fwtester: improve rule_match
[pve-firewall.git] / test / fwtester.pl
index 36b38bc..35729ee 100755 (executable)
@@ -7,16 +7,11 @@ use Data::Dumper;
 use PVE::Firewall;
 use Getopt::Long;
 use File::Basename;
+use Net::IP;
 
 my $mark;
 my $trace;
 
-my $outside_iface = 'eth0';
-my $outside_bridge = 'vmbr0';
-
-my $nfvm_iface = 'tapXYZ';
-my $nfvm_bridge = 'vmbr0';
-
 my $debug = 0;
 
 sub print_usage_and_exit {
@@ -52,78 +47,102 @@ sub rule_match {
 
     $rule =~ s/^-A $chain // || die "got strange rule: $rule";
 
-    if ($rule =~ s/^-m conntrack\s*//) {
-       return undef; # simply ignore
-    }
+    while (length($rule)) {
 
-    if ($rule =~ s/^-m addrtype\s*//) {
-       return undef; # simply ignore
-    }
+       if ($rule =~ s/^-m conntrack\s*//) {
+           return undef; # simply ignore
+       }
 
-    if ($rule =~ s/^-i (\S+)\s*//) {
-       my $devre = $1;
-       die "missing iface_in" if !$pkg->{iface_in};
-       return undef if !nf_dev_match($devre, $pkg->{iface_in});
-    }
-    if ($rule =~ s/^-o (\S+)\s*//) {
-       my $devre = $1;
-       die "missing iface_out" if !$pkg->{iface_out};
-       return undef if !nf_dev_match($devre, $pkg->{iface_out});
-    }
+       if ($rule =~ s/^-m addrtype\s*//) {
+           return undef; # simply ignore
+       }
 
-    if ($rule =~ s/^-p (tcp|udp)\s*//) {
-       die "missing proto" if !$pkg->{proto};
-       return undef if $pkg->{proto} ne $1; # no match
-    }
+       if ($rule =~ s/^-i (\S+)\s*//) {
+           my $devre = $1;
+           die "missing iface_in" if !$pkg->{iface_in};
+           return undef if !nf_dev_match($devre, $pkg->{iface_in});
+           next;
+       }
 
-    if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
-       die "missing dport" if !$pkg->{dport};
-       return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
-    }
+       if ($rule =~ s/^-o (\S+)\s*//) {
+           my $devre = $1;
+           die "missing iface_out" if !$pkg->{iface_out};
+           return undef if !nf_dev_match($devre, $pkg->{iface_out});
+           next;
+       }
 
-    if ($rule =~ s/^--dport (\d+)\s*//) {
-       die "missing dport" if !$pkg->{dport};
-       return undef if $pkg->{dport} != $1; # no match
-    }
+       if ($rule =~ s/^-p (tcp|udp)\s*//) {
+           die "missing proto" if !$pkg->{proto};
+           return undef if $pkg->{proto} ne $1; # no match
+           next;
+       }
 
-    if ($rule =~ s/^-s (\S+)\s*//) {
-       die "missing source" if !$pkg->{source};
-       return undef if $pkg->{source} ne $1; # no match
-    }
+       if ($rule =~ s/^--dport (\d+):(\d+)\s*//) {
+           die "missing dport" if !$pkg->{dport};
+           return undef if ($pkg->{dport} < $1) || ($pkg->{dport} > $2); # no match
+           next;
+       }
+
+       if ($rule =~ s/^--dport (\d+)\s*//) {
+           die "missing dport" if !$pkg->{dport};
+           return undef if $pkg->{dport} != $1; # no match
+           next;
+       }
+
+       if ($rule =~ s/^-s (\S+)\s*//) {
+           die "missing source" if !$pkg->{source};
+           my $ip = Net::IP->new($1);
+           return undef if !$ip->overlaps(Net::IP->new($pkg->{source})); # no match
+           next;
+       }
     
-    if ($rule =~ s/^-d (\S+)\s*//) {
-       die "missing destination" if !$pkg->{dest};
-       return undef if $pkg->{dest} ne $1; # no match
-    }
+       if ($rule =~ s/^-d (\S+)\s*//) {
+           die "missing destination" if !$pkg->{dest};
+           my $ip = Net::IP->new($1);
+           return undef if !$ip->overlaps(Net::IP->new($pkg->{dest})); # no match
+           next;
+       }
 
-    if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
-       die "missing source mac" if !$pkg->{mac_source};
-       return undef if $pkg->{mac_source} eq $1; # no match
-    }
+       if ($rule =~ s/^-m mac ! --mac-source (\S+)\s*//) {
+           die "missing source mac" if !$pkg->{mac_source};
+           return undef if $pkg->{mac_source} eq $1; # no match
+           next;
+       }
 
-    if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
-       my $devre = $1;
-       return undef if !$pkg->{physdev_in};
-       return undef if !nf_dev_match($devre, $pkg->{physdev_in});
-    }
+       if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-in (\S+)\s*//) {
+           my $devre = $1;
+           return undef if !$pkg->{physdev_in};
+           return undef if !nf_dev_match($devre, $pkg->{physdev_in});
+           next;
+       }
 
-    if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
-       my $devre = $1;
-       return undef if !$pkg->{physdev_out};
-       return undef if !nf_dev_match($devre, $pkg->{physdev_out});
-    }
+       if ($rule =~ s/^-m physdev --physdev-is-bridged --physdev-out (\S+)\s*//) {
+           my $devre = $1;
+           return undef if !$pkg->{physdev_out};
+           return undef if !nf_dev_match($devre, $pkg->{physdev_out});
+           next;
+       }
 
-    if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
-       $mark = $1;
-       return undef;
-    }
+       if ($rule =~ s/^-m mark --mark (\d+)\s*//) {
+           return undef if !defined($mark) || $mark != $1;
+           next;
+       }
 
-    if ($rule =~ s/^-j (\S+)\s*$//) {
-       return (0, $1);
-    }
+       # final actions
+       if ($rule =~ s/^-j MARK --set-mark (\d+)\s*$//) {
+           $mark = $1;
+           return undef;
+       }
+
+       if ($rule =~ s/^-j (\S+)\s*$//) {
+           return (0, $1);
+       }
+
+       if ($rule =~ s/^-g (\S+)\s*$//) {
+           return (1, $1);
+       }
 
-    if ($rule =~ s/^-g (\S+)\s*$//) {
-       return (1, $1);
+       last;
     }
 
     die "unable to parse rule: $rule";
@@ -224,24 +243,16 @@ sub route_packet {
        $pkg->{iface_in} = $pkg->{iface_out} = undef;
        $pkg->{physdev_in} = $pkg->{physdev_out} = undef;
 
-       if ($route_state eq 'from-outside') {
-           $next_route_state = $outside_bridge || die 'internal error';
-           $next_physdev_in = $outside_iface || die 'internal error';
-       } elsif ($route_state eq 'from-nfvm') {
-           $next_route_state = $nfvm_bridge || die 'internal error';
-           $next_physdev_in = $nfvm_iface || die 'internal error';
+       if ($route_state eq 'from-bport') {
+           $next_route_state = $from_info->{bridge} || die 'internal error';
+           $next_physdev_in = $from_info->{iface} || die 'internal error';
        } elsif ($route_state eq 'host') {
 
-           if ($target->{type} eq 'outside') {
+           if ($target->{type} eq 'bport') {
                $pkg->{iface_in} = 'lo';
-               $pkg->{iface_out} = $outside_bridge;
-               $chain = 'PVEFW-OUTPUT';
-               $next_route_state = $outside_iface
-           } elsif ($target->{type} eq 'nfvm') {
-               $pkg->{iface_in} = 'lo';
-               $pkg->{iface_out} = $nfvm_bridge;
+               $pkg->{iface_out} = $target->{bridge} || die 'internal error';
                $chain = 'PVEFW-OUTPUT';
-               $next_route_state = $nfvm_iface
+               $next_route_state = $target->{iface} || die 'internal error';
            } elsif ($target->{type} eq 'ct') {
                $pkg->{iface_in} = 'lo';
                $pkg->{iface_out} = 'venet0';
@@ -265,19 +276,12 @@ sub route_packet {
                $pkg->{iface_out} = 'lo';
                $next_route_state = 'host';
 
-           } elsif ($target->{type} eq 'outside') {
-               
-               $chain = 'PVEFW-FORWARD';
-               $pkg->{iface_in} = 'venet0';
-               $pkg->{iface_out} = $outside_bridge;
-               $next_route_state = $outside_iface;
-
-           } elsif ($target->{type} eq 'nfvm') {
+           } elsif ($target->{type} eq 'bport') {
                
                $chain = 'PVEFW-FORWARD';
                $pkg->{iface_in} = 'venet0';
-               $pkg->{iface_out} = $nfvm_bridge;
-               $next_route_state = $nfvm_iface;
+               $pkg->{iface_out} = $target->{bridge} || die 'internal error';
+               $next_route_state = $target->{iface} || die 'internal error';
 
            } elsif ($target->{type} eq 'vm') {
 
@@ -328,27 +332,16 @@ sub route_packet {
                $pkg->{iface_out} = 'lo';
                $next_route_state = 'host';
 
-           } elsif ($target->{type} eq 'outside') {
+           } elsif ($target->{type} eq 'bport') {
 
                $chain = 'PVEFW-FORWARD';
                $pkg->{iface_in} = $route_state;
-               $pkg->{iface_out} = $outside_bridge;
-               # conditionally set physdev_out (same behavior as kernel)
-               if ($route_state eq $outside_bridge) {
-                   $pkg->{physdev_out} = $outside_iface || die 'internal error';
-               }
-               $next_route_state = $outside_iface;
-
-           } elsif ($target->{type} eq 'nfvm') {
-
-               $chain = 'PVEFW-FORWARD';
-               $pkg->{iface_in} = $route_state;
-               $pkg->{iface_out} = $nfvm_bridge;
+               $pkg->{iface_out} = $target->{bridge} || die 'internal error';
                # conditionally set physdev_out (same behavior as kernel)
-               if ($route_state eq $nfvm_bridge) {
-                   $pkg->{physdev_out} = $nfvm_iface || die 'internal error';
+               if ($route_state eq $target->{bridge}) {
+                   $pkg->{physdev_out} = $target->{iface} || die 'internal error';
                }
-               $next_route_state = $nfvm_iface;
+               $next_route_state = $target->{iface};
 
            } elsif ($target->{type} eq 'ct') {
 
@@ -457,12 +450,21 @@ sub simulate_firewall {
     if ($from eq 'host') {
        $from_info->{type} = 'host';
        $start_state = 'host';
+    } elsif ($from =~ m|^(vmbr\d+)/(\S+)$|) {
+       $from_info->{type} = 'bport';
+       $from_info->{bridge} = $1;
+       $from_info->{iface} = $2;
+       $start_state = 'from-bport';
     } elsif ($from eq 'outside') {
-       $from_info->{type} = 'outside';
-       $start_state = 'from-outside';
+       $from_info->{type} = 'bport';
+       $from_info->{bridge} = 'vmbr0';
+       $from_info->{iface} = 'eth0';
+       $start_state = 'from-bport';
     } elsif ($from eq 'nfvm') {
-       $from_info->{type} = 'nfvm';
-       $start_state = 'from-nfvm';
+       $from_info->{type} = 'bport';
+       $from_info->{bridge} = 'vmbr0';
+       $from_info->{iface} = 'tapXYZ';
+       $start_state = 'from-bport';
     } elsif ($from =~ m/^ct(\d+)$/) {
        my $vmid = $1;
        $from_info = extract_ct_info($vmdata, $vmid);
@@ -486,12 +488,18 @@ sub simulate_firewall {
     if ($to eq 'host') {
        $target->{type} = 'host';
        $target->{iface} = 'host';
+    } elsif ($to =~ m|^(vmbr\d+)/(\S+)$|) {
+       $target->{type} = 'bport';
+       $target->{bridge} = $1;
+       $target->{iface} = $2;
     } elsif ($to eq 'outside') {
-       $target->{type} = 'outside';
-       $target->{iface} = $outside_iface;
+       $target->{type} = 'bport';
+       $target->{bridge} = 'vmbr0';
+       $target->{iface} = 'eth0';
      } elsif ($to eq 'nfvm') {
-       $target->{type} = 'nfvm';
-       $target->{iface} = $nfvm_iface;
+       $target->{type} = 'bport';
+       $target->{bridge} = 'vmbr0';
+       $target->{iface} = 'tapXYZ';
     } elsif ($to =~ m/^ct(\d+)$/) {
        my $vmid = $1;
        $target = extract_ct_info($vmdata, $vmid);
@@ -573,14 +581,14 @@ sub run_tests {
 my $vmdata = {
     qemu => {
        100 => {
-           net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0",
+           net0 => "e1000=0E:0B:38:B8:B3:21,bridge=vmbr0,firewall=1",
        },
        101 => {
-           net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0",
+           net0 => "e1000=0E:0B:38:B8:B3:22,bridge=vmbr0,firewall=1",
        },
        # on bridge vmbr1
        110 => {
-           net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1",
+           net0 => "e1000=0E:0B:38:B8:B4:21,bridge=vmbr1,firewall=1",
        },
     },
     openvz => {