test/fwtester.pl

   1 #!/usr/bin/perl
   2
   3 use lib '../src';
   4 use strict;
   5 use warnings;
   6 use Data::Dumper;
   7 use PVE::Firewall;
   8 use Getopt::Long;
   9 use File::Basename;
  10
  11 my $mark;
  12 my $trace;
  13
  14 my $debug = 0;
  15
  16 sub print_usage_and_exit {
  17     die "usage: $0 [--debug] [testfile [testid]]\n";
  18 }
  19
  20 if (!GetOptions ('debug' => \$debug)) {
  21     print_usage_and_exit();
  22 }
  23
  24 my $testfilename = shift;
  25 my $testid = shift;
  26
  27 sub add_trace {
  28     my ($text) = @_;
  29
  30     if ($debug) {
  31         print $text;
  32     } else {
  33         $trace .= $text;
  34     }
  35 }
  36
  37 sub nf_dev_match {
  38     my ($devre, $dev) = @_;
  39
  40     $devre =~ s/\+$/\.\*/;
  41     return  ($dev =~ m/^${devre}$/) ? 1 : 0;
  42 }
  43
  44 sub rule_match {
  45     my ($chain, $rule, $pkg) = @_;
  46
  47     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
  48
  49     if ($rule =~ s/^-m conntrack\s*//) {
  50         return undef; # simply ignore
  51     }
  52
  53     if ($rule =~ s/^-m addrtype\s*//) {
  54         return undef; # simply ignore
  55     }
  56
  57     if ($rule =~ s/^-i (\S+)\s*//) {
  58         my $devre = $1;
  59         die "missing iface_in" if !$pkg->{iface_in};
  60         return undef if !nf_dev_match($devre, $pkg->{iface_in});
  61     }
  62     if ($rule =~ s/^-o (\S+)\s*//) {
  63         my $devre = $1;
  64         die "missing iface_out" if !$pkg->{iface_out};
  65         return undef if !nf_dev_match($devre, $pkg->{iface_out});
  66     }
  67
  68     if ($rule =~ s/^-p (tcp|udp)\s*//) {
  69         die "missing proto" if !$pkg->{proto};
  70         return undef if $pkg->{proto} ne $1; # no match
  71     }
  72
  73     if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
  74         die "missing dport" if !$pkg->{dport};
  75         return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
  76     }
  77
  78     if ($rule =~ s/^--dport (\d+)\s*//) {
  79         die "missing dport" if !$pkg->{dport};
  80         return undef if $pkg->{dport} != $1; # no match
  81     }
  82
  83     if ($rule =~ s/^-s (\S+)\s*//) {
  84         die "missing source" if !$pkg->{source};
  85         return undef if $pkg->{source} ne $1; # no match
  86     }
  87
  88     if ($rule =~ s/^-d (\S+)\s*//) {
  89         die "missing destination" if !$pkg->{dest};
  90         return undef if $pkg->{dest} ne $1; # no match
  91     }
  92
  93     if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
  94         die "missing source mac" if !$pkg->{mac_source};
  95         return undef if $pkg->{mac_source} eq $1; # no match
  96     }
  97
  98     if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
  99         my $devre = $1;
 100         return undef if !$pkg->{physdev_in};
 101         return undef if !nf_dev_match($devre, $pkg->{physdev_in});
 102     }
 103
 104     if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
 105         my $devre = $1;
 106         return undef if !$pkg->{physdev_out};
 107         return undef if !nf_dev_match($devre, $pkg->{physdev_out});
 108     }
 109
 110     if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
 111         $mark = $1;
 112         return undef;
 113     }
 114
 115     if ($rule =~ s/^-j (\S+)\s*$//) {
 116         return (0, $1);
 117     }
 118
 119     if ($rule =~ s/^-g (\S+)\s*$//) {
 120         return (1, $1);
 121     }
 122
 123     die "unable to parse rule: $rule";
 124 }
 125
 126 sub ruleset_simulate_chain {
 127     my ($ruleset, $chain, $pkg) = @_;
 128
 129     add_trace("ENTER chain $chain\n");
 130
 131     my $counter = 0;
 132
 133     if ($chain eq 'PVEFW-Drop') {
 134         add_trace("LEAVE chain $chain\n");
 135         return ('DROP', $counter);
 136     }
 137     if ($chain eq 'PVEFW-reject') {
 138         add_trace("LEAVE chain $chain\n");
 139         return ('REJECT', $counter);
 140     }
 141
 142     if ($chain eq 'PVEFW-tcpflags') {
 143         add_trace("LEAVE chain $chain\n");
 144         return (undef, $counter);
 145     }
 146
 147     my $rules = $ruleset->{$chain} ||
 148         die "no such chain '$chain'";
 149
 150     foreach my $rule (@$rules) {
 151         $counter++;
 152         my ($goto, $action) = rule_match($chain, $rule, $pkg);
 153         if (!defined($action)) {
 154             add_trace("SKIP: $rule\n");
 155             next;
 156         }
 157         add_trace("MATCH: $rule\n");
 158
 159         if ($action eq 'ACCEPT' || $action eq 'DROP' || $action eq 'REJECT') {
 160             add_trace("TERMINATE chain $chain: $action\n");
 161             return ($action, $counter);
 162         } elsif ($action eq 'RETURN') {
 163             add_trace("RETURN FROM chain $chain\n");
 164             last;
 165         } else {
 166             if ($goto) {
 167                 add_trace("LEAVE chain $chain - goto $action\n");
 168                 return ruleset_simulate_chain($ruleset, $action, $pkg)
 169                 #$chain = $action;
 170                 #$rules = $ruleset->{$chain} || die "no such chain '$chain'";
 171             } else {
 172                 my ($act, $ctr) = ruleset_simulate_chain($ruleset, $action, $pkg);
 173                 $counter += $ctr;
 174                 return ($act, $counter) if $act;
 175                 add_trace("CONTINUE chain $chain\n");
 176             }
 177         }
 178     }
 179
 180     add_trace("LEAVE chain $chain\n");
 181     if ($chain =~ m/^PVEFW-(INPUT|OUTPUT|FORWARD)$/) {
 182         return ('ACCEPT', $counter); # default policy
 183     }
 184
 185     return (undef, $counter);
 186 }
 187
 188 sub copy_packet {
 189     my ($pkg) = @_;
 190
 191     my $res = {};
 192
 193     while (my ($k,$v) = each %$pkg) {
 194         $res->{$k} = $v;
 195     }
 196
 197     return $res;
 198 }
 199
 200 # Try to simulate packet traversal inside kernel. This invokes iptable
 201 # checks several times.
 202 sub route_packet {
 203     my ($ruleset, $ipset_ruleset, $pkg, $from_info, $target, $start_state) = @_;
 204
 205     my $route_state = $start_state;
 206
 207     my $physdev_in;
 208
 209     my $ipt_invocation_counter = 0;
 210     my $rule_check_counter = 0;
 211
 212     while ($route_state ne $target->{iface}) {
 213
 214         my $chain;
 215         my $next_route_state;
 216         my $next_physdev_in;
 217
 218         $pkg->{iface_in} = $pkg->{iface_out} = undef;
 219         $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 220
 221         if ($route_state eq 'from-bport') {
 222             $next_route_state = $from_info->{bridge} || die 'internal error';
 223             $next_physdev_in = $from_info->{iface} || die 'internal error';
 224         } elsif ($route_state eq 'host') {
 225
 226             if ($target->{type} eq 'bport') {
 227                 $pkg->{iface_in} = 'lo';
 228                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 229                 $chain = 'PVEFW-OUTPUT';
 230                 $next_route_state = $target->{iface} || die 'internal error';
 231             } elsif ($target->{type} eq 'ct') {
 232                 $pkg->{iface_in} = 'lo';
 233                 $pkg->{iface_out} = 'venet0';
 234                 $chain = 'PVEFW-OUTPUT';
 235                 $next_route_state = 'venet-in';
 236             } elsif ($target->{type} eq 'vm') {
 237                 $pkg->{iface_in} = 'lo';
 238                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 239                 $chain = 'PVEFW-OUTPUT';
 240                 $next_route_state = 'fwbr-in';
 241             } else {
 242                 die "implement me";
 243             }
 244
 245         } elsif ($route_state eq 'venet-out') {
 246
 247             if ($target->{type} eq 'host') {
 248
 249                 $chain = 'PVEFW-INPUT';
 250                 $pkg->{iface_in} = 'venet0';
 251                 $pkg->{iface_out} = 'lo';
 252                 $next_route_state = 'host';
 253
 254             } elsif ($target->{type} eq 'bport') {
 255
 256                 $chain = 'PVEFW-FORWARD';
 257                 $pkg->{iface_in} = 'venet0';
 258                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 259                 $next_route_state = $target->{iface} || die 'internal error';
 260
 261             } elsif ($target->{type} eq 'vm') {
 262
 263                 $chain = 'PVEFW-FORWARD';
 264                 $pkg->{iface_in} = 'venet0';
 265                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 266                 $next_route_state = 'fwbr-in';
 267
 268             } elsif ($target->{type} eq 'ct') {
 269
 270                 $chain = 'PVEFW-FORWARD';
 271                 $pkg->{iface_in} = 'venet0';
 272                 $pkg->{iface_out} = 'venet0';
 273                 $next_route_state = 'venet-in';
 274
 275             } else {
 276                 die "implement me";
 277             }
 278
 279         } elsif ($route_state eq 'fwbr-out') {
 280
 281             $chain = 'PVEFW-FORWARD';
 282             $next_route_state = $from_info->{bridge} || die 'internal error';
 283             $next_physdev_in = $from_info->{fwpr} || die 'internal error';
 284             $pkg->{iface_in} = $from_info->{fwbr} || die 'internal error';
 285             $pkg->{iface_out} = $from_info->{fwbr} || die 'internal error';
 286             $pkg->{physdev_in} = $from_info->{tapdev} || die 'internal error';
 287             $pkg->{physdev_out} = $from_info->{fwln} || die 'internal error';
 288
 289         } elsif ($route_state eq 'fwbr-in') {
 290
 291             $chain = 'PVEFW-FORWARD';
 292             $next_route_state = $target->{tapdev};
 293             $pkg->{iface_in} = $target->{fwbr} || die 'internal error';
 294             $pkg->{iface_out} = $target->{fwbr} || die 'internal error';
 295             $pkg->{physdev_in} = $target->{fwln} || die 'internal error';
 296             $pkg->{physdev_out} = $target->{tapdev} || die 'internal error';
 297
 298         } elsif ($route_state =~ m/^vmbr\d+$/) {
 299
 300             die "missing physdev_in - internal error?" if !$physdev_in;
 301             $pkg->{physdev_in} = $physdev_in;
 302
 303             if ($target->{type} eq 'host') {
 304
 305                 $chain = 'PVEFW-INPUT';
 306                 $pkg->{iface_in} = $route_state;
 307                 $pkg->{iface_out} = 'lo';
 308                 $next_route_state = 'host';
 309
 310             } elsif ($target->{type} eq 'bport') {
 311
 312                 $chain = 'PVEFW-FORWARD';
 313                 $pkg->{iface_in} = $route_state;
 314                 $pkg->{iface_out} = $target->{bridge} || die 'internal error';
 315                 # conditionally set physdev_out (same behavior as kernel)
 316                 if ($route_state eq $target->{bridge}) {
 317                     $pkg->{physdev_out} = $target->{iface} || die 'internal error';
 318                 }
 319                 $next_route_state = $target->{iface};
 320
 321             } elsif ($target->{type} eq 'ct') {
 322
 323                 $chain = 'PVEFW-FORWARD';
 324                 $pkg->{iface_in} = $route_state;
 325                 $pkg->{iface_out} = 'venet0';
 326                 $next_route_state = 'venet-in';
 327
 328             } elsif ($target->{type} eq 'vm') {
 329
 330                 $chain = 'PVEFW-FORWARD';
 331                 $pkg->{iface_in} = $route_state;
 332                 $pkg->{iface_out} = $target->{bridge};
 333                 # conditionally set physdev_out (same behavior as kernel)
 334                 if ($route_state eq $target->{bridge}) {
 335                     $pkg->{physdev_out} = $target->{fwpr} || die 'internal error';
 336                 }
 337                 $next_route_state = 'fwbr-in';
 338
 339             } else {
 340                 die "implement me";
 341             }
 342
 343         } else {
 344             die "implement me $route_state";
 345         }
 346
 347         die "internal error" if !defined($next_route_state);
 348
 349         if ($chain) {
 350             add_trace("IPT check at $route_state (chain $chain)\n");
 351             add_trace(Dumper($pkg));
 352             $ipt_invocation_counter++;
 353             my ($res, $ctr) = ruleset_simulate_chain($ruleset, $chain, $pkg);
 354             $rule_check_counter += $ctr;
 355             return ($res, $ipt_invocation_counter, $rule_check_counter) if $res ne 'ACCEPT';
 356         }
 357
 358         $route_state = $next_route_state;
 359
 360         $physdev_in = $next_physdev_in;
 361     }
 362
 363     return ('ACCEPT', $ipt_invocation_counter, $rule_check_counter);
 364 }
 365
 366 sub extract_ct_info {
 367     my ($vmdata, $vmid) = @_;
 368
 369     my $info = { type => 'ct', vmid => $vmid };
 370
 371     my $conf = $vmdata->{openvz}->{$vmid} || die "no such CT '$vmid'";
 372     if ($conf->{ip_address}) {
 373         $info->{ip_address} = $conf->{ip_address}->{value};
 374     } else {
 375         die "implement me";
 376     }
 377     return $info;
 378 }
 379
 380 sub extract_vm_info {
 381     my ($vmdata, $vmid) = @_;
 382
 383     my $info = { type => 'vm', vmid => $vmid };
 384
 385     my $conf = $vmdata->{qemu}->{$vmid} || die "no such VM '$vmid'";
 386     my $net = PVE::QemuServer::parse_net($conf->{net0});
 387     $info->{macaddr} = $net->{macaddr} || die "unable to get mac address";
 388     $info->{bridge} = $net->{bridge} || die "unable to get bridge";
 389     $info->{fwbr} = "fwbr${vmid}i0";
 390     $info->{tapdev} = "tap${vmid}i0";
 391     $info->{fwln} = "fwln${vmid}i0";
 392     $info->{fwpr} = "fwpr${vmid}p0";
 393
 394     return $info;
 395 }
 396
 397 sub simulate_firewall {
 398     my ($ruleset, $ipset_ruleset, $vmdata, $test) = @_;
 399
 400     my $from = delete $test->{from} || die "missing 'from' field";
 401     my $to = delete $test->{to} || die "missing 'to' field";
 402     my $action = delete $test->{action} || die "missing 'action'";
 403
 404     my $testid = delete $test->{id};
 405
 406     die "from/to needs to be different" if $from eq $to;
 407
 408     my $pkg = {
 409         proto => 'tcp',
 410         sport => undef,
 411         dport => undef,
 412         source => undef,
 413         dest => undef,
 414     };
 415
 416     while (my ($k,$v) = each %$test) {
 417         die "unknown attribute '$k'\n" if !exists($pkg->{$k});
 418         $pkg->{$k} = $v;
 419     }
 420
 421     my $from_info = {};
 422
 423     my $start_state;
 424
 425     if ($from eq 'host') {
 426         $from_info->{type} = 'host';
 427         $start_state = 'host';
 428     } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
 429         $from_info->{type} = 'bport';
 430         $from_info->{bridge} = $1;
 431         $from_info->{iface} = $2;
 432         $start_state = 'from-bport';
 433     } elsif ($from eq 'outside') {
 434         $from_info->{type} = 'bport';
 435         $from_info->{bridge} = 'vmbr0';
 436         $from_info->{iface} = 'eth0';
 437         $start_state = 'from-bport';
 438     } elsif ($from eq 'nfvm') {
 439         $from_info->{type} = 'bport';
 440         $from_info->{bridge} = 'vmbr0';
 441         $from_info->{iface} = 'tapXYZ';
 442         $start_state = 'from-bport';
 443     } elsif ($from =~ m/^ct(\d+)$/) {
 444         my $vmid = $1;
 445         $from_info = extract_ct_info($vmdata, $vmid);
 446         if ($from_info->{ip_address}) {
 447             $pkg->{source} = $from_info->{ip_address};
 448             $start_state = 'venet-out';
 449         } else {
 450             die "implement me";
 451         }
 452     } elsif ($from =~ m/^vm(\d+)$/) {
 453         my $vmid = $1;
 454         $from_info = extract_vm_info($vmdata, $vmid);
 455         $start_state = 'fwbr-out';
 456         $pkg->{mac_source} = $from_info->{macaddr};
 457     } else {
 458         die "unable to parse \"from => '$from'\"\n";
 459     }
 460
 461     my $target;
 462
 463     if ($to eq 'host') {
 464         $target->{type} = 'host';
 465         $target->{iface} = 'host';
 466     } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
 467         $target->{type} = 'bport';
 468         $target->{bridge} = $1;
 469         $target->{iface} = $2;
 470     } elsif ($to eq 'outside') {
 471         $target->{type} = 'bport';
 472         $target->{bridge} = 'vmbr0';
 473         $target->{iface} = 'eth0';
 474      } elsif ($to eq 'nfvm') {
 475         $target->{type} = 'bport';
 476         $target->{bridge} = 'vmbr0';
 477         $target->{iface} = 'tapXYZ';
 478     } elsif ($to =~ m/^ct(\d+)$/) {
 479         my $vmid = $1;
 480         $target = extract_ct_info($vmdata, $vmid);
 481         $target->{iface} = 'venet-in';
 482
 483         if ($target->{ip_address}) {
 484             $pkg->{dest} = $target->{ip_address};
 485         } else {
 486             die "implement me";
 487         }
 488    } elsif ($to =~ m/^vm(\d+)$/) {
 489         my $vmid = $1;
 490         $target = extract_vm_info($vmdata, $vmid);
 491         $target->{iface} = $target->{tapdev};
 492     } else {
 493         die "unable to parse \"to => '$to'\"\n";
 494     }
 495
 496     my ($res, $ic, $rc) = route_packet($ruleset, $ipset_ruleset, $pkg,
 497                                        $from_info, $target, $start_state);
 498
 499     add_trace("IPT statistics: invocation = $ic, checks = $rc\n");
 500
 501     die "test failed ($res != $action)\n" if $action ne $res;
 502
 503     return undef;
 504 }
 505
 506 sub run_tests {
 507     my ($vmdata, $testdir, $testfile, $testid) = @_;
 508
 509     $testfile = 'tests' if !$testfile;
 510
 511     $vmdata->{testdir} = $testdir;
 512
 513     my ($ruleset, $ipset_ruleset) =
 514         PVE::Firewall::compile(undef, undef, $vmdata);
 515
 516     my $filename = "$testdir/$testfile";
 517     my $fh = IO::File->new($filename) ||
 518         die "unable to open '$filename' - $!\n";
 519
 520     my $testcount = 0;
 521     while (defined(my $line = <$fh>)) {
 522         next if $line =~ m/^\s*$/;
 523         next if $line =~ m/^#.*$/;
 524         if ($line =~ m/^\{.*\}\s*$/) {
 525             my $test = eval $line;
 526             die $@ if $@;
 527             next if defined($testid) && (!defined($test->{id}) || ($testid ne $test->{id}));
 528             $trace = '';
 529             print Dumper($ruleset) if $debug;
 530             $testcount++;
 531             eval { simulate_firewall($ruleset, $ipset_ruleset, $vmdata, $test); };
 532             if (my $err = $@) {
 533
 534                 print Dumper($ruleset) if !$debug;
 535
 536                 print "$trace\n" if !$debug;
 537
 538                 print "$filename line $.: $line";
 539
 540                 print "test failed: $err\n";
 541
 542                 exit(-1);
 543             }
 544         } else {
 545             die "parse error";
 546         }
 547     }
 548
 549     die "no tests found\n" if $testcount <= 0;
 550
 551     print "PASS: $filename\n";
 552
 553     return undef;
 554 }
 555
 556 my $vmdata = {
 557     qemu => {
 558         100 => {
 559             net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
 560         },
 561         101 => {
 562             net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
 563         },
 564         # on bridge vmbr1
 565         110 => {
 566             net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
 567         },
 568     },
 569     openvz => {
 570         200 => {
 571             ip_address => { value => '10.0.200.1' },
 572         },
 573         201 => {
 574             ip_address => { value => '10.0.200.2' },
 575         },
 576     },
 577 };
 578
 579 if ($testfilename) {
 580     my $testfile;
 581     my $dir;
 582
 583     if (-d $testfilename) {
 584         $dir = $testfilename;
 585     } elsif (-f $testfilename) {
 586         $dir = dirname($testfilename);
 587         $testfile = basename($testfilename);
 588     } else {
 589         die "no such file/dir '$testfilename'\n";
 590     }
 591
 592     run_tests($vmdata, $dir, $testfile, $testid);
 593
 594 } else {
 595     foreach my $dir (<test-*>) {
 596         next if ! -d $dir;
 597         run_tests($vmdata, $dir);
 598     }
 599 }
 600
 601 print "OK - all tests passed\n";
 602
 603 exit(0);