$sha->add($k, ':', $v, "\n");
}
- my $digest = $sha->b64digest;
+ my $digest = $sha->hexdigest;
$res->{digest} = $digest;
push @$res, $data;
}
- my $digest = $sha->b64digest;
+ my $digest = $sha->hexdigest;
foreach my $entry (@$res) {
$entry->{digest} = $digest;
return 1 if $name =~ m/^venet0-\d+-(:?IN|OUT)$/;
- return 1 if $name =~ m/^vmbr\d+(v\d+)?-(:?FW|IN|OUT|IPS)$/;
+ return 1 if $name =~ m/^fwbr\d+(v\d+)?-(:?FW|IN|OUT|IPS)$/;
return 1 if $name =~ m/^GROUP-(:?[^\s\-]+)-(:?IN|OUT)$/;
return undef;
$logrule = "$rule $logrule" if defined($rule);
- ruleset_addrule($ruleset, $chain, $logrule)
-}
-
-sub generate_bridge_chains {
- my ($ruleset, $hostfw_conf, $bridge, $routing_table, $bridges_config) = @_;
-
- my $options = $hostfw_conf->{options} || {};
-
- die "error: detected direct route to bridge '$bridge'\n"
- if !$options->{allow_bridge_route} && $routing_table->{$bridge};
-
- if (!ruleset_chain_exist($ruleset, "$bridge-FW")) {
- ruleset_create_chain($ruleset, "$bridge-FW");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-out -j $bridge-FW");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-in -j $bridge-FW");
- }
-
- if (!ruleset_chain_exist($ruleset, "$bridge-OUT")) {
- ruleset_create_chain($ruleset, "$bridge-OUT");
-
- if($options->{optimize}){
- foreach my $interface (@{$bridges_config->{$bridge}}) {
- ruleset_addrule($ruleset, "$bridge-OUT", "-m physdev --physdev-is-bridged --physdev-in $interface -g PVEFW-SET-ACCEPT-MARK");
- }
- }
-
- ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-in -j $bridge-OUT");
- ruleset_insertrule($ruleset, "PVEFW-INPUT", "-i $bridge -m physdev --physdev-is-in -j $bridge-OUT");
- }
-
- if (!ruleset_chain_exist($ruleset, "$bridge-IN")) {
- ruleset_create_chain($ruleset, "$bridge-IN");
-
- if($options->{optimize}){
- foreach my $interface (@{$bridges_config->{$bridge}}) {
- ruleset_addrule($ruleset, "$bridge-IN", "-m physdev --physdev-is-bridged --physdev-out $interface -j ACCEPT");
- }
- }
-
- ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j $bridge-IN");
- ruleset_addrule($ruleset, "$bridge-FW", "-m mark --mark 1 -j ACCEPT");
- # accept traffic to unmanaged bridge ports
- ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j ACCEPT ");
- }
+ ruleset_addrule($ruleset, $chain, $logrule);
}
sub ruleset_add_chain_policy {
}
sub ruleset_generate_vm_ipsrules {
- my ($ruleset, $options, $direction, $iface, $bridge) = @_;
+ my ($ruleset, $options, $direction, $iface) = @_;
if ($options->{ips} && $direction eq 'IN') {
my $nfqueue = generate_nfqueue($options);
- if (!ruleset_chain_exist($ruleset, "$bridge-IPS")) {
+ if (!ruleset_chain_exist($ruleset, "PVEFW-IPS")) {
ruleset_create_chain($ruleset, "PVEFW-IPS");
}
- if (!ruleset_chain_exist($ruleset, "$bridge-IPS")) {
- ruleset_create_chain($ruleset, "$bridge-IPS");
- ruleset_insertrule($ruleset, "PVEFW-IPS", "-o $bridge -m physdev --physdev-is-out -j $bridge-IPS");
- }
-
- ruleset_addrule($ruleset, "$bridge-IPS", "-m physdev --physdev-out $iface --physdev-is-bridged -j $nfqueue");
+ ruleset_addrule($ruleset, "PVEFW-IPS", "-m physdev --physdev-out $iface --physdev-is-bridged -j $nfqueue");
}
}
}
sub generate_tap_rules_direction {
- my ($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $bridge, $direction) = @_;
+ my ($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $direction) = @_;
my $lc_direction = lc($direction);
ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $tapchain, $netid, $direction, $options);
- ruleset_generate_vm_ipsrules($ruleset, $options, $direction, $iface, $bridge);
+ ruleset_generate_vm_ipsrules($ruleset, $options, $direction, $iface);
# implement policy
my $policy;
# plug the tap chain to bridge chain
if ($direction eq 'IN') {
- ruleset_addrule($ruleset, "$bridge-IN",
- "-m physdev --physdev-is-bridged --physdev-out $iface -j $tapchain");
+ ruleset_addrule($ruleset, "PVEFW-FWBR-IN",
+ "-m physdev --physdev-is-bridged --physdev-out $iface -j $tapchain");
} else {
- ruleset_addrule($ruleset, "$bridge-OUT",
- "-m physdev --physdev-in $iface -j $tapchain");
+ ruleset_addrule($ruleset, "PVEFW-FWBR-OUT",
+ "-m physdev --physdev-is-bridged --physdev-in $iface -j $tapchain");
}
}
my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog";
- if ($line =~ m/^(enable|nosmurfs|tcpflags|allow_bridge_route|optimize):\s*(0|1)\s*$/i) {
+ if ($line =~ m/^(enable|nosmurfs|tcpflags|optimize):\s*(0|1)\s*$/i) {
$opt = lc($1);
$value = int($2);
} elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) {
my $options = $vmfw_conf->{options};
$raw .= &$format_options($options) if scalar(keys %$options);
- my $rules = $vmfw_conf->{rules};
+ my $rules = $vmfw_conf->{rules} || [];
if (scalar(@$rules)) {
$raw .= "[RULES]\n\n";
$raw .= &$format_rules($rules, 1);
return $status;
}
-# fixme: move to pve-common PVE::ProcFSTools
-sub read_proc_net_route {
- my $filename = "/proc/net/route";
-
- my $res = {};
-
- my $fh = IO::File->new ($filename, "r");
- return $res if !$fh;
-
- my $int_to_quad = sub {
- return join '.' => map { ($_[0] >> 8*(3-$_)) % 256 } (3, 2, 1, 0);
- };
-
- while (defined(my $line = <$fh>)) {
- next if $line =~/^Iface\s+Destination/; # skip head
- my ($iface, $dest, $gateway, $metric, $mask, $mtu) = (split(/\s+/, $line))[0,1,2,6,7,8];
- push @{$res->{$iface}}, {
- dest => &$int_to_quad(hex($dest)),
- gateway => &$int_to_quad(hex($gateway)),
- mask => &$int_to_quad(hex($mask)),
- metric => $metric,
- mtu => $mtu,
- };
- }
-
- return $res;
-}
-
sub load_clusterfw_conf {
my $cluster_conf = {};
my $vmdata = read_local_vm_config();
my $vmfw_configs = read_vm_firewall_configs($vmdata);
- my $routing_table = read_proc_net_route();
-
my $bridges_config = read_bridges_config();
my $ipset_ruleset = {};
ruleset_create_chain($ruleset, "PVEFW-OUTPUT");
ruleset_create_chain($ruleset, "PVEFW-FORWARD");
+
+ ruleset_create_chain($ruleset, "PVEFW-FWBR-IN");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-in link+ -j PVEFW-FWBR-IN");
+
+ ruleset_create_chain($ruleset, "PVEFW-FWBR-OUT");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-out link+ -j PVEFW-FWBR-OUT");
my $hostfw_options = $hostfw_conf->{options} || {};
+ # fixme: what log level should we use here?
+ my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
+
+ if($hostfw_options->{optimize}){
+
+ my $accept = ruleset_chain_exist($ruleset, "PVEFW-IPS") ? "PVEFW-IPS" : "ACCEPT";
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate INVALID -j DROP");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
+ }
+
+ if ($cluster_conf->{ipset}->{blacklist}){
+ ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-m set --match-set PVEFW-blacklist src");
+ ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m set --match-set PVEFW-blacklist src -j DROP");
+ }
+
generate_std_chains($ruleset, $hostfw_options);
my $hostfw_enable = !(defined($hostfw_options->{enable}) && ($hostfw_options->{enable} == 0));
next if !$net;
my $iface = "tap${vmid}i$1";
- my $bridge = $net->{bridge};
- next if !$bridge; # fixme: ?
-
- $bridge .= "v$net->{tag}" if $net->{tag};
-
- generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table, $bridges_config);
-
my $macaddr = $net->{macaddr};
generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr,
- $vmfw_conf, $vmid, $bridge, 'IN');
+ $vmfw_conf, $vmid, 'IN');
generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr,
- $vmfw_conf, $vmid, $bridge, 'OUT');
+ $vmfw_conf, $vmid, 'OUT');
}
}
my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value});
foreach my $netid (keys %$netif) {
my $d = $netif->{$netid};
- my $bridge = $d->{bridge};
- if (!$bridge) {
- warn "no bridge device for CT $vmid iface '$netid'\n";
- next; # fixme?
- }
-
- generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table, $bridges_config);
my $macaddr = $d->{mac};
my $iface = $d->{host_ifname};
generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr,
- $vmfw_conf, $vmid, $bridge, 'IN');
+ $vmfw_conf, $vmid, 'IN');
generate_tap_rules_direction($ruleset, $cluster_conf, $hostfw_conf, $iface, $netid, $macaddr,
- $vmfw_conf, $vmid, $bridge, 'OUT');
+ $vmfw_conf, $vmid, 'OUT');
}
}
}
- if($hostfw_options->{optimize}){
-
- my $accept = ruleset_chain_exist($ruleset, "PVEFW-IPS") ? "PVEFW-IPS" : "ACCEPT";
- ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept");
- ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate INVALID -j DROP");
- }
-
- # fixme: what log level should we use here?
- my $loglevel = get_option_log_level($hostfw_options, "log_level_out");
-
- # fixme: should we really block inter-bridge traffic?
-
- # always allow traffic from containers?
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j RETURN");
-
- # disable interbridge routing
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j PVEFW-Drop");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j PVEFW-Drop");
- ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-o vmbr+");
- ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-i vmbr+");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP");
- ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");
-
return ($ruleset, $ipset_ruleset);
}
projects / pve-firewall.git / blobdiff