X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=pvefw;h=1c346b555e7e4e6019452593844508b0145cfefd;hp=4ac96796e7331f32bbd293fafce45692f4f93478;hb=d050c7240e2a3d4c1de906fea7e48f926d876098;hpb=9a4644fa5560e9087b50e5f9c11699590ad8966e diff --git a/pvefw b/pvefw index 4ac9679..1c346b5 100755 --- a/pvefw +++ b/pvefw @@ -3,15 +3,11 @@ use strict; use lib qw(.); use PVE::Firewall; -use File::Path; -use IO::File; -use Data::Dumper; use PVE::SafeSyslog; use PVE::Cluster; use PVE::INotify; use PVE::RPCEnvironment; -use PVE::QemuServer; use PVE::JSONSchema qw(get_standard_option); @@ -33,173 +29,64 @@ $rpcenv->init_request(); $rpcenv->set_language($ENV{LANG}); $rpcenv->set_user('root@pam'); - -sub parse_fw_rules { - my ($filename, $fh) = @_; - - my $section; - - my $res = { in => [], out => [] }; - - my $macros = PVE::Firewall::get_shorewall_macros(); - - while (defined(my $line = <$fh>)) { - next if $line =~ m/^#/; - next if $line =~ m/^\s*$/; - - if ($line =~ m/^\[(in|out)\]\s*$/i) { - $section = lc($1); - next; - } - next if !$section; - - my ($action, $iface, $source, $dest, $proto, $dport, $sport) = - split(/\s+/, $line); - - if (!$action) { - warn "skip incomplete line\n"; - next; - } - - my $service; - if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) { - # OK - } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) { - ($service, $action) = ($1, $2); - if (!$macros->{$service}) { - warn "unknown service '$service'\n"; - next; - } - } else { - warn "unknown action '$action'\n"; - next; - } - - $iface = undef if $iface && $iface eq '-'; - if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) { - warn "unknown interface '$iface'\n"; - next; - } - - $proto = undef if $proto && $proto eq '-'; - if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) { - warn "unknown protokol '$proto'\n"; - next; - } - - $source = undef if $source && $source eq '-'; - -# if ($source !~ m/^(XYZ)$/) { -# warn "unknown source '$source'\n"; -# next; -# } - - $dest = undef if $dest && $dest eq '-'; -# if ($dest !~ m/^XYZ)$/) { -# warn "unknown destination '$dest'\n"; -# next; -# } - - $dport = undef if $dport && $dport eq '-'; - $sport = undef if $sport && $sport eq '-'; - - my $rule = { - action => $action, - service => $service, - iface => $iface, - source => $source, - dest => $dest, - proto => $proto, - dport => $dport, - sport => $sport, - }; - - push @{$res->{$section}}, $rule; - } - - return $res; -} - -sub read_local_vm_config { - - my $openvz = {}; - - my $qemu = {}; - - my $list = PVE::QemuServer::config_list(); - - foreach my $vmid (keys %$list) { - # next if $vmid ne '100'; - my $cfspath = PVE::QemuServer::cfs_config_path($vmid); - if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { - $qemu->{$vmid} = $conf; - } - } - - my $vmdata = { openvz => $openvz, qemu => $qemu }; - - return $vmdata; -}; - -sub read_vm_firewall_rules { - my ($vmdata) = @_; - my $rules = {}; - foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) { - my $filename = "/etc/pve/firewall/$vmid.fw"; - my $fh = IO::File->new($filename, O_RDONLY); - next if !$fh; - - $rules->{$vmid} = parse_fw_rules($filename, $fh); - } - - return $rules; -} - __PACKAGE__->register_method ({ name => 'compile', path => 'compile', method => 'POST', - description => "Compile firewall rules.", + description => "Compile amd print firewall rules. This is only for testing.", parameters => { additionalProperties => 0, - properties => {}, + properties => { + verbose => { + description => "Verbose output.", + type => "boolean", + optional => 1, + default => 0, + }, + }, }, returns => { type => 'null' }, code => sub { my ($param) = @_; - my $vmdata = read_local_vm_config(); - my $rules = read_vm_firewall_rules($vmdata); - - # print Dumper($vmdata); - - my $swdir = '/etc/shorewall'; - mkdir $swdir; - - PVE::Firewall::compile($swdir, $vmdata, $rules); + my $code = sub { + my $ruleset = PVE::Firewall::compile(); + PVE::Firewall::get_ruleset_status($ruleset, 1) if $param->{verbose}; + }; - PVE::Tools::run_command(['shorewall', 'compile']); + PVE::Firewall::run_locked($code); return undef; - }}); __PACKAGE__->register_method ({ name => 'start', path => 'start', method => 'POST', - description => "Start firewall.", + description => "Start (or restart if already active) firewall.", parameters => { additionalProperties => 0, - properties => {}, + properties => { + verbose => { + description => "Verbose output.", + type => "boolean", + optional => 1, + default => 0, + }, + }, }, returns => { type => 'null' }, code => sub { my ($param) = @_; - PVE::Tools::run_command(['shorewall', 'start']); + my $code = sub { + my $ruleset = PVE::Firewall::compile(); + PVE::Firewall::apply_ruleset($ruleset, $param->{verbose}); + }; + + PVE::Firewall::run_locked($code); return undef; }}); @@ -208,7 +95,7 @@ __PACKAGE__->register_method ({ name => 'stop', path => 'stop', method => 'POST', - description => "Stop firewall.", + description => "Stop firewall. This will remove all rules installed by this script. The host is then unprotected.", parameters => { additionalProperties => 0, properties => {}, @@ -218,26 +105,35 @@ __PACKAGE__->register_method ({ code => sub { my ($param) = @_; - PVE::Tools::run_command(['shorewall', 'stop']); + my $code = sub { + my $chash = PVE::Firewall::iptables_get_chains(); + my $cmdlist = "*filter\n"; + my $rule = "INPUT -j PVEFW-INPUT"; + if (PVE::Firewall::iptables_rule_exist($rule)) { + $cmdlist .= "-D $rule\n"; + } + $rule = "OUTPUT -j PVEFW-OUTPUT"; + if (PVE::Firewall::iptables_rule_exist($rule)) { + $cmdlist .= "-D $rule\n"; + } - return undef; - }}); + $rule = "FORWARD -j PVEFW-FORWARD"; + if (PVE::Firewall::iptables_rule_exist($rule)) { + $cmdlist .= "-D $rule\n"; + } -__PACKAGE__->register_method ({ - name => 'clear', - path => 'clear', - method => 'POST', - description => "Clear will remove all rules installed by this script. The host is then unprotected.", - parameters => { - additionalProperties => 0, - properties => {}, - }, - returns => { type => 'null' }, + foreach my $chain (keys %$chash) { + $cmdlist .= "-F $chain\n"; + } + foreach my $chain (keys %$chash) { + $cmdlist .= "-X $chain\n"; + } + $cmdlist .= "COMMIT\n"; - code => sub { - my ($param) = @_; + PVE::Firewall::iptables_restore_cmdlist($cmdlist); + }; - PVE::Tools::run_command(['shorewall', 'clear']); + PVE::Firewall::run_locked($code); return undef; }}); @@ -248,7 +144,6 @@ my $cmddef = { compile => [ __PACKAGE__, 'compile', []], start => [ __PACKAGE__, 'start', []], stop => [ __PACKAGE__, 'stop', []], - clear => [ __PACKAGE__, 'clear', []], }; my $cmd = shift;