use a file to store firewall status persistently.

[pve-firewall.git] / PVE / Firewall.pm

diff --git a/PVE/Firewall.pm b/PVE/Firewall.pm
index 968f91200c9805137ae55351b238530a2d5ab698..2ed65e82567a06c657843ce00bef1de82ed4da5c 100644 (file)
--- a/PVE/Firewall.pm
+++ b/PVE/Firewall.pm
@@ -6,6 +6,7 @@ use Data::Dumper;
 use Digest::SHA;
 use PVE::Tools;
 use PVE::QemuServer;
+use File::Basename;
 use File::Path;
 use IO::File;
 use Net::IP;
@@ -14,6 +15,7 @@ use PVE::Tools qw(run_command lock_file);
 use Data::Dumper;
 
 my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
+my $pve_fw_status_filename = "/var/lib/pve-firewall/pvefw.status";
 
 # imported/converted from: /usr/share/shorewall/macro.*
 my $pve_fw_macros = {
@@ -224,7 +226,7 @@ my $pve_fw_macros = {
        { action => 'PARAM', proto => 'tcp', dport => '1723' },
     ],
     'Ping' => [
-       { action => 'PARAM', proto => 'icmp', dport => '8' },
+       { action => 'PARAM', proto => 'icmp', dport => 'echo-request' },
     ],
     'PostgreSQL' => [
        { action => 'PARAM', proto => 'tcp', dport => '5432' },
@@ -322,7 +324,7 @@ my $pve_fw_macros = {
     ],
     'Trcrt' => [
        { action => 'PARAM', proto => 'udp', dport => '33434:33524' },
-       { action => 'PARAM', proto => 'icmp', dport => '8' },
+       { action => 'PARAM', proto => 'icmp', dport => 'echo-request' },
     ],
     'VNC' => [
        { action => 'PARAM', proto => 'tcp', dport => '5900:5909' },
@@ -722,33 +724,47 @@ sub ruleset_generate_rule {
     $cmd .= " -s $rule->{source}" if $rule->{source};
     $cmd .= " -m iprange --dst-range" if $rule->{nbdest} && $rule->{nbdest} > 1;
     $cmd .= " -d $rule->{dest}" if $rule->{dest};
-    $cmd .= " -p $rule->{proto}" if $rule->{proto};
 
-    if (($rule->{nbdport} && $rule->{nbdport} > 1) ||
-       ($rule->{nbsport} && $rule->{nbsport} > 1)) {
-       $cmd .= " --match multiport" 
-    }
+    if ($rule->{proto}) {
+       $cmd .= " -p $rule->{proto}";
 
-    if ($rule->{dport}) {
-       if ($rule->{proto} && $rule->{proto} eq 'icmp') {
-           # Note: we use dport to store --icmp-type
-           die "unknown icmp-type\n" if !$icmp_type_names->{$rule->{dport}};
-           $cmd .= " -m icmp --icmp-type $rule->{dport}";
-       } else {
-           if ($rule->{nbdport} && $rule->{nbdport} > 1) {
-               $cmd .= " --dports $rule->{dport}";
+       my $multiport = 0;
+       $multiport++ if $rule->{nbdport} && ($rule->{nbdport} > 1);
+       $multiport++ if $rule->{nbsport} && ($rule->{nbsport} > 1);
+
+       $cmd .= " --match multiport" if $multiport;
+
+       die "multiport: option '--sports' cannot be used together with '--dports'\n" 
+           if ($multiport == 2) && ($rule->{dport} ne $rule->{sport});
+
+       if ($rule->{dport}) {
+           if ($rule->{proto} && $rule->{proto} eq 'icmp') {
+               # Note: we use dport to store --icmp-type
+               die "unknown icmp-type '$rule->{dport}'\n" if !defined($icmp_type_names->{$rule->{dport}});
+               $cmd .= " -m icmp --icmp-type $rule->{dport}";
            } else {
-               $cmd .= " --dport $rule->{dport}";
+               if ($rule->{nbdport} && $rule->{nbdport} > 1) {
+                   if ($multiport == 2) {
+                       $cmd .= " --ports $rule->{dport}";
+                   } else {
+                       $cmd .= " --dports $rule->{dport}";
+                   }
+               } else {
+                   $cmd .= " --dport $rule->{dport}";
+               }
            }
        }
-    }
 
-    if ($rule->{sport}) {
-       if ($rule->{nbsport} && $rule->{nbsport} > 1) {
-           $cmd .= " --sports $rule->{sport}";
-       } else {
-           $cmd .= " --sport $rule->{sport}";
+       if ($rule->{sport}) {
+           if ($rule->{nbsport} && $rule->{nbsport} > 1) {
+               $cmd .= " --sports $rule->{sport}" if $multiport != 2;
+           } else {
+               $cmd .= " --sport $rule->{sport}";
+           }
        }
+    } elsif ($rule->{dport} || $rule->{sport}) {
+       warn "ignoring destination port '$rule->{dport}' - no protocol specified\n" if $rule->{dport};
+       warn "ignoring source port '$rule->{sport}' - no protocol specified\n" if $rule->{sport};
     }
 
     $cmd .= " -m addrtype --dst-type $rule->{dsttype}" if $rule->{dsttype};
@@ -757,7 +773,7 @@ sub ruleset_generate_rule {
        $action = $actions->{$action} if defined($actions->{$action}); 
        $goto = 1 if !defined($goto) && $action eq 'PVEFW-SET-ACCEPT-MARK';
        $cmd .= $goto ? " -g $action" : " -j $action";
-    };
+    }
 
     ruleset_addrule($ruleset, $chain, $cmd) if $cmd;
 }
@@ -1339,6 +1355,30 @@ sub generate_std_chains {
     }
 }
 
+sub save_pvefw_status {
+    my ($status) = @_;
+
+    die "unknown status '$status' - internal error"
+       if $status !~ m/^(stopped|active)$/;
+
+    mkdir dirname($pve_fw_status_filename);
+    PVE::Tools::file_set_contents($pve_fw_status_filename, $status);
+}
+
+sub read_pvefw_status {
+
+    my $status = 'unknown';
+
+    return 'stopped' if ! -f $pve_fw_status_filename;
+
+    eval {
+       $status = PVE::Tools::file_get_contents($pve_fw_status_filename);
+    };
+    warn $@ if $@;
+
+    return $status;
+}
+
 sub compile {
     my $vmdata = read_local_vm_config();
     my $rules = read_vm_firewall_rules($vmdata);
@@ -1460,11 +1500,9 @@ sub print_sig_rule {
     return "-A $chain -m comment --comment \"PVESIG:$sig\"\n";
 }
 
-sub apply_ruleset {
+sub get_rulset_cmdlist {
     my ($ruleset, $verbose) = @_;
 
-    enable_bridge_firewall();
-
     my $cmdlist = "*filter\n"; # we pass this to iptables-restore;
 
     my $statushash = get_ruleset_status($ruleset, $verbose);
@@ -1525,12 +1563,22 @@ sub apply_ruleset {
 
     $cmdlist .= "COMMIT\n";
 
+    return $cmdlist;
+}
+
+sub apply_ruleset {
+    my ($ruleset, $verbose) = @_;
+
+    enable_bridge_firewall();
+
+    my $cmdlist = get_rulset_cmdlist($ruleset, $verbose);
+
     print $cmdlist if $verbose;
 
     iptables_restore_cmdlist($cmdlist);
 
     # test: re-read status and check if everything is up to date
-    $statushash = get_ruleset_status($ruleset);
+    my $statushash = get_ruleset_status($ruleset);
 
     my $errors;
     foreach my $chain (sort keys %$ruleset) {
@@ -1544,4 +1592,26 @@ sub apply_ruleset {
     die "unable to apply firewall changes\n" if $errors;
 }
 
+sub update {
+    my ($start, $verbose) = @_;
+
+    my $code = sub {
+       my $status = read_pvefw_status();
+
+       my $ruleset = PVE::Firewall::compile();
+
+       if ($start || $status eq 'active') {
+
+           save_pvefw_status('active') if ($status ne 'active');
+
+           PVE::Firewall::apply_ruleset($ruleset, $verbose);
+       } else {
+           print "Firewall not active (status = $status)\n" if $verbose;
+       }
+    };
+
+    run_locked($code);
+}
+
+
 1;