use Encode;
my $hostfw_conf_filename = "/etc/pve/local/host.fw";
-my $clusterfw_conf_filename = "/etc/pve/firewall/cluster.fw";
+my $pvefw_conf_dir = "/etc/pve/firewall";
+my $clusterfw_conf_filename = "$pvefw_conf_dir/cluster.fw";
# dynamically include PVE::QemuServer and PVE::OpenVZ
# to avoid dependency problems
die "value does not look like a valid IP address or CIDR network\n";
}
+PVE::JSONSchema::register_format('IPv4orCIDRorAlias', \&pve_verify_ipv4_or_cidr_or_alias);
+sub pve_verify_ipv4_or_cidr_or_alias {
+ my ($cidr, $noerr) = @_;
+
+ return if $cidr =~ m/^(?:$ip_alias_pattern)$/;
+
+ if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) {
+ return $cidr if Net::IP->new($cidr);
+ return undef if $noerr;
+ die Net::IP::Error() . "\n";
+ }
+ return undef if $noerr;
+ die "value does not look like a valid IP address or CIDR network\n";
+}
+
PVE::JSONSchema::register_standard_option('ipset-name', {
description => "IP set name.",
type => 'string',
sub parse_fw_rule {
my ($prefix, $line, $cluster_conf, $fw_conf, $rule_env, $verbose) = @_;
- chomp $line;
-
my $orig_line = $line;
my $rule = {};
$opt = lc($1);
$value = $2;
} else {
- chomp $line;
die "can't parse option '$line'\n"
}
$opt = lc($1);
$value = int($2);
} else {
- chomp $line;
die "can't parse option '$line'\n"
}
$opt = lc($1);
$value = uc($3);
} else {
- chomp $line;
die "can't parse option '$line'\n"
}
return ($opt, $value);
}
+sub resolve_alias {
+ my ($clusterfw_conf, $fw_conf, $cidr) = @_;
+
+ if ($cidr !~ m/^\d/) {
+ my $alias = lc($cidr);
+ my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
+ $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf;
+ return $e->{cidr} if $e;
+
+ die "no such alias '$cidr'\n";
+ }
+
+ return $cidr;
+}
+
sub parse_alias {
my ($line) = @_;
return undef;
}
-sub generic_fw_rules_parser {
+sub generic_fw_config_parser {
my ($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env) = @_;
my $section;
my $res = $empty_conf;
- my $ipset_option = get_standard_option('ipset-name');
-
while (defined(my $line = <$fh>)) {
next if $line =~ m/^#/;
next if $line =~ m/^\s*$/;
+ chomp $line;
+
my $linenr = $fh->input_line_number();
my $prefix = "$filename (line $linenr)";
$line =~ m/^(\!)?\s*(\S+)\s*$/;
my $nomatch = $1;
my $cidr = $2;
+ my $errors;
- if($cidr !~ m/^${ip_alias_pattern}$/) {
- $cidr =~ s|/32$||;
+ if ($nomatch && !$feature_ipset_nomatch) {
+ $errors->{nomatch} = "nomatch not supported by kernel";
+ }
- eval { pve_verify_ipv4_or_cidr($cidr); };
- if (my $err = $@) {
- warn "$prefix: $cidr - $err";
- next;
+ eval {
+ if ($cidr =~ m/^${ip_alias_pattern}$/) {
+ resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists
+ } else {
+ $cidr =~ s|/32$||;
+ pve_verify_ipv4_or_cidr_or_alias($cidr);
}
+ };
+ if (my $err = $@) {
+ chomp $err;
+ $errors->{cidr} = $err;
}
my $entry = { cidr => $cidr };
$entry->{nomatch} = 1 if $nomatch;
$entry->{comment} = $comment if $comment;
+ $entry->{errors} = $errors if $errors;
+
+ if ($verbose && $errors) {
+ warn "$prefix - errors in ipset '$group': $line\n";
+ foreach my $p (keys %{$errors}) {
+ warn " $p: $errors->{$p}\n";
+ }
+ }
push @{$res->{$section}->{$group}}, $entry;
} else {
return $res;
}
-sub parse_host_fw_rules {
+sub parse_hostfw_config {
my ($filename, $fh, $cluster_conf, $verbose) = @_;
my $empty_conf = { rules => [], options => {}};
- return generic_fw_rules_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, 'host');
+ return generic_fw_config_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, 'host');
}
-sub parse_vm_fw_rules {
+sub parse_vmfw_config {
my ($filename, $fh, $cluster_conf, $rule_env, $verbose) = @_;
my $empty_conf = {
ipset_comments => {},
};
- return generic_fw_rules_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env);
+ return generic_fw_config_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env);
}
-sub parse_cluster_fw_rules {
+sub parse_clusterfw_config {
my ($filename, $fh, $verbose) = @_;
my $section;
ipset_comments => {},
};
- return generic_fw_rules_parser($filename, $fh, $verbose, $empty_conf, $empty_conf, 'cluster');
+ return generic_fw_config_parser($filename, $fh, $verbose, $empty_conf, $empty_conf, 'cluster');
}
sub run_locked {
my $vmfw_conf = {};
- $dir = "/etc/pve/firewall" if !defined($dir);
+ $dir = $pvefw_conf_dir if !defined($dir);
my $filename = "$dir/$vmid.fw";
if (my $fh = IO::File->new($filename, O_RDONLY)) {
- $vmfw_conf = parse_vm_fw_rules($filename, $fh, $cluster_conf, $rule_env, $verbose);
+ $vmfw_conf = parse_vmfw_config($filename, $fh, $cluster_conf, $rule_env, $verbose);
$vmfw_conf->{vmid} = $vmid;
}
my $raw = '';
my $options = $vmfw_conf->{options};
- $raw .= &$format_options($options) if scalar(keys %$options);
+ $raw .= &$format_options($options) if $options && scalar(keys %$options);
my $aliases = $vmfw_conf->{aliases};
- $raw .= &$format_aliases($aliases) if scalar(keys %$aliases);
+ $raw .= &$format_aliases($aliases) if $aliases && scalar(keys %$aliases);
- $raw .= &$format_ipsets($vmfw_conf);
+ $raw .= &$format_ipsets($vmfw_conf) if $vmfw_conf->{ipset};
my $rules = $vmfw_conf->{rules} || [];
- if (scalar(@$rules)) {
+ if ($rules && scalar(@$rules)) {
$raw .= "[RULES]\n\n";
$raw .= &$format_rules($rules, 1);
$raw .= "\n";
}
- my $filename = "/etc/pve/firewall/$vmid.fw";
+ mkdir $pvefw_conf_dir;
+
+ my $filename = "$pvefw_conf_dir/$vmid.fw";
PVE::Tools::file_set_contents($filename, $raw);
}
# remove duplicates
my $nethash = {};
foreach my $entry (@$options) {
- my $cidr = $entry->{cidr};
- if ($cidr =~ m/^${ip_alias_pattern}$/) {
- my $alias = lc($cidr);
- my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
- $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf;
- if ($e) {
- $entry->{cidr} = $e->{cidr};
- $nethash->{$entry->{cidr}} = $entry;
- } else {
- warn "no such alias '$cidr'\n";
- }
- } else {
- $nethash->{$entry->{cidr}} = $entry;
- }
+ next if $entry->{errors}; # skip entries with errors
+ eval {
+ my $cidr = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr});
+ $nethash->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} };
+ };
+ warn $@ if $@;
}
foreach my $cidr (sort keys %$nethash) {
my $cluster_conf = {};
if (my $fh = IO::File->new($filename, O_RDONLY)) {
- $cluster_conf = parse_cluster_fw_rules($filename, $fh, $verbose);
+ $cluster_conf = parse_clusterfw_config($filename, $fh, $verbose);
}
return $cluster_conf;
my $raw = '';
my $options = $cluster_conf->{options};
- $raw .= &$format_options($options) if scalar(keys %$options);
+ $raw .= &$format_options($options) if $options && scalar(keys %$options);
my $aliases = $cluster_conf->{aliases};
- $raw .= &$format_aliases($aliases) if scalar(keys %$aliases);
+ $raw .= &$format_aliases($aliases) if $aliases && scalar(keys %$aliases);
- $raw .= &$format_ipsets($cluster_conf);
+ $raw .= &$format_ipsets($cluster_conf) if $cluster_conf->{ipset};
my $rules = $cluster_conf->{rules};
- if (scalar(@$rules)) {
+ if ($rules && scalar(@$rules)) {
$raw .= "[RULES]\n\n";
$raw .= &$format_rules($rules, 1);
$raw .= "\n";
}
- foreach my $group (sort keys %{$cluster_conf->{groups}}) {
- my $rules = $cluster_conf->{groups}->{$group};
- if (my $comment = $cluster_conf->{group_comments}->{$group}) {
- my $utf8comment = encode('utf8', $comment);
- $raw .= "[group $group] # $utf8comment\n\n";
- } else {
- $raw .= "[group $group]\n\n";
- }
+ if ($cluster_conf->{groups}) {
+ foreach my $group (sort keys %{$cluster_conf->{groups}}) {
+ my $rules = $cluster_conf->{groups}->{$group};
+ if (my $comment = $cluster_conf->{group_comments}->{$group}) {
+ my $utf8comment = encode('utf8', $comment);
+ $raw .= "[group $group] # $utf8comment\n\n";
+ } else {
+ $raw .= "[group $group]\n\n";
+ }
- $raw .= &$format_rules($rules, 0);
- $raw .= "\n";
+ $raw .= &$format_rules($rules, 0);
+ $raw .= "\n";
+ }
}
+ mkdir $pvefw_conf_dir;
PVE::Tools::file_set_contents($clusterfw_conf_filename, $raw);
}
my $hostfw_conf = {};
if (my $fh = IO::File->new($filename, O_RDONLY)) {
- $hostfw_conf = parse_host_fw_rules($filename, $fh, $cluster_conf, $verbose);
+ $hostfw_conf = parse_hostfw_config($filename, $fh, $cluster_conf, $verbose);
}
return $hostfw_conf;
}
my $raw = '';
my $options = $hostfw_conf->{options};
- $raw .= &$format_options($options) if scalar(keys %$options);
+ $raw .= &$format_options($options) if $options && scalar(keys %$options);
my $rules = $hostfw_conf->{rules};
- if (scalar(@$rules)) {
+ if ($rules && scalar(@$rules)) {
$raw .= "[RULES]\n\n";
$raw .= &$format_rules($rules, 1);
$raw .= "\n";
push @{$cluster_conf->{ipset}->{management}}, { cidr => $localnet };
+ return ({}, {}) if !$cluster_conf->{options}->{enable};
+
my $ruleset = {};
ruleset_create_chain($ruleset, "PVEFW-INPUT");
}
foreach my $h (qw(INPUT OUTPUT FORWARD)) {
- if (!$hooks->{$h}) {
- $cmdlist .= "-A $h -j PVEFW-$h\n";
+ my $chain = "PVEFW-$h";
+ if ($ruleset->{$chain} && !$hooks->{$h}) {
+ $cmdlist .= "-A $h -j $chain\n";
}
}
$cmdlist .= "COMMIT\n";
iptables_restore_cmdlist($cmdlist);
+
+ my $ipset_chains = ipset_get_chains();
+
+ $cmdlist = "";
+
+ foreach my $chain (keys %$ipset_chains) {
+ $cmdlist .= "flush $chain\n";
+ $cmdlist .= "destroy $chain\n";
+ }
+
+ ipset_restore_cmdlist($cmdlist) if $cmdlist;
}
sub init {
my $cluster_conf = load_clusterfw_conf();
my $cluster_options = $cluster_conf->{options};
- my $enable = $cluster_options->{enable};
-
- die "Firewall is disabled - cannot start\n" if !$enable;
-
- if (!$enable) {
+ if (!$cluster_options->{enable}) {
PVE::Firewall::remove_pvefw_chains();
return;
}
projects / pve-firewall.git / blobdiff