X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=PVE%2FFirewall.pm;h=343f60c22a8faeb8b9ab8ef50778ae4228a20d99;hp=4c6e18e51585b49f9b4431baf43d802566dd0743;hb=d37fa05ca87e264772c6236759e8477a83c01650;hpb=51bae274914819734268a08bf3c1df3745b28bb6 diff --git a/PVE/Firewall.pm b/PVE/Firewall.pm index 4c6e18e..343f60c 100644 --- a/PVE/Firewall.pm +++ b/PVE/Firewall.pm @@ -15,22 +15,355 @@ use Data::Dumper; my $pve_fw_lock_filename = "/var/lock/pvefw.lck"; -my $macros; +# todo: define more MACROS +# imported/converted from: /usr/share/shorewall/macro.* +my $pve_fw_macros = { + 'Amanda' => [ + { action => 'PARAM', proto => 'udp', dport => '10080' }, + { action => 'PARAM', proto => 'tcp', dport => '10080' }, + ], + 'Auth' => [ + { action => 'PARAM', proto => 'tcp', dport => '113' }, + ], + 'BGP' => [ + { action => 'PARAM', proto => 'tcp', dport => '179' }, + ], + 'BitTorrent' => [ + { action => 'PARAM', proto => 'tcp', dport => '6881:6889' }, + { action => 'PARAM', proto => 'udp', dport => '6881' }, + ], + 'BitTorrent32' => [ + { action => 'PARAM', proto => 'tcp', dport => '6881:6999' }, + { action => 'PARAM', proto => 'udp', dport => '6881' }, + ], + 'CVS' => [ + { action => 'PARAM', proto => 'tcp', dport => '2401' }, + ], + 'Citrix' => [ + { action => 'PARAM', proto => 'tcp', dport => '1494' }, + { action => 'PARAM', proto => 'udp', dport => '1604' }, + { action => 'PARAM', proto => 'tcp', dport => '2598' }, + ], + 'DAAP' => [ + { action => 'PARAM', proto => 'tcp', dport => '3689' }, + { action => 'PARAM', proto => 'udp', dport => '3689' }, + ], + 'DCC' => [ + { action => 'PARAM', proto => 'tcp', dport => '6277' }, + ], + 'DHCPfwd' => [ + { action => 'PARAM', proto => 'udp', dport => '67:68', sport => '67:68' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '67:68', sport => '67:68' }, + ], + 'DNS' => [ + { action => 'PARAM', proto => 'udp', dport => '53' }, + { action => 'PARAM', proto => 'tcp', dport => '53' }, + ], + 'Distcc' => [ + { action => 'PARAM', proto => 'tcp', dport => '3632' }, + ], + 'Edonkey' => [ + { action => 'PARAM', proto => 'tcp', dport => '4662' }, + { action => 'PARAM', proto => 'udp', dport => '4665' }, + ], + 'FTP' => [ + { action => 'PARAM', proto => 'tcp', dport => '21' }, + ], + 'Finger' => [ + { action => 'PARAM', proto => 'tcp', dport => '79' }, + ], + 'GNUnet' => [ + { action => 'PARAM', proto => 'tcp', dport => '2086' }, + { action => 'PARAM', proto => 'udp', dport => '2086' }, + { action => 'PARAM', proto => 'tcp', dport => '1080' }, + { action => 'PARAM', proto => 'udp', dport => '1080' }, + ], + 'GRE' => [ + { action => 'PARAM', proto => '47' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '47' }, + ], + 'Git' => [ + { action => 'PARAM', proto => 'tcp', dport => '9418' }, + ], + 'Gnutella' => [ + { action => 'PARAM', proto => 'tcp', dport => '6346' }, + { action => 'PARAM', proto => 'udp', dport => '6346' }, + ], + 'HKP' => [ + { action => 'PARAM', proto => 'tcp', dport => '11371' }, + ], + 'HTTP' => [ + { action => 'PARAM', proto => 'tcp', dport => '80' }, + ], + 'HTTPS' => [ + { action => 'PARAM', proto => 'tcp', dport => '443' }, + ], + 'ICPV2' => [ + { action => 'PARAM', proto => 'udp', dport => '3130' }, + ], + 'ICQ' => [ + { action => 'PARAM', proto => 'tcp', dport => '5190' }, + ], + 'IMAP' => [ + { action => 'PARAM', proto => 'tcp', dport => '143' }, + ], + 'IMAPS' => [ + { action => 'PARAM', proto => 'tcp', dport => '993' }, + ], + 'IPIP' => [ + { action => 'PARAM', proto => '94' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '94' }, + ], + 'IPP' => [ + { action => 'PARAM', proto => 'tcp', dport => '631' }, + ], + 'IPPbrd' => [ + { action => 'PARAM', proto => 'udp', dport => '631' }, + ], + 'IPPserver' => [ + { action => 'PARAM', source => 'SOURCE', dest => 'DEST', proto => 'tcp', dport => '631' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '631' }, + ], + 'IPsec' => [ + { action => 'PARAM', proto => 'udp', dport => '500', sport => '500' }, + { action => 'PARAM', proto => '50' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500', sport => '500' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '50' }, + ], + 'IPsecah' => [ + { action => 'PARAM', proto => 'udp', dport => '500', sport => '500' }, + { action => 'PARAM', proto => '51' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500', sport => '500' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '51' }, + ], + 'IPsecnat' => [ + { action => 'PARAM', proto => 'udp', dport => '500' }, + { action => 'PARAM', proto => 'udp', dport => '4500' }, + { action => 'PARAM', proto => '50' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '500' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '4500' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '50' }, + ], + 'IRC' => [ + { action => 'PARAM', proto => 'tcp', dport => '6667' }, + ], + 'JabberPlain' => [ + { action => 'PARAM', proto => 'tcp', dport => '5222' }, + ], + 'JabberSecure' => [ + { action => 'PARAM', proto => 'tcp', dport => '5223' }, + ], + 'Jabberd' => [ + { action => 'PARAM', proto => 'tcp', dport => '5269' }, + ], + 'Jetdirect' => [ + { action => 'PARAM', proto => 'tcp', dport => '9100' }, + ], + 'L2TP' => [ + { action => 'PARAM', proto => 'udp', dport => '1701' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '1701' }, + ], + 'LDAP' => [ + { action => 'PARAM', proto => 'tcp', dport => '389' }, + ], + 'LDAPS' => [ + { action => 'PARAM', proto => 'tcp', dport => '636' }, + ], + 'MSNP' => [ + { action => 'PARAM', proto => 'tcp', dport => '1863' }, + ], + 'MSSQL' => [ + { action => 'PARAM', proto => 'tcp', dport => '1433' }, + ], + 'Mail' => [ + { action => 'PARAM', proto => 'tcp', dport => '25' }, + { action => 'PARAM', proto => 'tcp', dport => '465' }, + { action => 'PARAM', proto => 'tcp', dport => '587' }, + ], + 'Munin' => [ + { action => 'PARAM', proto => 'tcp', dport => '4949' }, + ], + 'MySQL' => [ + { action => 'PARAM', proto => 'tcp', dport => '3306' }, + ], + 'NNTP' => [ + { action => 'PARAM', proto => 'tcp', dport => '119' }, + ], + 'NNTPS' => [ + { action => 'PARAM', proto => 'tcp', dport => '563' }, + ], + 'NTP' => [ + { action => 'PARAM', proto => 'udp', dport => '123' }, + ], + 'NTPbi' => [ + { action => 'PARAM', proto => 'udp', dport => '123' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '123' }, + ], + 'NTPbrd' => [ + { action => 'PARAM', proto => 'udp', dport => '123' }, + { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '123' }, + ], + 'OSPF' => [ + { action => 'PARAM', proto => '89' }, + ], + 'OpenVPN' => [ + { action => 'PARAM', proto => 'udp', dport => '1194' }, + ], + 'PCA' => [ + { action => 'PARAM', proto => 'udp', dport => '5632' }, + { action => 'PARAM', proto => 'tcp', dport => '5631' }, + ], + 'POP3' => [ + { action => 'PARAM', proto => 'tcp', dport => '110' }, + ], + 'POP3S' => [ + { action => 'PARAM', proto => 'tcp', dport => '995' }, + ], + 'PPtP' => [ + { action => 'PARAM', proto => '47' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => '47' }, + { action => 'PARAM', proto => 'tcp', dport => '1723' }, + ], + 'Ping' => [ + { action => 'PARAM', proto => 'icmp', dport => '8' }, + ], + 'PostgreSQL' => [ + { action => 'PARAM', proto => 'tcp', dport => '5432' }, + ], + 'Printer' => [ + { action => 'PARAM', proto => 'tcp', dport => '515' }, + ], + 'RDP' => [ + { action => 'PARAM', proto => 'tcp', dport => '3389' }, + ], + 'RIPbi' => [ + { action => 'PARAM', proto => 'udp', dport => '520' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '520' }, + ], + 'RNDC' => [ + { action => 'PARAM', proto => 'tcp', dport => '953' }, + ], + 'Razor' => [ + { action => 'ACCEPT', proto => 'tcp', dport => '2703' }, + ], + 'Rdate' => [ + { action => 'PARAM', proto => 'tcp', dport => '37' }, + ], + 'Rsync' => [ + { action => 'PARAM', proto => 'tcp', dport => '873' }, + ], + 'SANE' => [ + { action => 'PARAM', proto => 'tcp', dport => '6566' }, + ], + 'SMB' => [ + { action => 'PARAM', proto => 'udp', dport => '135,445' }, + { action => 'PARAM', proto => 'udp', dport => '137:139' }, + { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '137' }, + { action => 'PARAM', proto => 'tcp', dport => '135,139,445' }, + ], + 'SMBBI' => [ + { action => 'PARAM', proto => 'udp', dport => '135,445' }, + { action => 'PARAM', proto => 'udp', dport => '137:139' }, + { action => 'PARAM', proto => 'udp', dport => '1024:65535', sport => '137' }, + { action => 'PARAM', proto => 'tcp', dport => '135,139,445' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '135,445' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '137:139' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'udp', dport => '1024:65535', sport => '137' }, + { action => 'PARAM', source => 'DEST', dest => 'SOURCE', proto => 'tcp', dport => '135,139,445' }, + ], + 'SMBswat' => [ + { action => 'PARAM', proto => 'tcp', dport => '901' }, + ], + 'SMTP' => [ + { action => 'PARAM', proto => 'tcp', dport => '25' }, + ], + 'SMTPS' => [ + { action => 'PARAM', proto => 'tcp', dport => '465' }, + ], + 'SNMP' => [ + { action => 'PARAM', proto => 'udp', dport => '161:162' }, + { action => 'PARAM', proto => 'tcp', dport => '161' }, + ], + 'SPAMD' => [ + { action => 'PARAM', proto => 'tcp', dport => '783' }, + ], + 'SSH' => [ + { action => 'PARAM', proto => 'tcp', dport => '22' }, + ], + 'SVN' => [ + { action => 'PARAM', proto => 'tcp', dport => '3690' }, + ], + 'SixXS' => [ + { action => 'PARAM', proto => 'tcp', dport => '3874' }, + { action => 'PARAM', proto => 'udp', dport => '3740' }, + { action => 'PARAM', proto => '41' }, + { action => 'PARAM', proto => 'udp', dport => '5072,8374' }, + ], + 'Squid' => [ + { action => 'PARAM', proto => 'tcp', dport => '3128' }, + ], + 'Submission' => [ + { action => 'PARAM', proto => 'tcp', dport => '587' }, + ], + 'Syslog' => [ + { action => 'PARAM', proto => 'udp', dport => '514' }, + { action => 'PARAM', proto => 'tcp', dport => '514' }, + ], + 'TFTP' => [ + { action => 'PARAM', proto => 'udp', dport => '69' }, + ], + 'Telnet' => [ + { action => 'PARAM', proto => 'tcp', dport => '23' }, + ], + 'Telnets' => [ + { action => 'PARAM', proto => 'tcp', dport => '992' }, + ], + 'Time' => [ + { action => 'PARAM', proto => 'tcp', dport => '37' }, + ], + 'Trcrt' => [ + { action => 'PARAM', proto => 'udp', dport => '33434:33524' }, + { action => 'PARAM', proto => 'icmp', dport => '8' }, + ], + 'VNC' => [ + { action => 'PARAM', proto => 'tcp', dport => '5900:5909' }, + ], + 'VNCL' => [ + { action => 'PARAM', proto => 'tcp', dport => '5500' }, + ], + 'Web' => [ + { action => 'PARAM', proto => 'tcp', dport => '80' }, + { action => 'PARAM', proto => 'tcp', dport => '443' }, + ], + 'Webcache' => [ + { action => 'PARAM', proto => 'tcp', dport => '8080' }, + ], + 'Webmin' => [ + { action => 'PARAM', proto => 'tcp', dport => '10000' }, + ], + 'Whois' => [ + { action => 'PARAM', proto => 'tcp', dport => '43' }, + ], +}; + +my $pve_fw_parsed_macros; +my $pve_fw_preferred_macro_names = {}; -# todo: implement some kind of MACROS, like shorewall /usr/share/shorewall/macro.* sub get_firewall_macros { - return $macros if $macros; + return $pve_fw_parsed_macros if $pve_fw_parsed_macros; + + $pve_fw_parsed_macros = {}; - #foreach my $path () { - # if ($path =~ m|/macro\.(\S+)$|) { - # $macros->{$1} = 1; - # } - #} + foreach my $k (keys %$pve_fw_macros) { + my $name = lc($k); - $macros = {}; # fixme: implemet me + my $macro = $pve_fw_macros->{$k}; + $pve_fw_preferred_macro_names->{$name} = $k; + $pve_fw_parsed_macros->{$name} = $macro; + } - return $macros; + return $pve_fw_parsed_macros; } my $etc_services; @@ -56,6 +389,7 @@ sub get_etc_services { if ($line =~ m!^(\S+)\s+(\S+)/(tcp|udp).*$!) { $services->{byid}->{$2}->{name} = $1; + $services->{byid}->{$2}->{port} = $2; $services->{byid}->{$2}->{$3} = 1; $services->{byname}->{$1} = $services->{byid}->{$2}; } @@ -124,9 +458,13 @@ sub parse_port_name_number_or_range { my $nbports = 0; foreach my $item (split(/,/, $str)) { my $portlist = ""; + my $oldpon = undef; foreach my $pon (split(':', $item, 2)) { + $pon = $services->{byname}->{$pon}->{port} if $services->{byname}->{$pon}->{port}; if ($pon =~ m/^\d+$/){ - die "invalid port '$pon'\n" if $pon < 0 && $pon > 65536; + die "invalid port '$pon'\n" if $pon < 0 && $pon > 65535; + die "port '$pon' must be bigger than port '$oldpon' \n" if $oldpon && ($pon < $oldpon); + $oldpon = $pon; }else{ die "invalid port $services->{byname}->{$pon}\n" if !$services->{byname}->{$pon}; } @@ -174,7 +512,7 @@ sub iptables_get_chains { return 1 if $name =~ m/^PVEFW-\S+$/; return 1 if $name =~ m/^tap\d+i\d+-(:?IN|OUT)$/; - return 1 if $name =~ m/^vmbr\d+-(:?IN|OUT)$/; + return 1 if $name =~ m/^vmbr\d+-(:?FW|IN|OUT)$/; return 1 if $name =~ m/^GROUP-(:?[^\s\-]+)-(:?IN|OUT)$/; return undef; @@ -244,7 +582,7 @@ sub ruleset_generate_rule { $cmd .= " -m iprange --src-range" if $rule->{nbsource} && $rule->{nbsource} > 1; $cmd .= " -s $rule->{source}" if $rule->{source}; $cmd .= " -m iprange --dst-range" if $rule->{nbdest} && $rule->{nbdest} > 1; - $cmd .= " -d $rule->{dest}" if $rule->{destination}; + $cmd .= " -d $rule->{dest}" if $rule->{dest}; $cmd .= " -p $rule->{proto}" if $rule->{proto}; $cmd .= " --match multiport" if $rule->{nbdport} && $rule->{nbdport} > 1; $cmd .= " --dport $rule->{dport}" if $rule->{dport}; @@ -294,45 +632,43 @@ sub ruleset_insertrule { sub generate_bridge_chains { my ($ruleset, $bridge) = @_; - if (!ruleset_chain_exist($ruleset, "PVEFW-BRIDGE-IN")){ - ruleset_create_chain($ruleset, "PVEFW-BRIDGE-IN"); - } - - if (!ruleset_chain_exist($ruleset, "PVEFW-BRIDGE-OUT")){ - ruleset_create_chain($ruleset, "PVEFW-BRIDGE-OUT"); - } - if (!ruleset_chain_exist($ruleset, "PVEFW-FORWARD")){ ruleset_create_chain($ruleset, "PVEFW-FORWARD"); - - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m state --state RELATED,ESTABLISHED -j ACCEPT"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-in --physdev-is-bridged -j PVEFW-BRIDGE-OUT"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-out --physdev-is-bridged -j PVEFW-BRIDGE-IN"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); } - if (!ruleset_chain_exist($ruleset, "$bridge-IN")) { - ruleset_create_chain($ruleset, "$bridge-IN"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -j DROP"); # disable interbridge routing - ruleset_addrule($ruleset, "PVEFW-BRIDGE-IN", "-j $bridge-IN"); - ruleset_addrule($ruleset, "$bridge-IN", "-j ACCEPT"); + if (!ruleset_chain_exist($ruleset, "$bridge-FW")) { + ruleset_create_chain($ruleset, "$bridge-FW"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-bridged -j $bridge-FW"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-bridged -j $bridge-FW"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -j DROP"); # disable interbridge routing + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -j DROP"); # disable interbridge routing } if (!ruleset_chain_exist($ruleset, "$bridge-OUT")) { ruleset_create_chain($ruleset, "$bridge-OUT"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -j DROP"); # disable interbridge routing - ruleset_addrule($ruleset, "PVEFW-BRIDGE-OUT", "-j $bridge-OUT"); + ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-in -j $bridge-OUT"); + } + + if (!ruleset_chain_exist($ruleset, "$bridge-IN")) { + ruleset_create_chain($ruleset, "$bridge-IN"); + ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-out -j $bridge-IN"); + ruleset_addrule($ruleset, "$bridge-FW", "-j ACCEPT"); } } sub generate_tap_rules_direction { - my ($ruleset, $group_rules, $iface, $netid, $macaddr, $rules, $bridge, $direction) = @_; + my ($ruleset, $group_rules, $iface, $netid, $macaddr, $vmfw_conf, $bridge, $direction) = @_; + + my $rules = $vmfw_conf->{lc($direction)}; + my $options = $vmfw_conf->{options}; my $tapchain = "$iface-$direction"; ruleset_create_chain($ruleset, $tapchain); - ruleset_addrule($ruleset, $tapchain, "-m state --state INVALID -j DROP"); - ruleset_addrule($ruleset, $tapchain, "-m state --state RELATED,ESTABLISHED -j ACCEPT"); + ruleset_addrule($ruleset, $tapchain, "-m conntrack --ctstate INVALID -j DROP"); + ruleset_addrule($ruleset, $tapchain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); if ($direction eq 'OUT' && defined($macaddr)) { ruleset_addrule($ruleset, $tapchain, "-m mac ! --mac-source $macaddr -j DROP"); @@ -341,6 +677,7 @@ sub generate_tap_rules_direction { if ($rules) { foreach my $rule (@$rules) { next if $rule->{iface} && $rule->{iface} ne $netid; + # we go to $bridge-IN if accept in out rules if($rule->{action} =~ m/^(GROUP-(\S+))$/){ $rule->{action} .= "-$direction"; # generate empty group rule if don't exist @@ -348,17 +685,40 @@ sub generate_tap_rules_direction { generate_group_rules($ruleset, $group_rules, $2); } ruleset_generate_rule($ruleset, $tapchain, $rule); - ruleset_addrule($ruleset, $tapchain, "-m mark --mark 1 -g $bridge-IN"); + ruleset_addrule($ruleset, $tapchain, "-m mark --mark 1 -j RETURN") + if $direction eq 'OUT'; } else { - # we go to vmbr-IN if accept in out rules - $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT'; + $rule->{action} = "RETURN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT'; ruleset_generate_rule($ruleset, $tapchain, $rule); } } } - ruleset_addrule($ruleset, $tapchain, "-j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4"); - ruleset_addrule($ruleset, $tapchain, "-j DROP"); + # implement policy + my $policy; + + if ($direction eq 'OUT') { + $policy = $options->{'policy-out'} || 'ACCEPT'; # allow everything by default + } else { + $policy = $options->{'policy-in'} || 'DROP'; # allow everything by default + } + + if ($policy eq 'ACCEPT') { + if ($direction eq 'OUT') { + ruleset_addrule($ruleset, $tapchain, "-j RETURN"); + } else { + ruleset_addrule($ruleset, $tapchain, "-j ACCEPT"); + } + } elsif ($policy eq 'DROP') { + ruleset_addrule($ruleset, $tapchain, "-j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4"); + ruleset_addrule($ruleset, $tapchain, "-j DROP"); + } elsif ($policy eq 'REJECT') { + ruleset_addrule($ruleset, $tapchain, "-j LOG --log-prefix \"$tapchain-reject: \" --log-level 4"); + ruleset_addrule($ruleset, $tapchain, "-j REJECT"); + } else { + # should not happen + die "internal error: unknown policy '$policy'"; + } # plug the tap chain to bridge chain my $physdevdirection = $direction eq 'IN' ? "out" : "in"; @@ -381,11 +741,11 @@ sub enablehostfw { my $chain = "PVEFW-HOST-IN"; ruleset_create_chain($ruleset, $chain); - ruleset_addrule($ruleset, $chain, "-m state --state INVALID -j DROP"); - ruleset_addrule($ruleset, $chain, "-m state --state RELATED,ESTABLISHED -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT"); - ruleset_addrule($ruleset, $chain, "-p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync if ($rules->{in}) { @@ -403,11 +763,11 @@ sub enablehostfw { $chain = "PVEFW-HOST-OUT"; ruleset_create_chain($ruleset, $chain); - ruleset_addrule($ruleset, $chain, "-m state --state INVALID -j DROP"); - ruleset_addrule($ruleset, $chain, "-m state --state RELATED,ESTABLISHED -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-o lo -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT"); - ruleset_addrule($ruleset, $chain, "-p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync if ($rules->{out}) { @@ -487,16 +847,20 @@ sub parse_fw_rule { die "incomplete rule\n" if !$action; - my $service; + my $macro; + my $macro_name; + if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) { # OK } elsif ($allow_groups && $action =~ m/^GROUP-(:?\S+)$/) { # OK } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) { - ($service, $action) = ($1, $2); - if (!$macros->{$service}) { - die "unknown service '$service'\n"; - } + ($macro_name, $action) = ($1, $2); + my $lc_macro_name = lc($macro_name); + my $preferred_name = $pve_fw_preferred_macro_names->{$lc_macro_name}; + $macro_name = $preferred_name if $preferred_name; + $macro = $macros->{$lc_macro_name}; + die "unknown macro '$macro_name'\n" if !$macro; } else { die "unknown action '$action'\n"; } @@ -518,19 +882,16 @@ sub parse_fw_rule { $dport = undef if $dport && $dport eq '-'; $sport = undef if $sport && $sport eq '-'; - my $nbdport = undef; - my $nbsport = undef; my $nbsource = undef; my $nbdest = undef; $nbsource = parse_address_list($source) if $source; $nbdest = parse_address_list($dest) if $dest; - $nbdport = parse_port_name_number_or_range($dport) if $dport; - $nbsport = parse_port_name_number_or_range($sport) if $sport; + + my $rules = []; - return { + my $param = { action => $action, - service => $service, iface => $iface, source => $source, dest => $dest, @@ -539,15 +900,63 @@ sub parse_fw_rule { proto => $proto, dport => $dport, sport => $sport, - nbdport => $nbdport, - nbsport => $nbsport, }; + + if ($macro) { + foreach my $templ (@$macro) { + my $rule = {}; + foreach my $k (keys %$templ) { + my $v = $templ->{$k}; + if ($v eq 'PARAM') { + $v = $param->{$k}; + } elsif ($v eq 'DEST') { + $v = $param->{dest}; + } elsif ($v eq 'SOURCE') { + $v = $param->{source}; + } + + die "missing parameter '$k' in macro '$macro_name'\n" if !defined($v); + $rule->{$k} = $v; + } + push @$rules, $rule; + } + } else { + push @$rules, $param; + } + + foreach my $rule (@$rules) { + $rule->{nbdport} = parse_port_name_number_or_range($rule->{dport}) + if defined($rule->{dport}); + $rule->{nbsport} = parse_port_name_number_or_range($rule->{sport}) + if defined($rule->{sport}); + } + + return $rules; +} + +sub parse_fw_option { + my ($line) = @_; + + my ($opt, $value); + + if ($line =~ m/^enable:\s*(0|1)\s*$/i) { + $opt = 'enable'; + $value = int($1); + } elsif ($line =~ m/^(policy-(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) { + $opt = lc($1); + $value = uc($3); + } else { + chomp $line; + die "can't parse option '$line'\n" + } + + return ($opt, $value); } sub parse_vm_fw_rules { my ($filename, $fh) = @_; - my $res = { in => [], out => [] }; + my $res = { in => [], out => [], options => {}}; my $section; @@ -555,23 +964,38 @@ sub parse_vm_fw_rules { next if $line =~ m/^#/; next if $line =~ m/^\s*$/; - if ($line =~ m/^\[(in|out)\]\s*$/i) { + my $linenr = $fh->input_line_number(); + my $prefix = "$filename (line $linenr)"; + + if ($line =~ m/^\[(\S+)\]\s*$/i) { $section = lc($1); + warn "$prefix: ignore unknown section '$section'\n" if !$res->{$section}; next; } if (!$section) { - warn "$filename (line $.): skip line - no section"; + warn "$prefix: skip line - no section"; next; } - my $rule; - eval { $rule = parse_fw_rule($line, 1, 1); }; + next if !$res->{$section}; # skip undefined section + + if ($section eq 'options') { + eval { + my ($opt, $value) = parse_fw_option($line); + $res->{options}->{$opt} = $value; + }; + warn "$prefix: $@" if $@; + next; + } + + my $rules; + eval { $rules = parse_fw_rule($line, 1, 1); }; if (my $err = $@) { - warn "$filename (line $.): $err"; + warn "$prefix: $err"; next; } - push @{$res->{$section}}, $rule; + push @{$res->{$section}}, @$rules; } return $res; @@ -588,23 +1012,26 @@ sub parse_host_fw_rules { next if $line =~ m/^#/; next if $line =~ m/^\s*$/; + my $linenr = $fh->input_line_number(); + my $prefix = "$filename (line $linenr)"; + if ($line =~ m/^\[(in|out)\]\s*$/i) { $section = lc($1); next; } if (!$section) { - warn "$filename (line $.): skip line - no section"; + warn "$prefix: skip line - no section"; next; } - my $rule; - eval { $rule = parse_fw_rule($line, 1, 1); }; + my $rules; + eval { $rules = parse_fw_rule($line, 1, 1); }; if (my $err = $@) { - warn "$filename (line $.): $err"; + warn "$prefix: $err"; next; } - push @{$res->{$section}}, $rule; + push @{$res->{$section}}, @$rules; } return $res; @@ -622,24 +1049,27 @@ sub parse_group_fw_rules { next if $line =~ m/^#/; next if $line =~ m/^\s*$/; + my $linenr = $fh->input_line_number(); + my $prefix = "$filename (line $linenr)"; + if ($line =~ m/^\[(in|out):(\S+)\]\s*$/i) { $section = lc($1); $group = lc($2); next; } if (!$section || !$group) { - warn "$filename (line $.): skip line - no section"; + warn "$prefix: skip line - no section"; next; } - my $rule; - eval { $rule = parse_fw_rule($line, 0, 0); }; + my $rules; + eval { $rules = parse_fw_rule($line, 0, 0); }; if (my $err = $@) { - warn "$filename (line $.): $err"; + warn "$prefix: $err"; next; } - push @{$res->{$group}->{$section}}, $rule; + push @{$res->{$group}->{$section}}, @$rules; } return $res; @@ -705,23 +1135,29 @@ sub compile { my $ruleset = {}; - # setup host firewall rules ruleset_create_chain($ruleset, "PVEFW-INPUT"); ruleset_create_chain($ruleset, "PVEFW-OUTPUT"); + ruleset_create_chain($ruleset, "PVEFW-FORWARD"); ruleset_create_chain($ruleset, "PVEFW-SET-ACCEPT-MARK"); ruleset_addrule($ruleset, "PVEFW-SET-ACCEPT-MARK", "-j MARK --set-mark 1"); + my $enable_hostfw = 0; $filename = "/etc/pve/local/host.fw"; if (my $fh = IO::File->new($filename, O_RDONLY)) { my $host_rules = parse_host_fw_rules($filename, $fh); + + $enable_hostfw = 1; + enablehostfw($ruleset, $host_rules, $group_rules); } # generate firewall rules for QEMU VMs foreach my $vmid (keys %{$vmdata->{qemu}}) { my $conf = $vmdata->{qemu}->{$vmid}; - next if !$rules->{$vmid}; + my $vmfw_conf = $rules->{$vmid}; + next if !$vmfw_conf; + next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0); foreach my $netid (keys %$conf) { next if $netid !~ m/^net(\d+)$/; @@ -734,13 +1170,20 @@ sub compile { $bridge .= "v$net->{tag}" if $net->{tag}; + generate_bridge_chains($ruleset, $bridge); my $macaddr = $net->{macaddr}; - generate_tap_rules_direction($ruleset, $group_rules, $iface, $netid, $macaddr, $rules->{$vmid}->{in}, $bridge, 'IN'); - generate_tap_rules_direction($ruleset, $group_rules, $iface, $netid, $macaddr, $rules->{$vmid}->{out}, $bridge, 'OUT'); + generate_tap_rules_direction($ruleset, $group_rules, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN'); + generate_tap_rules_direction($ruleset, $group_rules, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT'); } } + + if ($enable_hostfw) { + # allow traffic from lo (ourself) + ruleset_addrule($ruleset, "PVEFW-INPUT", "-i lo -j ACCEPT"); + } + return $ruleset; } @@ -857,6 +1300,9 @@ sub apply_ruleset { } foreach my $chain (keys %$statushash) { next if $statushash->{$chain}->{action} ne 'delete'; + next if $chain eq 'PVEFW-INPUT'; + next if $chain eq 'PVEFW-OUTPUT'; + next if $chain eq 'PVEFW-FORWARD'; $cmdlist .= "-X $chain\n"; }