use Data::Dumper;
+# fixme: remove loglevel settings? NFLOG does not have --loglevel
+
my $nodename = PVE::INotify::nodename();
my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
my ($ruleset, $chain) = @_;
die "Invalid chain name '$chain' (28 char max)\n" if length($chain) > 28;
+ die "chain name may not contain collons\n" if $chain =~ m/:/; # because of log format
die "chain '$chain' already exists\n" if $ruleset->{$chain};
unshift @{$ruleset->{$chain}}, "-A $chain $rule";
}
+sub get_log_rule_base {
+ my ($chain, $vmid, $msg, $loglevel) = @_;
+
+ die "internal error - no log level" if !defined($loglevel);
+
+ $vmid = 0 if !defined($vmid);
+
+ # Note: we use special format for prefix to pass further
+ # info to log daemon (VMID, LOGVELEL and CHAIN)
+
+ return "-j NFLOG --nflog-prefix \":$vmid:$loglevel:$chain: $msg\"";
+}
+
+sub ruleset_addlog {
+ my ($ruleset, $chain, $vmid, $msg, $loglevel, $rule) = @_;
+
+ return if !defined($loglevel);
+
+ my $logrule = get_log_rule_base($chain, $vmid, $msg, $loglevel);
+
+ $logrule = "$rule $logrule" if defined($rule);
+
+ ruleset_addrule($ruleset, $chain, $logrule)
+}
+
sub generate_bridge_chains {
- my ($ruleset, $hostfw_conf, $bridge) = @_;
+ my ($ruleset, $hostfw_conf, $bridge, $routing_table) = @_;
+
+ my $options = $hostfw_conf->{options} || {};
+
+ die "error: detected direct route to bridge '$bridge'\n"
+ if !$options->{allow_bridge_route} && $routing_table->{$bridge};
if (!ruleset_chain_exist($ruleset, "$bridge-FW")) {
ruleset_create_chain($ruleset, "$bridge-FW");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-bridged -j $bridge-FW");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-bridged -j $bridge-FW");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-out -j $bridge-FW");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-in -j $bridge-FW");
}
if (!ruleset_chain_exist($ruleset, "$bridge-OUT")) {
ruleset_create_chain($ruleset, "$bridge-OUT");
- ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-in -j $bridge-OUT");
- ruleset_addrule($ruleset, "PVEFW-INPUT", "-i $bridge -m physdev --physdev-is-bridged --physdev-is-in -j $bridge-OUT");
+ ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-in -j $bridge-OUT");
+ ruleset_insertrule($ruleset, "PVEFW-INPUT", "-i $bridge -m physdev --physdev-is-in -j $bridge-OUT");
}
if (!ruleset_chain_exist($ruleset, "$bridge-IN")) {
ruleset_create_chain($ruleset, "$bridge-IN");
- ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-out -j $bridge-IN");
+ ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j $bridge-IN");
ruleset_addrule($ruleset, "$bridge-FW", "-m mark --mark 1 -j ACCEPT");
# accept traffic to unmanaged bridge ports
- ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-out -j ACCEPT ");
+ ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j ACCEPT ");
}
}
sub ruleset_add_chain_policy {
- my ($ruleset, $chain, $policy, $loglevel, $accept_action) = @_;
+ my ($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action) = @_;
if ($policy eq 'ACCEPT') {
ruleset_addrule($ruleset, $chain, "-j PVEFW-Drop");
- ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"$chain-dropped: \" --log-level $loglevel")
- if defined($loglevel);
+ ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel);
ruleset_addrule($ruleset, $chain, "-j DROP");
} elsif ($policy eq 'REJECT') {
ruleset_addrule($ruleset, $chain, "-j PVEFW-Reject");
- ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"$chain-reject: \" --log-level $loglevel")
- if defined($loglevel);
+ ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel);
ruleset_addrule($ruleset, $chain, "-g PVEFW-reject");
} else {
}
my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : "ACCEPT";
- ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action);
+ ruleset_add_chain_policy($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action);
- # plug into FORWARD chain
+ # plug into FORWARD, INPUT and OUTPUT chain
if ($direction eq 'OUT') {
ruleset_generate_rule_insert($ruleset, "PVEFW-FORWARD", {
action => $chain,
source => $ip,
iface_in => 'venet0'});
+
+ ruleset_generate_rule_insert($ruleset, "PVEFW-INPUT", {
+ action => $chain,
+ source => $ip,
+ iface_in => 'venet0'});
} else {
ruleset_generate_rule($ruleset, "PVEFW-FORWARD", {
action => $chain,
dest => $ip,
iface_out => 'venet0'});
+
+ ruleset_generate_rule($ruleset, "PVEFW-OUTPUT", {
+ action => $chain,
+ dest => $ip,
+ iface_out => 'venet0'});
}
}
sub generate_tap_rules_direction {
- my ($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, $direction) = @_;
+ my ($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $bridge, $direction) = @_;
my $lc_direction = lc($direction);
}
my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : "ACCEPT";
- ruleset_add_chain_policy($ruleset, $tapchain, $policy, $loglevel, $accept_action);
+ ruleset_add_chain_policy($ruleset, $tapchain, $vmid, $policy, $loglevel, $accept_action);
# plug the tap chain to bridge chain
- my $physdevdirection = $direction eq 'IN' ? "out" : "in";
- my $rule = "-m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain";
- ruleset_insertrule($ruleset, "$bridge-$direction", $rule);
+ if ($direction eq 'IN') {
+ ruleset_insertrule($ruleset, "$bridge-IN",
+ "-m physdev --physdev-is-bridged --physdev-out $iface -j $tapchain");
+ } else {
+ ruleset_insertrule($ruleset, "$bridge-OUT",
+ "-m physdev --physdev-in $iface -j $tapchain");
+ }
}
sub enable_host_firewall {
ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT");
ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT");
- ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT");
+ ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j ACCEPT");
ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync
# we use RETURN because we need to check also tap rules
# implement input policy
my $policy = $options->{policy_in} || 'DROP'; # allow nothing by default
- ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action);
+ ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action);
# host outbound firewall
$chain = "PVEFW-HOST-OUT";
ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT");
ruleset_addrule($ruleset, $chain, "-o lo -j ACCEPT");
ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT");
- ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT");
+ ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j ACCEPT");
ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync
# we use RETURN because we may want to check other thigs later
# implement output policy
$policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default
- ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action);
+ ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action);
ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-j PVEFW-HOST-OUT");
ruleset_addrule($ruleset, "PVEFW-INPUT", "-j PVEFW-HOST-IN");
my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog";
- if ($line =~ m/^(enable|dhcp|nosmurfs|tcpflags):\s*(0|1)\s*$/i) {
+ if ($line =~ m/^(enable|dhcp|nosmurfs|tcpflags|allow_bridge_route):\s*(0|1)\s*$/i) {
$opt = lc($1);
$value = int($2);
} elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) {
my $loglevel = get_option_log_level($options, 'smurf_log_level');
# same as shorewall smurflog.
- if (defined($loglevel)) {
- $pve_std_chains-> {'PVEFW-smurflog'} = [
- "-j LOG --log-prefix \"smurfs-dropped: \" --log-level $loglevel",
- "-j DROP",
- ];
- } else {
- $pve_std_chains-> {'PVEFW-smurflog'} = [ "-j DROP" ];
- }
+ my $chain = 'PVEFW-smurflog';
+
+ push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel;
+ push @{$pve_std_chains->{$chain}}, "-j DROP";
# same as shorewall logflags action.
$loglevel = get_option_log_level($options, 'tcp_flags_log_level');
- if (defined($loglevel)) {
- $pve_std_chains-> {'PVEFW-logflags'} = [
- "-j LOG --log-prefix \"logflags-dropped: \" --log-level $loglevel --log-ip-options",
- "-j DROP",
- ];
- } else {
- $pve_std_chains-> {'PVEFW-logflags'} = [ "-j DROP" ];
- }
+ $chain = 'PVEFW-logflags';
+ # fixme: is this correctly logged by pvewf-logger? (ther is no --log-ip-options for NFLOG)
+ push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel;
+ push @{$pve_std_chains->{$chain}}, "-j DROP";
foreach my $chain (keys %$pve_std_chains) {
ruleset_create_chain($ruleset, $chain);
return $status;
}
+# fixme: move to pve-common PVE::ProcFSTools
+sub read_proc_net_route {
+ my $filename = "/proc/net/route";
+
+ my $res = {};
+
+ my $fh = IO::File->new ($filename, "r");
+ return $res if !$fh;
+
+ my $int_to_quad = sub {
+ return join '.' => map { ($_[0] >> 8*(3-$_)) % 256 } (3, 2, 1, 0);
+ };
+
+ while (defined(my $line = <$fh>)) {
+ next if $line =~/^Iface\s+Destination/; # skip head
+ my ($iface, $dest, $gateway, $metric, $mask, $mtu) = (split(/\s+/, $line))[0,1,2,6,7,8];
+ push @{$res->{$iface}}, {
+ dest => &$int_to_quad(hex($dest)),
+ gateway => &$int_to_quad(hex($gateway)),
+ mask => &$int_to_quad(hex($mask)),
+ metric => $metric,
+ mtu => $mtu,
+ };
+ }
+
+ return $res;
+}
+
sub compile {
my $vmdata = read_local_vm_config();
my $vmfw_configs = read_vm_firewall_configs($vmdata);
+ my $routing_table = read_proc_net_route();
+
my $groups_conf = {};
my $filename = "/etc/pve/firewall/groups.fw";
if (my $fh = IO::File->new($filename, O_RDONLY)) {
$bridge .= "v$net->{tag}" if $net->{tag};
- generate_bridge_chains($ruleset, $hostfw_conf, $bridge);
+ generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table);
my $macaddr = $net->{macaddr};
- generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN');
- generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT');
+ generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, $bridge, 'IN');
+ generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, $bridge, 'OUT');
}
}
warn "no bridge device for CT $vmid iface '$netid'\n";
next; # fixme?
}
- my $macaddr = $d->{host_mac};
+
+ generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table);
+
+ my $macaddr = $d->{mac};
my $iface = $d->{host_ifname};
- generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN');
- generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT');
+ generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, $bridge, 'IN');
+ generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr,
+ $vmfw_conf, $vmid, $bridge, 'OUT');
}
}
}
# fixme: what log level should we use here?
my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j ACCEPT");
+ # fixme: should we really block inter-bridge traffic?
+
+ # always allow traffic from containers?
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j RETURN");
+
# disable interbridge routing
ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j PVEFW-Drop");
ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j PVEFW-Drop");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel");
+ ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-o vmbr+");
+ ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-i vmbr+");
ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP");
ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");
}
sub apply_ruleset {
- my ($ruleset, $verbose) = @_;
+ my ($ruleset, $hostfw_conf, $verbose) = @_;
enable_bridge_firewall();
+ update_nf_conntrack_max($hostfw_conf);
+
my $cmdlist = get_rulset_cmdlist($ruleset, $verbose);
print $cmdlist if $verbose;
my ($ruleset, $hostfw_conf) = PVE::Firewall::compile();
- update_nf_conntrack_max($hostfw_conf);
-
if ($start || $status eq 'active') {
save_pvefw_status('active') if ($status ne 'active');
- PVE::Firewall::apply_ruleset($ruleset, $verbose);
+ apply_ruleset($ruleset, $hostfw_conf, $verbose);
} else {
print "Firewall not active (status = $status)\n" if $verbose;
}
projects / pve-firewall.git / blobdiff