 114     }
 115     if ($chain eq 'PVEFW-reject') {
 116         add_trace("LEAVE chain $chain\n");
 117         return 'REJECT';
 118     }
 119
 120     if ($chain eq 'PVEFW-tcpflags') {
 121         add_trace("LEAVE chain $chain\n");
 122         return undef;
 123     }
 124
 125     my $rules = $ruleset->{$chain} ||
 126         die "no such chain '$chain'";
 127
 128     foreach my $rule (@$rules) {
 129         my ($goto, $action) = rule_match($chain, $rule, $pkg);
 130         if (!defined($action)) {
 131             add_trace("SKIP: $rule\n");
 132             next;
 133         }
 134         add_trace("MATCH: $rule\n");
 135
 136         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 137             add_trace("TERMINATE chain $chain: $action\n");
 138             return $action;
 139         } elsif ($action eq 'RETURN') {
 140             add_trace("RETURN FROM chain $chain\n");
 141             last;
 142         } else {
 143             if ($goto) {
 144                 add_trace("LEAVE chain $chain - goto $action\n");
 145                 return ruleset_simulate_chain($ruleset, $action, $pkg)
 146                 #$chain = $action;
 147                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 148             } else {
 149                 if ($action = ruleset_simulate_chain($ruleset, $action, $pkg)) {
 150                     return $action;
 151                 }
 152                 add_trace("CONTINUE chain $chain\n");
 153             }
 154         }
 155     }
 156
 157     add_trace("LEAVE chain $chain\n");
 158     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 159         return 'ACCEPT'; # default policy
 160     }
 161
 162     return undef;
 163 }
 164
 165 sub copy_packet {
 166     my ($pkg) = @_;
 167
 168     my $res = {};
 169
 170     while (my ($k,$v) = each %$pkg) {
 171         $res->{$k} = $v;
 172     }
 173
 174     return $res;
 175 }
 176
 177 # Try to simulate packet traversal inside kernel. This invokes iptable
 178 # checks several times.
 179 sub route_packet {
 180     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 181
 182     my $route_state = $start_state;
 183
 184     my $physdev_in;
 185
 186     while ($route_state ne $target->{iface}) {
 187
 188         my $chain;
 189         my $next_route_state;
 190         my $next_physdev_in;
 191
 192         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 193         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 194
 195         if ($route_state eq 'host') {
 196
 197             if ($target->{type} eq 'ct') {
 198                 $pkg->{iface_in} = 'lo';
 199                 $pkg->{iface_out} = 'venet0';
 200                 $chain = 'PVEFW-OUTPUT';
 201                 $next_route_state = 'venet-in';
 202             } elsif ($target->{type} eq 'vm') {
 203                 $pkg->{iface_in} = 'lo';
 204                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 205                 $chain = 'PVEFW-OUTPUT';
 206                 $next_route_state = 'fwbr-in';
 207             } else {
 208                 die "implement me";
 209             }
 210
 211         } elsif ($route_state eq 'venet-out') {
 212
 213             if ($target->{type} eq 'host') {
 214
 215                 $chain = 'PVEFW-INPUT';
 216                 $pkg->{iface_in} = 'venet0';
 217                 $pkg->{iface_out} = 'lo';
 218                 $next_route_state = 'host';
 219
 220             } elsif ($target->{type} eq 'vm') {
 221
 222                 $chain = 'PVEFW-FORWARD';
 223                 $pkg->{iface_in} = 'venet0';
 224                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 225                 $next_route_state = 'fwbr-in';
 226
 227             } elsif ($target->{type} eq 'ct') {
 228
 229                 $chain = 'PVEFW-FORWARD';
 230                 $pkg->{iface_in} = 'venet0';
 231                 $pkg->{iface_out} = 'venet0';
 232                 $next_route_state = 'venet-in';
 233
 234             } else {
 235                 die "implement me";
 236             }
 237
 238         } elsif ($route_state eq 'fwbr-out') {
 239
 240             $chain = 'PVEFW-FORWARD';
 241             $next_route_state = $from_info->{bridge} || die 'internal error';
 242             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 243             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 244             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 245             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 246             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 247
 248         } elsif ($route_state eq 'fwbr-in') {
 249
 250             $chain = 'PVEFW-FORWARD';
 251             $next_route_state = $target->{tapdev};
 252             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 253             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 254             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 255             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 256
 257         } elsif ($route_state =~ m/^vmbr\d+$/) {
 258
 259             die "missing physdev_in - internal error?" if !$physdev_in;
 260
 261             if ($target->{type} eq 'host') {
 262
 263                 $chain = 'PVEFW-INPUT';
 264                 $pkg->{iface_in} = $route_state;
 265                 $pkg->{iface_out} = 'lo';
 266                 $next_route_state = 'host';
 267
 268             } elsif ($target->{type} eq 'ct') {
 269
 270                 $chain = 'PVEFW-FORWARD';
 271                 $pkg->{iface_in} = $route_state;
 272                 $pkg->{iface_out} = 'venet0';
 273                 $next_route_state = 'venet-in';
 274
 275             } elsif ($target->{type} eq 'vm') {
 276
 277                 $chain = 'PVEFW-FORWARD';
 278                 if ($route_state eq $target->{bridge}) {
 279                     $pkg->{iface_in} = $route_state;
 280                     $pkg->{iface_out} = $route_state;
 281                     $pkg->{physdev_in} = $physdev_in;
 282                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 283                 } else {
 284                     $pkg->{iface_in} = $route_state;
 285                     $pkg->{iface_out} = $route_state;
 286                     $pkg->{physdev_in} = $physdev_in;
 287                     # do not set physdev_out (same behavior as kernel)
 288                 }
 289                 $next_route_state = 'fwbr-in';
 290
 291             } else {
 292                 die "implement me";
 293             }
 294
 295         } else {
 296             die "implement me $route_state";
 297         }
 298
 299         die "internal error" if !defined($next_route_state);
 300
 301         if ($chain) {
 302             add_trace("IPT check at $route_state (chain $chain)\n");
 303             add_trace(Dumper($pkg));
 304             my $res = ruleset_simulate_chain($ruleset, $chain, $pkg);
 305             return $res if $res ne 'ACCEPT';
 306         }
 307
 308         $route_state = $next_route_state;
 309
 310         $physdev_in = $next_physdev_in;
 311     }
 312
 313     return 'ACCEPT';
 314 }
 315
 316 sub extract_ct_info {
 317     my ($vmdata, $vmid) = @_;
 318
 319     my $info = { type => 'ct', vmid => $vmid };
 320
 321     my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
 322     if ($conf->{ip_address}) {
 323         $info->{ip_address} = $conf->{ip_address}->{value};
 324     } else {
 325         die "implement me";
 326     }
 327     return $info;
 328 }
 329
 330 sub extract_vm_info {
 331     my ($vmdata, $vmid) = @_;
 332
 333     my $info = { type => 'vm', vmid => $vmid };
 334
 335     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 336     my $net = PVE::QemuServer::parse_net($conf->{net0});
 337     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 338     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 339     $info->{fwbr} = "fwbr${vmid}i0";
 340     $info->{tapdev} = "tap${vmid}i0";
 341     $info->{fwln} = "fwln${vmid}i0";
 342     $info->{fwpr} = "fwpr${vmid}p0";
 343
 344     return $info;
 345 }
 346
 347 sub simulate_firewall {
 348     my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
 349
 350     my $from = delete $test->{from} || die "missing 'from' field";
 351     my $to = delete $test->{to} || die "missing 'to' field";
 352     my $action = delete $test->{action} || die "missing 'action'";
 353
 354     die "from/to needs to be different" if $from eq $to;
 355
 356     my $pkg = {
 357         proto => 'tcp',
 358         sport => '1234',
 359         dport => '4321',
 360         source => '10.11.12.13',
 361         dest => '10.11.12.14',
 362     };
 363
 364     while (my ($k,$v) = each %$test) {
 365         $pkg->{$k} = $v;
 366     }
 367
 368     my $from_info = {};
 369
 370     my $start_state;
 371
 372     if ($from eq 'host') {
 373         $from_info->{type} = 'host';
 374         $start_state = 'host';
 375     } elsif ($from =~ m/^ct(\d+)$/) {
 376         my $vmid = $1;
 377         $from_info = extract_ct_info($vmdata, $vmid);
 378         if ($from_info->{ip_address}) {
 379             $pkg->{source} = $from_info->{ip_address};
 380             $start_state = 'venet-out';
 381         } else {
 382             die "implement me";
 383         }
 384     } elsif ($from =~ m/^vm(\d+)$/) {
 385         my $vmid = $1;
 386         $from_info = extract_vm_info($vmdata, $vmid);
 387         $start_state = 'fwbr-out';
 388         $pkg->{mac_source} = $from_info->{macaddr};
 389     } else {
 390         die "implement me";
 391     }
 392
 393     my $target;
 394
 395     if ($to eq 'host') {
 396         $target->{type} = 'host';
 397         $target->{iface} = 'host';
 398     } elsif ($to =~ m/^ct(\d+)$/) {
 399         my $vmid = $1;
 400         $target = extract_ct_info($vmdata, $vmid);
 401         $target->{iface} = 'venet-in';
 402
 403         if ($target->{ip_address}) {
 404             $pkg->{dest} = $target->{ip_address};
 405         } else {
 406             die "implement me";
 407         }
 408    } elsif ($to =~ m/^vm(\d+)$/) {
 409         my $vmid = $1;
 410         $target = extract_vm_info($vmdata, $vmid);
 411         $target->{iface} = $target->{tapdev};
 412     } else {
 413         die "implement me";
 414     }
 415
 416     my $res = route_packet($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state);
 417
 418     die "test failed ($res != $action)\n" if $action ne $res;
 419
 420     return undef;
 421 }
 422
 423 sub run_tests {
 424     my ($vmdata, $testdir) = @_;
 425
 426     $vmdata->{testdir} = $testdir;
 427
 428     my ($ruleset, $ipset_ruleset) =
 429         PVE::Firewall::compile(undef, undef, $vmdata);
 430
 431     my $testfile = "$testdir/tests";
 432     my $fh = IO::File->new($testfile) ||
 433         die "unable to open '$testfile' - $!\n";
 434
 435     while (defined(my $line = <$fh>)) {
 436         next if $line =~ m/^\s*$/;
 437         next if $line =~ m/^#.*$/;
 438         if ($line =~ m/^\{.*\}\s*$/) {
 439             my $test = eval $line;
 440             die $@ if $@;
 441             $trace = '';
 442             print Dumper($ruleset) if $debug;
 443             eval { simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test); };
 444             if (my $err = $@) {
 445
 446                 print Dumper($ruleset) if !$debug;
 447
 448                 print "$trace\n" if !$debug;
 449
 450                 print "$testfile line $.: $line";
 451
 452                 print "test failed: $err\n";
 453
 454                 exit(-1);
 455             }
 456         } else {
 457             die "parse error";
 458         }
 459     }
 460
 461     print "PASS: $testfile\n";
 462
 463     return undef;
 464 }
 465
 466 my $vmdata = {
 467     qemu => {
 468         100 => {
 469             net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0",
 470         },
 471         101 => {
 472             net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0",
 473         },
 474         # on bridge vmbr1
 475         110 => {
 476             net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1",
 477         },
 478     },
 479     openvz => {
 480         200 => {
 481             ip_address => { value => '10.0.200.1' },
 482         },
 483         201 => {
 484             ip_address => { value => '10.0.200.2' },
 485         },
 486     },
 487 };
 488
 489 foreach my $dir (<test-*>) {
 490     next if ! -d $dir;
 491     run_tests($vmdata, $dir);
 492 }
 493
 494 print "OK - all tests passed\n";
 495
 496 exit(0);