X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=ad592676d0a9b30f4bcf1b9e4a4e255f105b122c;hp=5a6284fa3d2800f84d067c0bf578d8c5d89ccc8a;hb=7f7930f8cf5558659e0664737f9b03811f84f3f1;hpb=9268573a4675ab12576c956ad055538df616c994 diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 5a6284f..ad59267 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -5,12 +5,15 @@ use strict; use POSIX; use Data::Dumper; use Digest::SHA; +use Socket qw(AF_INET6 inet_ntop inet_pton); use PVE::INotify; use PVE::Exception qw(raise raise_param_exc); use PVE::JSONSchema qw(register_standard_option get_standard_option); use PVE::Cluster; use PVE::ProcFSTools; -use PVE::Tools qw($IPV4RE); +use PVE::Tools qw($IPV4RE $IPV6RE); +use PVE::Network; +use PVE::SafeSyslog; use File::Basename; use File::Path; use IO::File; @@ -22,33 +25,47 @@ my $hostfw_conf_filename = "/etc/pve/local/host.fw"; my $pvefw_conf_dir = "/etc/pve/firewall"; my $clusterfw_conf_filename = "$pvefw_conf_dir/cluster.fw"; -# dynamically include PVE::QemuServer and PVE::OpenVZ +# dynamically include PVE::QemuServer and PVE::LXC # to avoid dependency problems my $have_qemu_server; eval { require PVE::QemuServer; + require PVE::QemuConfig; $have_qemu_server = 1; }; -my $have_pve_manager; +my $have_lxc; eval { - require PVE::OpenVZ; - $have_pve_manager = 1; + require PVE::LXC; + $have_lxc = 1; }; + +my $pve_fw_status_dir = "/var/lib/pve-firewall"; + +mkdir $pve_fw_status_dir; # make sure this exists + my $security_group_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; my $ipset_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; -my $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; +our $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; my $max_alias_name_length = 64; my $max_ipset_name_length = 64; -my $max_group_name_length = 20; +my $max_group_name_length = 18; + +my $PROTOCOLS_WITH_PORTS = { + udp => 1, 17 => 1, + udplite => 1, 136 => 1, + tcp => 1, 6 => 1, + dccp => 1, 33 => 1, + sctp => 1, 132 => 1, +}; -PVE::JSONSchema::register_format('IPv4orCIDR', \&pve_verify_ipv4_or_cidr); -sub pve_verify_ipv4_or_cidr { +PVE::JSONSchema::register_format('IPorCIDR', \&pve_verify_ip_or_cidr); +sub pve_verify_ip_or_cidr { my ($cidr, $noerr) = @_; - if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) { + if ($cidr =~ m!^(?:$IPV6RE|$IPV4RE)(/(\d+))?$!) { return $cidr if Net::IP->new($cidr); return undef if $noerr; die Net::IP::Error() . "\n"; @@ -57,19 +74,13 @@ sub pve_verify_ipv4_or_cidr { die "value does not look like a valid IP address or CIDR network\n"; } -PVE::JSONSchema::register_format('IPv4orCIDRorAlias', \&pve_verify_ipv4_or_cidr_or_alias); -sub pve_verify_ipv4_or_cidr_or_alias { +PVE::JSONSchema::register_format('IPorCIDRorAlias', \&pve_verify_ip_or_cidr_or_alias); +sub pve_verify_ip_or_cidr_or_alias { my ($cidr, $noerr) = @_; return if $cidr =~ m/^(?:$ip_alias_pattern)$/; - if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) { - return $cidr if Net::IP->new($cidr); - return undef if $noerr; - die Net::IP::Error() . "\n"; - } - return undef if $noerr; - die "value does not look like a valid IP address or CIDR network\n"; + return pve_verify_ip_or_cidr($cidr, $noerr); } PVE::JSONSchema::register_standard_option('ipset-name', { @@ -114,8 +125,6 @@ eval { }; -use Data::Dumper; - my $nodename = PVE::INotify::nodename(); my $pve_fw_lock_filename = "/var/lock/pvefw.lck"; @@ -133,6 +142,28 @@ my $log_level_hash = { emerg => 0, }; +# we need to overwrite some macros for ipv6 +my $pve_ipv6fw_macros = { + 'Ping' => [ + { action => 'PARAM', proto => 'icmpv6', dport => 'echo-request' }, + ], + 'NeighborDiscovery' => [ + "IPv6 neighbor solicitation, neighbor and router advertisement", + { action => 'PARAM', proto => 'icmpv6', dport => 'router-solicitation' }, + { action => 'PARAM', proto => 'icmpv6', dport => 'router-advertisement' }, + { action => 'PARAM', proto => 'icmpv6', dport => 'neighbor-solicitation' }, + { action => 'PARAM', proto => 'icmpv6', dport => 'neighbor-advertisement' }, + ], + 'DHCPv6' => [ + "DHCPv6 traffic", + { action => 'PARAM', proto => 'udp', dport => '546:547', sport => '546:547' }, + ], + 'Trcrt' => [ + { action => 'PARAM', proto => 'udp', dport => '33434:33524' }, + { action => 'PARAM', proto => 'icmpv6', dport => 'echo-request' }, + ], + }; + # imported/converted from: /usr/share/shorewall/macro.* my $pve_fw_macros = { 'Amanda' => [ @@ -158,6 +189,11 @@ my $pve_fw_macros = { { action => 'PARAM', proto => 'tcp', dport => '6881:6999' }, { action => 'PARAM', proto => 'udp', dport => '6881' }, ], + 'Ceph' => [ + "Ceph Storage Cluster traffic (Ceph Monitors, OSD & MDS Deamons)", + { action => 'PARAM', proto => 'tcp', dport => '6789' }, + { action => 'PARAM', proto => 'tcp', dport => '6800:7300' }, + ], 'CVS' => [ "Concurrent Versions System pserver traffic", { action => 'PARAM', proto => 'tcp', dport => '2401' }, @@ -295,6 +331,10 @@ my $pve_fw_macros = { { action => 'PARAM', proto => 'tcp', dport => '465' }, { action => 'PARAM', proto => 'tcp', dport => '587' }, ], + 'MDNS' => [ + "Multicast DNS", + { action => 'PARAM', proto => 'udp', dport => '5353' }, + ], 'Munin' => [ "Munin networked resource monitoring traffic", { action => 'PARAM', proto => 'tcp', dport => '4949' }, @@ -487,11 +527,16 @@ my $pve_fw_macros = { my $pve_fw_parsed_macros; my $pve_fw_macro_descr; +my $pve_fw_macro_ipversion = {}; my $pve_fw_preferred_macro_names = {}; -my $pve_std_chains = { +my $FWACCEPTMARK_ON = "0x80000000/0x80000000"; +my $FWACCEPTMARK_OFF = "0x00000000/0x80000000"; + +my $pve_std_chains = {}; +$pve_std_chains->{4} = { 'PVEFW-SET-ACCEPT-MARK' => [ - "-j MARK --set-mark 1", + "-j MARK --set-mark $FWACCEPTMARK_ON", ], 'PVEFW-DropBroadcast' => [ # same as shorewall 'Broadcast' @@ -570,12 +615,98 @@ my $pve_std_chains = { 'PVEFW-smurfs' => [ # same as shorewall smurfs action # Filter packets for smurfs (packets with a broadcast address as the source). - "-s 0.0.0.0/32 -j RETURN", + "-s 0.0.0.0/32 -j RETURN", # allow DHCP "-m addrtype --src-type BROADCAST -g PVEFW-smurflog", "-s 224.0.0.0/4 -g PVEFW-smurflog", ], }; +$pve_std_chains->{6} = { + 'PVEFW-SET-ACCEPT-MARK' => [ + "-j MARK --set-mark $FWACCEPTMARK_ON", + ], + 'PVEFW-DropBroadcast' => [ + # same as shorewall 'Broadcast' + # simply DROP BROADCAST/MULTICAST/ANYCAST + # we can use this to reduce logging + #{ action => 'DROP', dsttype => 'BROADCAST' }, #no broadcast in ipv6 + # ipv6 addrtype does not work with kernel 2.6.32 + #{ action => 'DROP', dsttype => 'MULTICAST' }, + #{ action => 'DROP', dsttype => 'ANYCAST' }, + { action => 'DROP', dest => 'ff00::/8' }, + #{ action => 'DROP', dest => '224.0.0.0/4' }, + ], + 'PVEFW-reject' => [ + # same as shorewall 'reject' + #{ action => 'DROP', dsttype => 'BROADCAST' }, + #{ action => 'DROP', source => '224.0.0.0/4' }, + { action => 'DROP', proto => 'icmpv6' }, + "-p tcp -j REJECT --reject-with tcp-reset", + #"-p udp -j REJECT --reject-with icmp-port-unreachable", + #"-p icmp -j REJECT --reject-with icmp-host-unreachable", + #"-j REJECT --reject-with icmp-host-prohibited", + ], + 'PVEFW-Drop' => [ + # same as shorewall 'Drop', which is equal to DROP, + # but REJECT/DROP some packages to reduce logging, + # and ACCEPT critical ICMP types + { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, # REJECT 'auth' + # we are not interested in BROADCAST/MULTICAST/ANYCAST + { action => 'PVEFW-DropBroadcast' }, + # ACCEPT critical ICMP types + { action => 'ACCEPT', proto => 'icmpv6', dport => 'destination-unreachable' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'time-exceeded' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'packet-too-big' }, + + # Drop packets with INVALID state + "-m conntrack --ctstate INVALID -j DROP", + # Drop Microsoft SMB noise + { action => 'DROP', proto => 'udp', dport => '135,445', nbdport => 2 }, + { action => 'DROP', proto => 'udp', dport => '137:139'}, + { action => 'DROP', proto => 'udp', dport => '1024:65535', sport => 137 }, + { action => 'DROP', proto => 'tcp', dport => '135,139,445', nbdport => 3 }, + { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP + # Drop new/NotSyn traffic so that it doesn't get logged + "-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP", + # Drop DNS replies + { action => 'DROP', proto => 'udp', sport => 53 }, + ], + 'PVEFW-Reject' => [ + # same as shorewall 'Reject', which is equal to Reject, + # but REJECT/DROP some packages to reduce logging, + # and ACCEPT critical ICMP types + { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, # REJECT 'auth' + # we are not interested in BROADCAST/MULTICAST/ANYCAST + { action => 'PVEFW-DropBroadcast' }, + # ACCEPT critical ICMP types + { action => 'ACCEPT', proto => 'icmpv6', dport => 'destination-unreachable' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'time-exceeded' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'packet-too-big' }, + + # Drop packets with INVALID state + "-m conntrack --ctstate INVALID -j DROP", + # Drop Microsoft SMB noise + { action => 'PVEFW-reject', proto => 'udp', dport => '135,445', nbdport => 2 }, + { action => 'PVEFW-reject', proto => 'udp', dport => '137:139'}, + { action => 'PVEFW-reject', proto => 'udp', dport => '1024:65535', sport => 137 }, + { action => 'PVEFW-reject', proto => 'tcp', dport => '135,139,445', nbdport => 3 }, + { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP + # Drop new/NotSyn traffic so that it doesn't get logged + "-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP", + # Drop DNS replies + { action => 'DROP', proto => 'udp', sport => 53 }, + ], + 'PVEFW-tcpflags' => [ + # same as shorewall tcpflags action. + # Packets arriving on this interface are checked for som illegal combinations of TCP flags + "-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g PVEFW-logflags", + "-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g PVEFW-logflags", + "-p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g PVEFW-logflags", + "-p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g PVEFW-logflags", + "-p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g PVEFW-logflags", + ], +}; + # iptables -p icmp -h my $icmp_type_names = { any => 1, @@ -617,18 +748,64 @@ my $icmp_type_names = { 'address-mask-reply' => 1, }; +# ip6tables -p icmpv6 -h + +my $icmpv6_type_names = { + 'any' => 1, + 'destination-unreachable' => 1, + 'no-route' => 1, + 'communication-prohibited' => 1, + 'address-unreachable' => 1, + 'port-unreachable' => 1, + 'packet-too-big' => 1, + 'time-exceeded' => 1, + 'ttl-zero-during-transit' => 1, + 'ttl-zero-during-reassembly' => 1, + 'parameter-problem' => 1, + 'bad-header' => 1, + 'unknown-header-type' => 1, + 'unknown-option' => 1, + 'echo-request' => 1, + 'echo-reply' => 1, + 'router-solicitation' => 1, + 'router-advertisement' => 1, + 'neighbor-solicitation' => 1, + 'neighbour-solicitation' => 1, + 'neighbor-advertisement' => 1, + 'neighbour-advertisement' => 1, + 'redirect' => 1, +}; + sub init_firewall_macros { $pve_fw_parsed_macros = {}; - foreach my $k (keys %$pve_fw_macros) { + my $parse = sub { + my ($k, $macro) = @_; my $lc_name = lc($k); - my $macro = $pve_fw_macros->{$k}; - if (!ref($macro->[0])) { - $pve_fw_macro_descr->{$k} = shift @$macro; + $pve_fw_macro_ipversion->{$k} = 0; + while (!ref($macro->[0])) { + my $desc = shift @$macro; + if ($desc eq 'ipv4only') { + $pve_fw_macro_ipversion->{$k} = 4; + } elsif ($desc eq 'ipv6only') { + $pve_fw_macro_ipversion->{$k} = 6; + } else { + $pve_fw_macro_descr->{$k} = $desc; + } } $pve_fw_preferred_macro_names->{$lc_name} = $k; $pve_fw_parsed_macros->{$k} = $macro; + }; + + foreach my $k (keys %$pve_fw_macros) { + &$parse($k, $pve_fw_macros->{$k}); + } + + foreach my $k (keys %$pve_ipv6fw_macros) { + next if $pve_fw_parsed_macros->{$k}; + &$parse($k, $pve_ipv6fw_macros->{$k}); + $pve_fw_macro_ipversion->{$k} = 6; } } @@ -703,29 +880,15 @@ sub get_etc_protocols { close($fh); + # add special case for ICMP v6 + $protocols->{byid}->{icmpv6}->{name} = "icmpv6"; + $protocols->{byname}->{icmpv6} = $protocols->{byid}->{icmpv6}; + $etc_protocols = $protocols; return $etc_protocols; } -my $ipv4_mask_hash_localnet = { - '255.255.0.0' => 16, - '255.255.128.0' => 17, - '255.255.192.0' => 18, - '255.255.224.0' => 19, - '255.255.240.0' => 20, - '255.255.248.0' => 21, - '255.255.252.0' => 22, - '255.255.254.0' => 23, - '255.255.255.0' => 24, - '255.255.255.128' => 25, - '255.255.255.192' => 26, - '255.255.255.224' => 27, - '255.255.255.240' => 28, - '255.255.255.248' => 29, - '255.255.255.252' => 30, -}; - my $__local_network; sub local_network { @@ -742,14 +905,24 @@ sub local_network { my $testip = Net::IP->new($ip); - my $routes = PVE::ProcFSTools::read_proc_net_route(); + my $isv6 = $testip->version == 6; + my $routes = $isv6 ? PVE::ProcFSTools::read_proc_net_ipv6_route() + : PVE::ProcFSTools::read_proc_net_route(); foreach my $entry (@$routes) { - my $mask = $ipv4_mask_hash_localnet->{$entry->{mask}}; - next if !defined($mask); - return if $mask eq '0.0.0.0'; + my $mask; + if ($isv6) { + $mask = $entry->{prefix}; + next if !$mask; # skip the default route... + } else { + $mask = $PVE::Network::ipv4_mask_hash_localnet->{$entry->{mask}}; + next if !defined($mask); + } my $cidr = "$entry->{dest}/$mask"; my $testnet = Net::IP->new($cidr); - if ($testnet->overlaps($testip)) { + my $overlap = $testnet->overlaps($testip); + if ($overlap == $Net::IP::IP_B_IN_A_OVERLAP || + $overlap == $Net::IP::IP_IDENTICAL) + { $__local_network = $cidr; return; } @@ -760,20 +933,21 @@ sub local_network { return $__local_network; } -# ipset names are limited to 31 characters, and we use '_swap' -# suffix for atomic update, for example PVEFW-${VMID}-${ipset_name}_swap +# ipset names are limited to 31 characters, +# and we use '-v4' or '-v6' to indicate IP versions, +# and we use '_swap' suffix for atomic update, +# for example PVEFW-${VMID}-${ipset_name}_swap -my $max_iptables_ipset_name_length = 31 - length("_swap"); +my $max_iptables_ipset_name_length = 31 - length("PVEFW-") - length("_swap"); sub compute_ipset_chain_name { - my ($vmid, $ipset_name) = @_; + my ($vmid, $ipset_name, $ipversion) = @_; $vmid = 0 if !defined($vmid); - my $id = "$vmid-${ipset_name}"; + my $id = "$vmid-${ipset_name}-v$ipversion"; - - if ((length($id) + 6) > $max_iptables_ipset_name_length) { + if (length($id) > $max_iptables_ipset_name_length) { $id = PVE::Tools::fnv31a_hex($id); } @@ -801,26 +975,42 @@ sub parse_address_list { my $count = 0; my $iprange = 0; - foreach my $elem (split(/,/, $str)) { + my $ipversion; + + my @elements = split(/,/, $str); + die "extraneous commas in list\n" if $str ne join(',', @elements); + foreach my $elem (@elements) { $count++; - if (!Net::IP->new($elem)) { + my $ip = Net::IP->new($elem); + if (!$ip) { my $err = Net::IP::Error(); die "invalid IP address: $err\n"; } $iprange = 1 if $elem =~ m/-/; + + my $new_ipversion = Net::IP::ip_is_ipv6($ip->ip()) ? 6 : 4; + + die "detected mixed ipv4/ipv6 addresses in address list '$str'\n" + if $ipversion && ($new_ipversion != $ipversion); + + $ipversion = $new_ipversion; } - die "you can use a range in a list\n" if $iprange && $count > 1; + die "you can't use a range in a list\n" if $iprange && $count > 1; + + return $ipversion; } sub parse_port_name_number_or_range { - my ($str) = @_; + my ($str, $dport) = @_; my $services = PVE::Firewall::get_etc_services(); my $count = 0; my $icmp_port = 0; - foreach my $item (split(/,/, $str)) { + my @elements = split(/,/, $str); + die "extraneous commas in list\n" if $str ne join(',', @elements); + foreach my $item (@elements) { $count++; if ($item =~ m/^(\d+):(\d+)$/) { my ($port1, $port2) = ($1, $2); @@ -830,7 +1020,9 @@ sub parse_port_name_number_or_range { my $port = $1; die "invalid port '$port'\n" if $port > 65535; } else { - if ($icmp_type_names->{$item}) { + if ($dport && $icmp_type_names->{$item}) { + $icmp_port = 1; + } elsif ($dport && $icmpv6_type_names->{$item}) { $icmp_port = 1; } else { die "invalid port '$item'\n" if !$services->{byname}->{$item}; @@ -843,17 +1035,26 @@ sub parse_port_name_number_or_range { return $count; } -PVE::JSONSchema::register_format('pve-fw-port-spec', \&pve_fw_verify_port_spec); -sub pve_fw_verify_port_spec { +PVE::JSONSchema::register_format('pve-fw-sport-spec', \&pve_fw_verify_sport_spec); +sub pve_fw_verify_sport_spec { + my ($portstr) = @_; + + parse_port_name_number_or_range($portstr, 0); + + return $portstr; +} + +PVE::JSONSchema::register_format('pve-fw-dport-spec', \&pve_fw_verify_dport_spec); +sub pve_fw_verify_dport_spec { my ($portstr) = @_; - parse_port_name_number_or_range($portstr); + parse_port_name_number_or_range($portstr, 1); return $portstr; } -PVE::JSONSchema::register_format('pve-fw-v4addr-spec', \&pve_fw_verify_v4addr_spec); -sub pve_fw_verify_v4addr_spec { +PVE::JSONSchema::register_format('pve-fw-addr-spec', \&pve_fw_verify_addr_spec); +sub pve_fw_verify_addr_spec { my ($list) = @_; parse_address_list($list); @@ -910,7 +1111,10 @@ sub copy_list_with_digest { next if !defined($v); $data->{$k} = $v; # Note: digest ignores refs ($rule->{errors}) - $sha->add($k, ':', $v, "\n") if !ref($v); ; + # since Digest::SHA expects a series of bytes, + # we have to encode the value here to prevent errors when + # using utf8 characters (eg. in comments) + $sha->add($k, ':', encode_utf8($v), "\n") if !ref($v); ; } push @$res, $data; } @@ -924,6 +1128,130 @@ sub copy_list_with_digest { return wantarray ? ($res, $digest) : $res; } +our $cluster_option_properties = { + enable => { + description => "Enable or disable the firewall cluster wide.", + type => 'integer', + minimum => 0, + optional => 1, + }, + policy_in => { + description => "Input policy.", + type => 'string', + optional => 1, + enum => ['ACCEPT', 'REJECT', 'DROP'], + }, + policy_out => { + description => "Output policy.", + type => 'string', + optional => 1, + enum => ['ACCEPT', 'REJECT', 'DROP'], + }, +}; + +our $host_option_properties = { + enable => { + description => "Enable host firewall rules.", + type => 'boolean', + optional => 1, + }, + log_level_in => get_standard_option('pve-fw-loglevel', { + description => "Log level for incoming traffic." }), + log_level_out => get_standard_option('pve-fw-loglevel', { + description => "Log level for outgoing traffic." }), + tcp_flags_log_level => get_standard_option('pve-fw-loglevel', { + description => "Log level for illegal tcp flags filter." }), + smurf_log_level => get_standard_option('pve-fw-loglevel', { + description => "Log level for SMURFS filter." }), + nosmurfs => { + description => "Enable SMURFS filter.", + type => 'boolean', + optional => 1, + }, + tcpflags => { + description => "Filter illegal combinations of TCP flags.", + type => 'boolean', + optional => 1, + }, + nf_conntrack_max => { + description => "Maximum number of tracked connections.", + type => 'integer', + optional => 1, + minimum => 32768, + }, + nf_conntrack_tcp_timeout_established => { + description => "Conntrack established timeout.", + type => 'integer', + optional => 1, + minimum => 7875, + }, + ndp => { + description => "Enable NDP.", + type => 'boolean', + optional => 1, + }, +}; + +our $vm_option_properties = { + enable => { + description => "Enable/disable firewall rules.", + type => 'boolean', + optional => 1, + }, + macfilter => { + description => "Enable/disable MAC address filter.", + type => 'boolean', + optional => 1, + }, + dhcp => { + description => "Enable DHCP.", + type => 'boolean', + optional => 1, + }, + ndp => { + description => "Enable NDP.", + type => 'boolean', + optional => 1, + }, + radv => { + description => "Allow sending Router Advertisement.", + type => 'boolean', + optional => 1, + }, + ipfilter => { + description => "Enable default IP filters. " . + "This is equivalent to adding an empty ipfilter-net ipset " . + "for every interface. Such ipsets implicitly contain sane default " . + "restrictions such as restricting IPv6 link local addresses to " . + "the one derived from the interface's MAC address. For containers " . + "the configured IP addresses will be implicitly added.", + type => 'boolean', + optional => 1, + }, + policy_in => { + description => "Input policy.", + type => 'string', + optional => 1, + enum => ['ACCEPT', 'REJECT', 'DROP'], + }, + policy_out => { + description => "Output policy.", + type => 'string', + optional => 1, + enum => ['ACCEPT', 'REJECT', 'DROP'], + }, + log_level_in => get_standard_option('pve-fw-loglevel', { + description => "Log level for incoming traffic." }), + log_level_out => get_standard_option('pve-fw-loglevel', { + description => "Log level for outgoing traffic." }), + +}; + + +my $addr_list_descr = "This can refer to a single IP address, an IP set ('+ipsetname') or an IP alias definition. You can also specify an address range like '20.34.101.207-201.3.9.99', or a list of IP addresses and networks (entries are separated by comma). Please do not mix IPv4 and IPv6 addresses inside such lists."; + +my $port_descr = "You can use service names or simple numbers (0-65535), as defined in '/etc/services'. Port ranges can be specified with '\\d+:\\d+', for example '80:85', and you can use comma separated list to match several ports or ranges."; + my $rule_properties = { pos => { description => "Update rule at position .", @@ -933,6 +1261,7 @@ my $rule_properties = { }, digest => get_standard_option('pve-config-digest'), type => { + description => "Rule type.", type => 'string', optional => 1, enum => ['in', 'out', 'group'], @@ -946,36 +1275,48 @@ my $rule_properties = { minLength => 2, }, macro => { + description => "Use predefined standard macro.", type => 'string', optional => 1, maxLength => 128, }, - iface => get_standard_option('pve-iface', { optional => 1 }), + iface => get_standard_option('pve-iface', { + description => "Network interface name. You have to use network configuration key names for VMs and containers ('net\\d+'). Host related rules can use arbitrary strings.", + optional => 1 + }), source => { - type => 'string', format => 'pve-fw-v4addr-spec', + description => "Restrict packet source address. $addr_list_descr", + type => 'string', format => 'pve-fw-addr-spec', optional => 1, }, dest => { - type => 'string', format => 'pve-fw-v4addr-spec', + description => "Restrict packet destination address. $addr_list_descr", + type => 'string', format => 'pve-fw-addr-spec', optional => 1, }, proto => { + description => "IP protocol. You can use protocol names ('tcp'/'udp') or simple numbers, as defined in '/etc/protocols'.", type => 'string', format => 'pve-fw-protocol-spec', optional => 1, }, enable => { - type => 'boolean', + description => "Flag to enable/disable a rule.", + type => 'integer', + minimum => 0, optional => 1, }, sport => { - type => 'string', format => 'pve-fw-port-spec', + description => "Restrict TCP/UDP source port. $port_descr", + type => 'string', format => 'pve-fw-sport-spec', optional => 1, }, dport => { - type => 'string', format => 'pve-fw-port-spec', + description => "Restrict TCP/UDP destination port. $port_descr", + type => 'string', format => 'pve-fw-dport-spec', optional => 1, }, comment => { + description => "Descriptive comment.", type => 'string', optional => 1, }, @@ -1008,11 +1349,20 @@ sub delete_rule_properties { } my $apply_macro = sub { - my ($macro_name, $param, $verify) = @_; + my ($macro_name, $param, $verify, $ipversion) = @_; my $macro_rules = $pve_fw_parsed_macros->{$macro_name}; die "unknown macro '$macro_name'\n" if !$macro_rules; # should not happen + if ($ipversion && ($ipversion == 6) && $pve_ipv6fw_macros->{$macro_name}) { + $macro_rules = $pve_ipv6fw_macros->{$macro_name}; + } + + # skip macros which are specific to another ipversion + if ($ipversion && (my $required = $pve_fw_macro_ipversion->{$macro_name})) { + return if $ipversion != $required; + } + my $rules = []; foreach my $templ (@$macro_rules) { @@ -1086,8 +1436,18 @@ sub verify_rule { $errors->{$param} = $msg if !$errors->{$param}; }; + my $ipversion; + my $set_ip_version = sub { + my $vers = shift; + if ($vers) { + die "detected mixed ipv4/ipv6 adresses in rule\n" + if $ipversion && ($vers != $ipversion); + $ipversion = $vers; + } + }; + my $check_ipset_or_alias_property = sub { - my ($name) = @_; + my ($name, $expected_ipversion) = @_; if (my $value = $rule->{$name}) { if ($value =~ m/^\+/) { @@ -1101,7 +1461,11 @@ sub verify_rule { } elsif ($value =~ m/^${ip_alias_pattern}$/){ my $alias = lc($value); &$add_error($name, "no such alias '$value'") - if !($cluster_conf->{aliases}->{$alias} || ($fw_conf && $fw_conf->{aliases}->{$alias})) + if !($cluster_conf->{aliases}->{$alias} || ($fw_conf && $fw_conf->{aliases}->{$alias})); + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; + $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; + + &$set_ip_version($e->{ipversion}); } } }; @@ -1131,12 +1495,9 @@ sub verify_rule { if !$allow_iface; eval { PVE::JSONSchema::pve_verify_iface($rule->{iface}); }; &$add_error('iface', $@) if $@; - if ($rule_env eq 'vm') { + if ($rule_env eq 'vm' || $rule_env eq 'ct') { &$add_error('iface', "value does not match the regex pattern 'net\\d+'") if $rule->{iface} !~ m/^net(\d+)$/; - } elsif ($rule_env eq 'ct') { - &$add_error('iface', "value does not match the regex pattern '(venet|eth\\d+)'") - if $rule->{iface} !~ m/^(venet|eth(\d+))$/; } } @@ -1151,36 +1512,53 @@ sub verify_rule { if ($rule->{proto}) { eval { pve_fw_verify_protocol_spec($rule->{proto}); }; &$add_error('proto', $@) if $@; + &$set_ip_version(4) if $rule->{proto} eq 'icmp'; + &$set_ip_version(6) if $rule->{proto} eq 'icmpv6'; } if ($rule->{dport}) { - eval { parse_port_name_number_or_range($rule->{dport}); }; + eval { parse_port_name_number_or_range($rule->{dport}, 1); }; &$add_error('dport', $@) if $@; + my $proto = $rule->{proto}; &$add_error('proto', "missing property - 'dport' requires this property") - if !$rule->{proto}; + if !$proto; + &$add_error('dport', "protocol '$proto' does not support ports") + if !$PROTOCOLS_WITH_PORTS->{$proto} && + $proto ne 'icmp' && $proto ne 'icmpv6'; # special cases } if ($rule->{sport}) { - eval { parse_port_name_number_or_range($rule->{sport}); }; + eval { parse_port_name_number_or_range($rule->{sport}, 0); }; &$add_error('sport', $@) if $@; + my $proto = $rule->{proto}; &$add_error('proto', "missing property - 'sport' requires this property") - if !$rule->{proto}; + if !$proto; + &$add_error('sport', "protocol '$proto' does not support ports") + if !$PROTOCOLS_WITH_PORTS->{$proto}; } if ($rule->{source}) { - eval { parse_address_list($rule->{source}); }; + eval { + my $source_ipversion = parse_address_list($rule->{source}); + &$set_ip_version($source_ipversion); + }; &$add_error('source', $@) if $@; - &$check_ipset_or_alias_property('source'); + &$check_ipset_or_alias_property('source', $ipversion); } if ($rule->{dest}) { - eval { parse_address_list($rule->{dest}); }; + eval { + my $dest_ipversion = parse_address_list($rule->{dest}); + &$set_ip_version($dest_ipversion); + }; &$add_error('dest', $@) if $@; - &$check_ipset_or_alias_property('dest'); + &$check_ipset_or_alias_property('dest', $ipversion); } + $rule->{ipversion} = $ipversion if $ipversion; + if ($rule->{macro} && !$error_count) { - eval { &$apply_macro($rule->{macro}, $rule, 1); }; + eval { &$apply_macro($rule->{macro}, $rule, 1, $ipversion); }; if (my $err = $@) { if (ref($err) eq "PVE::Exception" && $err->{errors}) { my $eh = $err->{errors}; @@ -1225,7 +1603,7 @@ sub rules_modify_permissions { return { check => ['perm', '/', [ 'Sys.Modify' ]], }; - } elsif ($rule_env eq 'vm' || $rule_env eq 'ct') { + } elsif ($rule_env eq 'vm' || $rule_env eq 'ct') { return { check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]], } @@ -1245,7 +1623,7 @@ sub rules_audit_permissions { return { check => ['perm', '/', [ 'Sys.Audit' ]], }; - } elsif ($rule_env eq 'vm' || $rule_env eq 'ct') { + } elsif ($rule_env eq 'vm' || $rule_env eq 'ct') { return { check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]], } @@ -1270,21 +1648,28 @@ sub enable_bridge_firewall { $bridge_firewall_enabled = 1; } -my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n"; - sub iptables_restore_cmdlist { my ($cmdlist) = @_; - run_command("/sbin/iptables-restore -n", input => $cmdlist); + run_command("/sbin/iptables-restore -n", input => $cmdlist, errmsg => "iptables_restore_cmdlist"); +} + +sub ip6tables_restore_cmdlist { + my ($cmdlist) = @_; + + run_command("/sbin/ip6tables-restore -n", input => $cmdlist, errmsg => "iptables_restore_cmdlist"); } sub ipset_restore_cmdlist { my ($cmdlist) = @_; - run_command("/usr/sbin/ipset restore", input => $cmdlist); + run_command("/sbin/ipset restore", input => $cmdlist, errmsg => "ipset_restore_cmdlist"); } sub iptables_get_chains { + my ($iptablescmd) = @_; + + $iptablescmd = "iptables" if !$iptablescmd; my $res = {}; @@ -1294,14 +1679,12 @@ sub iptables_get_chains { return 1 if $name =~ m/^PVEFW-\S+$/; - return 1 if $name =~ m/^tap\d+i\d+-(:?IN|OUT)$/; - - return 1 if $name =~ m/^veth\d+.\d+-(:?IN|OUT)$/; # fixme: dev name is configurable + return 1 if $name =~ m/^tap\d+i\d+-(?:IN|OUT)$/; - return 1 if $name =~ m/^venet0-\d+-(:?IN|OUT)$/; + return 1 if $name =~ m/^veth\d+i\d+-(?:IN|OUT)$/; - return 1 if $name =~ m/^fwbr\d+(v\d+)?-(:?FW|IN|OUT|IPS)$/; - return 1 if $name =~ m/^GROUP-(:?[^\s\-]+)-(:?IN|OUT)$/; + return 1 if $name =~ m/^fwbr\d+(v\d+)?-(?:FW|IN|OUT|IPS)$/; + return 1 if $name =~ m/^GROUP-(?:$security_group_name_pattern)-(?:IN|OUT)$/; return undef; }; @@ -1339,7 +1722,7 @@ sub iptables_get_chains { } }; - run_command("/sbin/iptables-save", outfunc => $parser); + run_command("/sbin/$iptablescmd-save", outfunc => $parser); return wantarray ? ($res, $hooks) : $res; } @@ -1383,7 +1766,7 @@ sub ipset_get_chains { } }; - run_command("/usr/sbin/ipset save", outfunc => $parser); + run_command("/sbin/ipset save", outfunc => $parser); # compute digest for each chain foreach my $chain (keys %$chains) { @@ -1393,16 +1776,16 @@ sub ipset_get_chains { return $res; } -sub ruleset_generate_cmdstr { - my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; +sub ruleset_generate_match { + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; return if defined($rule->{enable}) && !$rule->{enable}; return if $rule->{errors}; die "unable to emit macro - internal error" if $rule->{macro}; # should not happen - my $nbdport = defined($rule->{dport}) ? parse_port_name_number_or_range($rule->{dport}) : 0; - my $nbsport = defined($rule->{sport}) ? parse_port_name_number_or_range($rule->{sport}) : 0; + my $nbdport = defined($rule->{dport}) ? parse_port_name_number_or_range($rule->{dport}, 1) : 0; + my $nbsport = defined($rule->{sport}) ? parse_port_name_number_or_range($rule->{sport}, 0) : 0; my @cmd = (); @@ -1417,10 +1800,10 @@ sub ruleset_generate_cmdstr { if ($source =~ m/^\+(${ipset_name_pattern})$/) { my $name = $1; if ($fw_conf && $fw_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name); + my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} src"; } elsif ($cluster_conf && $cluster_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name(0, $name); + my $ipset_chain = compute_ipset_chain_name(0, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} src"; } else { die "no such ipset '$name'\n"; @@ -1430,7 +1813,7 @@ sub ruleset_generate_cmdstr { } } elsif ($source =~ m/^${ip_alias_pattern}$/){ my $alias = lc($source); - my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; die "no such alias '$source'\n" if !$e; push @cmd, "-s $e->{cidr}"; @@ -1446,10 +1829,10 @@ sub ruleset_generate_cmdstr { if ($dest =~ m/^\+(${ipset_name_pattern})$/) { my $name = $1; if ($fw_conf && $fw_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name); + my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} dst"; } elsif ($cluster_conf && $cluster_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name(0, $name); + my $ipset_chain = compute_ipset_chain_name(0, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} dst"; } else { die "no such ipset '$name'\n"; @@ -1459,7 +1842,7 @@ sub ruleset_generate_cmdstr { } } elsif ($dest =~ m/^${ip_alias_pattern}$/){ my $alias = lc($dest); - my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; die "no such alias '$dest'\n" if !$e; push @cmd, "-d $e->{cidr}"; @@ -1470,8 +1853,8 @@ sub ruleset_generate_cmdstr { } } - if ($rule->{proto}) { - push @cmd, "-p $rule->{proto}"; + if (my $proto = $rule->{proto}) { + push @cmd, "-p $proto"; my $multiport = 0; $multiport++ if $nbdport > 1; @@ -1483,10 +1866,18 @@ sub ruleset_generate_cmdstr { if ($multiport == 2) && ($rule->{dport} ne $rule->{sport}); if ($rule->{dport}) { - if ($rule->{proto} && $rule->{proto} eq 'icmp') { + if ($proto eq 'icmp') { # Note: we use dport to store --icmp-type - die "unknown icmp-type '$rule->{dport}'\n" if !defined($icmp_type_names->{$rule->{dport}}); + die "unknown icmp-type '$rule->{dport}'\n" + if $rule->{dport} !~ /^\d+$/ && !defined($icmp_type_names->{$rule->{dport}}); push @cmd, "-m icmp --icmp-type $rule->{dport}"; + } elsif ($proto eq 'icmpv6') { + # Note: we use dport to store --icmpv6-type + die "unknown icmpv6-type '$rule->{dport}'\n" + if $rule->{dport} !~ /^\d+$/ && !defined($icmpv6_type_names->{$rule->{dport}}); + push @cmd, "-m icmpv6 --icmpv6-type $rule->{dport}"; + } elsif (!$PROTOCOLS_WITH_PORTS->{$proto}) { + die "protocol $proto does not have ports\n"; } else { if ($nbdport > 1) { if ($multiport == 2) { @@ -1501,6 +1892,8 @@ sub ruleset_generate_cmdstr { } if ($rule->{sport}) { + die "protocol $proto does not have ports\n" + if !$PROTOCOLS_WITH_PORTS->{$proto}; if ($nbsport > 1) { push @cmd, "--sports $rule->{sport}" if $multiport != 2; } else { @@ -1514,6 +1907,14 @@ sub ruleset_generate_cmdstr { push @cmd, "-m addrtype --dst-type $rule->{dsttype}" if $rule->{dsttype}; + return scalar(@cmd) ? join(' ', @cmd) : undef; +} + +sub ruleset_generate_action { + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; + + my @cmd = (); + if (my $action = $rule->{action}) { $action = $actions->{$action} if defined($actions->{$action}); $goto = 1 if !defined($goto) && $action eq 'PVEFW-SET-ACCEPT-MARK'; @@ -1523,38 +1924,55 @@ sub ruleset_generate_cmdstr { return scalar(@cmd) ? join(' ', @cmd) : undef; } +sub ruleset_generate_cmdstr { + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; + my $match = ruleset_generate_match($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf); + my $action = ruleset_generate_action($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf); + + return undef if !(defined($match) or defined($action)); + my $ret = defined($match) ? $match : ""; + $ret = "$ret $action" if defined($action); + return $ret; +} + sub ruleset_generate_rule { - my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; my $rules; if ($rule->{macro}) { - $rules = &$apply_macro($rule->{macro}, $rule); + $rules = &$apply_macro($rule->{macro}, $rule, 0, $ipversion); } else { $rules = [ $rule ]; } # update all or nothing - my @cmds = (); + my @mstrs = (); + my @astrs = (); foreach my $tmp (@$rules) { - if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $tmp, $actions, $goto, $cluster_conf, $fw_conf)) { - push @cmds, $cmdstr; + my $m = ruleset_generate_match($ruleset, $chain, $ipversion, $tmp, $actions, $goto, $cluster_conf, $fw_conf); + my $a = ruleset_generate_action($ruleset, $chain, $ipversion, $tmp, $actions, $goto, $cluster_conf, $fw_conf); + if (defined $m or defined $a) { + push @mstrs, defined($m) ? $m : ""; + push @astrs, defined($a) ? $a : ""; } } - foreach my $cmdstr (@cmds) { - ruleset_addrule($ruleset, $chain, $cmdstr); + for my $i (0 .. $#mstrs) { + ruleset_addrule($ruleset, $chain, $mstrs[$i], $astrs[$i]); } } sub ruleset_generate_rule_insert { - my ($ruleset, $chain, $rule, $actions, $goto) = @_; + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto) = @_; die "implement me" if $rule->{macro}; # not implemented, because not needed so far - if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $rule, $actions, $goto)) { - ruleset_insertrule($ruleset, $chain, $cmdstr); + my $match = ruleset_generate_match($ruleset, $chain, $ipversion, $rule, $actions, $goto); + my $action = ruleset_generate_action($ruleset, $chain, $ipversion, $rule, $actions, $goto); + if (defined $match && defined $action) { + ruleset_insertrule($ruleset, $chain, $match, $action); } } @@ -1575,7 +1993,7 @@ sub ruleset_chain_exist { return $ruleset->{$chain} ? 1 : undef; } -sub ruleset_addrule { +sub ruleset_addrule_old { my ($ruleset, $chain, $rule) = @_; die "no such chain '$chain'\n" if !$ruleset->{$chain}; @@ -1583,144 +2001,173 @@ sub ruleset_addrule { push @{$ruleset->{$chain}}, "-A $chain $rule"; } +sub ruleset_addrule { + my ($ruleset, $chain, $match, $action, $log, $logmsg, $vmid) = @_; + + die "no such chain '$chain'\n" if !$ruleset->{$chain}; + + if (defined($log) && $log) { + my $logaction = get_log_rule_base($chain, $vmid, $logmsg, $log); + push @{$ruleset->{$chain}}, "-A $chain $match $logaction"; + } + push @{$ruleset->{$chain}}, "-A $chain $match $action"; +} + sub ruleset_insertrule { - my ($ruleset, $chain, $rule) = @_; + my ($ruleset, $chain, $match, $action, $log) = @_; die "no such chain '$chain'\n" if !$ruleset->{$chain}; - unshift @{$ruleset->{$chain}}, "-A $chain $rule"; + unshift @{$ruleset->{$chain}}, "-A $chain $match $action"; } sub get_log_rule_base { my ($chain, $vmid, $msg, $loglevel) = @_; - die "internal error - no log level" if !defined($loglevel); - $vmid = 0 if !defined($vmid); + $msg = "" if !defined($msg); # Note: we use special format for prefix to pass further - # info to log daemon (VMID, LOGVELEL and CHAIN) + # info to log daemon (VMID, LOGLEVEL and CHAIN) return "-j NFLOG --nflog-prefix \":$vmid:$loglevel:$chain: $msg\""; } -sub ruleset_addlog { - my ($ruleset, $chain, $vmid, $msg, $loglevel, $rule) = @_; - - return if !defined($loglevel); - - my $logrule = get_log_rule_base($chain, $vmid, $msg, $loglevel); - - $logrule = "$rule $logrule" if defined($rule); - - ruleset_addrule($ruleset, $chain, $logrule); -} - sub ruleset_add_chain_policy { - my ($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action) = @_; + my ($ruleset, $chain, $ipversion, $vmid, $policy, $loglevel, $accept_action) = @_; if ($policy eq 'ACCEPT') { - ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT' }, + ruleset_generate_rule($ruleset, $chain, $ipversion, { action => 'ACCEPT' }, { ACCEPT => $accept_action}); } elsif ($policy eq 'DROP') { - ruleset_addrule($ruleset, $chain, "-j PVEFW-Drop"); + ruleset_addrule($ruleset, $chain, "", "-j PVEFW-Drop"); - ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel); - - ruleset_addrule($ruleset, $chain, "-j DROP"); + ruleset_addrule($ruleset, $chain, "", "-j DROP", $loglevel, "policy $policy: ", $vmid); } elsif ($policy eq 'REJECT') { - ruleset_addrule($ruleset, $chain, "-j PVEFW-Reject"); - - ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel); + ruleset_addrule($ruleset, $chain, "", "-j PVEFW-Reject"); - ruleset_addrule($ruleset, $chain, "-g PVEFW-reject"); + ruleset_addrule($ruleset, $chain, "", "-g PVEFW-reject", $loglevel, "policy $policy:", $vmid); } else { # should not happen die "internal error: unknown policy '$policy'"; } } +sub ruleset_chain_add_ndp { + my ($ruleset, $chain, $ipversion, $options, $direction, $accept) = @_; + return if $ipversion != 6 || (defined($options->{ndp}) && !$options->{ndp}); + + ruleset_addrule($ruleset, $chain, "-p icmpv6 --icmpv6-type router-solicitation", $accept); + if ($direction ne 'OUT' || $options->{radv}) { + ruleset_addrule($ruleset, $chain, "-p icmpv6 --icmpv6-type router-advertisement", $accept); + } + ruleset_addrule($ruleset, $chain, "-p icmpv6 --icmpv6-type neighbor-solicitation", $accept); + ruleset_addrule($ruleset, $chain, "-p icmpv6 --icmpv6-type neighbor-advertisement", $accept); +} + sub ruleset_chain_add_conn_filters { my ($ruleset, $chain, $accept) = @_; - ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID -j DROP"); - ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j $accept"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID", "-j DROP"); + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED", "-j $accept"); } sub ruleset_chain_add_input_filters { - my ($ruleset, $chain, $options, $cluster_conf, $loglevel) = @_; + my ($ruleset, $chain, $ipversion, $options, $cluster_conf, $loglevel) = @_; if ($cluster_conf->{ipset}->{blacklist}){ if (!ruleset_chain_exist($ruleset, "PVEFW-blacklist")) { ruleset_create_chain($ruleset, "PVEFW-blacklist"); - ruleset_addlog($ruleset, "PVEFW-blacklist", 0, "DROP: ", $loglevel) if $loglevel; - ruleset_addrule($ruleset, "PVEFW-blacklist", "-j DROP"); + ruleset_addrule($ruleset, "PVEFW-blacklist", "", "-j DROP", $loglevel, "DROP: "); } - my $ipset_chain = compute_ipset_chain_name(0, 'blacklist'); - ruleset_addrule($ruleset, $chain, "-m set --match-set ${ipset_chain} src -j PVEFW-blacklist"); + my $ipset_chain = compute_ipset_chain_name(0, 'blacklist', $ipversion); + ruleset_addrule($ruleset, $chain, "-m set --match-set ${ipset_chain} src", "-j PVEFW-blacklist"); } if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) { - ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs"); + if ($ipversion == 4) { + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW", "-j PVEFW-smurfs"); + } } if ($options->{tcpflags}) { - ruleset_addrule($ruleset, $chain, "-p tcp -j PVEFW-tcpflags"); + ruleset_addrule($ruleset, $chain, "-p tcp", "-j PVEFW-tcpflags"); } } sub ruleset_create_vm_chain { - my ($ruleset, $chain, $options, $macaddr, $ipfilter_ipset, $direction) = @_; + my ($ruleset, $chain, $ipversion, $options, $macaddr, $ipfilter_ipset, $direction) = @_; ruleset_create_chain($ruleset, $chain); my $accept = generate_nfqueue($options); if (!(defined($options->{dhcp}) && $options->{dhcp} == 0)) { - if ($direction eq 'OUT') { - ruleset_generate_rule($ruleset, $chain, { action => 'PVEFW-SET-ACCEPT-MARK', - proto => 'udp', sport => 68, dport => 67 }); - } else { - ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT', - proto => 'udp', sport => 67, dport => 68 }); + if ($ipversion == 4) { + if ($direction eq 'OUT') { + ruleset_generate_rule($ruleset, $chain, $ipversion, + { action => 'PVEFW-SET-ACCEPT-MARK', + proto => 'udp', sport => 68, dport => 67 }); + } else { + ruleset_generate_rule($ruleset, $chain, $ipversion, + { action => 'ACCEPT', + proto => 'udp', sport => 67, dport => 68 }); + } + } elsif ($ipversion == 6) { + if ($direction eq 'OUT') { + ruleset_generate_rule($ruleset, $chain, $ipversion, + { action => 'PVEFW-SET-ACCEPT-MARK', + proto => 'udp', sport => 546, dport => 547 }); + } else { + ruleset_generate_rule($ruleset, $chain, $ipversion, + { action => 'ACCEPT', + proto => 'udp', sport => 547, dport => 546 }); + } } + } if ($direction eq 'OUT') { if (defined($macaddr) && !(defined($options->{macfilter}) && $options->{macfilter} == 0)) { - ruleset_addrule($ruleset, $chain, "-m mac ! --mac-source $macaddr -j DROP"); + ruleset_addrule($ruleset, $chain, "-m mac ! --mac-source $macaddr", "-j DROP"); + } + if ($ipversion == 6 && !$options->{radv}) { + ruleset_addrule($ruleset, $chain, "-p icmpv6 --icmpv6-type router-advertisement", "-j DROP"); } if ($ipfilter_ipset) { - ruleset_addrule($ruleset, $chain, "-m set ! --match-set $ipfilter_ipset src -j DROP"); + ruleset_addrule($ruleset, $chain, "-m set ! --match-set $ipfilter_ipset src", "-j DROP"); } - ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark + ruleset_addrule($ruleset, $chain, "", "-j MARK --set-mark $FWACCEPTMARK_OFF"); # clear mark } + + my $accept_action = $direction eq 'OUT' ? '-g PVEFW-SET-ACCEPT-MARK' : "-j $accept"; + ruleset_chain_add_ndp($ruleset, $chain, $ipversion, $options, $direction, $accept_action); } sub ruleset_add_group_rule { - my ($ruleset, $cluster_conf, $chain, $rule, $direction, $action) = @_; + my ($ruleset, $cluster_conf, $chain, $rule, $direction, $action, $ipversion) = @_; my $group = $rule->{action}; my $group_chain = "GROUP-$group-$direction"; if(!ruleset_chain_exist($ruleset, $group_chain)){ - generate_group_rules($ruleset, $cluster_conf, $group); + generate_group_rules($ruleset, $cluster_conf, $group, $ipversion); } if ($direction eq 'OUT' && $rule->{iface_out}) { - ruleset_addrule($ruleset, $chain, "-o $rule->{iface_out} -j $group_chain"); + ruleset_addrule($ruleset, $chain, "-o $rule->{iface_out}", "-j $group_chain"); } elsif ($direction eq 'IN' && $rule->{iface_in}) { - ruleset_addrule($ruleset, $chain, "-i $rule->{iface_in} -j $group_chain"); + ruleset_addrule($ruleset, $chain, "-i $rule->{iface_in}", "-j $group_chain"); } else { - ruleset_addrule($ruleset, $chain, "-j $group_chain"); + ruleset_addrule($ruleset, $chain, "", "-j $group_chain"); } - ruleset_addrule($ruleset, $chain, "-m mark --mark 1 -j $action"); + ruleset_addrule($ruleset, $chain, "-m mark --mark $FWACCEPTMARK_ON", "-j $action"); } sub ruleset_generate_vm_rules { - my ($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, $netid, $direction, $options) = @_; + my ($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, $netid, $direction, $options, $ipversion) = @_; my $lc_direction = lc($direction); @@ -1729,18 +2176,20 @@ sub ruleset_generate_vm_rules { foreach my $rule (@$rules) { next if $rule->{iface} && $rule->{iface} ne $netid; next if !$rule->{enable} || $rule->{errors}; + next if $rule->{ipversion} && ($rule->{ipversion} != $ipversion); + if ($rule->{type} eq 'group') { ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, $direction, - $direction eq 'OUT' ? 'RETURN' : $in_accept); + $direction eq 'OUT' ? 'RETURN' : $in_accept, $ipversion); } else { next if $rule->{type} ne $lc_direction; eval { if ($direction eq 'OUT') { - ruleset_generate_rule($ruleset, $chain, $rule, + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, undef, $cluster_conf, $vmfw_conf); } else { - ruleset_generate_rule($ruleset, $chain, $rule, + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, { ACCEPT => $in_accept , REJECT => "PVEFW-reject" }, undef, $cluster_conf, $vmfw_conf); } @@ -1779,54 +2228,12 @@ sub ruleset_generate_vm_ipsrules { ruleset_create_chain($ruleset, "PVEFW-IPS"); } - ruleset_addrule($ruleset, "PVEFW-IPS", "-m physdev --physdev-out $iface --physdev-is-bridged -j $nfqueue"); - } -} - -sub generate_venet_rules_direction { - my ($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, $direction) = @_; - - my $lc_direction = lc($direction); - - my $rules = $vmfw_conf->{rules}; - - my $options = $vmfw_conf->{options}; - my $loglevel = get_option_log_level($options, "log_level_${lc_direction}"); - - my $chain = "venet0-$vmid-$direction"; - - ruleset_create_vm_chain($ruleset, $chain, $options, undef, undef, $direction); - - ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, 'venet', $direction); - - # implement policy - my $policy; - - if ($direction eq 'OUT') { - $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default - } else { - $policy = $options->{policy_in} || 'DROP'; # allow nothing by default - } - - my $accept = generate_nfqueue($options); - my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : $accept; - ruleset_add_chain_policy($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action); - - if ($direction eq 'OUT') { - ruleset_generate_rule_insert($ruleset, "PVEFW-VENET-OUT", { - action => $chain, - source => $ip, - iface_in => 'venet0'}); - } else { - ruleset_generate_rule($ruleset, "PVEFW-VENET-IN", { - action => $chain, - dest => $ip, - iface_out => 'venet0'}); + ruleset_addrule($ruleset, "PVEFW-IPS", "-m physdev --physdev-out $iface --physdev-is-bridged", "-j $nfqueue"); } } sub generate_tap_rules_direction { - my ($ruleset, $cluster_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $direction) = @_; + my ($ruleset, $cluster_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $direction, $ipversion) = @_; my $lc_direction = lc($direction); @@ -1838,14 +2245,14 @@ sub generate_tap_rules_direction { my $tapchain = "$iface-$direction"; my $ipfilter_name = compute_ipfilter_ipset_name($netid); - my $ipfilter_ipset = compute_ipset_chain_name($vmid, $ipfilter_name) - if $vmfw_conf->{ipset}->{$ipfilter_name}; + my $ipfilter_ipset = compute_ipset_chain_name($vmid, $ipfilter_name, $ipversion) + if $options->{ipfilter} || $vmfw_conf->{ipset}->{$ipfilter_name}; # create chain with mac and ip filter - ruleset_create_vm_chain($ruleset, $tapchain, $options, $macaddr, $ipfilter_ipset, $direction); + ruleset_create_vm_chain($ruleset, $tapchain, $ipversion, $options, $macaddr, $ipfilter_ipset, $direction); if ($options->{enable}) { - ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $tapchain, $netid, $direction, $options); + ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $tapchain, $netid, $direction, $options, $ipversion); ruleset_generate_vm_ipsrules($ruleset, $options, $direction, $iface); @@ -1860,24 +2267,24 @@ sub generate_tap_rules_direction { my $accept = generate_nfqueue($options); my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : $accept; - ruleset_add_chain_policy($ruleset, $tapchain, $vmid, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $tapchain, $ipversion, $vmid, $policy, $loglevel, $accept_action); } else { my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : 'ACCEPT'; - ruleset_add_chain_policy($ruleset, $tapchain, $vmid, 'ACCEPT', $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $tapchain, $ipversion, $vmid, 'ACCEPT', $loglevel, $accept_action); } # plug the tap chain to bridge chain if ($direction eq 'IN') { ruleset_addrule($ruleset, "PVEFW-FWBR-IN", - "-m physdev --physdev-is-bridged --physdev-out $iface -j $tapchain"); + "-m physdev --physdev-is-bridged --physdev-out $iface", "-j $tapchain"); } else { ruleset_addrule($ruleset, "PVEFW-FWBR-OUT", - "-m physdev --physdev-is-bridged --physdev-in $iface -j $tapchain"); + "-m physdev --physdev-is-bridged --physdev-in $iface", "-j $tapchain"); } } sub enable_host_firewall { - my ($ruleset, $hostfw_conf, $cluster_conf) = @_; + my ($ruleset, $hostfw_conf, $cluster_conf, $ipversion) = @_; my $options = $hostfw_conf->{options}; my $cluster_options = $cluster_conf->{options}; @@ -1890,27 +2297,30 @@ sub enable_host_firewall { my $loglevel = get_option_log_level($options, "log_level_in"); - ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-i lo", "-j ACCEPT"); ruleset_chain_add_conn_filters($ruleset, $chain, 'ACCEPT'); - ruleset_chain_add_input_filters($ruleset, $chain, $options, $cluster_conf, $loglevel); + ruleset_chain_add_ndp($ruleset, $chain, $ipversion, $options, 'IN', '-j RETURN'); + ruleset_chain_add_input_filters($ruleset, $chain, $ipversion, $options, $cluster_conf, $loglevel); # we use RETURN because we need to check also tap rules my $accept_action = 'RETURN'; - ruleset_addrule($ruleset, $chain, "-p igmp -j $accept_action"); # important for multicast + ruleset_addrule($ruleset, $chain, "-p igmp", "-j $accept_action"); # important for multicast # add host rules first, so that cluster wide rules can be overwritten foreach my $rule (@$rules, @$cluster_rules) { next if !$rule->{enable} || $rule->{errors}; + next if $rule->{ipversion} && ($rule->{ipversion} != $ipversion); $rule->{iface_in} = $rule->{iface} if $rule->{iface}; eval { if ($rule->{type} eq 'group') { - ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'IN', $accept_action); + ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'IN', $accept_action, $ipversion); } elsif ($rule->{type} eq 'in') { - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, + { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf, $hostfw_conf); } }; @@ -1919,25 +2329,26 @@ sub enable_host_firewall { } # allow standard traffic for management ipset (includes cluster network) - my $mngmnt_ipset_chain = compute_ipset_chain_name(0, "management"); + my $mngmnt_ipset_chain = compute_ipset_chain_name(0, "management", $ipversion); my $mngmntsrc = "-m set --match-set ${mngmnt_ipset_chain} src"; - ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 8006 -j $accept_action"); # PVE API - ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console - ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 3128 -j $accept_action"); # SPICE Proxy - ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 22 -j $accept_action"); # SSH + ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 8006", "-j $accept_action"); # PVE API + ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 5900:5999", "-j $accept_action"); # PVE VNC Console + ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 3128", "-j $accept_action"); # SPICE Proxy + ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 22", "-j $accept_action"); # SSH - my $localnet = local_network(); + my $localnet = $cluster_conf->{aliases}->{local_network}->{cidr}; + my $localnet_ver = $cluster_conf->{aliases}->{local_network}->{ipversion}; # corosync - if ($localnet) { - my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action"; - ruleset_addrule($ruleset, $chain, "-s $localnet -d $localnet $corosync_rule"); - ruleset_addrule($ruleset, $chain, "-s $localnet -m addrtype --dst-type MULTICAST $corosync_rule"); + if ($localnet && ($ipversion == $localnet_ver)) { + my $corosync_rule = "-p udp --dport 5404:5405"; + ruleset_addrule($ruleset, $chain, "-s $localnet -d $localnet $corosync_rule", "-j $accept_action"); + ruleset_addrule($ruleset, $chain, "-s $localnet -m addrtype --dst-type MULTICAST $corosync_rule", "-j $accept_action"); } # implement input policy my $policy = $cluster_options->{policy_in} || 'DROP'; # allow nothing by default - ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, $ipversion, 0, $policy, $loglevel, $accept_action); # host outbound firewall $chain = "PVEFW-HOST-OUT"; @@ -1945,25 +2356,28 @@ sub enable_host_firewall { $loglevel = get_option_log_level($options, "log_level_out"); - ruleset_addrule($ruleset, $chain, "-o lo -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-o lo", "-j ACCEPT"); ruleset_chain_add_conn_filters($ruleset, $chain, 'ACCEPT'); # we use RETURN because we may want to check other thigs later $accept_action = 'RETURN'; + ruleset_chain_add_ndp($ruleset, $chain, $ipversion, $options, 'OUT', "-j $accept_action"); - ruleset_addrule($ruleset, $chain, "-p igmp -j $accept_action"); # important for multicast + ruleset_addrule($ruleset, $chain, "-p igmp", "-j $accept_action"); # important for multicast # add host rules first, so that cluster wide rules can be overwritten foreach my $rule (@$rules, @$cluster_rules) { next if !$rule->{enable} || $rule->{errors}; + next if $rule->{ipversion} && ($rule->{ipversion} != $ipversion); $rule->{iface_out} = $rule->{iface} if $rule->{iface}; eval { if ($rule->{type} eq 'group') { - ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'OUT', $accept_action); + ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'OUT', $accept_action, $ipversion); } elsif ($rule->{type} eq 'out') { - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, + ruleset_generate_rule($ruleset, $chain, $ipversion, + $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf, $hostfw_conf); } }; @@ -1972,27 +2386,27 @@ sub enable_host_firewall { } # allow standard traffic on cluster network - if ($localnet) { - ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 8006 -j $accept_action"); # PVE API - ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 22 -j $accept_action"); # SSH - ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console - ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 3128 -j $accept_action"); # SPICE Proxy + if ($localnet && ($ipversion == $localnet_ver)) { + ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 8006", "-j $accept_action"); # PVE API + ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 22", "-j $accept_action"); # SSH + ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 5900:5999", "-j $accept_action"); # PVE VNC Console + ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 3128", "-j $accept_action"); # SPICE Proxy - my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action"; - ruleset_addrule($ruleset, $chain, "-d $localnet $corosync_rule"); - ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST $corosync_rule"); + my $corosync_rule = "-p udp --dport 5404:5405"; + ruleset_addrule($ruleset, $chain, "-d $localnet $corosync_rule", "-j $accept_action"); + ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST $corosync_rule", "-j $accept_action"); } # implement output policy $policy = $cluster_options->{policy_out} || 'ACCEPT'; # allow everything by default - ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, $ipversion, 0, $policy, $loglevel, $accept_action); - ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-j PVEFW-HOST-OUT"); - ruleset_addrule($ruleset, "PVEFW-INPUT", "-j PVEFW-HOST-IN"); + ruleset_addrule($ruleset, "PVEFW-OUTPUT", "", "-j PVEFW-HOST-OUT"); + ruleset_addrule($ruleset, "PVEFW-INPUT", "", "-j PVEFW-HOST-IN"); } sub generate_group_rules { - my ($ruleset, $cluster_conf, $group) = @_; + my ($ruleset, $cluster_conf, $group, $ipversion) = @_; my $rules = $cluster_conf->{groups}->{$group}; @@ -2004,24 +2418,29 @@ sub generate_group_rules { my $chain = "GROUP-${group}-IN"; ruleset_create_chain($ruleset, $chain); - ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark + ruleset_addrule($ruleset, $chain, "", "-j MARK --set-mark $FWACCEPTMARK_OFF"); # clear mark foreach my $rule (@$rules) { next if $rule->{type} ne 'in'; - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, undef, $cluster_conf); + next if $rule->{ipversion} && $rule->{ipversion} ne $ipversion; + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, + { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, + undef, $cluster_conf); } $chain = "GROUP-${group}-OUT"; ruleset_create_chain($ruleset, $chain); - ruleset_addrule($ruleset, $chain, "-j MARK --set-mark 0"); # clear mark + ruleset_addrule($ruleset, $chain, "", "-j MARK --set-mark $FWACCEPTMARK_OFF"); # clear mark foreach my $rule (@$rules) { next if $rule->{type} ne 'out'; + next if $rule->{ipversion} && $rule->{ipversion} ne $ipversion; # we use PVEFW-SET-ACCEPT-MARK (Instead of ACCEPT) because we need to # check also other tap rules later - ruleset_generate_rule($ruleset, $chain, $rule, - { ACCEPT => 'PVEFW-SET-ACCEPT-MARK', REJECT => "PVEFW-reject" }, undef, $cluster_conf); + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, + { ACCEPT => 'PVEFW-SET-ACCEPT-MARK', REJECT => "PVEFW-reject" }, + undef, $cluster_conf); } } @@ -2031,6 +2450,14 @@ for (my $i = 0; $i < $MAX_NETS; $i++) { $valid_netdev_names->{"net$i"} = 1; } +sub get_mark_values { + my ($value, $mask) = @_; + $value = hex($value) if $value =~ /^0x/; + $mask = hex($mask) if defined($mask) && $mask =~ /^0x/; + $mask = 0xffffffff if !defined($mask); + return ($value, $mask); +} + sub parse_fw_rule { my ($prefix, $line, $cluster_conf, $fw_conf, $rule_env, $verbose) = @_; @@ -2097,10 +2524,14 @@ sub parse_fw_rule { die "unable to parse rule parameters: $line\n" if length($line); $rule = verify_rule($rule, $cluster_conf, $fw_conf, $rule_env, 1); - if ($verbose && $rule->{errors}) { - warn "$prefix - errors in rule parameters: $orig_line\n"; + if ($rule->{errors}) { + # The verbose flag really means we're running from the CLI and want + # output on the console - in the other case we really want such errors + # to go into the syslog instead. + my $log = $verbose ? sub { warn @_ } : sub { syslog(err => @_) }; + $log->("$prefix - errors in rule parameters: $orig_line\n"); foreach my $p (keys %{$rule->{errors}}) { - warn " $p: $rule->{errors}->{$p}\n"; + $log->(" $p: $rule->{errors}->{$p}\n"); } } @@ -2114,7 +2545,7 @@ sub parse_vmfw_option { my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog"; - if ($line =~ m/^(enable|dhcp|macfilter|ips):\s*(0|1)\s*$/i) { + if ($line =~ m/^(enable|dhcp|ndp|radv|macfilter|ipfilter|ips):\s*(0|1)\s*$/i) { $opt = lc($1); $value = int($2); } elsif ($line =~ m/^(log_level_in|log_level_out):\s*(($loglevels)\s*)?$/i) { @@ -2140,7 +2571,7 @@ sub parse_hostfw_option { my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog"; - if ($line =~ m/^(enable|nosmurfs|tcpflags):\s*(0|1)\s*$/i) { + if ($line =~ m/^(enable|nosmurfs|tcpflags|ndp):\s*(0|1)\s*$/i) { $opt = lc($1); $value = int($2); } elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) { @@ -2161,9 +2592,12 @@ sub parse_clusterfw_option { my ($opt, $value); - if ($line =~ m/^(enable):\s*(0|1)\s*$/i) { + if ($line =~ m/^(enable):\s*(\d+)\s*$/i) { $opt = lc($1); $value = int($2); + if (($value > 1) && ((time() - $value) > 60)) { + $value = 0 + } } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) { $opt = lc($1); $value = uc($3); @@ -2177,16 +2611,31 @@ sub parse_clusterfw_option { sub resolve_alias { my ($clusterfw_conf, $fw_conf, $cidr) = @_; - if ($cidr !~ m/^\d/) { - my $alias = lc($cidr); - my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; - $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf; - return $e->{cidr} if $e; - - die "no such alias '$cidr'\n"; + my $alias = lc($cidr); + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; + $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf; + + die "no such alias '$cidr'\n" if !$e;; + + return wantarray ? ($e->{cidr}, $e->{ipversion}) : $e->{cidr}; +} + +sub parse_ip_or_cidr { + my ($cidr) = @_; + + my $ipversion; + + if ($cidr =~ m!^(?:$IPV6RE)(/(\d+))?$!) { + $cidr =~ s|/128$||; + $ipversion = 6; + } elsif ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) { + $cidr =~ s|/32$||; + $ipversion = 4; + } else { + die "value does not look like a valid IP address or CIDR network\n"; } - return $cidr; + return wantarray ? ($cidr, $ipversion) : $cidr; } sub parse_alias { @@ -2197,11 +2646,14 @@ sub parse_alias { if ($line =~ m/^(\S+)\s(\S+)$/) { my ($name, $cidr) = ($1, $2); - $cidr =~ s|/32$||; - pve_verify_ipv4_or_cidr($cidr); + my $ipversion; + + ($cidr, $ipversion) = parse_ip_or_cidr($cidr); + my $data = { name => $name, cidr => $cidr, + ipversion => $ipversion, }; $data->{comment} = $comment if $comment; return $data; @@ -2339,8 +2791,7 @@ sub generic_fw_config_parser { if ($cidr =~ m/^${ip_alias_pattern}$/) { resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists } else { - $cidr =~ s|/32$||; - pve_verify_ipv4_or_cidr_or_alias($cidr); + $cidr = parse_ip_or_cidr($cidr); } }; if (my $err = $@) { @@ -2348,6 +2799,10 @@ sub generic_fw_config_parser { $errors->{cidr} = $err; } + if ($cidr =~ m!/0+$!) { + $errors->{cidr} = "a zero prefix is not allowed in ipset entries\n"; + } + my $entry = { cidr => $cidr }; $entry->{nomatch} = 1 if $nomatch; $entry->{comment} = $comment if $comment; @@ -2425,10 +2880,10 @@ sub run_locked { sub read_local_vm_config { - my $openvz = {}; my $qemu = {}; + my $lxc = {}; - my $vmdata = { openvz => $openvz, qemu => $qemu }; + my $vmdata = { qemu => $qemu, lxc => $lxc }; my $vmlist = PVE::Cluster::get_vmlist(); return $vmdata if !$vmlist || !$vmlist->{ids}; @@ -2439,21 +2894,21 @@ sub read_local_vm_config { my $d = $ids->{$vmid}; next if !$d->{node} || $d->{node} ne $nodename; next if !$d->{type}; - if ($d->{type} eq 'openvz') { - if ($have_pve_manager) { - my $cfspath = PVE::OpenVZ::cfs_config_path($vmid); - if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { - $openvz->{$vmid} = $conf; - } - } - } elsif ($d->{type} eq 'qemu') { + if ($d->{type} eq 'qemu') { if ($have_qemu_server) { - my $cfspath = PVE::QemuServer::cfs_config_path($vmid); + my $cfspath = PVE::QemuConfig->cfs_config_path($vmid); if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { $qemu->{$vmid} = $conf; } } - } + } elsif ($d->{type} eq 'lxc') { + if ($have_lxc) { + my $cfspath = PVE::LXC::Config->cfs_config_path($vmid); + if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { + $lxc->{$vmid} = $conf; + } + } + } } return $vmdata; @@ -2598,10 +3053,36 @@ sub save_vmfw_conf { $raw .= "\n"; } - mkdir $pvefw_conf_dir; - my $filename = "$pvefw_conf_dir/$vmid.fw"; - PVE::Tools::file_set_contents($filename, $raw); + if ($raw) { + mkdir $pvefw_conf_dir; + PVE::Tools::file_set_contents($filename, $raw); + } else { + unlink $filename; + } +} + +sub remove_vmfw_conf { + my ($vmid) = @_; + + my $vmfw_conffile = "$pvefw_conf_dir/$vmid.fw"; + + unlink $vmfw_conffile; +} + +sub clone_vmfw_conf { + my ($vmid, $newid) = @_; + + my $sourcevm_conffile = "$pvefw_conf_dir/$vmid.fw"; + my $clonevm_conffile = "$pvefw_conf_dir/$newid.fw"; + + if (-f $clonevm_conffile) { + unlink $clonevm_conffile; + } + if (-f $sourcevm_conffile) { + my $data = PVE::Tools::file_get_contents($sourcevm_conffile); + PVE::Tools::file_set_contents($clonevm_conffile, $data); + } } sub read_vm_firewall_configs { @@ -2614,10 +3095,10 @@ sub read_vm_firewall_configs { next if !$vmfw_conf->{options}; # skip if file does not exists $vmfw_configs->{$vmid} = $vmfw_conf; } - foreach my $vmid (keys %{$vmdata->{openvz}}) { - my $vmfw_conf = load_vmfw_conf($cluster_conf, 'ct', $vmid, $dir, $verbose); - next if !$vmfw_conf->{options}; # skip if file does not exists - $vmfw_configs->{$vmid} = $vmfw_conf; + foreach my $vmid (keys %{$vmdata->{lxc}}) { + my $vmfw_conf = load_vmfw_conf($cluster_conf, 'ct', $vmid, $dir, $verbose); + next if !$vmfw_conf->{options}; # skip if file does not exists + $vmfw_configs->{$vmid} = $vmfw_conf; } return $vmfw_configs; @@ -2641,84 +3122,114 @@ sub get_option_log_level { } sub generate_std_chains { - my ($ruleset, $options) = @_; + my ($ruleset, $options, $ipversion) = @_; + + my $std_chains = $pve_std_chains->{$ipversion} || die "internal error"; my $loglevel = get_option_log_level($options, 'smurf_log_level'); - # same as shorewall smurflog. - my $chain = 'PVEFW-smurflog'; - $pve_std_chains->{$chain} = []; + my $chain; - push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel; - push @{$pve_std_chains->{$chain}}, "-j DROP"; + if ($ipversion == 4) { + # same as shorewall smurflog. + $chain = 'PVEFW-smurflog'; + $std_chains->{$chain} = []; + + push @{$std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel; + push @{$std_chains->{$chain}}, "-j DROP"; + } # same as shorewall logflags action. $loglevel = get_option_log_level($options, 'tcp_flags_log_level'); $chain = 'PVEFW-logflags'; - $pve_std_chains->{$chain} = []; + $std_chains->{$chain} = []; # fixme: is this correctly logged by pvewf-logger? (ther is no --log-ip-options for NFLOG) - push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel; - push @{$pve_std_chains->{$chain}}, "-j DROP"; + push @{$std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel; + push @{$std_chains->{$chain}}, "-j DROP"; - foreach my $chain (keys %$pve_std_chains) { + foreach my $chain (keys %$std_chains) { ruleset_create_chain($ruleset, $chain); - foreach my $rule (@{$pve_std_chains->{$chain}}) { + foreach my $rule (@{$std_chains->{$chain}}) { if (ref($rule)) { - ruleset_generate_rule($ruleset, $chain, $rule); + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule); } else { - ruleset_addrule($ruleset, $chain, $rule); + ruleset_addrule_old($ruleset, $chain, $rule); } } } } sub generate_ipset_chains { - my ($ipset_ruleset, $clusterfw_conf, $fw_conf) = @_; + my ($ipset_ruleset, $clusterfw_conf, $fw_conf, $device_ips, $ipsets) = @_; - foreach my $ipset (keys %{$fw_conf->{ipset}}) { - my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $ipset); - generate_ipset($ipset_ruleset, $ipset_chain, $fw_conf->{ipset}->{$ipset}, $clusterfw_conf, $fw_conf); - } -} + foreach my $ipset (keys %{$ipsets}) { -sub generate_ipset { - my ($ipset_ruleset, $name, $options, $clusterfw_conf, $fw_conf) = @_; + my $options = $ipsets->{$ipset}; - die "duplicate ipset chain '$name'\n" if defined($ipset_ruleset->{$name}); + if ($device_ips && $ipset =~ /^ipfilter-(net\d+)$/) { + if (my $ips = $device_ips->{$1}) { + $options = [@$options, @$ips]; + } + } - my $hashsize = scalar(@$options); - if ($hashsize <= 64) { - $hashsize = 64; - } else { - $hashsize = round_powerof2($hashsize); - } + # remove duplicates + my $nethash = {}; + foreach my $entry (@$options) { + next if $entry->{errors}; # skip entries with errors + eval { + my ($cidr, $ver); + if ($entry->{cidr} =~ m/^${ip_alias_pattern}$/) { + ($cidr, $ver) = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr}); + } else { + ($cidr, $ver) = parse_ip_or_cidr($entry->{cidr}); + } + #http://backreference.org/2013/03/01/ipv6-address-normalization/ + if ($ver == 6) { + # ip_compress_address takes an address only, no CIDR + my ($addr, $prefix_len) = ($cidr =~ m@^([^/]*)(/.*)?$@); + $cidr = lc(Net::IP::ip_compress_address($addr, 6)); + $cidr .= $prefix_len if defined($prefix_len); + $cidr =~ s|/128$||; + } else { + $cidr =~ s|/32$||; + } - $ipset_ruleset->{$name} = ["create $name hash:net family inet hashsize $hashsize maxelem $hashsize"]; + $nethash->{$ver}->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} }; + }; + warn $@ if $@; + } - # remove duplicates - my $nethash = {}; - foreach my $entry (@$options) { - next if $entry->{errors}; # skip entries with errors - eval { - my $cidr = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr}); - $nethash->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} }; - }; - warn $@ if $@; - } + foreach my $ipversion (4, 6) { + my $data = $nethash->{$ipversion}; - foreach my $cidr (sort keys %$nethash) { - my $entry = $nethash->{$cidr}; + my $name = compute_ipset_chain_name($fw_conf->{vmid}, $ipset, $ipversion); - my $cmd = "add $name $cidr"; - if ($entry->{nomatch}) { - if ($feature_ipset_nomatch) { - push @{$ipset_ruleset->{$name}}, "$cmd nomatch"; + my $hashsize = scalar(@$options); + if ($hashsize <= 64) { + $hashsize = 64; } else { - warn "ignore !$cidr - nomatch not supported by kernel\n"; + $hashsize = round_powerof2($hashsize); + } + + my $family = $ipversion == "6" ? "inet6" : "inet"; + + $ipset_ruleset->{$name} = ["create $name hash:net family $family hashsize $hashsize maxelem $hashsize"]; + + foreach my $cidr (sort keys %$data) { + my $entry = $data->{$cidr}; + + my $cmd = "add $name $cidr"; + if ($entry->{nomatch}) { + if ($feature_ipset_nomatch) { + push @{$ipset_ruleset->{$name}}, "$cmd nomatch"; + } else { + warn "ignore !$cidr - nomatch not supported by kernel\n"; + } + } else { + push @{$ipset_ruleset->{$name}}, $cmd; + } } - } else { - push @{$ipset_ruleset->{$name}}, $cmd; } } } @@ -2779,8 +3290,12 @@ sub save_clusterfw_conf { } } - mkdir $pvefw_conf_dir; - PVE::Tools::file_set_contents($clusterfw_conf_filename, $raw); + if ($raw) { + mkdir $pvefw_conf_dir; + PVE::Tools::file_set_contents($clusterfw_conf_filename, $raw); + } else { + unlink $clusterfw_conf_filename; + } } sub load_hostfw_conf { @@ -2810,7 +3325,11 @@ sub save_hostfw_conf { $raw .= "\n"; } - PVE::Tools::file_set_contents($hostfw_conf_filename, $raw); + if ($raw) { + PVE::Tools::file_set_contents($hostfw_conf_filename, $raw); + } else { + unlink $hostfw_conf_filename; + } } sub compile { @@ -2836,27 +3355,30 @@ sub compile { $vmfw_configs = read_vm_firewall_configs($cluster_conf, $vmdata, undef, $verbose); } - my ($ruleset, $ipset_ruleset) = compile_iptables_filter($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, 4, $verbose); - return ($ruleset, $ipset_ruleset); -} - -sub compile_iptables_filter { - my ($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, $ipversion, $verbose) = @_; - - $cluster_conf->{ipset}->{venet0} = []; - my $venet0_ipset_chain = compute_ipset_chain_name(0, 'venet0'); + return ({},{},{}) if !$cluster_conf->{options}->{enable}; my $localnet; if ($cluster_conf->{aliases}->{local_network}) { $localnet = $cluster_conf->{aliases}->{local_network}->{cidr}; } else { - $localnet = local_network() || '127.0.0.0/8'; - $cluster_conf->{aliases}->{local_network} = { cidr => $localnet }; + my $localnet_ver; + ($localnet, $localnet_ver) = parse_ip_or_cidr(local_network() || '127.0.0.0/8'); + + $cluster_conf->{aliases}->{local_network} = { + name => 'local_network', cidr => $localnet, ipversion => $localnet_ver }; } push @{$cluster_conf->{ipset}->{management}}, { cidr => $localnet }; - return ({}, {}) if !$cluster_conf->{options}->{enable}; + my $ruleset = compile_iptables_filter($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, 4, $verbose); + my $rulesetv6 = compile_iptables_filter($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, 6, $verbose); + my $ipset_ruleset = compile_ipsets($cluster_conf, $vmfw_configs, $vmdata); + + return ($ruleset, $ipset_ruleset, $rulesetv6); +} + +sub compile_iptables_filter { + my ($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, $ipversion, $verbose) = @_; my $ruleset = {}; @@ -2872,47 +3394,31 @@ sub compile_iptables_filter { ruleset_chain_add_conn_filters($ruleset, "PVEFW-FORWARD", "ACCEPT"); - - ruleset_create_chain($ruleset, "PVEFW-VENET-OUT"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -m set --match-set ${venet0_ipset_chain} src -j PVEFW-VENET-OUT"); - ruleset_addrule($ruleset, "PVEFW-INPUT", "-i venet0 -m set --match-set ${venet0_ipset_chain} src -j PVEFW-VENET-OUT"); - ruleset_create_chain($ruleset, "PVEFW-FWBR-IN"); - ruleset_chain_add_input_filters($ruleset, "PVEFW-FWBR-IN", $hostfw_options, $cluster_conf, $loglevel); + ruleset_chain_add_input_filters($ruleset, "PVEFW-FWBR-IN", $ipversion, $hostfw_options, $cluster_conf, $loglevel); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-in fwln+ -j PVEFW-FWBR-IN"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-in fwln+", "-j PVEFW-FWBR-IN"); ruleset_create_chain($ruleset, "PVEFW-FWBR-OUT"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-out fwln+ -j PVEFW-FWBR-OUT"); - - ruleset_create_chain($ruleset, "PVEFW-VENET-IN"); - ruleset_chain_add_input_filters($ruleset, "PVEFW-VENET-IN", $hostfw_options, $cluster_conf, $loglevel); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-out fwln+", "-j PVEFW-FWBR-OUT"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o venet0 -m set --match-set ${venet0_ipset_chain} dst -j PVEFW-VENET-IN"); - - generate_std_chains($ruleset, $hostfw_options); + generate_std_chains($ruleset, $hostfw_options, $ipversion); my $hostfw_enable = !(defined($hostfw_options->{enable}) && ($hostfw_options->{enable} == 0)); - my $ipset_ruleset = {}; - if ($hostfw_enable) { - eval { enable_host_firewall($ruleset, $hostfw_conf, $cluster_conf); }; + eval { enable_host_firewall($ruleset, $hostfw_conf, $cluster_conf, $ipversion); }; warn $@ if $@; # just to be sure - should not happen } - ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-o venet0 -m set --match-set ${venet0_ipset_chain} dst -j PVEFW-VENET-IN"); - # generate firewall rules for QEMU VMs - foreach my $vmid (keys %{$vmdata->{qemu}}) { + foreach my $vmid (sort keys %{$vmdata->{qemu}}) { eval { my $conf = $vmdata->{qemu}->{$vmid}; my $vmfw_conf = $vmfw_configs->{$vmid}; return if !$vmfw_conf; - generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf); - - foreach my $netid (keys %$conf) { + foreach my $netid (sort keys %$conf) { next if $netid !~ m/^net(\d+)$/; my $net = PVE::QemuServer::parse_net($conf->{$netid}); next if !$net->{firewall}; @@ -2920,68 +3426,164 @@ sub compile_iptables_filter { my $macaddr = $net->{macaddr}; generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'IN'); + $vmfw_conf, $vmid, 'IN', $ipversion); generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'OUT'); + $vmfw_conf, $vmid, 'OUT', $ipversion); } }; warn $@ if $@; # just to be sure - should not happen } - # generate firewall rules for OpenVZ containers - foreach my $vmid (keys %{$vmdata->{openvz}}) { - eval { - my $conf = $vmdata->{openvz}->{$vmid}; + # generate firewall rules for LXC containers + foreach my $vmid (sort keys %{$vmdata->{lxc}}) { + eval { + my $conf = $vmdata->{lxc}->{$vmid}; + my $vmfw_conf = $vmfw_configs->{$vmid}; + return if !$vmfw_conf; + + if ($vmfw_conf->{options}->{enable}) { + foreach my $netid (sort keys %$conf) { + next if $netid !~ m/^net(\d+)$/; + my $net = PVE::LXC::Config->parse_lxc_network($conf->{$netid}); + next if !$net->{firewall}; + my $iface = "veth${vmid}i$1"; + my $macaddr = $net->{hwaddr}; + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, 'IN', $ipversion); + generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, 'OUT', $ipversion); + } + } + }; + warn $@ if $@; # just to be sure - should not happen + } + + if(ruleset_chain_exist($ruleset, "PVEFW-IPS")){ + ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED", "-j PVEFW-IPS"); + } + return $ruleset; +} + +sub mac_to_linklocal { + my ($macaddr) = @_; + my @parts = split(/:/, $macaddr); + # The standard link local address uses the fe80::/64 prefix with the + # modified EUI-64 identifier derived from the MAC address by flipping the + # universal/local bit and inserting FF:FE in the middle. + # See RFC 4291. + $parts[0] = sprintf("%02x", hex($parts[0]) ^ 0x02); + my @meui64 = (@parts[0,1,2], 'ff', 'fe', @parts[3,4,5]); + return "fe80::$parts[0]$parts[1]:$parts[2]FF:FE$parts[3]:$parts[4]$parts[5]"; +} + +sub compile_ipsets { + my ($cluster_conf, $vmfw_configs, $vmdata) = @_; + + my $localnet; + if ($cluster_conf->{aliases}->{local_network}) { + $localnet = $cluster_conf->{aliases}->{local_network}->{cidr}; + } else { + my $localnet_ver; + ($localnet, $localnet_ver) = parse_ip_or_cidr(local_network() || '127.0.0.0/8'); + + $cluster_conf->{aliases}->{local_network} = { + name => 'local_network', cidr => $localnet, ipversion => $localnet_ver }; + } + + push @{$cluster_conf->{ipset}->{management}}, { cidr => $localnet }; + + + my $ipset_ruleset = {}; + + # generate ipsets for QEMU VMs + foreach my $vmid (keys %{$vmdata->{qemu}}) { + eval { + my $conf = $vmdata->{qemu}->{$vmid}; my $vmfw_conf = $vmfw_configs->{$vmid}; return if !$vmfw_conf; - generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf); + # When the 'ipfilter' option is enabled every device for which there + # is no 'ipfilter-netX' ipset defiend gets an implicit empty default + # ipset. + # The reason is that ipfilter ipsets are always filled with standard + # IPv6 link-local filters. + my $ipsets = $vmfw_conf->{ipset}; + my $implicit_sets = {}; - if ($vmfw_conf->{options}->{enable}) { - if ($conf->{ip_address} && $conf->{ip_address}->{value}) { - my $ip = $conf->{ip_address}->{value}; - $ip =~ s/\s+/,/g; - parse_address_list($ip); # make sure we have a valid $ip list + my $device_ips = {}; + foreach my $netid (keys %$conf) { + next if $netid !~ m/^net(\d+)$/; + my $net = PVE::QemuServer::parse_net($conf->{$netid}); + next if !$net->{firewall}; - my @ips = split(',', $ip); + if ($vmfw_conf->{options}->{ipfilter} && !$ipsets->{"ipfilter-$netid"}) { + $implicit_sets->{"ipfilter-$netid"} = []; + } - foreach my $singleip (@ips) { - my $venet0ipset = {}; - $venet0ipset->{cidr} = $singleip; - push @{$cluster_conf->{ipset}->{venet0}}, $venet0ipset; - } + my $macaddr = $net->{macaddr}; + my $linklocal = mac_to_linklocal($macaddr); + $device_ips->{$netid} = [ + { cidr => $linklocal }, + { cidr => 'fe80::/10', nomatch => 1 } + ]; + } + + generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf, $device_ips, $ipsets); + generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf, $device_ips, $implicit_sets); + }; + warn $@ if $@; # just to be sure - should not happen + } + + # generate firewall rules for LXC containers + foreach my $vmid (keys %{$vmdata->{lxc}}) { + eval { + my $conf = $vmdata->{lxc}->{$vmid}; + my $vmfw_conf = $vmfw_configs->{$vmid}; + return if !$vmfw_conf; + + # When the 'ipfilter' option is enabled every device for which there + # is no 'ipfilter-netX' ipset defiend gets an implicit empty default + # ipset. + # The reason is that ipfilter ipsets are always filled with standard + # IPv6 link-local filters, as well as the IP addresses configured + # for the container. + my $ipsets = $vmfw_conf->{ipset}; + my $implicit_sets = {}; + + my $device_ips = {}; + foreach my $netid (keys %$conf) { + next if $netid !~ m/^net(\d+)$/; + my $net = PVE::LXC::Config->parse_lxc_network($conf->{$netid}); + next if !$net->{firewall}; - generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'IN'); - generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'OUT'); + if ($vmfw_conf->{options}->{ipfilter} && !$ipsets->{"ipfilter-$netid"}) { + $implicit_sets->{"ipfilter-$netid"} = []; } - } - if ($conf->{netif} && $conf->{netif}->{value}) { - my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value}); - foreach my $netid (keys %$netif) { - my $d = $netif->{$netid}; - my $bridge = $d->{bridge}; - next if !$bridge || $bridge !~ m/^vmbr\d+(v(\d+))?f$/; # firewall enabled ? - my $macaddr = $d->{mac}; - my $iface = $d->{host_ifname}; - generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'IN'); - generate_tap_rules_direction($ruleset, $cluster_conf, $iface, $netid, $macaddr, - $vmfw_conf, $vmid, 'OUT'); + my $macaddr = $net->{hwaddr}; + my $linklocal = mac_to_linklocal($macaddr); + my $set = $device_ips->{$netid} = [ + { cidr => $linklocal }, + { cidr => 'fe80::/10', nomatch => 1 } + ]; + if (defined($net->{ip}) && $net->{ip} =~ m!^($IPV4RE)(?:/\d+)?$!) { + push @$set, { cidr => $1 }; + } + if (defined($net->{ip6}) && $net->{ip6} =~ m!^($IPV6RE)(?:/\d+)?$!) { + push @$set, { cidr => $1 }; } } + + generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf, $device_ips, $ipsets); + generate_ipset_chains($ipset_ruleset, $cluster_conf, $vmfw_conf, $device_ips, $implicit_sets); }; warn $@ if $@; # just to be sure - should not happen } - if(ruleset_chain_exist($ruleset, "PVEFW-IPS")){ - ruleset_insertrule($ruleset, "PVEFW-FORWARD", "-m conntrack --ctstate RELATED,ESTABLISHED -j PVEFW-IPS"); - } + generate_ipset_chains($ipset_ruleset, undef, $cluster_conf, undef, $cluster_conf->{ipset}); - generate_ipset_chains($ipset_ruleset, undef, $cluster_conf); - - return ($ruleset, $ipset_ruleset); + return $ipset_ruleset; } sub get_ruleset_status { @@ -3030,11 +3632,11 @@ sub print_sig_rule { } sub get_ruleset_cmdlist { - my ($ruleset, $verbose) = @_; + my ($ruleset, $verbose, $iptablescmd) = @_; my $cmdlist = "*filter\n"; # we pass this to iptables-restore; - my ($active_chains, $hooks) = iptables_get_chains(); + my ($active_chains, $hooks) = iptables_get_chains($iptablescmd); my $statushash = get_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, $verbose); # create missing chains first @@ -3108,7 +3710,7 @@ sub get_ipset_cmdlist { } } - foreach my $chain (sort keys %$ruleset) { + foreach my $chain (keys %$ruleset) { my $stat = $statushash->{$chain}; die "internal error" if !$stat; @@ -3117,6 +3719,11 @@ sub get_ipset_cmdlist { $cmdlist .= "$cmd\n"; } } + } + + foreach my $chain (keys %$ruleset) { + my $stat = $statushash->{$chain}; + die "internal error" if !$stat; if ($stat->{action} eq 'update') { my $chain_swap = $chain."_swap"; @@ -3129,9 +3736,9 @@ sub get_ipset_cmdlist { $cmdlist .= "flush $chain_swap\n"; $cmdlist .= "destroy $chain_swap\n"; } - } + # the remove unused chains foreach my $chain (keys %$statushash) { next if $statushash->{$chain}->{action} ne 'delete'; @@ -3145,14 +3752,15 @@ sub get_ipset_cmdlist { } sub apply_ruleset { - my ($ruleset, $hostfw_conf, $ipset_ruleset, $verbose) = @_; + my ($ruleset, $hostfw_conf, $ipset_ruleset, $rulesetv6, $verbose) = @_; enable_bridge_firewall(); my ($ipset_create_cmdlist, $ipset_delete_cmdlist, $ipset_changes) = - get_ipset_cmdlist($ipset_ruleset, undef, $verbose); + get_ipset_cmdlist($ipset_ruleset, $verbose); my ($cmdlist, $changes) = get_ruleset_cmdlist($ruleset, $verbose); + my ($cmdlistv6, $changesv6) = get_ruleset_cmdlist($rulesetv6, $verbose, "ip6tables"); if ($verbose) { if ($ipset_changes) { @@ -3165,12 +3773,31 @@ sub apply_ruleset { print "iptables changes:\n"; print $cmdlist; } + + if ($changesv6) { + print "ip6tables changes:\n"; + print $cmdlistv6; + } } + my $tmpfile = "$pve_fw_status_dir/ipsetcmdlist1"; + PVE::Tools::file_set_contents($tmpfile, $ipset_create_cmdlist || ''); + ipset_restore_cmdlist($ipset_create_cmdlist); + $tmpfile = "$pve_fw_status_dir/ip4cmdlist"; + PVE::Tools::file_set_contents($tmpfile, $cmdlist || ''); + iptables_restore_cmdlist($cmdlist); + $tmpfile = "$pve_fw_status_dir/ip6cmdlist"; + PVE::Tools::file_set_contents($tmpfile, $cmdlistv6 || ''); + + ip6tables_restore_cmdlist($cmdlistv6); + + $tmpfile = "$pve_fw_status_dir/ipsetcmdlist2"; + PVE::Tools::file_set_contents($tmpfile, $ipset_delete_cmdlist || ''); + ipset_restore_cmdlist($ipset_delete_cmdlist) if $ipset_delete_cmdlist; # test: re-read status and check if everything is up to date @@ -3186,6 +3813,17 @@ sub apply_ruleset { } } + my $active_chainsv6 = iptables_get_chains("ip6tables"); + my $statushashv6 = get_ruleset_status($rulesetv6, $active_chainsv6, \&iptables_chain_digest, 0); + + foreach my $chain (sort keys %$rulesetv6) { + my $stat = $statushashv6->{$chain}; + if ($stat->{action} ne 'exists') { + warn "unable to update chain '$chain'\n"; + $errors = 1; + } + } + die "unable to apply firewall changes\n" if $errors; update_nf_conntrack_max($hostfw_conf); @@ -3230,7 +3868,16 @@ sub update_nf_conntrack_tcp_timeout_established { sub remove_pvefw_chains { - my ($chash, $hooks) = iptables_get_chains(); + PVE::Firewall::remove_pvefw_chains_iptables("iptables"); + PVE::Firewall::remove_pvefw_chains_iptables("ip6tables"); + PVE::Firewall::remove_pvefw_chains_ipset(); + +} + +sub remove_pvefw_chains_iptables { + my ($iptablescmd) = @_; + + my ($chash, $hooks) = iptables_get_chains($iptablescmd); my $cmdlist = "*filter\n"; foreach my $h (qw(INPUT OUTPUT FORWARD)) { @@ -3248,18 +3895,25 @@ sub remove_pvefw_chains { } $cmdlist .= "COMMIT\n"; - iptables_restore_cmdlist($cmdlist); + if($iptablescmd eq "ip6tables") { + ip6tables_restore_cmdlist($cmdlist); + } else { + iptables_restore_cmdlist($cmdlist); + } +} + +sub remove_pvefw_chains_ipset { my $ipset_chains = ipset_get_chains(); - $cmdlist = ""; + my $cmdlist = ""; foreach my $chain (keys %$ipset_chains) { - $cmdlist .= "flush $chain\n"; - $cmdlist .= "destroy $chain\n"; + $cmdlist .= "flush $chain\n"; + $cmdlist .= "destroy $chain\n"; } - ipset_restore_cmdlist($cmdlist) if $cmdlist; + ipset_restore_cmdlist($cmdlist) if $cmdlist; } sub init { @@ -3283,11 +3937,11 @@ sub update { return; } - my $hostfw_conf = load_hostfw_conf(); + my $hostfw_conf = load_hostfw_conf($cluster_conf); - my ($ruleset, $ipset_ruleset) = compile($cluster_conf, $hostfw_conf); + my ($ruleset, $ipset_ruleset, $rulesetv6) = compile($cluster_conf, $hostfw_conf); - apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset); + apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $rulesetv6); }; run_locked($code);