X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=PVE%2FFirewall.pm;h=f29d5ec8c9da3c3015840e5705296da9b21f06fa;hp=3f0adf0cb531d0314a97135f5b3fceef79d7cf79;hb=d6de1dc216e21fe6d4214d9ea7187ae6bf177bea;hpb=8fb53d8ccf5b71e3352c33221fdecb9e97e1753c diff --git a/PVE/Firewall.pm b/PVE/Firewall.pm index 3f0adf0..f29d5ec 100644 --- a/PVE/Firewall.pm +++ b/PVE/Firewall.pm @@ -7,9 +7,14 @@ use PVE::Tools; use PVE::QemuServer; use File::Path; use IO::File; +use Net::IP; +use PVE::Tools qw(run_command); + use Data::Dumper; my $macros; +my @ruleset = (); + sub get_shorewall_macros { return $macros if $macros; @@ -22,9 +27,326 @@ sub get_shorewall_macros { return $macros; } +my $etc_services; + +sub get_etc_services { + + return $etc_services if $etc_services; + + my $filename = "/etc/services"; + + my $fh = IO::File->new($filename, O_RDONLY); + if (!$fh) { + warn "unable to read '$filename' - $!\n"; + return {}; + } + + my $services = {}; + + while (my $line = <$fh>) { + chomp ($line); + next if $line =~m/^#/; + next if ($line =~m/^\s*$/); + + if ($line =~ m!^(\S+)\s+(\S+)/(tcp|udp).*$!) { + $services->{byid}->{$2}->{name} = $1; + $services->{byid}->{$2}->{$3} = 1; + $services->{byname}->{$1} = $services->{byid}->{$2}; + } + } + + close($fh); + + $etc_services = $services; + + + return $etc_services; +} + +my $etc_protocols; + +sub get_etc_protocols { + return $etc_protocols if $etc_protocols; + + my $filename = "/etc/protocols"; + + my $fh = IO::File->new($filename, O_RDONLY); + if (!$fh) { + warn "unable to read '$filename' - $!\n"; + return {}; + } + + my $protocols = {}; + + while (my $line = <$fh>) { + chomp ($line); + next if $line =~m/^#/; + next if ($line =~m/^\s*$/); + + if ($line =~ m!^(\S+)\s+(\d+)\s+.*$!) { + $protocols->{byid}->{$2}->{name} = $1; + $protocols->{byname}->{$1} = $protocols->{byid}->{$2}; + } + } + + close($fh); + + $etc_protocols = $protocols; + + return $etc_protocols; +} + +sub parse_address_list { + my ($str) = @_; + + my $nbaor = 0; + foreach my $aor (split(/,/, $str)) { + if (!Net::IP->new($aor)) { + my $err = Net::IP::Error(); + die "invalid IP address: $err\n"; + }else{ + $nbaor++; + } + } + return $nbaor; +} + +sub parse_port_name_number_or_range { + my ($str) = @_; + + my $services = PVE::Firewall::get_etc_services(); + my $nbports = 0; + foreach my $item (split(/,/, $str)) { + my $portlist = ""; + foreach my $pon (split(':', $item, 2)) { + if ($pon =~ m/^\d+$/){ + die "invalid port '$pon'\n" if $pon < 0 && $pon > 65536; + }else{ + die "invalid port $services->{byname}->{$pon}\n" if !$services->{byname}->{$pon}; + } + $nbports++; + } + } + + return ($nbports); +} my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n"; +sub iptables { + my ($cmd) = @_; + + run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {}); +} + +sub iptables_restore { + + unshift (@ruleset, '*filter'); + push (@ruleset, 'COMMIT'); + + my $cmdlist = join("\n", @ruleset); + + run_command("echo '$cmdlist' | /sbin/iptables-restore -n", outfunc => sub {}); +} + +sub iptables_addrule { + my ($rule) = @_; + + push (@ruleset, $rule); +} + +sub iptables_chain_exist { + my ($chain) = @_; + + eval{ + iptables("-n --list $chain"); + }; + return undef if $@; + + return 1; +} + +sub iptables_rule_exist { + my ($rule) = @_; + + eval{ + iptables("-C $rule"); + }; + return undef if $@; + + return 1; +} + +sub iptables_generate_rule { + my ($chain, $rule) = @_; + + my $cmd = "-A $chain"; + + $cmd .= " -m iprange --src-range" if $rule->{nbsource} && $rule->{nbsource} > 1; + $cmd .= " -s $rule->{source}" if $rule->{source}; + $cmd .= " -m iprange --dst-range" if $rule->{nbdest} && $rule->{nbdest} > 1; + $cmd .= " -d $rule->{dest}" if $rule->{destination}; + $cmd .= " -p $rule->{proto}" if $rule->{proto}; + $cmd .= " --match multiport" if $rule->{nbdport} && $rule->{nbdport} > 1; + $cmd .= " --dport $rule->{dport}" if $rule->{dport}; + $cmd .= " --match multiport" if $rule->{nbsport} && $rule->{nbsport} > 1; + $cmd .= " --sport $rule->{sport}" if $rule->{sport}; + $cmd .= " -j $rule->{action}" if $rule->{action}; + + iptables_addrule($cmd); + +} + +sub generate_bridge_rules { + my ($bridge) = @_; + + if(!iptables_chain_exist("BRIDGEFW-OUT")){ + iptables_addrule(":BRIDGEFW-OUT - [0:0]"); + } + + if(!iptables_chain_exist("BRIDGEFW-IN")){ + iptables_addrule(":BRIDGEFW-IN - [0:0]"); + } + + if(!iptables_chain_exist("proxmoxfw-FORWARD")){ + iptables_addrule(":proxmoxfw-FORWARD - [0:0]"); + iptables_addrule("-I FORWARD -j proxmoxfw-FORWARD"); + iptables_addrule("-A proxmoxfw-FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT"); + iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-in --physdev-is-bridged -j BRIDGEFW-OUT"); + iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-out --physdev-is-bridged -j BRIDGEFW-IN"); + + } + + generate_proxmoxfwinput(); + + if(!iptables_chain_exist("$bridge-IN")){ + iptables_addrule(":$bridge-IN - [0:0]"); + iptables_addrule("-A proxmoxfw-FORWARD -i $bridge -j DROP"); #disable interbridge routing + iptables_addrule("-A BRIDGEFW-IN -j $bridge-IN"); + iptables_addrule("-A $bridge-IN -j ACCEPT"); + + } + + if(!iptables_chain_exist("$bridge-OUT")){ + iptables_addrule(":$bridge-OUT - [0:0]"); + iptables_addrule("-A proxmoxfw-FORWARD -o $bridge -j DROP"); # disable interbridge routing + iptables_addrule("-A BRIDGEFW-OUT -j $bridge-OUT"); + + } + +} + + +sub generate_tap_rules_direction { + my ($iface, $netid, $rules, $bridge, $direction) = @_; + + my $tapchain = "$iface-$direction"; + + iptables_addrule(":$tapchain - [0:0]"); + + iptables_addrule("-A $tapchain -m state --state INVALID -j DROP"); + iptables_addrule("-A $tapchain -m state --state RELATED,ESTABLISHED -j ACCEPT"); + + if (scalar(@$rules)) { + foreach my $rule (@$rules) { + next if $rule->{iface} && $rule->{iface} ne $netid; + if($rule->{action} =~ m/^(GROUP-(\S+))$/){ + $rule->{action} .= "-$direction"; + #generate empty group rule if don't exist + if(!iptables_chain_exist($rule->{action})){ + generate_group_rules($2); + } + } + #we go to vmbr-IN if accept in out rules + $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT'; + iptables_generate_rule($tapchain, $rule); + } + } + + iptables_addrule("-A $tapchain -j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4"); + iptables_addrule("-A $tapchain -j DROP"); + + #plug the tap chain to bridge chain + my $physdevdirection = $direction eq 'IN' ? "out":"in"; + my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain"; + + if(!iptables_rule_exist($rule)){ + iptables_addrule("-I $rule"); + } + + if($direction eq 'OUT'){ + #add tap->host rules + my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain"; + + if(!iptables_rule_exist($rule)){ + iptables_addrule("-A $rule"); + } + } +} + +sub generate_tap_rules { + my ($net, $netid, $vmid) = @_; + + my $filename = "/etc/pve/firewall/$vmid.fw"; + my $fh = IO::File->new($filename, O_RDONLY); + return if !$fh; + + #generate bridge rules + my $bridge = $net->{bridge}; + my $tag = $net->{tag}; + $bridge .= "v$tag" if $tag; + + #generate tap chain + my $rules = parse_fw_rules($filename, $fh); + + my $inrules = $rules->{in}; + my $outrules = $rules->{out}; + + my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/; + + generate_bridge_rules($bridge); + generate_tap_rules_direction($iface, $netid, $inrules, $bridge, 'IN'); + generate_tap_rules_direction($iface, $netid, $outrules, $bridge, 'OUT'); + iptables_restore(); +} + +sub flush_tap_rules { + my ($net, $netid, $vmid) = @_; + + my $bridge = $net->{bridge}; + my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/; + + flush_tap_rules_direction($iface, $bridge, 'IN'); + flush_tap_rules_direction($iface, $bridge, 'OUT'); + iptables_restore(); +} + +sub flush_tap_rules_direction { + my ($iface, $bridge, $direction) = @_; + + my $tapchain = "$iface-$direction"; + + if(iptables_chain_exist($tapchain)){ + iptables_addrule("-F $tapchain"); + + my $physdevdirection = $direction eq 'IN' ? "out":"in"; + my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain"; + if(iptables_rule_exist($rule)){ + iptables_addrule("-D $rule"); + } + + if($direction eq 'OUT'){ + my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain"; + + if(!iptables_rule_exist($rule)){ + iptables_addrule("-D $rule"); + } + } + + iptables_addrule("-X $tapchain"); + } +} + my $generate_input_rule = sub { my ($zoneinfo, $rule, $net, $netid) = @_; @@ -41,25 +363,36 @@ my $generate_input_rule = sub { my $action = $rule->{service} ? "$rule->{service}($rule->{action})" : $rule->{action}; - my $source; + my $sources = []; - if ($zoneinfo->{$zone}->{type} eq 'bport') { + if (!$rule->{source}) { + push @$sources, 'all'; + } elsif ($zoneinfo->{$zone}->{type} eq 'bport') { my $bridge_zone = $zoneinfo->{$zone}->{bridge_zone} || die "internal error"; - my $bridge_ext_zone = $zoneinfo->{$bridge_zone}->{bridge_ext_zone} || die "internal error"; - my $zoneref = $zoneinfo->{$bridge_ext_zone}->{zoneref} || die "internal error"; - if (!$rule->{source}) { - # $source = "${zoneref}"; - $source = 'all'; - } else { - # 'all' does not work - $source = "${zoneref}:$rule->{source}"; + my $zoneref = $zoneinfo->{$bridge_zone}->{zoneref} || die "internal error"; + + # using 'all' does not work, so we create one rule for + # each related zone on the same bridge + push @$sources, "${zoneref}:$rule->{source}"; + foreach my $z (keys %$zoneinfo) { + next if $z eq $zone; + next if !$zoneinfo->{$z}->{bridge_zone}; + next if $zoneinfo->{$z}->{bridge_zone} ne $bridge_zone; + $zoneref = $zoneinfo->{$z}->{zoneref} || die "internal error"; + push @$sources, "${zoneref}:$rule->{source}"; } } else { - $source = "all:$rule->{source}"; + push @$sources, "all:$rule->{source}"; } - return sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-', - $rule->{dport} || '-', $rule->{sport} || '-'); + my $out = ''; + + foreach my $source (@$sources) { + $out .= sprintf($rule_format, $action, $source, $dest, $rule->{proto} || '-', + $rule->{dport} || '-', $rule->{sport} || '-'); + } + + return $out; }; my $generate_output_rule = sub { @@ -108,11 +441,11 @@ my $compile_shorewall = sub { $register_bridge = sub { my ($bridge, $vlan) = @_; - my $zone = 'z' . $bridge; + my $zone = $bridge; return $zone if $zoneinfo->{$zone}; - my $ext_zone = "z${bridge}ext"; + my $ext_zone = "${bridge}_ext"; $zoneinfo->{$zone} = { type => 'bridge', @@ -143,7 +476,7 @@ my $compile_shorewall = sub { my ($bridge, $vlan, $vmzone, $tap) = @_; my $bridge_zone = &$register_bridge($bridge, $vlan); - my $zone = $bridge_zone . $vmzone; + my $zone = $bridge_zone . '_' . $vmzone; if (!$zoneinfo->{$zone}) { $zoneinfo->{$zone} = { @@ -333,8 +666,9 @@ sub parse_fw_rules { my $res = { in => [], out => [] }; - my $macros = PVE::Firewall::get_shorewall_macros(); - + my $macros = get_shorewall_macros(); + my $protocols = get_etc_protocols(); + while (defined(my $line = <$fh>)) { next if $line =~ m/^#/; next if $line =~ m/^\s*$/; @@ -354,7 +688,7 @@ sub parse_fw_rules { } my $service; - if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) { + if ($action =~ m/^(ACCEPT|DROP|REJECT|GROUP-(\S+))$/) { # OK } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) { ($service, $action) = ($1, $2); @@ -374,26 +708,34 @@ sub parse_fw_rules { } $proto = undef if $proto && $proto eq '-'; - if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) { + if ($proto && !(defined($protocols->{byname}->{$proto}) || + defined($protocols->{byid}->{$proto}))) { warn "unknown protokol '$proto'\n"; next; } $source = undef if $source && $source eq '-'; - -# if ($source !~ m/^(XYZ)$/) { -# warn "unknown source '$source'\n"; -# next; -# } - $dest = undef if $dest && $dest eq '-'; -# if ($dest !~ m/^XYZ)$/) { -# warn "unknown destination '$dest'\n"; -# next; -# } $dport = undef if $dport && $dport eq '-'; $sport = undef if $sport && $sport eq '-'; + my $nbdport = undef; + my $nbsport = undef; + my $nbsource = undef; + my $nbdest = undef; + + eval { + $nbsource = parse_address_list($source) if $source; + $nbdest = parse_address_list($dest) if $dest; + $nbdport = parse_port_name_number_or_range($dport) if $dport; + $nbsport = parse_port_name_number_or_range($sport) if $sport; + }; + if (my $err = $@) { + warn $err; + next; + + } + my $rule = { action => $action, @@ -401,9 +743,14 @@ sub parse_fw_rules { iface => $iface, source => $source, dest => $dest, + nbsource => $nbsource, + nbdest => $nbdest, proto => $proto, dport => $dport, sport => $sport, + nbdport => $nbdport, + nbsport => $nbsport, + }; push @{$res->{$section}}, $rule; @@ -421,7 +768,7 @@ sub read_local_vm_config { my $list = PVE::QemuServer::config_list(); foreach my $vmid (keys %$list) { - # next if $vmid ne '100'; + #next if !($vmid eq '100' || $vmid eq '102'); my $cfspath = PVE::QemuServer::cfs_config_path($vmid); if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { $qemu->{$vmid} = $conf;