X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=c03d91a449810d8d034b0e43d206239dd778e464;hp=941e62a934b9b8bed35cc096b538de428a69195f;hb=2a052ee388223312d862eaf94619d574c97ee3da;hpb=fca39c2cafd333ff0c572f18bdd13fcfe2c1c56a diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 941e62a..c03d91a 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -791,12 +791,6 @@ sub enable_bridge_firewall { my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n"; -sub iptables { - my ($cmd) = @_; - - run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {}); -} - sub iptables_restore_cmdlist { my ($cmdlist) = @_; @@ -833,6 +827,8 @@ sub iptables_get_chains { my $table = ''; + my $hooks = {}; + my $parser = sub { my $line = shift; @@ -854,6 +850,8 @@ sub iptables_get_chains { my ($chain, $sig) = ($1, $2); return if !&$is_pvefw_chain($chain); $res->{$chain} = $sig; + } elsif ($line =~ m/^-A\s+(INPUT|OUTPUT|FORWARD)\s+-j\s+PVEFW-\1$/) { + $hooks->{$1} = 1; } else { # simply ignore the rest return; @@ -862,11 +860,21 @@ sub iptables_get_chains { run_command("/sbin/iptables-save", outfunc => $parser); - return $res; + return wantarray ? ($res, $hooks) : $res; +} + +sub iptables_chain_digest { + my ($rules) = @_; + my $digest = Digest::SHA->new('sha1'); + foreach my $rule (@$rules) { # order is important + $digest->add($rule); + } + return $digest->b64digest; } sub ipset_chain_digest { my ($rules) = @_; + my $digest = Digest::SHA->new('sha1'); foreach my $rule (sort @$rules) { # note: sorted $digest->add($rule); @@ -902,28 +910,6 @@ sub ipset_get_chains { return $res; } -sub iptables_chain_exist { - my ($chain) = @_; - - eval{ - iptables("-n --list $chain"); - }; - return undef if $@; - - return 1; -} - -sub iptables_rule_exist { - my ($rule) = @_; - - eval{ - iptables("-C $rule"); - }; - return undef if $@; - - return 1; -} - sub ruleset_generate_cmdstr { my ($ruleset, $chain, $rule, $actions, $goto) = @_; @@ -1468,9 +1454,9 @@ sub enable_host_firewall { sub generate_group_rules { my ($ruleset, $cluster_conf, $group) = @_; - die "no such security group '$group'\n" if !$cluster_conf->{rules}->{$group}; + die "no such security group '$group'\n" if !$cluster_conf->{groups}->{$group}; - my $rules = $cluster_conf->{rules}->{$group}; + my $rules = $cluster_conf->{groups}->{$group}; my $chain = "GROUP-${group}-IN"; @@ -1640,6 +1626,22 @@ sub parse_hostfw_option { return ($opt, $value); } +sub parse_clusterfw_option { + my ($line) = @_; + + my ($opt, $value); + + if ($line =~ m/^(enable):\s*(0|1)\s*$/i) { + $opt = lc($1); + $value = int($2); + } else { + chomp $line; + die "can't parse option '$line'\n" + } + + return ($opt, $value); +} + sub parse_vm_fw_rules { my ($filename, $fh) = @_; @@ -1748,13 +1750,13 @@ sub parse_host_fw_rules { return $res; } -sub parse_group_fw_rules { +sub parse_cluster_fw_rules { my ($filename, $fh) = @_; my $section; my $group; - my $res = { rules => {}, ipset => {} }; + my $res = { rules => [], options => {}, groups => {}, ipset => {} }; my $digest = Digest::SHA->new('sha1'); @@ -1767,33 +1769,48 @@ sub parse_group_fw_rules { my $linenr = $fh->input_line_number(); my $prefix = "$filename (line $linenr)"; - if ($line =~ m/^\[group\s+(\S+)\]\s*$/i) { - $section = 'rules'; - $group = lc($1); + if ($line =~ m/^\[options\]$/i) { + $section = 'options'; next; } - if ($line =~ m/^\[ipgroup\s+(\S+)\]\s*$/i) { - $section = 'ipset'; + if ($line =~ m/^\[group\s+(\S+)\]\s*$/i) { + $section = 'groups'; $group = lc($1); - $res->{$section}->{$group}->{type} = 'hash:ip family inet hashsize 1024 maxelem 65536 '; + next; + } + if ($line =~ m/^\[rules\]$/i) { + $section = 'rules'; next; } + if ($line =~ m/^\[netgroup\s+(\S+)\]\s*$/i) { $section = 'ipset'; $group = lc($1); - $res->{$section}->{$group}->{type} = 'hash:net family inet hashsize 1024 maxelem 65536 '; - next; } - if (!$section || !$group) { + if (!$section) { warn "$prefix: skip line - no section"; next; } - if ($section eq 'rules') { + if ($section eq 'options') { + eval { + my ($opt, $value) = parse_clusterfw_option($line); + $res->{options}->{$opt} = $value; + }; + warn "$prefix: $@" if $@; + } elsif ($section eq 'rules') { + my $rule; + eval { $rule = parse_fw_rule($line, 1, 1); }; + if (my $err = $@) { + warn "$prefix: $err"; + next; + } + push @{$res->{$section}}, $rule; + } elsif ($section eq 'groups') { my $rule; eval { $rule = parse_fw_rule($line, 0, 0); }; if (my $err = $@) { @@ -1801,22 +1818,27 @@ sub parse_group_fw_rules { next; } push @{$res->{$section}->{$group}}, $rule; - } elsif ($section eq 'ipset') { chomp $line; - my $ip; - if (!Net::IP->new($line)) { + $line =~ m/^(\!)?(\s)?((\d+)\.(\d+)\.(\d+)\.(\d+)(\/(\d+))?)/; + my $nomatch = $1; + my $ip = $3; + + if(!$ip){ warn "$prefix: $line is not an valid ip address"; next; } - push @{$res->{$section}->{$group}->{ip}}, $line; - } + if (!Net::IP->new($ip)) { + warn "$prefix: $line is not an valid ip address"; + next; + } + $ip .= " nomatch" if $nomatch; - + push @{$res->{$section}->{$group}}, $ip; + } } $res->{digest} = $digest->b64digest; - return $res; } @@ -1952,13 +1974,30 @@ sub generate_ipset_chains { sub generate_ipset { my ($ipset_ruleset, $name, $options) = @_; - push @{$ipset_ruleset->{$name}}, "create $name $options->{type}"; + my $hashsize = @{$options}; + if ($hashsize <= 64){ + $hashsize = 64; + }else{ + $hashsize = round_powerof2($hashsize); + } - foreach my $ip (@{$options->{ip}}) { + push @{$ipset_ruleset->{$name}}, "create $name hash:net family inet hashsize $hashsize maxelem $hashsize "; + + foreach my $ip (@{$options}) { push @{$ipset_ruleset->{$name}}, "add $name $ip"; } + +} + +sub round_powerof2 { + my ($int) = @_; + + $int--; + $int |= $int >> $_ foreach (1,2,4,8,16); + return ++$int; } + sub save_pvefw_status { my ($status) = @_; @@ -2015,39 +2054,66 @@ sub load_clusterfw_conf { my $cluster_conf = {}; if (my $fh = IO::File->new($clusterfw_conf_filename, O_RDONLY)) { - $cluster_conf = parse_group_fw_rules($clusterfw_conf_filename, $fh); + $cluster_conf = parse_cluster_fw_rules($clusterfw_conf_filename, $fh); } return $cluster_conf; } +my $rules_to_conf = sub { + my ($rules, $need_iface) = @_; + + my $raw = ''; + + foreach my $rule (@$rules) { + if ($rule->{type} eq 'in' || $rule->{type} eq 'out') { + $raw .= '|' if defined($rule->{enable}) && !$rule->{enable}; + $raw .= uc($rule->{type}); + $raw .= " " . $rule->{action}; + $raw .= " " . ($rule->{iface} || '-') if $need_iface; + $raw .= " " . ($rule->{source} || '-'); + $raw .= " " . ($rule->{dest} || '-'); + $raw .= " " . ($rule->{proto} || '-'); + $raw .= " " . ($rule->{dport} || '-'); + $raw .= " " . ($rule->{sport} || '-'); + $raw .= " # " . encode('utf8', $rule->{comment}) + if $rule->{comment} && $rule->{comment} !~ m/^\s*$/; + $raw .= "\n"; + } else { + die "implement me '$rule->{type}'"; + } + } + + return $raw; +}; + sub save_clusterfw_conf { my ($cluster_conf) = @_; my $raw = ''; - foreach my $group (sort keys %{$cluster_conf->{rules}}) { - my $rules = $cluster_conf->{rules}->{$group}; - $raw .= "[group $group]\n\n"; - - foreach my $rule (@$rules) { - if ($rule->{type} eq 'in' || $rule->{type} eq 'out') { - $raw .= '|' if defined($rule->{enable}) && !$rule->{enable}; - $raw .= uc($rule->{type}); - $raw .= " " . $rule->{action}; - $raw .= " " . ($rule->{source} || '-'); - $raw .= " " . ($rule->{dest} || '-'); - $raw .= " " . ($rule->{proto} || '-'); - $raw .= " " . ($rule->{dport} || '-'); - $raw .= " " . ($rule->{sport} || '-'); - $raw .= " # " . encode('utf8', $rule->{comment}) - if $rule->{comment} && $rule->{comment} !~ m/^\s*$/; - $raw .= "\n"; - } else { - die "implement me '$rule->{type}'"; - } + my $options = $cluster_conf->{options}; + if (scalar(keys %$options)) { + $raw .= "[OPTIONS]\n\n"; + foreach my $opt (keys %$options) { + $raw .= "$opt: $options->{$opt}\n"; } + $raw .= "\n"; + } + + # fixme: save ipset + my $rules = $cluster_conf->{rules}; + if (scalar(@$rules)) { + $raw .= "[RULES]\n\n"; + $raw .= &$rules_to_conf($rules, 1); + $raw .= "\n"; + } + + foreach my $group (sort keys %{$cluster_conf->{groups}}) { + my $rules = $cluster_conf->{groups}->{$group}; + $raw .= "[group $group]\n\n"; + $raw .= &$rules_to_conf($rules, 0); $raw .= "\n"; } @@ -2182,19 +2248,13 @@ sub compile { } sub get_ruleset_status { - my ($ruleset, $verbose, $ipset) = @_; - - my $active_chains = undef; - if($ipset){ - $active_chains = ipset_get_chains(); - }else{ - $active_chains = iptables_get_chains(); - } + my ($ruleset, $active_chains, $digest_fn, $verbose) = @_; my $statushash = {}; foreach my $chain (sort keys %$ruleset) { - my $sig = ipset_chain_digest($ruleset->{$chain}); + my $sig = &$digest_fn($ruleset->{$chain}); + $statushash->{$chain}->{sig} = $sig; my $oldsig = $active_chains->{$chain}; @@ -2221,7 +2281,7 @@ sub get_ruleset_status { print "delete $chain ($sig)\n" if $verbose; } } - + return $statushash; } @@ -2232,12 +2292,13 @@ sub print_sig_rule { return "-A $chain -m comment --comment \"PVESIG:$sig\"\n"; } -sub get_rulset_cmdlist { +sub get_ruleset_cmdlist { my ($ruleset, $verbose) = @_; my $cmdlist = "*filter\n"; # we pass this to iptables-restore; - - my $statushash = get_ruleset_status($ruleset, $verbose); + + my ($active_chains, $hooks) = iptables_get_chains(); + my $statushash = get_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, $verbose); # create missing chains first foreach my $chain (sort keys %$ruleset) { @@ -2248,18 +2309,10 @@ sub get_rulset_cmdlist { $cmdlist .= ":$chain - [0:0]\n"; } - my $rule = "INPUT -j PVEFW-INPUT"; - if (!PVE::Firewall::iptables_rule_exist($rule)) { - $cmdlist .= "-A $rule\n"; - } - $rule = "OUTPUT -j PVEFW-OUTPUT"; - if (!PVE::Firewall::iptables_rule_exist($rule)) { - $cmdlist .= "-A $rule\n"; - } - - $rule = "FORWARD -j PVEFW-FORWARD"; - if (!PVE::Firewall::iptables_rule_exist($rule)) { - $cmdlist .= "-A $rule\n"; + foreach my $h (qw(INPUT OUTPUT FORWARD)) { + if (!$hooks->{$h}) { + $cmdlist .= "-A $h -j PVEFW-$h\n"; + } } foreach my $chain (sort keys %$ruleset) { @@ -2294,49 +2347,54 @@ sub get_rulset_cmdlist { } my $changes = $cmdlist ne "*filter\n" ? 1 : 0; - + $cmdlist .= "COMMIT\n"; return wantarray ? ($cmdlist, $changes) : $cmdlist; } sub get_ipset_cmdlist { - my ($ruleset, $verbose) = @_; + my ($ruleset, $delete, $verbose) = @_; my $cmdlist = ""; - my $statushash = get_ruleset_status($ruleset, $verbose, 1); + my $active_chains = ipset_get_chains(); + my $statushash = get_ruleset_status($ruleset, $active_chains, \&ipset_chain_digest, $verbose); - foreach my $chain (sort keys %$ruleset) { - my $stat = $statushash->{$chain}; - die "internal error" if !$stat; + if(!$delete){ - if ($stat->{action} eq 'create') { - foreach my $cmd (@{$ruleset->{$chain}}) { + foreach my $chain (sort keys %$ruleset) { + my $stat = $statushash->{$chain}; + die "internal error" if !$stat; + + if ($stat->{action} eq 'create') { + foreach my $cmd (@{$ruleset->{$chain}}) { $cmdlist .= "$cmd\n"; + } } - } - if ($stat->{action} eq 'update') { - my $chain_swap = $chain."_swap"; - - foreach my $cmd (@{$ruleset->{$chain}}) { - $cmd =~ s/$chain/$chain_swap/; - $cmdlist .= "$cmd\n"; + if ($stat->{action} eq 'update') { + my $chain_swap = $chain."_swap"; + foreach my $cmd (@{$ruleset->{$chain}}) { + $cmd =~ s/$chain/$chain_swap/; + $cmdlist .= "$cmd\n"; + } + $cmdlist .= "swap $chain_swap $chain\n"; + $cmdlist .= "flush $chain_swap\n"; + $cmdlist .= "destroy $chain_swap\n"; } - $cmdlist .= "swap $chain_swap $chain\n"; - $cmdlist .= "flush $chain_swap\n"; - $cmdlist .= "destroy $chain_swap\n"; - } - } + } - foreach my $chain (keys %$statushash) { - next if $statushash->{$chain}->{action} ne 'delete'; + }else{ - $cmdlist .= "flush $chain\n"; - $cmdlist .= "destroy $chain\n"; + foreach my $chain (keys %$statushash) { + next if $statushash->{$chain}->{action} ne 'delete'; + + $cmdlist .= "flush $chain\n"; + $cmdlist .= "destroy $chain\n"; + } } my $changes = $cmdlist ? 1 : 0; @@ -2351,20 +2409,27 @@ sub apply_ruleset { update_nf_conntrack_max($hostfw_conf); - my $ipsetcmdlist = get_ipset_cmdlist($ipset_ruleset, $verbose); + my $ipset_create_cmdlist = get_ipset_cmdlist($ipset_ruleset, undef, $verbose); - my $cmdlist = get_rulset_cmdlist($ruleset, $verbose); + my $ipset_delete_cmdlist = get_ipset_cmdlist($ipset_ruleset, 1, $verbose); - print $ipsetcmdlist if $verbose; + my $cmdlist = get_ruleset_cmdlist($ruleset, $verbose); + + print $ipset_create_cmdlist if $verbose; + + print $ipset_delete_cmdlist if $verbose; print $cmdlist if $verbose; - ipset_restore_cmdlist($ipsetcmdlist); + ipset_restore_cmdlist($ipset_create_cmdlist); iptables_restore_cmdlist($cmdlist); + ipset_restore_cmdlist($ipset_delete_cmdlist); + # test: re-read status and check if everything is up to date - my $statushash = get_ruleset_status($ruleset); + my $active_chains = iptables_get_chains(); + my $statushash = get_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, $verbose); my $errors; foreach my $chain (sort keys %$ruleset) { @@ -2402,6 +2467,29 @@ sub update_nf_conntrack_max { } } +sub remove_pvefw_chains { + + my ($chash, $hooks) = iptables_get_chains(); + my $cmdlist = "*filter\n"; + + foreach my $h (qw(INPUT OUTPUT FORWARD)) { + if ($hooks->{$h}) { + $cmdlist .= "-D $h -j PVEFW-$h\n"; + } + } + + foreach my $chain (keys %$chash) { + $cmdlist .= "-F $chain\n"; + } + + foreach my $chain (keys %$chash) { + $cmdlist .= "-X $chain\n"; + } + $cmdlist .= "COMMIT\n"; + + iptables_restore_cmdlist($cmdlist); +} + sub update { my ($start, $verbose) = @_;