use accept mark for security groups

[pve-firewall.git] / PVE / Firewall.pm

diff --git a/PVE/Firewall.pm b/PVE/Firewall.pm
index 2de83345d49e6d8ccd246a12d37a0b0a17eced4b..ec6112afe914146d4b15e603cd2d1135fac919c3 100644 (file)
--- a/PVE/Firewall.pm
+++ b/PVE/Firewall.pm
@@ -3,7 +3,7 @@ package PVE::Firewall;
 use warnings;
 use strict;
 use Data::Dumper;
-use Digest::MD5;
+use Digest::SHA;
 use PVE::Tools;
 use PVE::QemuServer;
 use File::Path;
@@ -199,7 +199,7 @@ sub iptables_get_chains {
            my $chain = $1;
            return if !&$is_pvefw_chain($chain);
            $res->{$chain} = "unknown";
-       } elsif ($line =~ m/^-A\s+(\S+)\s.*--log-prefix\s+\"PVESIG:(\S+)\"/) {
+       } elsif ($line =~ m/^-A\s+(\S+)\s.*--comment\s+\"PVESIG:(\S+)\"/) {
            my ($chain, $sig) = ($1, $2);
            return if !&$is_pvefw_chain($chain);
            $res->{$chain} = $sig;
@@ -237,7 +237,7 @@ sub iptables_rule_exist {
 }
 
 sub ruleset_generate_rule {
-    my ($ruleset, $chain, $rule) = @_;
+    my ($ruleset, $chain, $rule, $goto) = @_;
 
     my $cmd = '';
 
@@ -250,7 +250,11 @@ sub ruleset_generate_rule {
     $cmd .= " --dport $rule->{dport}" if $rule->{dport};
     $cmd .= "  --match multiport" if $rule->{nbsport} && $rule->{nbsport} > 1;
     $cmd .= " --sport $rule->{sport}" if $rule->{sport};
-    $cmd .= " -j $rule->{action}" if $rule->{action};
+
+    if (my $action = $rule->{action}) {
+       $goto = 1 if !defined($goto) && $action eq 'PVEFW-SET-ACCEPT-MARK';
+       $cmd .= $goto ? " -g $action" : " -j $action";
+    };
 
     ruleset_addrule($ruleset, $chain, $cmd) if $cmd;
 }
@@ -258,6 +262,8 @@ sub ruleset_generate_rule {
 sub ruleset_create_chain {
     my ($ruleset, $chain) = @_;
 
+    die "Invalid chain name '$chain' (28 char max)\n" if length($chain) > 28;
+
     die "chain '$chain' already exists\n" if $ruleset->{$chain};
 
     $ruleset->{$chain} = [];
@@ -341,11 +347,14 @@ sub generate_tap_rules_direction {
                if(!ruleset_chain_exist($ruleset, $rule->{action})){
                    generate_group_rules($ruleset, $2);
                }
+               ruleset_generate_rule($ruleset, $tapchain, $rule);
+               ruleset_addrule($ruleset, $tapchain, "-m mark --mark 1 -g $bridge-IN");
+           } else {
+               # we go to vmbr-IN if accept in out rules
+               $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT';
+               ruleset_generate_rule($ruleset, $tapchain, $rule);
            }
-           # we go to vmbr-IN if accept in out rules
-           $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT';
-           ruleset_generate_rule($ruleset, $tapchain, $rule);
-        }
+       }
     }
 
     ruleset_addrule($ruleset, $tapchain, "-j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4");
@@ -442,13 +451,15 @@ sub generate_group_rules {
     $chain = "GROUP-${group}-OUT";
 
     ruleset_create_chain($ruleset, $chain);
+    ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark
 
     if ($rules->{out}) {
         foreach my $rule (@{$rules->{out}}) {
-            # we go the PVEFW-BRIDGE-IN because we need to check also other tap rules 
-            # (and group rules can be set on any bridge, so we can't go to VMBRXX-IN)
-            $rule->{action} = 'PVEFW-BRIDGE-IN' if $rule->{action} eq 'ACCEPT';
-            ruleset_generate_rule($rule, $chain, $rule);
+            # we go the PVEFW-SET-ACCEPT-MARK Instead of ACCEPT) because we need to 
+           # check also other tap rules (and group rules can be set on any bridge, 
+           # so we can't go to VMBRXX-IN)
+            $rule->{action} = 'PVEFW-SET-ACCEPT-MARK' if $rule->{action} eq 'ACCEPT';
+            ruleset_generate_rule($ruleset, $chain, $rule);
         }
     }
 }
@@ -617,6 +628,9 @@ sub compile {
     ruleset_create_chain($ruleset, "PVEFW-INPUT");
     ruleset_create_chain($ruleset, "PVEFW-OUTPUT");
 
+    ruleset_create_chain($ruleset, "PVEFW-SET-ACCEPT-MARK");
+    ruleset_addrule($ruleset, "PVEFW-SET-ACCEPT-MARK", "-j MARK --set-mark 1");
+
     enablehostfw($ruleset);
 
     # generate firewall rules for QEMU VMs 
@@ -653,7 +667,7 @@ sub get_ruleset_status {
     my $statushash = {};
 
     foreach my $chain (sort keys %$ruleset) {
-       my $digest = Digest::MD5->new();
+       my $digest = Digest::SHA->new('sha1');
        foreach my $cmd (@{$ruleset->{$chain}}) {
             $digest->add("$cmd\n");
        }
@@ -697,9 +711,8 @@ sub print_ruleset {
 sub print_sig_rule {
     my ($chain, $sig) = @_;
 
-    # Note: This rule should never match! We just use this hack to store a SHA1 checksum
-    # used to detect changes
-    return "-A $chain -j LOG --log-prefix \"PVESIG:$sig\" -p tcp -s \"127.128.129.130\" --dport 1\n";
+    # We just use this to store a SHA1 checksum used to detect changes
+    return "-A $chain -m comment --comment \"PVESIG:$sig\"\n";
 }
 
 sub apply_ruleset {
@@ -745,8 +758,7 @@ sub apply_ruleset {
            }
            $cmdlist .= print_sig_rule($chain, $stat->{sig});
        } elsif ($stat->{action} eq 'delete') {
-           $cmdlist .= "-F $chain\n";
-           $cmdlist .= "-X $chain\n";
+           die "internal error"; # this should not happen
        } elsif ($stat->{action} eq 'exists') {
            # do nothing
        } else {
@@ -754,6 +766,15 @@ sub apply_ruleset {
        }
     }
 
+    foreach my $chain (keys %$statushash) {
+       next if $statushash->{$chain}->{action} ne 'delete';
+       $cmdlist .= "-F $chain\n";
+    }
+    foreach my $chain (keys %$statushash) {
+       next if $statushash->{$chain}->{action} ne 'delete';
+       $cmdlist .= "-X $chain\n";
+    }
+
     $cmdlist .= "COMMIT\n";
 
     print $cmdlist if $verbose;