X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=751cc9f8082855c9e236e45e7afac6181efbcf84;hp=941e62a934b9b8bed35cc096b538de428a69195f;hb=4b96e87759bac374f695143f584f69c1855aa878;hpb=fca39c2cafd333ff0c572f18bdd13fcfe2c1c56a diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 941e62a..751cc9f 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -16,6 +16,7 @@ use Net::IP; use PVE::Tools qw(run_command lock_file); use Encode; +my $hostfw_conf_filename = "/etc/pve/local/host.fw"; my $clusterfw_conf_filename = "/etc/pve/firewall/cluster.fw"; # dynamically include PVE::QemuServer and PVE::OpenVZ @@ -602,6 +603,9 @@ sub parse_address_list { my $nbaor = 0; foreach my $aor (split(/,/, $str)) { + if($nbaor > 0 && $aor =~ m/-/){ + die "you can use a range in a list"; + } if (!Net::IP->new($aor)) { my $err = Net::IP::Error(); die "invalid IP address: $err\n"; @@ -609,7 +613,6 @@ sub parse_address_list { $nbaor++; } } - return $nbaor; } sub parse_port_name_number_or_range { @@ -791,12 +794,6 @@ sub enable_bridge_firewall { my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n"; -sub iptables { - my ($cmd) = @_; - - run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {}); -} - sub iptables_restore_cmdlist { my ($cmdlist) = @_; @@ -806,7 +803,7 @@ sub iptables_restore_cmdlist { sub ipset_restore_cmdlist { my ($cmdlist) = @_; - run_command(" /usr/sbin/ipset restore", input => $cmdlist); + run_command("/usr/sbin/ipset restore", input => $cmdlist); } sub iptables_get_chains { @@ -833,6 +830,8 @@ sub iptables_get_chains { my $table = ''; + my $hooks = {}; + my $parser = sub { my $line = shift; @@ -854,6 +853,8 @@ sub iptables_get_chains { my ($chain, $sig) = ($1, $2); return if !&$is_pvefw_chain($chain); $res->{$chain} = $sig; + } elsif ($line =~ m/^-A\s+(INPUT|OUTPUT|FORWARD)\s+-j\s+PVEFW-\1$/) { + $hooks->{$1} = 1; } else { # simply ignore the rest return; @@ -862,11 +863,21 @@ sub iptables_get_chains { run_command("/sbin/iptables-save", outfunc => $parser); - return $res; + return wantarray ? ($res, $hooks) : $res; +} + +sub iptables_chain_digest { + my ($rules) = @_; + my $digest = Digest::SHA->new('sha1'); + foreach my $rule (@$rules) { # order is important + $digest->add($rule); + } + return $digest->b64digest; } sub ipset_chain_digest { my ($rules) = @_; + my $digest = Digest::SHA->new('sha1'); foreach my $rule (sort @$rules) { # note: sorted $digest->add($rule); @@ -884,8 +895,10 @@ sub ipset_get_chains { return if $line =~ m/^#/; return if $line =~ m/^\s*$/; - if ($line =~ m/^(\S+)\s(\S+)\s(\S+)/) { - push @{$chains->{$2}}, $line; + if ($line =~ m/^(?:\S+)\s(PVEFW-\S+)\s(?:\S+).*/) { + my $chain = $1; + $line =~ s/\s+$//; # delete trailing white space + push @{$chains->{$chain}}, $line; } else { # simply ignore the rest return; @@ -902,30 +915,8 @@ sub ipset_get_chains { return $res; } -sub iptables_chain_exist { - my ($chain) = @_; - - eval{ - iptables("-n --list $chain"); - }; - return undef if $@; - - return 1; -} - -sub iptables_rule_exist { - my ($rule) = @_; - - eval{ - iptables("-C $rule"); - }; - return undef if $@; - - return 1; -} - sub ruleset_generate_cmdstr { - my ($ruleset, $chain, $rule, $actions, $goto) = @_; + my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf) = @_; return if defined($rule->{enable}) && !$rule->{enable}; @@ -933,18 +924,40 @@ sub ruleset_generate_cmdstr { my $nbdport = defined($rule->{dport}) ? parse_port_name_number_or_range($rule->{dport}) : 0; my $nbsport = defined($rule->{sport}) ? parse_port_name_number_or_range($rule->{sport}) : 0; - my $nbsource = $rule->{source} ? parse_address_list( $rule->{source}) : 0; - my $nbdest = $rule->{dest} ? parse_address_list($rule->{dest}) : 0; my @cmd = (); push @cmd, "-i $rule->{iface_in}" if $rule->{iface_in}; push @cmd, "-o $rule->{iface_out}" if $rule->{iface_out}; - push @cmd, "-m iprange --src-range" if $nbsource > 1; - push @cmd, "-s $rule->{source}" if $rule->{source}; - push @cmd, "-m iprange --dst-range" if $nbdest > 1; - push @cmd, "-d $rule->{dest}" if $rule->{dest}; + my $source = $rule->{source}; + my $dest = $rule->{dest}; + + if ($source){ + if($source =~ m/^(\+)(\S+)$/){ + die "no such netgroup $2" if !$cluster_conf->{ipset}->{$2}; + push @cmd, "-m set --match-set PVEFW-$2 src"; + + }elsif ($source =~ m/^(\d+)\.(\d+).(\d+).(\d+)\-(\d+)\.(\d+).(\d+).(\d+)$/){ + push @cmd, "-m iprange --src-range $source"; + + }else{ + push @cmd, "-s $source"; + } + } + + if ($dest){ + if($dest =~ m/^(\+)(\S+)$/){ + die "no such netgroup $2" if !$cluster_conf->{ipset}->{$2}; + push @cmd, "-m set --match-set PVEFW-$2 dst"; + + }elsif ($dest =~ m/^(\d+)\.(\d+).(\d+).(\d+)\-(\d+)\.(\d+).(\d+).(\d+)$/){ + push @cmd, "-m iprange --dst-range $dest"; + + }else{ + push @cmd, "-s $dest"; + } + } if ($rule->{proto}) { push @cmd, "-p $rule->{proto}"; @@ -1044,7 +1057,7 @@ my $apply_macro = sub { }; sub ruleset_generate_rule { - my ($ruleset, $chain, $rule, $actions, $goto) = @_; + my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf) = @_; my $rules; @@ -1055,7 +1068,7 @@ sub ruleset_generate_rule { } foreach my $tmp (@$rules) { - if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $tmp, $actions, $goto)) { + if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $tmp, $actions, $goto, $cluster_conf)) { ruleset_addrule($ruleset, $chain, $cmdstr); } } @@ -1251,10 +1264,10 @@ sub ruleset_generate_vm_rules { next if $rule->{type} ne $lc_direction; if ($direction eq 'OUT') { ruleset_generate_rule($ruleset, $chain, $rule, - { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }); + { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, undef, $cluster_conf); } else { my $accept = generate_nfqueue($options); - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept , REJECT => "PVEFW-reject" }); + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept , REJECT => "PVEFW-reject" }, undef, $cluster_conf); } } } @@ -1430,7 +1443,7 @@ sub enable_host_firewall { foreach my $rule (@$rules) { next if $rule->{type} ne 'in'; - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }); + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf); } # implement input policy @@ -1455,7 +1468,7 @@ sub enable_host_firewall { foreach my $rule (@$rules) { next if $rule->{type} ne 'out'; - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }); + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf); } # implement output policy @@ -1468,9 +1481,9 @@ sub enable_host_firewall { sub generate_group_rules { my ($ruleset, $cluster_conf, $group) = @_; - die "no such security group '$group'\n" if !$cluster_conf->{rules}->{$group}; + die "no such security group '$group'\n" if !$cluster_conf->{groups}->{$group}; - my $rules = $cluster_conf->{rules}->{$group}; + my $rules = $cluster_conf->{groups}->{$group}; my $chain = "GROUP-${group}-IN"; @@ -1479,7 +1492,7 @@ sub generate_group_rules { foreach my $rule (@$rules) { next if $rule->{type} ne 'in'; - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }); + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, undef, $cluster_conf); } $chain = "GROUP-${group}-OUT"; @@ -1492,7 +1505,7 @@ sub generate_group_rules { # we use PVEFW-SET-ACCEPT-MARK (Instead of ACCEPT) because we need to # check also other tap rules later ruleset_generate_rule($ruleset, $chain, $rule, - { ACCEPT => 'PVEFW-SET-ACCEPT-MARK', REJECT => "PVEFW-reject" }); + { ACCEPT => 'PVEFW-SET-ACCEPT-MARK', REJECT => "PVEFW-reject" }, undef, $cluster_conf); } } @@ -1567,9 +1580,9 @@ sub parse_fw_rule { parse_port_name_number_or_range($dport) if defined($dport); parse_port_name_number_or_range($sport) if defined($sport); - - parse_address_list($source) if $source; - parse_address_list($dest) if $dest; + + parse_address_list($source) if $source && $source !~ m/^(\+)(\S+)$/; + parse_address_list($dest) if $dest && $dest !~ m/^(\+)(\S+)$/; return { type => $type, @@ -1640,6 +1653,22 @@ sub parse_hostfw_option { return ($opt, $value); } +sub parse_clusterfw_option { + my ($line) = @_; + + my ($opt, $value); + + if ($line =~ m/^(enable):\s*(0|1)\s*$/i) { + $opt = lc($1); + $value = int($2); + } else { + chomp $line; + die "can't parse option '$line'\n" + } + + return ($opt, $value); +} + sub parse_vm_fw_rules { my ($filename, $fh) = @_; @@ -1748,13 +1777,13 @@ sub parse_host_fw_rules { return $res; } -sub parse_group_fw_rules { +sub parse_cluster_fw_rules { my ($filename, $fh) = @_; my $section; my $group; - my $res = { rules => {}, ipset => {} }; + my $res = { rules => [], options => {}, groups => {}, ipset => {} }; my $digest = Digest::SHA->new('sha1'); @@ -1767,33 +1796,48 @@ sub parse_group_fw_rules { my $linenr = $fh->input_line_number(); my $prefix = "$filename (line $linenr)"; - if ($line =~ m/^\[group\s+(\S+)\]\s*$/i) { - $section = 'rules'; - $group = lc($1); + if ($line =~ m/^\[options\]$/i) { + $section = 'options'; next; } - if ($line =~ m/^\[ipgroup\s+(\S+)\]\s*$/i) { - $section = 'ipset'; + if ($line =~ m/^\[group\s+(\S+)\]\s*$/i) { + $section = 'groups'; $group = lc($1); - $res->{$section}->{$group}->{type} = 'hash:ip family inet hashsize 1024 maxelem 65536 '; + next; + } + if ($line =~ m/^\[rules\]$/i) { + $section = 'rules'; next; } + if ($line =~ m/^\[netgroup\s+(\S+)\]\s*$/i) { $section = 'ipset'; $group = lc($1); - $res->{$section}->{$group}->{type} = 'hash:net family inet hashsize 1024 maxelem 65536 '; - next; } - if (!$section || !$group) { + if (!$section) { warn "$prefix: skip line - no section"; next; } - if ($section eq 'rules') { + if ($section eq 'options') { + eval { + my ($opt, $value) = parse_clusterfw_option($line); + $res->{options}->{$opt} = $value; + }; + warn "$prefix: $@" if $@; + } elsif ($section eq 'rules') { + my $rule; + eval { $rule = parse_fw_rule($line, 1, 1); }; + if (my $err = $@) { + warn "$prefix: $err"; + next; + } + push @{$res->{$section}}, $rule; + } elsif ($section eq 'groups') { my $rule; eval { $rule = parse_fw_rule($line, 0, 0); }; if (my $err = $@) { @@ -1801,22 +1845,27 @@ sub parse_group_fw_rules { next; } push @{$res->{$section}->{$group}}, $rule; - } elsif ($section eq 'ipset') { chomp $line; - my $ip; - if (!Net::IP->new($line)) { + $line =~ m/^(\!)?(\s)?((\d+)\.(\d+)\.(\d+)\.(\d+)(\/(\d+))?)/; + my $nomatch = $1; + my $ip = $3; + + if(!$ip){ warn "$prefix: $line is not an valid ip address"; next; } - push @{$res->{$section}->{$group}->{ip}}, $line; - } + if (!Net::IP->new($ip)) { + warn "$prefix: $line is not an valid ip address"; + next; + } + $ip .= " nomatch" if $nomatch; - + push @{$res->{$section}->{$group}}, $ip; + } } $res->{digest} = $digest->b64digest; - return $res; } @@ -1881,6 +1930,66 @@ sub load_vmfw_conf { return $vmfw_conf; } +my $format_rules = sub { + my ($rules, $need_iface) = @_; + + my $raw = ''; + + foreach my $rule (@$rules) { + if ($rule->{type} eq 'in' || $rule->{type} eq 'out') { + $raw .= '|' if defined($rule->{enable}) && !$rule->{enable}; + $raw .= uc($rule->{type}); + $raw .= " " . $rule->{action}; + $raw .= " " . ($rule->{iface} || '-') if $need_iface; + $raw .= " " . ($rule->{source} || '-'); + $raw .= " " . ($rule->{dest} || '-'); + $raw .= " " . ($rule->{proto} || '-'); + $raw .= " " . ($rule->{dport} || '-'); + $raw .= " " . ($rule->{sport} || '-'); + $raw .= " # " . encode('utf8', $rule->{comment}) + if $rule->{comment} && $rule->{comment} !~ m/^\s*$/; + $raw .= "\n"; + } else { + die "implement me '$rule->{type}'"; + } + } + + return $raw; +}; + +my $format_options = sub { + my ($options) = @_; + + my $raw = ''; + + $raw .= "[OPTIONS]\n\n"; + foreach my $opt (keys %$options) { + $raw .= "$opt: $options->{$opt}\n"; + } + $raw .= "\n"; + + return $raw; +}; + +sub save_vmfw_conf { + my ($vmid, $vmfw_conf) = @_; + + my $raw = ''; + + my $options = $vmfw_conf->{options}; + $raw .= &$format_options($options) if scalar(keys %$options); + + my $rules = $vmfw_conf->{rules}; + if (scalar(@$rules)) { + $raw .= "[RULES]\n\n"; + $raw .= &$format_rules($rules, 1); + $raw .= "\n"; + } + + my $filename = "/etc/pve/firewall/$vmid.fw"; + PVE::Tools::file_set_contents($filename, $raw); +} + sub read_vm_firewall_configs { my ($vmdata) = @_; my $vmfw_configs = {}; @@ -1942,23 +2051,38 @@ sub generate_std_chains { } sub generate_ipset_chains { - my ($ipset_ruleset, $options) = @_; + my ($ipset_ruleset, $fw_conf) = @_; - foreach my $ipset (keys %{$options->{ipset}}) { - generate_ipset($ipset_ruleset, $ipset, $options->{ipset}->{$ipset}); + foreach my $ipset (keys %{$fw_conf->{ipset}}) { + generate_ipset($ipset_ruleset, "PVEFW-$ipset", $fw_conf->{ipset}->{$ipset}); } } sub generate_ipset { my ($ipset_ruleset, $name, $options) = @_; - push @{$ipset_ruleset->{$name}}, "create $name $options->{type}"; + my $hashsize = scalar(@$options); + if ($hashsize <= 64) { + $hashsize = 64; + } else { + $hashsize = round_powerof2($hashsize); + } + + push @{$ipset_ruleset->{$name}}, "create $name hash:net family inet hashsize $hashsize maxelem $hashsize"; - foreach my $ip (@{$options->{ip}}) { + foreach my $ip (@$options) { push @{$ipset_ruleset->{$name}}, "add $name $ip"; } } +sub round_powerof2 { + my ($int) = @_; + + $int--; + $int |= $int >> $_ foreach (1,2,4,8,16); + return ++$int; +} + sub save_pvefw_status { my ($status) = @_; @@ -2015,7 +2139,7 @@ sub load_clusterfw_conf { my $cluster_conf = {}; if (my $fh = IO::File->new($clusterfw_conf_filename, O_RDONLY)) { - $cluster_conf = parse_group_fw_rules($clusterfw_conf_filename, $fh); + $cluster_conf = parse_cluster_fw_rules($clusterfw_conf_filename, $fh); } return $cluster_conf; @@ -2026,28 +2150,22 @@ sub save_clusterfw_conf { my $raw = ''; - foreach my $group (sort keys %{$cluster_conf->{rules}}) { - my $rules = $cluster_conf->{rules}->{$group}; - $raw .= "[group $group]\n\n"; + my $options = $cluster_conf->{options}; + $raw .= &$format_options($options) if scalar(keys %$options); - foreach my $rule (@$rules) { - if ($rule->{type} eq 'in' || $rule->{type} eq 'out') { - $raw .= '|' if defined($rule->{enable}) && !$rule->{enable}; - $raw .= uc($rule->{type}); - $raw .= " " . $rule->{action}; - $raw .= " " . ($rule->{source} || '-'); - $raw .= " " . ($rule->{dest} || '-'); - $raw .= " " . ($rule->{proto} || '-'); - $raw .= " " . ($rule->{dport} || '-'); - $raw .= " " . ($rule->{sport} || '-'); - $raw .= " # " . encode('utf8', $rule->{comment}) - if $rule->{comment} && $rule->{comment} !~ m/^\s*$/; - $raw .= "\n"; - } else { - die "implement me '$rule->{type}'"; - } - } + # fixme: save ipset + my $rules = $cluster_conf->{rules}; + if (scalar(@$rules)) { + $raw .= "[RULES]\n\n"; + $raw .= &$format_rules($rules, 1); + $raw .= "\n"; + } + + foreach my $group (sort keys %{$cluster_conf->{groups}}) { + my $rules = $cluster_conf->{groups}->{$group}; + $raw .= "[group $group]\n\n"; + $raw .= &$format_rules($rules, 0); $raw .= "\n"; } @@ -2057,13 +2175,30 @@ sub save_clusterfw_conf { sub load_hostfw_conf { my $hostfw_conf = {}; - my $filename = "/etc/pve/local/host.fw"; - if (my $fh = IO::File->new($filename, O_RDONLY)) { - $hostfw_conf = parse_host_fw_rules($filename, $fh); + if (my $fh = IO::File->new($hostfw_conf_filename, O_RDONLY)) { + $hostfw_conf = parse_host_fw_rules($hostfw_conf_filename, $fh); } return $hostfw_conf; } +sub save_hostfw_conf { + my ($hostfw_conf) = @_; + + my $raw = ''; + + my $options = $hostfw_conf->{options}; + $raw .= &$format_options($options) if scalar(keys %$options); + + my $rules = $hostfw_conf->{rules}; + if (scalar(@$rules)) { + $raw .= "[RULES]\n\n"; + $raw .= &$format_rules($rules, 1); + $raw .= "\n"; + } + + PVE::Tools::file_set_contents($hostfw_conf_filename, $raw); +} + sub compile { my $vmdata = read_local_vm_config(); my $vmfw_configs = read_vm_firewall_configs($vmdata); @@ -2182,19 +2317,13 @@ sub compile { } sub get_ruleset_status { - my ($ruleset, $verbose, $ipset) = @_; - - my $active_chains = undef; - if($ipset){ - $active_chains = ipset_get_chains(); - }else{ - $active_chains = iptables_get_chains(); - } + my ($ruleset, $active_chains, $digest_fn, $verbose) = @_; my $statushash = {}; foreach my $chain (sort keys %$ruleset) { - my $sig = ipset_chain_digest($ruleset->{$chain}); + my $sig = &$digest_fn($ruleset->{$chain}); + $statushash->{$chain}->{sig} = $sig; my $oldsig = $active_chains->{$chain}; @@ -2221,7 +2350,7 @@ sub get_ruleset_status { print "delete $chain ($sig)\n" if $verbose; } } - + return $statushash; } @@ -2232,12 +2361,13 @@ sub print_sig_rule { return "-A $chain -m comment --comment \"PVESIG:$sig\"\n"; } -sub get_rulset_cmdlist { +sub get_ruleset_cmdlist { my ($ruleset, $verbose) = @_; my $cmdlist = "*filter\n"; # we pass this to iptables-restore; - - my $statushash = get_ruleset_status($ruleset, $verbose); + + my ($active_chains, $hooks) = iptables_get_chains(); + my $statushash = get_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, $verbose); # create missing chains first foreach my $chain (sort keys %$ruleset) { @@ -2248,18 +2378,10 @@ sub get_rulset_cmdlist { $cmdlist .= ":$chain - [0:0]\n"; } - my $rule = "INPUT -j PVEFW-INPUT"; - if (!PVE::Firewall::iptables_rule_exist($rule)) { - $cmdlist .= "-A $rule\n"; - } - $rule = "OUTPUT -j PVEFW-OUTPUT"; - if (!PVE::Firewall::iptables_rule_exist($rule)) { - $cmdlist .= "-A $rule\n"; - } - - $rule = "FORWARD -j PVEFW-FORWARD"; - if (!PVE::Firewall::iptables_rule_exist($rule)) { - $cmdlist .= "-A $rule\n"; + foreach my $h (qw(INPUT OUTPUT FORWARD)) { + if (!$hooks->{$h}) { + $cmdlist .= "-A $h -j PVEFW-$h\n"; + } } foreach my $chain (sort keys %$ruleset) { @@ -2294,7 +2416,7 @@ sub get_rulset_cmdlist { } my $changes = $cmdlist ne "*filter\n" ? 1 : 0; - + $cmdlist .= "COMMIT\n"; return wantarray ? ($cmdlist, $changes) : $cmdlist; @@ -2305,7 +2427,10 @@ sub get_ipset_cmdlist { my $cmdlist = ""; - my $statushash = get_ruleset_status($ruleset, $verbose, 1); + my $delete_cmdlist = ""; + + my $active_chains = ipset_get_chains(); + my $statushash = get_ruleset_status($ruleset, $active_chains, \&ipset_chain_digest, $verbose); foreach my $chain (sort keys %$ruleset) { my $stat = $statushash->{$chain}; @@ -2315,33 +2440,32 @@ sub get_ipset_cmdlist { foreach my $cmd (@{$ruleset->{$chain}}) { $cmdlist .= "$cmd\n"; } - } + } if ($stat->{action} eq 'update') { my $chain_swap = $chain."_swap"; - + foreach my $cmd (@{$ruleset->{$chain}}) { $cmd =~ s/$chain/$chain_swap/; $cmdlist .= "$cmd\n"; - } $cmdlist .= "swap $chain_swap $chain\n"; $cmdlist .= "flush $chain_swap\n"; $cmdlist .= "destroy $chain_swap\n"; - } + } } foreach my $chain (keys %$statushash) { next if $statushash->{$chain}->{action} ne 'delete'; - $cmdlist .= "flush $chain\n"; - $cmdlist .= "destroy $chain\n"; + $delete_cmdlist .= "flush $chain\n"; + $delete_cmdlist .= "destroy $chain\n"; } - my $changes = $cmdlist ? 1 : 0; - - return wantarray ? ($cmdlist, $changes) : $cmdlist; + my $changes = ($cmdlist || $delete_cmdlist) ? 1 : 0; + + return ($cmdlist, $delete_cmdlist, $changes); } sub apply_ruleset { @@ -2351,20 +2475,33 @@ sub apply_ruleset { update_nf_conntrack_max($hostfw_conf); - my $ipsetcmdlist = get_ipset_cmdlist($ipset_ruleset, $verbose); + my ($ipset_create_cmdlist, $ipset_delete_cmdlist, $ipset_changes) = + get_ipset_cmdlist($ipset_ruleset, undef, $verbose); - my $cmdlist = get_rulset_cmdlist($ruleset, $verbose); + my ($cmdlist, $changes) = get_ruleset_cmdlist($ruleset, $verbose); - print $ipsetcmdlist if $verbose; + if ($verbose) { + if ($ipset_changes) { + print "ipset changes:\n"; + print $ipset_create_cmdlist if $ipset_create_cmdlist; + print $ipset_delete_cmdlist if $ipset_delete_cmdlist; + } - print $cmdlist if $verbose; + if ($changes) { + print "iptables changes:\n"; + print $cmdlist; + } + } - ipset_restore_cmdlist($ipsetcmdlist); + ipset_restore_cmdlist($ipset_create_cmdlist); iptables_restore_cmdlist($cmdlist); + ipset_restore_cmdlist($ipset_delete_cmdlist) if $ipset_delete_cmdlist; + # test: re-read status and check if everything is up to date - my $statushash = get_ruleset_status($ruleset); + my $active_chains = iptables_get_chains(); + my $statushash = get_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, 0); my $errors; foreach my $chain (sort keys %$ruleset) { @@ -2402,6 +2539,29 @@ sub update_nf_conntrack_max { } } +sub remove_pvefw_chains { + + my ($chash, $hooks) = iptables_get_chains(); + my $cmdlist = "*filter\n"; + + foreach my $h (qw(INPUT OUTPUT FORWARD)) { + if ($hooks->{$h}) { + $cmdlist .= "-D $h -j PVEFW-$h\n"; + } + } + + foreach my $chain (keys %$chash) { + $cmdlist .= "-F $chain\n"; + } + + foreach my $chain (keys %$chash) { + $cmdlist .= "-X $chain\n"; + } + $cmdlist .= "COMMIT\n"; + + iptables_restore_cmdlist($cmdlist); +} + sub update { my ($start, $verbose) = @_;