X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=8407e3cc8b4b344980f97837380969e9b0af829e;hp=3a96179b4886a07fb465c9b5ec63c5a0340f55f4;hb=4803b296c5728bd70bca35bc48279225acf6e453;hpb=525778d783fafdf616347afa674adccec5dfdc6f diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 3a96179..8407e3c 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -35,6 +35,14 @@ eval { $have_pve_manager = 1; }; +my $security_group_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; +my $ipset_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; +my $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; + +my $max_alias_name_length = 64; +my $max_ipset_name_length = 64; +my $max_group_name_length = 20; + PVE::JSONSchema::register_format('IPv4orCIDR', \&pve_verify_ipv4_or_cidr); sub pve_verify_ipv4_or_cidr { my ($cidr, $noerr) = @_; @@ -48,20 +56,35 @@ sub pve_verify_ipv4_or_cidr { die "value does not look like a valid IP address or CIDR network\n"; } +PVE::JSONSchema::register_format('IPv4orCIDRorAlias', \&pve_verify_ipv4_or_cidr_or_alias); +sub pve_verify_ipv4_or_cidr_or_alias { + my ($cidr, $noerr) = @_; + + return if $cidr =~ m/^(?:$ip_alias_pattern)$/; + + if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) { + return $cidr if Net::IP->new($cidr); + return undef if $noerr; + die Net::IP::Error() . "\n"; + } + return undef if $noerr; + die "value does not look like a valid IP address or CIDR network\n"; +} + PVE::JSONSchema::register_standard_option('ipset-name', { description => "IP set name.", type => 'string', - pattern => '[A-Za-z][A-Za-z0-9\-\_]+', + pattern => $ipset_name_pattern, minLength => 2, - maxLength => 20, + maxLength => $max_ipset_name_length, }); PVE::JSONSchema::register_standard_option('pve-fw-alias', { description => "Alias name.", type => 'string', - pattern => '[A-Za-z][A-Za-z0-9\-\_]+', + pattern => $ip_alias_pattern, minLength => 2, - maxLength => 20, + maxLength => $max_alias_name_length, }); PVE::JSONSchema::register_standard_option('pve-fw-loglevel' => { @@ -71,15 +94,12 @@ PVE::JSONSchema::register_standard_option('pve-fw-loglevel' => { optional => 1, }); -my $security_group_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; -my $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; - PVE::JSONSchema::register_standard_option('pve-security-group-name', { description => "Security Group name.", type => 'string', pattern => $security_group_name_pattern, minLength => 2, - maxLength => 20, + maxLength => $max_group_name_length, }); my $feature_ipset_nomatch = 0; @@ -720,7 +740,7 @@ sub local_network { my $ip = PVE::Cluster::remote_node_ip($nodename); my $testip = Net::IP->new($ip); - + my $routes = PVE::ProcFSTools::read_proc_net_route(); foreach my $entry (@$routes) { my $mask = $ipv4_mask_hash_localnet->{$entry->{mask}}; @@ -739,11 +759,35 @@ sub local_network { return $__local_network; } +my $max_iptables_ipset_name_length = 27; + +sub compute_ipset_chain_name { + my ($vmid, $ipset_name) = @_; + + $vmid = 0 if !defined($vmid); + + my $id = "$vmid-${ipset_name}"; + + + if ((length($id) + 6) > $max_iptables_ipset_name_length) { + $id = PVE::Tools::fnv31a_hex($id); + } + + return "PVEFW-$id"; +} + sub parse_address_list { my ($str) = @_; - return if $str =~ m/^(\+)(\S+)$/; # ipset ref - return if $str =~ m/^${ip_alias_pattern}$/; + if ($str =~ m/^(\+)(\S+)$/) { # ipset ref + die "ipset name too long\n" if length($str) > ($max_ipset_name_length + 1); + return; + } + + if ($str =~ m/^${ip_alias_pattern}$/) { + die "alias name too long\n" if length($str) > $max_alias_name_length; + return; + } my $count = 0; my $iprange = 0; @@ -855,7 +899,8 @@ sub copy_list_with_digest { my $v = $entry->{$k}; next if !defined($v); $data->{$k} = $v; - $sha->add($k, ':', $v, "\n"); + # Note: digest ignores refs ($rule->{errors}) + $sha->add($k, ':', $v, "\n") if !ref($v); ; } push @$res, $data; } @@ -1003,61 +1048,143 @@ my $apply_macro = sub { return $rules; }; +my $rule_env_iface_lookup = { + 'ct' => 1, + 'vm' => 1, + 'group' => 0, + 'cluster' => 1, + 'host' => 1, +}; + sub verify_rule { - my ($rule, $allow_groups) = @_; + my ($rule, $cluster_conf, $fw_conf, $rule_env, $noerr) = @_; - my $type = $rule->{type}; + my $allow_groups = $rule_env eq 'group' ? 0 : 1; - raise_param_exc({ type => "missing property"}) if !$type; - raise_param_exc({ action => "missing property"}) if !$rule->{action}; - - if ($type eq 'in' || $type eq 'out') { - raise_param_exc({ action => "unknown action '$rule->{action}'"}) - if $rule->{action} !~ m/^(ACCEPT|DROP|REJECT)$/; - } elsif ($type eq 'group') { - raise_param_exc({ type => "security groups not allowed"}) - if !$allow_groups; - raise_param_exc({ action => "invalid characters in security group name"}) - if $rule->{action} !~ m/^${security_group_name_pattern}$/; - } else { - raise_param_exc({ type => "unknown rule type '$type'"}); + my $allow_iface = $rule_env_iface_lookup->{$rule_env}; + die "unknown rule_env '$rule_env'\n" if !defined($allow_iface); # should not happen + + my $errors = $rule->{errors} || {}; + + my $error_count = 0; + + my $add_error = sub { + my ($param, $msg) = @_; + chomp $msg; + raise_param_exc({ $param => $msg }) if !$noerr; + $error_count++; + $errors->{$param} = $msg if !$errors->{$param}; + }; + + my $check_ipset_or_alias_property = sub { + my ($name) = @_; + + if (my $value = $rule->{$name}) { + if ($value =~ m/^\+/) { + if ($value =~ m/^\+(${ipset_name_pattern})$/) { + &$add_error($name, "no such ipset '$1'") + if !($cluster_conf->{ipset}->{$1} || ($fw_conf && $fw_conf->{ipset}->{$1})); + + } else { + &$add_error($name, "invalid ipset name '$value'"); + } + } elsif ($value =~ m/^${ip_alias_pattern}$/){ + my $alias = lc($value); + &$add_error($name, "no such alias '$value'") + if !($cluster_conf->{aliases}->{$alias} || ($fw_conf && $fw_conf->{aliases}->{$alias})) + } + } + }; + + my $type = $rule->{type}; + my $action = $rule->{action}; + + &$add_error('type', "missing property") if !$type; + &$add_error('action', "missing property") if !$action; + + if ($type) { + if ($type eq 'in' || $type eq 'out') { + &$add_error('action', "unknown action '$action'") + if $action && ($action !~ m/^(ACCEPT|DROP|REJECT)$/); + } elsif ($type eq 'group') { + &$add_error('type', "security groups not allowed") + if !$allow_groups; + &$add_error('action', "invalid characters in security group name") + if $action && ($action !~ m/^${security_group_name_pattern}$/); + } else { + &$add_error('type', "unknown rule type '$type'"); + } } if ($rule->{iface}) { + &$add_error('type', "parameter -i not allowed for this rule type") + if !$allow_iface; eval { PVE::JSONSchema::pve_verify_iface($rule->{iface}); }; - raise_param_exc({ iface => $@ }) if $@; - } + &$add_error('iface', $@) if $@; + if ($rule_env eq 'vm') { + &$add_error('iface', "value does not match the regex pattern 'net\\d+'") + if $rule->{iface} !~ m/^net(\d+)$/; + } elsif ($rule_env eq 'ct') { + &$add_error('iface', "value does not match the regex pattern '(venet|eth\\d+)'") + if $rule->{iface} !~ m/^(venet|eth(\d+))$/; + } + } if ($rule->{macro}) { - my $preferred_name = $pve_fw_preferred_macro_names->{lc($rule->{macro})}; - raise_param_exc({ macro => "unknown macro '$rule->{macro}'"}) if !$preferred_name; - $rule->{macro} = $preferred_name; + if (my $preferred_name = $pve_fw_preferred_macro_names->{lc($rule->{macro})}) { + $rule->{macro} = $preferred_name; + } else { + &$add_error('macro', "unknown macro '$rule->{macro}'"); + } + } + + if ($rule->{proto}) { + eval { pve_fw_verify_protocol_spec($rule->{proto}); }; + &$add_error('proto', $@) if $@; } if ($rule->{dport}) { eval { parse_port_name_number_or_range($rule->{dport}); }; - raise_param_exc({ dport => $@ }) if $@; + &$add_error('dport', $@) if $@; + &$add_error('proto', "missing property - 'dport' requires this property") + if !$rule->{proto}; } if ($rule->{sport}) { eval { parse_port_name_number_or_range($rule->{sport}); }; - raise_param_exc({ sport => $@ }) if $@; + &$add_error('sport', $@) if $@; + &$add_error('proto', "missing property - 'sport' requires this property") + if !$rule->{proto}; } if ($rule->{source}) { eval { parse_address_list($rule->{source}); }; - raise_param_exc({ source => $@ }) if $@; + &$add_error('source', $@) if $@; + &$check_ipset_or_alias_property('source'); } if ($rule->{dest}) { eval { parse_address_list($rule->{dest}); }; - raise_param_exc({ dest => $@ }) if $@; + &$add_error('dest', $@) if $@; + &$check_ipset_or_alias_property('dest'); } - if ($rule->{macro}) { - &$apply_macro($rule->{macro}, $rule, 1); + if ($rule->{macro} && !$error_count) { + eval { &$apply_macro($rule->{macro}, $rule, 1); }; + if (my $err = $@) { + if (ref($err) eq "PVE::Exception" && $err->{errors}) { + my $eh = $err->{errors}; + foreach my $p (keys %$eh) { + &$add_error($p, $eh->{$p}); + } + } else { + &$add_error('macro', "$err"); + } + } } + $rule->{errors} = $errors if $error_count; + return $rule; } @@ -1071,13 +1198,9 @@ sub copy_rule_data { } else { $rule->{$k} = $v; } - } else { - delete $rule->{$k}; } } - # verify rule now - return $rule; } @@ -1221,9 +1344,10 @@ sub ipset_get_chains { } sub ruleset_generate_cmdstr { - my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf) = @_; + my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; return if defined($rule->{enable}) && !$rule->{enable}; + return if $rule->{errors}; die "unable to emit macro - internal error" if $rule->{macro}; # should not happen @@ -1240,20 +1364,28 @@ sub ruleset_generate_cmdstr { if ($source) { if ($source =~ m/^\+/) { - if ($source =~ m/^\+(${security_group_name_pattern})$/) { - die "no such ipset '$1'\n" if !$cluster_conf->{ipset}->{$1}; - push @cmd, "-m set --match-set PVEFW-$1 src"; + if ($source =~ m/^\+(${ipset_name_pattern})$/) { + my $name = $1; + if ($fw_conf && $fw_conf->{ipset}->{$name}) { + my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name); + push @cmd, "-m set --match-set ${ipset_chain} src"; + } elsif ($cluster_conf && $cluster_conf->{ipset}->{$name}) { + my $ipset_chain = compute_ipset_chain_name(0, $name); + push @cmd, "-m set --match-set ${ipset_chain} src"; + } else { + die "no such ipset '$name'\n"; + } } else { die "invalid security group name '$source'\n"; } } elsif ($source =~ m/^${ip_alias_pattern}$/){ my $alias = lc($source); - my $e = $cluster_conf->{aliases}->{$alias}; - die "no such alias $source\n" if !$e; + my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; + $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; + die "no such alias '$source'\n" if !$e; push @cmd, "-s $e->{cidr}"; } elsif ($source =~ m/\-/){ push @cmd, "-m iprange --src-range $source"; - } else { push @cmd, "-s $source"; } @@ -1261,20 +1393,28 @@ sub ruleset_generate_cmdstr { if ($dest) { if ($dest =~ m/^\+/) { - if ($dest =~ m/^\+(${security_group_name_pattern})$/) { - die "no such ipset '$1'\n" if !$cluster_conf->{ipset}->{$1}; - push @cmd, "-m set --match-set PVEFW-$1 dst"; + if ($dest =~ m/^\+(${ipset_name_pattern})$/) { + my $name = $1; + if ($fw_conf && $fw_conf->{ipset}->{$name}) { + my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name); + push @cmd, "-m set --match-set ${ipset_chain} dst"; + } elsif ($cluster_conf && $cluster_conf->{ipset}->{$name}) { + my $ipset_chain = compute_ipset_chain_name(0, $name); + push @cmd, "-m set --match-set ${ipset_chain} dst"; + } else { + die "no such ipset '$name'\n"; + } } else { die "invalid security group name '$dest'\n"; } } elsif ($dest =~ m/^${ip_alias_pattern}$/){ my $alias = lc($dest); - my $e = $cluster_conf->{aliases}->{$alias}; - die "no such alias $dest" if !$e; + my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; + $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; + die "no such alias '$dest'\n" if !$e; push @cmd, "-d $e->{cidr}"; } elsif ($dest =~ m/^(\d+)\.(\d+).(\d+).(\d+)\-(\d+)\.(\d+).(\d+).(\d+)$/){ push @cmd, "-m iprange --dst-range $dest"; - } else { push @cmd, "-d $dest"; } @@ -1318,8 +1458,8 @@ sub ruleset_generate_cmdstr { } } } elsif ($rule->{dport} || $rule->{sport}) { - warn "ignoring destination port '$rule->{dport}' - no protocol specified\n" if $rule->{dport}; - warn "ignoring source port '$rule->{sport}' - no protocol specified\n" if $rule->{sport}; + die "destination port '$rule->{dport}', but no protocol specified\n" if $rule->{dport}; + die "source port '$rule->{sport}', but no protocol specified\n" if $rule->{sport}; } push @cmd, "-m addrtype --dst-type $rule->{dsttype}" if $rule->{dsttype}; @@ -1334,7 +1474,7 @@ sub ruleset_generate_cmdstr { } sub ruleset_generate_rule { - my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf) = @_; + my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; my $rules; @@ -1348,7 +1488,7 @@ sub ruleset_generate_rule { my @cmds = (); foreach my $tmp (@$rules) { - if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $tmp, $actions, $goto, $cluster_conf)) { + if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $tmp, $actions, $goto, $cluster_conf, $fw_conf)) { push @cmds, $cmdstr; } } @@ -1464,8 +1604,13 @@ sub ruleset_chain_add_input_filters { my ($ruleset, $chain, $options, $cluster_conf, $loglevel) = @_; if ($cluster_conf->{ipset}->{blacklist}){ - ruleset_addlog($ruleset, $chain, 0, "DROP: ", $loglevel, "-m set --match-set PVEFW-blacklist src"); - ruleset_addrule($ruleset, $chain, "-m set --match-set PVEFW-blacklist src -j DROP"); + if (!ruleset_chain_exist($ruleset, "PVEFW-blacklist")) { + ruleset_create_chain($ruleset, "PVEFW-blacklist"); + ruleset_addlog($ruleset, "PVEFW-blacklist", 0, "DROP: ", $loglevel) if $loglevel; + ruleset_addrule($ruleset, "PVEFW-blacklist", "-j DROP"); + } + my $ipset_chain = compute_ipset_chain_name(0, 'blacklist'); + ruleset_addrule($ruleset, $chain, "-m set --match-set ${ipset_chain} src -j PVEFW-blacklist"); } if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) { @@ -1509,7 +1654,7 @@ sub ruleset_add_group_rule { if(!ruleset_chain_exist($ruleset, $group_chain)){ generate_group_rules($ruleset, $cluster_conf, $group); } - + if ($direction eq 'OUT' && $rule->{iface_out}) { ruleset_addrule($ruleset, $chain, "-o $rule->{iface_out} -j $group_chain"); } elsif ($direction eq 'IN' && $rule->{iface_in}) { @@ -1522,7 +1667,7 @@ sub ruleset_add_group_rule { } sub ruleset_generate_vm_rules { - my ($ruleset, $rules, $cluster_conf, $chain, $netid, $direction, $options) = @_; + my ($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, $netid, $direction, $options) = @_; my $lc_direction = lc($direction); @@ -1530,7 +1675,7 @@ sub ruleset_generate_vm_rules { foreach my $rule (@$rules) { next if $rule->{iface} && $rule->{iface} ne $netid; - next if !$rule->{enable}; + next if !$rule->{enable} || $rule->{errors}; if ($rule->{type} eq 'group') { ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, $direction, $direction eq 'OUT' ? 'RETURN' : $in_accept); @@ -1540,11 +1685,11 @@ sub ruleset_generate_vm_rules { if ($direction eq 'OUT') { ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, - undef, $cluster_conf); + undef, $cluster_conf, $vmfw_conf); } else { ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $in_accept , REJECT => "PVEFW-reject" }, - undef, $cluster_conf); + undef, $cluster_conf, $vmfw_conf); } }; warn $@ if $@; @@ -1599,7 +1744,7 @@ sub generate_venet_rules_direction { ruleset_create_vm_chain($ruleset, $chain, $options, undef, $direction); - ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $chain, 'venet', $direction); + ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, 'venet', $direction); # implement policy my $policy; @@ -1641,7 +1786,7 @@ sub generate_tap_rules_direction { ruleset_create_vm_chain($ruleset, $tapchain, $options, $macaddr, $direction); - ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $tapchain, $netid, $direction, $options); + ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $tapchain, $netid, $direction, $options); ruleset_generate_vm_ipsrules($ruleset, $options, $direction, $iface); @@ -1690,25 +1835,34 @@ sub enable_host_firewall { # we use RETURN because we need to check also tap rules my $accept_action = 'RETURN'; + ruleset_addrule($ruleset, $chain, "-p igmp -j $accept_action"); # important for multicast + # add host rules first, so that cluster wide rules can be overwritten foreach my $rule (@$rules, @$cluster_rules) { + next if !$rule->{enable} || $rule->{errors}; + $rule->{iface_in} = $rule->{iface} if $rule->{iface}; - if ($rule->{type} eq 'group') { - ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'IN', $accept_action); - } elsif ($rule->{type} eq 'in') { - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, - undef, $cluster_conf); - } + + eval { + if ($rule->{type} eq 'group') { + ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'IN', $accept_action); + } elsif ($rule->{type} eq 'in') { + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, + undef, $cluster_conf, $hostfw_conf); + } + }; + warn $@ if $@; delete $rule->{iface_in}; } # allow standard traffic for management ipset (includes cluster network) - my $mngmntsrc = "-m set --match-set PVEFW-management src"; + my $mngmnt_ipset_chain = compute_ipset_chain_name(0, "management"); + my $mngmntsrc = "-m set --match-set ${mngmnt_ipset_chain} src"; ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 8006 -j $accept_action"); # PVE API - ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console + ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 3128 -j $accept_action"); # SPICE Proxy ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 22 -j $accept_action"); # SSH - + my $localnet = local_network(); # corosync @@ -1735,15 +1889,22 @@ sub enable_host_firewall { # we use RETURN because we may want to check other thigs later $accept_action = 'RETURN'; + ruleset_addrule($ruleset, $chain, "-p igmp -j $accept_action"); # important for multicast + # add host rules first, so that cluster wide rules can be overwritten foreach my $rule (@$rules, @$cluster_rules) { + next if !$rule->{enable} || $rule->{errors}; + $rule->{iface_out} = $rule->{iface} if $rule->{iface}; - if ($rule->{type} eq 'group') { - ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'OUT', $accept_action); - } elsif ($rule->{type} eq 'out') { - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, - undef, $cluster_conf); - } + eval { + if ($rule->{type} eq 'group') { + ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'OUT', $accept_action); + } elsif ($rule->{type} eq 'out') { + ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, + undef, $cluster_conf, $hostfw_conf); + } + }; + warn $@ if $@; delete $rule->{iface_out}; } @@ -1751,9 +1912,9 @@ sub enable_host_firewall { if ($localnet) { ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 8006 -j $accept_action"); # PVE API ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 22 -j $accept_action"); # SSH - ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console + ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 3128 -j $accept_action"); # SPICE Proxy - + my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action"; ruleset_addrule($ruleset, $chain, "-d $localnet $corosync_rule"); ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST $corosync_rule"); @@ -1808,77 +1969,64 @@ for (my $i = 0; $i < $MAX_NETS; $i++) { } sub parse_fw_rule { - my ($line, $allow_iface, $allow_groups) = @_; - - my ($type, $action, $macro, $iface, $source, $dest, $proto, $dport, $sport); + my ($prefix, $line, $cluster_conf, $fw_conf, $rule_env, $verbose) = @_; chomp $line; + my $orig_line = $line; + + my $rule = {}; + # we can add single line comments to the end of the rule - my $comment = decode('utf8', $1) if $line =~ s/#\s*(.*?)\s*$//; + if ($line =~ s/#\s*(.*?)\s*$//) { + $rule->{comment} = decode('utf8', $1); + } # we can disable a rule when prefixed with '|' - my $enable = 1; - $enable = 0 if $line =~ s/^\|//; + $rule->{enable} = $line =~ s/^\|// ? 0 : 1; $line =~ s/^(\S+)\s+(\S+)\s*// || die "unable to parse rule: $line\n"; - - $type = lc($1); - $action = $2; - - if ($type eq 'in' || $type eq 'out') { - if ($action =~ m/^(ACCEPT|DROP|REJECT)$/) { - # OK - } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) { - $action = $2; - my $preferred_name = $pve_fw_preferred_macro_names->{lc($1)}; - die "unknown macro '$1'\n" if !$preferred_name; - $macro = $preferred_name; - } else { - die "unknown action '$action'\n"; + + $rule->{type} = lc($1); + $rule->{action} = $2; + + if ($rule->{type} eq 'in' || $rule->{type} eq 'out') { + if ($rule->{action} =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) { + $rule->{macro} = $1; + $rule->{action} = $2; } - } elsif ($type eq 'group') { - die "groups disabled\n" if !$allow_groups; - die "invalid characters in group name\n" if $action !~ m/^${security_group_name_pattern}$/; - } else { - die "unknown rule type '$type'\n"; } while (length($line)) { if ($line =~ s/^-i (\S+)\s*//) { - die "parameter -i not allowed\n" if !$allow_iface; - $iface = $1; - PVE::JSONSchema::pve_verify_iface($iface); + $rule->{iface} = $1; next; } - last if $type eq 'group'; + last if $rule->{type} eq 'group'; if ($line =~ s/^-p (\S+)\s*//) { - $proto = $1; - pve_fw_verify_protocol_spec($proto); + $rule->{proto} = $1; next; } + if ($line =~ s/^-dport (\S+)\s*//) { - $dport = $1; - parse_port_name_number_or_range($dport); + $rule->{dport} = $1; next; } + if ($line =~ s/^-sport (\S+)\s*//) { - $sport = $1; - parse_port_name_number_or_range($sport); + $rule->{sport} = $1; next; } if ($line =~ s/^-source (\S+)\s*//) { - $source = $1; - parse_address_list($source); + $rule->{source} = $1; next; } if ($line =~ s/^-dest (\S+)\s*//) { - $dest = $1; - parse_address_list($dest); + $rule->{dest} = $1; next; } @@ -1887,19 +2035,15 @@ sub parse_fw_rule { die "unable to parse rule parameters: $line\n" if length($line); - return { - type => $type, - enable => $enable, - comment => $comment, - action => $action, - macro => $macro, - iface => $iface, - source => $source, - dest => $dest, - proto => $proto, - dport => $dport, - sport => $sport, - }; + $rule = verify_rule($rule, $cluster_conf, $fw_conf, $rule_env, 1); + if ($verbose && $rule->{errors}) { + warn "$prefix - errors in rule parameters: $orig_line\n"; + foreach my $p (keys %{$rule->{errors}}) { + warn " $p: $rule->{errors}->{$p}\n"; + } + } + + return $rule; } sub parse_vmfw_option { @@ -1972,6 +2116,21 @@ sub parse_clusterfw_option { return ($opt, $value); } +sub resolve_alias { + my ($clusterfw_conf, $fw_conf, $cidr) = @_; + + if ($cidr !~ m/^\d/) { + my $alias = lc($cidr); + my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; + $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf; + return $e->{cidr} if $e; + + die "no such alias '$cidr'\n"; + } + + return $cidr; +} + sub parse_alias { my ($line) = @_; @@ -1993,130 +2152,13 @@ sub parse_alias { return undef; } -sub parse_vm_fw_rules { - my ($filename, $fh) = @_; - - my $res = { - rules => [], - options => {}, - aliases => {}, - }; - - my $section; - - while (defined(my $line = <$fh>)) { - next if $line =~ m/^#/; - next if $line =~ m/^\s*$/; - - my $linenr = $fh->input_line_number(); - my $prefix = "$filename (line $linenr)"; - - if ($line =~ m/^\[(\S+)\]\s*$/i) { - $section = lc($1); - warn "$prefix: ignore unknown section '$section'\n" if !$res->{$section}; - next; - } - if (!$section) { - warn "$prefix: skip line - no section"; - next; - } - - next if !$res->{$section}; # skip undefined section - - if ($section eq 'options') { - eval { - my ($opt, $value) = parse_vmfw_option($line); - $res->{options}->{$opt} = $value; - }; - warn "$prefix: $@" if $@; - next; - } - - if ($section eq 'aliases') { - eval { - my $data = parse_alias($line); - $res->{aliases}->{lc($data->{name})} = $data; - }; - warn "$prefix: $@" if $@; - next; - } - - my $rule; - eval { $rule = parse_fw_rule($line, 1, 1); }; - if (my $err = $@) { - warn "$prefix: $err"; - next; - } - - push @{$res->{$section}}, $rule; - } - - return $res; -} - -sub parse_host_fw_rules { - my ($filename, $fh) = @_; - - my $res = { rules => [], options => {}}; - - my $section; - - while (defined(my $line = <$fh>)) { - next if $line =~ m/^#/; - next if $line =~ m/^\s*$/; - - my $linenr = $fh->input_line_number(); - my $prefix = "$filename (line $linenr)"; - - if ($line =~ m/^\[(\S+)\]\s*$/i) { - $section = lc($1); - warn "$prefix: ignore unknown section '$section'\n" if !$res->{$section}; - next; - } - if (!$section) { - warn "$prefix: skip line - no section"; - next; - } - - next if !$res->{$section}; # skip undefined section - - if ($section eq 'options') { - eval { - my ($opt, $value) = parse_hostfw_option($line); - $res->{options}->{$opt} = $value; - }; - warn "$prefix: $@" if $@; - next; - } - - my $rule; - eval { $rule = parse_fw_rule($line, 1, 1); }; - if (my $err = $@) { - warn "$prefix: $err"; - next; - } - - push @{$res->{$section}}, $rule; - } - - return $res; -} - -sub parse_cluster_fw_rules { - my ($filename, $fh) = @_; +sub generic_fw_config_parser { + my ($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env) = @_; my $section; my $group; - my $res = { - rules => [], - options => {}, - aliases => {}, - groups => {}, - group_comments => {}, - ipset => {} , - ipset_comments => {}, - }; + my $res = $empty_conf; while (defined(my $line = <$fh>)) { next if $line =~ m/^#/; @@ -2125,35 +2167,55 @@ sub parse_cluster_fw_rules { my $linenr = $fh->input_line_number(); my $prefix = "$filename (line $linenr)"; - if ($line =~ m/^\[options\]$/i) { + if ($empty_conf->{options} && ($line =~ m/^\[options\]$/i)) { $section = 'options'; next; } - if ($line =~ m/^\[aliases\]$/i) { + if ($empty_conf->{aliases} && ($line =~ m/^\[aliases\]$/i)) { $section = 'aliases'; next; } - if ($line =~ m/^\[group\s+(\S+)\]\s*(?:#\s*(.*?)\s*)?$/i) { + if ($empty_conf->{groups} && ($line =~ m/^\[group\s+(\S+)\]\s*(?:#\s*(.*?)\s*)?$/i)) { $section = 'groups'; $group = lc($1); my $comment = $2; + eval { + die "security group name too long\n" if length($group) > $max_group_name_length; + die "invalid security group name '$group'\n" if $group !~ m/^${security_group_name_pattern}$/; + }; + if (my $err = $@) { + ($section, $group, $comment) = undef; + warn "$prefix: $err"; + next; + } + $res->{$section}->{$group} = []; $res->{group_comments}->{$group} = decode('utf8', $comment) if $comment; next; } - if ($line =~ m/^\[rules\]$/i) { + if ($empty_conf->{rules} && ($line =~ m/^\[rules\]$/i)) { $section = 'rules'; next; } - if ($line =~ m/^\[ipset\s+(\S+)\]\s*(?:#\s*(.*?)\s*)?$/i) { + if ($empty_conf->{ipset} && ($line =~ m/^\[ipset\s+(\S+)\]\s*(?:#\s*(.*?)\s*)?$/i)) { $section = 'ipset'; $group = lc($1); my $comment = $2; + eval { + die "ipset name too long\n" if length($group) > $max_ipset_name_length; + die "invalid ipset name '$group'\n" if $group !~ m/^${ipset_name_pattern}$/; + }; + if (my $err = $@) { + ($section, $group, $comment) = undef; + warn "$prefix: $err"; + next; + } + $res->{$section}->{$group} = []; $res->{ipset_comments}->{$group} = decode('utf8', $comment) if $comment; @@ -2167,7 +2229,14 @@ sub parse_cluster_fw_rules { if ($section eq 'options') { eval { - my ($opt, $value) = parse_clusterfw_option($line); + my ($opt, $value); + if ($rule_env eq 'cluster') { + ($opt, $value) = parse_clusterfw_option($line); + } elsif ($rule_env eq 'host') { + ($opt, $value) = parse_hostfw_option($line); + } else { + ($opt, $value) = parse_vmfw_option($line); + } $res->{options}->{$opt} = $value; }; warn "$prefix: $@" if $@; @@ -2179,7 +2248,7 @@ sub parse_cluster_fw_rules { warn "$prefix: $@" if $@; } elsif ($section eq 'rules') { my $rule; - eval { $rule = parse_fw_rule($line, 1, 1); }; + eval { $rule = parse_fw_rule($prefix, $line, $cluster_conf, $res, $rule_env, $verbose); }; if (my $err = $@) { warn "$prefix: $err"; next; @@ -2187,7 +2256,7 @@ sub parse_cluster_fw_rules { push @{$res->{$section}}, $rule; } elsif ($section eq 'groups') { my $rule; - eval { $rule = parse_fw_rule($line, 0, 0); }; + eval { $rule = parse_fw_rule($prefix, $line, $cluster_conf, undef, 'group', $verbose); }; if (my $err = $@) { warn "$prefix: $err"; next; @@ -2201,14 +2270,17 @@ sub parse_cluster_fw_rules { my $nomatch = $1; my $cidr = $2; - if($cidr !~ m/^${ip_alias_pattern}$/) { - $cidr =~ s|/32$||; - - eval { pve_verify_ipv4_or_cidr($cidr); }; - if (my $err = $@) { - warn "$prefix: $cidr - $err"; - next; + eval { + if ($cidr =~ m/^${ip_alias_pattern}$/) { + resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists + } else { + $cidr =~ s|/32$||; + pve_verify_ipv4_or_cidr($cidr); } + }; + if (my $err = $@) { + warn "$prefix: $cidr - $err"; + next; } my $entry = { cidr => $cidr }; @@ -2216,12 +2288,56 @@ sub parse_cluster_fw_rules { $entry->{comment} = $comment if $comment; push @{$res->{$section}->{$group}}, $entry; + } else { + warn "$prefix: skip line - unknown section\n"; + next; } } return $res; } +sub parse_hostfw_config { + my ($filename, $fh, $cluster_conf, $verbose) = @_; + + my $empty_conf = { rules => [], options => {}}; + + return generic_fw_config_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, 'host'); +} + +sub parse_vmfw_config { + my ($filename, $fh, $cluster_conf, $rule_env, $verbose) = @_; + + my $empty_conf = { + rules => [], + options => {}, + aliases => {}, + ipset => {} , + ipset_comments => {}, + }; + + return generic_fw_config_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env); +} + +sub parse_clusterfw_config { + my ($filename, $fh, $verbose) = @_; + + my $section; + my $group; + + my $empty_conf = { + rules => [], + options => {}, + aliases => {}, + groups => {}, + group_comments => {}, + ipset => {} , + ipset_comments => {}, + }; + + return generic_fw_config_parser($filename, $fh, $verbose, $empty_conf, $empty_conf, 'cluster'); +} + sub run_locked { my ($code, @param) = @_; @@ -2271,7 +2387,7 @@ sub read_local_vm_config { }; sub load_vmfw_conf { - my ($vmid, $dir) = @_; + my ($cluster_conf, $rule_env, $vmid, $dir, $verbose) = @_; my $vmfw_conf = {}; @@ -2279,7 +2395,8 @@ sub load_vmfw_conf { my $filename = "$dir/$vmid.fw"; if (my $fh = IO::File->new($filename, O_RDONLY)) { - $vmfw_conf = parse_vm_fw_rules($filename, $fh); + $vmfw_conf = parse_vmfw_config($filename, $fh, $cluster_conf, $rule_env, $verbose); + $vmfw_conf->{vmid} = $vmid; } return $vmfw_conf; @@ -2354,23 +2471,35 @@ my $format_aliases = sub { return $raw; }; -my $format_ipset = sub { - my ($options) = @_; - +my $format_ipsets = sub { + my ($fw_conf) = @_; + my $raw = ''; - my $nethash = {}; - foreach my $entry (@$options) { - $nethash->{$entry->{cidr}} = $entry; - } + foreach my $ipset (sort keys %{$fw_conf->{ipset}}) { + if (my $comment = $fw_conf->{ipset_comments}->{$ipset}) { + my $utf8comment = encode('utf8', $comment); + $raw .= "[IPSET $ipset] # $utf8comment\n\n"; + } else { + $raw .= "[IPSET $ipset]\n\n"; + } + my $options = $fw_conf->{ipset}->{$ipset}; - foreach my $cidr (sort keys %$nethash) { - my $entry = $nethash->{$cidr}; - my $line = $entry->{nomatch} ? '!' : ''; - $line .= $entry->{cidr}; - $line .= " # " . encode('utf8', $entry->{comment}) - if $entry->{comment} && $entry->{comment} !~ m/^\s*$/; - $raw .= "$line\n"; + my $nethash = {}; + foreach my $entry (@$options) { + $nethash->{$entry->{cidr}} = $entry; + } + + foreach my $cidr (sort keys %$nethash) { + my $entry = $nethash->{$cidr}; + my $line = $entry->{nomatch} ? '!' : ''; + $line .= $entry->{cidr}; + $line .= " # " . encode('utf8', $entry->{comment}) + if $entry->{comment} && $entry->{comment} !~ m/^\s*$/; + $raw .= "$line\n"; + } + + $raw .= "\n"; } return $raw; @@ -2387,6 +2516,8 @@ sub save_vmfw_conf { my $aliases = $vmfw_conf->{aliases}; $raw .= &$format_aliases($aliases) if scalar(keys %$aliases); + $raw .= &$format_ipsets($vmfw_conf); + my $rules = $vmfw_conf->{rules} || []; if (scalar(@$rules)) { $raw .= "[RULES]\n\n"; @@ -2399,12 +2530,17 @@ sub save_vmfw_conf { } sub read_vm_firewall_configs { - my ($vmdata, $dir) = @_; + my ($cluster_conf, $vmdata, $dir, $verbose) = @_; my $vmfw_configs = {}; - foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) { - my $vmfw_conf = load_vmfw_conf($vmid, $dir); + foreach my $vmid (keys %{$vmdata->{qemu}}) { + my $vmfw_conf = load_vmfw_conf($cluster_conf, 'vm', $vmid, $dir, $verbose); + next if !$vmfw_conf->{options}; # skip if file does not exists + $vmfw_configs->{$vmid} = $vmfw_conf; + } + foreach my $vmid (keys %{$vmdata->{openvz}}) { + my $vmfw_conf = load_vmfw_conf($cluster_conf, 'ct', $vmid, $dir, $verbose); next if !$vmfw_conf->{options}; # skip if file does not exists $vmfw_configs->{$vmid} = $vmfw_conf; } @@ -2463,15 +2599,18 @@ sub generate_std_chains { } sub generate_ipset_chains { - my ($ipset_ruleset, $fw_conf) = @_; + my ($ipset_ruleset, $clusterfw_conf, $fw_conf) = @_; foreach my $ipset (keys %{$fw_conf->{ipset}}) { - generate_ipset($ipset_ruleset, "PVEFW-$ipset", $fw_conf->{ipset}->{$ipset}, $fw_conf->{aliases}); + my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $ipset); + generate_ipset($ipset_ruleset, $ipset_chain, $fw_conf->{ipset}->{$ipset}, $clusterfw_conf, $fw_conf); } } sub generate_ipset { - my ($ipset_ruleset, $name, $options, $aliases) = @_; + my ($ipset_ruleset, $name, $options, $clusterfw_conf, $fw_conf) = @_; + + die "duplicate ipset chain '$name'\n" if defined($ipset_ruleset->{$name}); my $hashsize = scalar(@$options); if ($hashsize <= 64) { @@ -2480,23 +2619,16 @@ sub generate_ipset { $hashsize = round_powerof2($hashsize); } - push @{$ipset_ruleset->{$name}}, "create $name hash:net family inet hashsize $hashsize maxelem $hashsize"; + $ipset_ruleset->{$name} = ["create $name hash:net family inet hashsize $hashsize maxelem $hashsize"]; # remove duplicates my $nethash = {}; foreach my $entry (@$options) { - my $cidr = $entry->{cidr}; - if ($cidr =~ m/^${ip_alias_pattern}$/) { - my $alias = lc($cidr); - if ($aliases->{$alias}) { - $entry->{cidr} = $aliases->{$alias}->{cidr}; - $nethash->{$entry->{cidr}} = $entry; - } else { - warn "no such alias '$cidr'\n" if !$aliases->{$alias}; - } - } else { - $nethash->{$entry->{cidr}} = $entry; - } + eval { + my $cidr = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr}); + $nethash->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} }; + }; + warn $@ if $@; } foreach my $cidr (sort keys %$nethash) { @@ -2524,13 +2656,13 @@ sub round_powerof2 { } sub load_clusterfw_conf { - my ($filename) = @_; + my ($filename, $verbose) = @_; $filename = $clusterfw_conf_filename if !defined($filename); my $cluster_conf = {}; if (my $fh = IO::File->new($filename, O_RDONLY)) { - $cluster_conf = parse_cluster_fw_rules($filename, $fh); + $cluster_conf = parse_clusterfw_config($filename, $fh, $verbose); } return $cluster_conf; @@ -2547,18 +2679,8 @@ sub save_clusterfw_conf { my $aliases = $cluster_conf->{aliases}; $raw .= &$format_aliases($aliases) if scalar(keys %$aliases); - foreach my $ipset (sort keys %{$cluster_conf->{ipset}}) { - if (my $comment = $cluster_conf->{ipset_comments}->{$ipset}) { - my $utf8comment = encode('utf8', $comment); - $raw .= "[IPSET $ipset] # $utf8comment\n\n"; - } else { - $raw .= "[IPSET $ipset]\n\n"; - } - my $options = $cluster_conf->{ipset}->{$ipset}; - $raw .= &$format_ipset($options); - $raw .= "\n"; - } - + $raw .= &$format_ipsets($cluster_conf); + my $rules = $cluster_conf->{rules}; if (scalar(@$rules)) { $raw .= "[RULES]\n\n"; @@ -2583,13 +2705,13 @@ sub save_clusterfw_conf { } sub load_hostfw_conf { - my ($filename) = @_; + my ($cluster_conf, $filename, $verbose) = @_; $filename = $hostfw_conf_filename if !defined($filename); my $hostfw_conf = {}; if (my $fh = IO::File->new($filename, O_RDONLY)) { - $hostfw_conf = parse_host_fw_rules($filename, $fh); + $hostfw_conf = parse_hostfw_config($filename, $fh, $cluster_conf, $verbose); } return $hostfw_conf; } @@ -2613,31 +2735,31 @@ sub save_hostfw_conf { } sub compile { - my ($cluster_conf, $hostfw_conf, $vmdata) = @_; + my ($cluster_conf, $hostfw_conf, $vmdata, $verbose) = @_; my $vmfw_configs; if ($vmdata) { # test mode my $testdir = $vmdata->{testdir} || die "no test directory specified"; my $filename = "$testdir/cluster.fw"; - $cluster_conf = load_clusterfw_conf($filename); + $cluster_conf = load_clusterfw_conf($filename, $verbose); $filename = "$testdir/host.fw"; - $hostfw_conf = load_hostfw_conf($filename); + $hostfw_conf = load_hostfw_conf($cluster_conf, $filename, $verbose); - $vmfw_configs = read_vm_firewall_configs($vmdata, $testdir); + $vmfw_configs = read_vm_firewall_configs($cluster_conf, $vmdata, $testdir, $verbose); } else { # normal operation - $cluster_conf = load_clusterfw_conf() if !$cluster_conf; + $cluster_conf = load_clusterfw_conf(undef, $verbose) if !$cluster_conf; - $hostfw_conf = load_hostfw_conf() if !$hostfw_conf; + $hostfw_conf = load_hostfw_conf($cluster_conf, undef, $verbose) if !$hostfw_conf; $vmdata = read_local_vm_config(); - $vmfw_configs = read_vm_firewall_configs($vmdata); + $vmfw_configs = read_vm_firewall_configs($cluster_conf, $vmdata, undef, $verbose); } - $cluster_conf->{ipset}->{venet0} = []; - + my $venet0_ipset_chain = compute_ipset_chain_name(0, 'venet0'); + my $localnet; if ($cluster_conf->{aliases}->{local_network}) { $localnet = $cluster_conf->{aliases}->{local_network}->{cidr}; @@ -2647,7 +2769,7 @@ sub compile { } push @{$cluster_conf->{ipset}->{management}}, { cidr => $localnet }; - + my $ruleset = {}; ruleset_create_chain($ruleset, "PVEFW-INPUT"); @@ -2662,9 +2784,10 @@ sub compile { ruleset_chain_add_conn_filters($ruleset, "PVEFW-FORWARD", "ACCEPT"); + ruleset_create_chain($ruleset, "PVEFW-VENET-OUT"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -m set --match-set PVEFW-venet0 src -j PVEFW-VENET-OUT"); - ruleset_addrule($ruleset, "PVEFW-INPUT", "-i venet0 -m set --match-set PVEFW-venet0 src -j PVEFW-VENET-OUT"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -m set --match-set ${venet0_ipset_chain} src -j PVEFW-VENET-OUT"); + ruleset_addrule($ruleset, "PVEFW-INPUT", "-i venet0 -m set --match-set ${venet0_ipset_chain} src -j PVEFW-VENET-OUT"); ruleset_create_chain($ruleset, "PVEFW-FWBR-IN"); ruleset_chain_add_input_filters($ruleset, "PVEFW-FWBR-IN", $hostfw_options, $cluster_conf, $loglevel); @@ -2677,83 +2800,97 @@ sub compile { ruleset_create_chain($ruleset, "PVEFW-VENET-IN"); ruleset_chain_add_input_filters($ruleset, "PVEFW-VENET-IN", $hostfw_options, $cluster_conf, $loglevel); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o venet0 -m set --match-set PVEFW-venet0 dst -j PVEFW-VENET-IN"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o venet0 -m set --match-set ${venet0_ipset_chain} dst -j PVEFW-VENET-IN"); generate_std_chains($ruleset, $hostfw_options); my $hostfw_enable = !(defined($hostfw_options->{enable}) && ($hostfw_options->{enable} == 0)); - enable_host_firewall($ruleset, $hostfw_conf, $cluster_conf) if $hostfw_enable; + my $ipset_ruleset = {}; + + if ($hostfw_enable) { + eval { enable_host_firewall($ruleset, $hostfw_conf, $cluster_conf); }; + warn $@ if $@; # just to be sure - should not happen + } - ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-o venet0 -m set --match-set PVEFW-venet0 dst -j PVEFW-VENET-IN"); + ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-o venet0 -m set --match-set ${venet0_ipset_chain} dst -j PVEFW-VENET-IN"); # generate firewall rules for QEMU VMs foreach my $vmid (keys %{$vmdata->{qemu}}) { - my $conf = $vmdata->{qemu}->{$vmid}; - my $vmfw_conf = $vmfw_configs->{$vmid}; - next if !$vmfw_conf; - next if !$vmfw_conf->{options}->{enable}; - - foreach my $netid (keys %$conf) { - next if $netid !~ m/^net(\d+)$/; - my $net = PVE::QemuServer::parse_net($conf->{$netid}); - next if !$net->{firewall}; - my $iface = "tap${vmid}i$1"; - - my $macaddr = $net->{macaddr}; - generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'IN'); - generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'OUT'); - } + eval { + my $conf = $vmdata->{qemu}->{$vmid}; + my $vmfw_conf = $vmfw_configs->{$vmid}; + return if !$vmfw_conf; + return if !$vmfw_conf->{options}->{enable}; + + generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf); + + foreach my $netid (keys %$conf) { + next if $netid !~ m/^net(\d+)$/; + my $net = PVE::QemuServer::parse_net($conf->{$netid}); + next if !$net->{firewall}; + my $iface = "tap${vmid}i$1"; + + my $macaddr = $net->{macaddr}; + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, 'IN'); + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, 'OUT'); + } + }; + warn $@ if $@; # just to be sure - should not happen } # generate firewall rules for OpenVZ containers foreach my $vmid (keys %{$vmdata->{openvz}}) { - my $conf = $vmdata->{openvz}->{$vmid}; + eval { + my $conf = $vmdata->{openvz}->{$vmid}; - my $vmfw_conf = $vmfw_configs->{$vmid}; - next if !$vmfw_conf; - next if !$vmfw_conf->{options}->{enable}; + my $vmfw_conf = $vmfw_configs->{$vmid}; + return if !$vmfw_conf; + return if !$vmfw_conf->{options}->{enable}; - if ($conf->{ip_address} && $conf->{ip_address}->{value}) { - my $ip = $conf->{ip_address}->{value}; - $ip =~ s/\s+/,/g; - parse_address_list($ip); # make sure we have a valid $ip list + generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf); - my @ips = split(',', $ip); + if ($conf->{ip_address} && $conf->{ip_address}->{value}) { + my $ip = $conf->{ip_address}->{value}; + $ip =~ s/\s+/,/g; + parse_address_list($ip); # make sure we have a valid $ip list - foreach my $singleip (@ips) { - my $venet0ipset = {}; - $venet0ipset->{cidr} = $singleip; - push @{$cluster_conf->{ipset}->{venet0}}, $venet0ipset; - } + my @ips = split(',', $ip); - generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'IN'); - generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'OUT'); - } + foreach my $singleip (@ips) { + my $venet0ipset = {}; + $venet0ipset->{cidr} = $singleip; + push @{$cluster_conf->{ipset}->{venet0}}, $venet0ipset; + } - if ($conf->{netif} && $conf->{netif}->{value}) { - my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value}); - foreach my $netid (keys %$netif) { - my $d = $netif->{$netid}; + generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'IN'); + generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'OUT'); + } - my $macaddr = $d->{mac}; - my $iface = $d->{host_ifname}; - generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'IN'); - generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'OUT'); + if ($conf->{netif} && $conf->{netif}->{value}) { + my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value}); + foreach my $netid (keys %$netif) { + my $d = $netif->{$netid}; + + my $macaddr = $d->{mac}; + my $iface = $d->{host_ifname}; + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, 'IN'); + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, 'OUT'); + } } - } + }; + warn $@ if $@; # just to be sure - should not happen } if(ruleset_chain_exist($ruleset, "PVEFW-IPS")){ ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j PVEFW-IPS"); } - my $ipset_ruleset = {}; - generate_ipset_chains($ipset_ruleset, $cluster_conf); + generate_ipset_chains($ipset_ruleset, undef, $cluster_conf); return ($ruleset, $ipset_ruleset); } @@ -3035,8 +3172,6 @@ sub init { } sub update { - my ($verbose) = @_; - my $code = sub { my $cluster_conf = load_clusterfw_conf(); @@ -3048,7 +3183,6 @@ sub update { if (!$enable) { PVE::Firewall::remove_pvefw_chains(); - print "Firewall disabled\n" if $verbose; return; } @@ -3056,7 +3190,7 @@ sub update { my ($ruleset, $ipset_ruleset) = compile($cluster_conf, $hostfw_conf); - apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $verbose); + apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset); }; run_locked($code);