X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=d4de6f6eed702f84abd264b3307cb80dc34dcc96;hp=003dde67c7acbb2542e5ae1a3c8539aff5426e6d;hb=8f1192842a00af8626df1dfbb6a76c1f4944ac9b;hpb=edb75ba9dfab214380fd9eb31f9baaead5049e5e diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 003dde6..d4de6f6 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -8,14 +8,26 @@ use PVE::INotify; use PVE::Cluster; use PVE::ProcFSTools; use PVE::Tools; -use PVE::QemuServer; -use PVE::OpenVZ; # dependeny problem?! use File::Basename; use File::Path; use IO::File; use Net::IP; use PVE::Tools qw(run_command lock_file); +# dynamically include PVE::QemuServer and PVE::OpenVZ +# to avoid dependency problems +my $have_qemu_server; +eval { + require PVE::QemuServer; + $have_qemu_server = 1; +}; + +my $have_pve_manager; +eval { + require PVE::OpenVZ; + $have_pve_manager = 1; +}; + use Data::Dumper; my $nodename = PVE::INotify::nodename(); @@ -817,6 +829,7 @@ sub ruleset_create_chain { my ($ruleset, $chain) = @_; die "Invalid chain name '$chain' (28 char max)\n" if length($chain) > 28; + die "chain name may not contain collons\n" if $chain =~ m/:/; # because of log format die "chain '$chain' already exists\n" if $ruleset->{$chain}; @@ -845,32 +858,62 @@ sub ruleset_insertrule { unshift @{$ruleset->{$chain}}, "-A $chain $rule"; } +sub get_log_rule_base { + my ($chain, $vmid, $msg, $loglevel) = @_; + + die "internal error - no log level" if !defined($loglevel); + + $vmid = 0 if !defined($vmid); + + # Note: we use special format for prefix to pass further + # info to log daemon (VMID, LOGVELEL and CHAIN) + + return "-j NFLOG --nflog-prefix \":$vmid:$loglevel:$chain: $msg\""; +} + +sub ruleset_addlog { + my ($ruleset, $chain, $vmid, $msg, $loglevel, $rule) = @_; + + return if !defined($loglevel); + + my $logrule = get_log_rule_base($chain, $vmid, $msg, $loglevel); + + $logrule = "$rule $logrule" if defined($rule); + + ruleset_addrule($ruleset, $chain, $logrule) +} + sub generate_bridge_chains { - my ($ruleset, $hostfw_conf, $bridge) = @_; + my ($ruleset, $hostfw_conf, $bridge, $routing_table) = @_; + + my $options = $hostfw_conf->{options} || {}; + + die "error: detected direct route to bridge '$bridge'\n" + if !$options->{allow_bridge_route} && $routing_table->{$bridge}; if (!ruleset_chain_exist($ruleset, "$bridge-FW")) { ruleset_create_chain($ruleset, "$bridge-FW"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-bridged -j $bridge-FW"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-bridged -j $bridge-FW"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o $bridge -m physdev --physdev-is-out -j $bridge-FW"); + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i $bridge -m physdev --physdev-is-in -j $bridge-FW"); } if (!ruleset_chain_exist($ruleset, "$bridge-OUT")) { ruleset_create_chain($ruleset, "$bridge-OUT"); - ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-in -j $bridge-OUT"); - ruleset_insertrule($ruleset, "PVEFW-INPUT", "-i $bridge -m physdev --physdev-is-bridged --physdev-is-in -j $bridge-OUT"); + ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-in -j $bridge-OUT"); + ruleset_insertrule($ruleset, "PVEFW-INPUT", "-i $bridge -m physdev --physdev-is-in -j $bridge-OUT"); } if (!ruleset_chain_exist($ruleset, "$bridge-IN")) { ruleset_create_chain($ruleset, "$bridge-IN"); - ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-out -j $bridge-IN"); + ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j $bridge-IN"); ruleset_addrule($ruleset, "$bridge-FW", "-m mark --mark 1 -j ACCEPT"); # accept traffic to unmanaged bridge ports - ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-bridged --physdev-is-out -j ACCEPT "); + ruleset_addrule($ruleset, "$bridge-FW", "-m physdev --physdev-is-out -j ACCEPT "); } } sub ruleset_add_chain_policy { - my ($ruleset, $chain, $policy, $loglevel, $accept_action) = @_; + my ($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action) = @_; if ($policy eq 'ACCEPT') { @@ -881,15 +924,13 @@ sub ruleset_add_chain_policy { ruleset_addrule($ruleset, $chain, "-j PVEFW-Drop"); - ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"$chain-dropped: \" --log-level $loglevel") - if defined($loglevel); + ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel); ruleset_addrule($ruleset, $chain, "-j DROP"); } elsif ($policy eq 'REJECT') { ruleset_addrule($ruleset, $chain, "-j PVEFW-Reject"); - ruleset_addrule($ruleset, $chain, "-j LOG --log-prefix \"$chain-reject: \" --log-level $loglevel") - if defined($loglevel); + ruleset_addlog($ruleset, $chain, $vmid, "policy $policy: ", $loglevel); ruleset_addrule($ruleset, $chain, "-g PVEFW-reject"); } else { @@ -982,7 +1023,7 @@ sub generate_venet_rules_direction { } my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : "ACCEPT"; - ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action); # plug into FORWARD, INPUT and OUTPUT chain if ($direction eq 'OUT') { @@ -1009,7 +1050,7 @@ sub generate_venet_rules_direction { } sub generate_tap_rules_direction { - my ($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, $direction) = @_; + my ($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $vmid, $bridge, $direction) = @_; my $lc_direction = lc($direction); @@ -1034,12 +1075,16 @@ sub generate_tap_rules_direction { } my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : "ACCEPT"; - ruleset_add_chain_policy($ruleset, $tapchain, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $tapchain, $vmid, $policy, $loglevel, $accept_action); # plug the tap chain to bridge chain - my $physdevdirection = $direction eq 'IN' ? "out" : "in"; - my $rule = "-m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain"; - ruleset_insertrule($ruleset, "$bridge-$direction", $rule); + if ($direction eq 'IN') { + ruleset_insertrule($ruleset, "$bridge-IN", + "-m physdev --physdev-is-bridged --physdev-out $iface -j $tapchain"); + } else { + ruleset_insertrule($ruleset, "$bridge-OUT", + "-m physdev --physdev-in $iface -j $tapchain"); + } } sub enable_host_firewall { @@ -1060,7 +1105,7 @@ sub enable_host_firewall { ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT"); - ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync # we use RETURN because we need to check also tap rules @@ -1073,7 +1118,7 @@ sub enable_host_firewall { # implement input policy my $policy = $options->{policy_in} || 'DROP'; # allow nothing by default - ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action); # host outbound firewall $chain = "PVEFW-HOST-OUT"; @@ -1085,7 +1130,7 @@ sub enable_host_firewall { ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-o lo -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-m addrtype --dst-type MULTICAST -j ACCEPT"); - ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW -m multiport --dports 5404,5405 -j ACCEPT"); + ruleset_addrule($ruleset, $chain, "-p udp -m conntrack --ctstate NEW --dport 5404:5405 -j ACCEPT"); ruleset_addrule($ruleset, $chain, "-p udp -m udp --dport 9000 -j ACCEPT"); #corosync # we use RETURN because we may want to check other thigs later @@ -1098,7 +1143,7 @@ sub enable_host_firewall { # implement output policy $policy = $options->{policy_out} || 'ACCEPT'; # allow everything by default - ruleset_add_chain_policy($ruleset, $chain, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action); ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-j PVEFW-HOST-OUT"); ruleset_addrule($ruleset, "PVEFW-INPUT", "-j PVEFW-HOST-IN"); @@ -1109,7 +1154,7 @@ sub generate_group_rules { die "no such security group '$group'\n" if !$groups_conf->{$group}; - my $rules = $groups_conf->{$group}->{rules}; + my $rules = $groups_conf->{rules}->{$group}; my $chain = "GROUP-${group}-IN"; @@ -1309,7 +1354,7 @@ sub parse_hostfw_option { my $loglevels = "emerg|alert|crit|err|warning|notice|info|debug|nolog"; - if ($line =~ m/^(enable|dhcp|nosmurfs|tcpflags):\s*(0|1)\s*$/i) { + if ($line =~ m/^(enable|dhcp|nosmurfs|tcpflags|allow_bridge_route):\s*(0|1)\s*$/i) { $opt = lc($1); $value = int($2); } elsif ($line =~ m/^(log_level_in|log_level_out|tcp_flags_log_level|smurf_log_level):\s*(($loglevels)\s*)?$/i) { @@ -1431,7 +1476,7 @@ sub parse_group_fw_rules { my $section; my $group; - my $res = { rules => [] }; + my $res = { rules => {} }; while (defined(my $line = <$fh>)) { next if $line =~ m/^#/; @@ -1457,7 +1502,7 @@ sub parse_group_fw_rules { next; } - push @{$res->{$group}->{$section}}, @$rules; + push @{$res->{$section}->{$group}}, @$rules; } return $res; @@ -1492,18 +1537,22 @@ sub read_local_vm_config { next if !$d->{node} || $d->{node} ne $nodename; next if !$d->{type}; if ($d->{type} eq 'openvz') { - my $cfspath = PVE::OpenVZ::cfs_config_path($vmid); - if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { - $openvz->{$vmid} = $conf; + if ($have_pve_manager) { + my $cfspath = PVE::OpenVZ::cfs_config_path($vmid); + if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { + $openvz->{$vmid} = $conf; + } } } elsif ($d->{type} eq 'qemu') { - my $cfspath = PVE::QemuServer::cfs_config_path($vmid); - if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { - $qemu->{$vmid} = $conf; + if ($have_qemu_server) { + my $cfspath = PVE::QemuServer::cfs_config_path($vmid); + if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) { + $qemu->{$vmid} = $conf; + } } } } - + return $vmdata; }; @@ -1545,25 +1594,17 @@ sub generate_std_chains { my $loglevel = get_option_log_level($options, 'smurf_log_level'); # same as shorewall smurflog. - if (defined($loglevel)) { - $pve_std_chains-> {'PVEFW-smurflog'} = [ - "-j LOG --log-prefix \"smurfs-dropped: \" --log-level $loglevel", - "-j DROP", - ]; - } else { - $pve_std_chains-> {'PVEFW-smurflog'} = [ "-j DROP" ]; - } + my $chain = 'PVEFW-smurflog'; + + push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel; + push @{$pve_std_chains->{$chain}}, "-j DROP"; # same as shorewall logflags action. $loglevel = get_option_log_level($options, 'tcp_flags_log_level'); - if (defined($loglevel)) { - $pve_std_chains-> {'PVEFW-logflags'} = [ - "-j LOG --log-prefix \"logflags-dropped: \" --log-level $loglevel --log-ip-options", - "-j DROP", - ]; - } else { - $pve_std_chains-> {'PVEFW-logflags'} = [ "-j DROP" ]; - } + $chain = 'PVEFW-logflags'; + # fixme: is this correctly logged by pvewf-logger? (ther is no --log-ip-options for NFLOG) + push @{$pve_std_chains->{$chain}}, get_log_rule_base($chain, 0, "DROP: ", $loglevel) if $loglevel; + push @{$pve_std_chains->{$chain}}, "-j DROP"; foreach my $chain (keys %$pve_std_chains) { ruleset_create_chain($ruleset, $chain); @@ -1601,9 +1642,35 @@ sub read_pvefw_status { return $status; } -sub compile { - my $vmdata = read_local_vm_config(); - my $vmfw_configs = read_vm_firewall_configs($vmdata); +# fixme: move to pve-common PVE::ProcFSTools +sub read_proc_net_route { + my $filename = "/proc/net/route"; + + my $res = {}; + + my $fh = IO::File->new ($filename, "r"); + return $res if !$fh; + + my $int_to_quad = sub { + return join '.' => map { ($_[0] >> 8*(3-$_)) % 256 } (3, 2, 1, 0); + }; + + while (defined(my $line = <$fh>)) { + next if $line =~/^Iface\s+Destination/; # skip head + my ($iface, $dest, $gateway, $metric, $mask, $mtu) = (split(/\s+/, $line))[0,1,2,6,7,8]; + push @{$res->{$iface}}, { + dest => &$int_to_quad(hex($dest)), + gateway => &$int_to_quad(hex($gateway)), + mask => &$int_to_quad(hex($mask)), + metric => $metric, + mtu => $mtu, + }; + } + + return $res; +} + +sub load_security_groups { my $groups_conf = {}; my $filename = "/etc/pve/firewall/groups.fw"; @@ -1611,6 +1678,17 @@ sub compile { $groups_conf = parse_group_fw_rules($filename, $fh); } + return $groups_conf; +} + +sub compile { + my $vmdata = read_local_vm_config(); + my $vmfw_configs = read_vm_firewall_configs($vmdata); + + my $routing_table = read_proc_net_route(); + + my $groups_conf = load_security_groups(); + my $ruleset = {}; ruleset_create_chain($ruleset, "PVEFW-INPUT"); @@ -1621,7 +1699,7 @@ sub compile { my $hostfw_options = {}; my $hostfw_conf = {}; - $filename = "/etc/pve/local/host.fw"; + my $filename = "/etc/pve/local/host.fw"; if (my $fh = IO::File->new($filename, O_RDONLY)) { $hostfw_conf = parse_host_fw_rules($filename, $fh); $hostfw_options = $hostfw_conf->{options}; @@ -1651,11 +1729,13 @@ sub compile { $bridge .= "v$net->{tag}" if $net->{tag}; - generate_bridge_chains($ruleset, $hostfw_conf, $bridge); + generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table); my $macaddr = $net->{macaddr}; - generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN'); - generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT'); + generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, $bridge, 'IN'); + generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, $bridge, 'OUT'); } } @@ -1682,10 +1762,15 @@ sub compile { warn "no bridge device for CT $vmid iface '$netid'\n"; next; # fixme? } - my $macaddr = $d->{host_mac}; + + generate_bridge_chains($ruleset, $hostfw_conf, $bridge, $routing_table); + + my $macaddr = $d->{mac}; my $iface = $d->{host_ifname}; - generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN'); - generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT'); + generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, $bridge, 'IN'); + generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, + $vmfw_conf, $vmid, $bridge, 'OUT'); } } } @@ -1696,12 +1781,16 @@ sub compile { # fixme: what log level should we use here? my $loglevel = get_option_log_level($hostfw_options, "log_level_out"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j ACCEPT"); + # fixme: should we really block inter-bridge traffic? + + # always allow traffic from containers? + ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i venet0 -j RETURN"); + # disable interbridge routing ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j PVEFW-Drop"); ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j PVEFW-Drop"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel"); - ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j LOG --log-prefix \"PVEFW-FORWARD-dropped \" --log-level $loglevel"); + ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-o vmbr+"); + ruleset_addlog($ruleset, "PVEFW-FORWARD", 0, "DROP: ", $loglevel, "-i vmbr+"); ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o vmbr+ -j DROP"); ruleset_addrule($ruleset, "PVEFW-FORWARD", "-i vmbr+ -j DROP");