X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=f75b2954d215e9c06d472ff367392a30cda498b6;hp=e99019e4d1421a99e4f802441ef3121dd9521234;hb=b828ae3d3498a26497f896b6b010b7dcd1b65204;hpb=006490cb2f0e6eed699f1f451e5beaf6b78ef52f diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index e99019e..f75b295 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -5,12 +5,13 @@ use strict; use POSIX; use Data::Dumper; use Digest::SHA; +use Socket qw(AF_INET6 inet_ntop inet_pton); use PVE::INotify; use PVE::Exception qw(raise raise_param_exc); use PVE::JSONSchema qw(register_standard_option get_standard_option); use PVE::Cluster; use PVE::ProcFSTools; -use PVE::Tools qw($IPV4RE); +use PVE::Tools qw($IPV4RE $IPV6RE); use File::Basename; use File::Path; use IO::File; @@ -36,19 +37,23 @@ eval { $have_pve_manager = 1; }; +my $pve_fw_status_dir = "/var/lib/pve-firewall"; + +mkdir $pve_fw_status_dir; # make sure this exists + my $security_group_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; my $ipset_name_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; -my $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; +our $ip_alias_pattern = '[A-Za-z][A-Za-z0-9\-\_]+'; my $max_alias_name_length = 64; my $max_ipset_name_length = 64; my $max_group_name_length = 20; -PVE::JSONSchema::register_format('IPv4orCIDR', \&pve_verify_ipv4_or_cidr); -sub pve_verify_ipv4_or_cidr { +PVE::JSONSchema::register_format('IPorCIDR', \&pve_verify_ip_or_cidr); +sub pve_verify_ip_or_cidr { my ($cidr, $noerr) = @_; - if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) { + if ($cidr =~ m!^(?:$IPV6RE|$IPV4RE)(/(\d+))?$!) { return $cidr if Net::IP->new($cidr); return undef if $noerr; die Net::IP::Error() . "\n"; @@ -57,19 +62,13 @@ sub pve_verify_ipv4_or_cidr { die "value does not look like a valid IP address or CIDR network\n"; } -PVE::JSONSchema::register_format('IPv4orCIDRorAlias', \&pve_verify_ipv4_or_cidr_or_alias); -sub pve_verify_ipv4_or_cidr_or_alias { +PVE::JSONSchema::register_format('IPorCIDRorAlias', \&pve_verify_ip_or_cidr_or_alias); +sub pve_verify_ip_or_cidr_or_alias { my ($cidr, $noerr) = @_; return if $cidr =~ m/^(?:$ip_alias_pattern)$/; - if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) { - return $cidr if Net::IP->new($cidr); - return undef if $noerr; - die Net::IP::Error() . "\n"; - } - return undef if $noerr; - die "value does not look like a valid IP address or CIDR network\n"; + return pve_verify_ip_or_cidr($cidr, $noerr); } PVE::JSONSchema::register_standard_option('ipset-name', { @@ -133,6 +132,17 @@ my $log_level_hash = { emerg => 0, }; +# we need to overwrite some macros for ipv6 +my $pve_ipv6fw_macros = { + 'Ping' => [ + { action => 'PARAM', proto => 'icmpv6', dport => 'echo-request' }, + ], + 'Trcrt' => [ + { action => 'PARAM', proto => 'udp', dport => '33434:33524' }, + { action => 'PARAM', proto => 'icmpv6', dport => 'echo-request' }, + ], + }; + # imported/converted from: /usr/share/shorewall/macro.* my $pve_fw_macros = { 'Amanda' => [ @@ -577,6 +587,92 @@ $pve_std_chains->{4} = { ], }; +$pve_std_chains->{6} = { + 'PVEFW-SET-ACCEPT-MARK' => [ + "-j MARK --set-mark 1", + ], + 'PVEFW-DropBroadcast' => [ + # same as shorewall 'Broadcast' + # simply DROP BROADCAST/MULTICAST/ANYCAST + # we can use this to reduce logging + #{ action => 'DROP', dsttype => 'BROADCAST' }, #no broadcast in ipv6 + # ipv6 addrtype does not work with kernel 2.6.32 + #{ action => 'DROP', dsttype => 'MULTICAST' }, + #{ action => 'DROP', dsttype => 'ANYCAST' }, + { action => 'DROP', dest => 'ff00::/8' }, + #{ action => 'DROP', dest => '224.0.0.0/4' }, + ], + 'PVEFW-reject' => [ + # same as shorewall 'reject' + #{ action => 'DROP', dsttype => 'BROADCAST' }, + #{ action => 'DROP', source => '224.0.0.0/4' }, + { action => 'DROP', proto => 'icmpv6' }, + "-p tcp -j REJECT --reject-with tcp-reset", + #"-p udp -j REJECT --reject-with icmp-port-unreachable", + #"-p icmp -j REJECT --reject-with icmp-host-unreachable", + #"-j REJECT --reject-with icmp-host-prohibited", + ], + 'PVEFW-Drop' => [ + # same as shorewall 'Drop', which is equal to DROP, + # but REJECT/DROP some packages to reduce logging, + # and ACCEPT critical ICMP types + { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, # REJECT 'auth' + # we are not interested in BROADCAST/MULTICAST/ANYCAST + { action => 'PVEFW-DropBroadcast' }, + # ACCEPT critical ICMP types + { action => 'ACCEPT', proto => 'icmpv6', dport => 'destination-unreachable' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'time-exceeded' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'packet-too-big' }, + + # Drop packets with INVALID state + "-m conntrack --ctstate INVALID -j DROP", + # Drop Microsoft SMB noise + { action => 'DROP', proto => 'udp', dport => '135,445', nbdport => 2 }, + { action => 'DROP', proto => 'udp', dport => '137:139'}, + { action => 'DROP', proto => 'udp', dport => '1024:65535', sport => 137 }, + { action => 'DROP', proto => 'tcp', dport => '135,139,445', nbdport => 3 }, + { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP + # Drop new/NotSyn traffic so that it doesn't get logged + "-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP", + # Drop DNS replies + { action => 'DROP', proto => 'udp', sport => 53 }, + ], + 'PVEFW-Reject' => [ + # same as shorewall 'Reject', which is equal to Reject, + # but REJECT/DROP some packages to reduce logging, + # and ACCEPT critical ICMP types + { action => 'PVEFW-reject', proto => 'tcp', dport => '43' }, # REJECT 'auth' + # we are not interested in BROADCAST/MULTICAST/ANYCAST + { action => 'PVEFW-DropBroadcast' }, + # ACCEPT critical ICMP types + { action => 'ACCEPT', proto => 'icmpv6', dport => 'destination-unreachable' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'time-exceeded' }, + { action => 'ACCEPT', proto => 'icmpv6', dport => 'packet-too-big' }, + + # Drop packets with INVALID state + "-m conntrack --ctstate INVALID -j DROP", + # Drop Microsoft SMB noise + { action => 'PVEFW-reject', proto => 'udp', dport => '135,445', nbdport => 2 }, + { action => 'PVEFW-reject', proto => 'udp', dport => '137:139'}, + { action => 'PVEFW-reject', proto => 'udp', dport => '1024:65535', sport => 137 }, + { action => 'PVEFW-reject', proto => 'tcp', dport => '135,139,445', nbdport => 3 }, + { action => 'DROP', proto => 'udp', dport => 1900 }, # UPnP + # Drop new/NotSyn traffic so that it doesn't get logged + "-p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP", + # Drop DNS replies + { action => 'DROP', proto => 'udp', sport => 53 }, + ], + 'PVEFW-tcpflags' => [ + # same as shorewall tcpflags action. + # Packets arriving on this interface are checked for som illegal combinations of TCP flags + "-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g PVEFW-logflags", + "-p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g PVEFW-logflags", + "-p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g PVEFW-logflags", + "-p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g PVEFW-logflags", + "-p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g PVEFW-logflags", + ], +}; + # iptables -p icmp -h my $icmp_type_names = { any => 1, @@ -618,6 +714,32 @@ my $icmp_type_names = { 'address-mask-reply' => 1, }; +# ip6tables -p icmpv6 -h + +my $icmpv6_type_names = { + 'any' => 1, + 'destination-unreachable' => 1, + 'no-route' => 1, + 'communication-prohibited' => 1, + 'address-unreachable' => 1, + 'port-unreachable' => 1, + 'packet-too-big' => 1, + 'time-exceeded' => 1, + 'ttl-zero-during-transit' => 1, + 'ttl-zero-during-reassembly' => 1, + 'parameter-problem' => 1, + 'bad-header' => 1, + 'unknown-header-type' => 1, + 'unknown-option' => 1, + 'echo-request' => 1, + 'echo-reply' => 1, + 'router-solicitation' => 1, + 'router-advertisement' => 1, + 'neighbour-solicitation' => 1, + 'neighbour-advertisement' => 1, + 'redirect' => 1, +}; + sub init_firewall_macros { $pve_fw_parsed_macros = {}; @@ -704,6 +826,10 @@ sub get_etc_protocols { close($fh); + # add special case for ICMP v6 + $protocols->{byid}->{icmpv6}->{name} = "icmpv6"; + $protocols->{byname}->{icmpv6} = $protocols->{byid}->{icmpv6}; + $etc_protocols = $protocols; return $etc_protocols; @@ -761,20 +887,21 @@ sub local_network { return $__local_network; } -# ipset names are limited to 31 characters, and we use '_swap' -# suffix for atomic update, for example PVEFW-${VMID}-${ipset_name}_swap +# ipset names are limited to 31 characters, +# and we use '-v4' or '-v6' to indicate IP versions, +# and we use '_swap' suffix for atomic update, +# for example PVEFW-${VMID}-${ipset_name}_swap -my $max_iptables_ipset_name_length = 31 - length("_swap"); +my $max_iptables_ipset_name_length = 31 - length("PVEFW-") - length("_swap"); sub compute_ipset_chain_name { - my ($vmid, $ipset_name) = @_; + my ($vmid, $ipset_name, $ipversion) = @_; $vmid = 0 if !defined($vmid); - my $id = "$vmid-${ipset_name}"; + my $id = "$vmid-${ipset_name}-v$ipversion"; - - if ((length($id) + 6) > $max_iptables_ipset_name_length) { + if (length($id) > $max_iptables_ipset_name_length) { $id = PVE::Tools::fnv31a_hex($id); } @@ -845,6 +972,8 @@ sub parse_port_name_number_or_range { } else { if ($icmp_type_names->{$item}) { $icmp_port = 1; + } elsif ($icmpv6_type_names->{$item}) { + $icmp_port = 1; } else { die "invalid port '$item'\n" if !$services->{byname}->{$item}; } @@ -1021,11 +1150,15 @@ sub delete_rule_properties { } my $apply_macro = sub { - my ($macro_name, $param, $verify) = @_; + my ($macro_name, $param, $verify, $ipversion) = @_; my $macro_rules = $pve_fw_parsed_macros->{$macro_name}; die "unknown macro '$macro_name'\n" if !$macro_rules; # should not happen + if ($ipversion && ($ipversion == 6) && $pve_ipv6fw_macros->{$macro_name}) { + $macro_rules = $pve_ipv6fw_macros->{$macro_name}; + } + my $rules = []; foreach my $templ (@$macro_rules) { @@ -1099,8 +1232,18 @@ sub verify_rule { $errors->{$param} = $msg if !$errors->{$param}; }; + my $ipversion; + my $set_ip_version = sub { + my $vers = shift; + if ($vers) { + die "detected mixed ipv4/ipv6 adresses in rule\n" + if $ipversion && ($vers != $ipversion); + $ipversion = $vers; + } + }; + my $check_ipset_or_alias_property = sub { - my ($name) = @_; + my ($name, $expected_ipversion) = @_; if (my $value = $rule->{$name}) { if ($value =~ m/^\+/) { @@ -1114,7 +1257,11 @@ sub verify_rule { } elsif ($value =~ m/^${ip_alias_pattern}$/){ my $alias = lc($value); &$add_error($name, "no such alias '$value'") - if !($cluster_conf->{aliases}->{$alias} || ($fw_conf && $fw_conf->{aliases}->{$alias})) + if !($cluster_conf->{aliases}->{$alias} || ($fw_conf && $fw_conf->{aliases}->{$alias})); + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; + $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; + + &$set_ip_version($e->{ipversion}); } } }; @@ -1164,6 +1311,8 @@ sub verify_rule { if ($rule->{proto}) { eval { pve_fw_verify_protocol_spec($rule->{proto}); }; &$add_error('proto', $@) if $@; + &$set_ip_version(4) if $rule->{proto} eq 'icmp'; + &$set_ip_version(6) if $rule->{proto} eq 'icmpv6'; } if ($rule->{dport}) { @@ -1180,27 +1329,28 @@ sub verify_rule { if !$rule->{proto}; } - my $ipversion; - if ($rule->{source}) { - eval { $ipversion = parse_address_list($rule->{source}); }; + eval { + my $source_ipversion = parse_address_list($rule->{source}); + &$set_ip_version($source_ipversion); + }; &$add_error('source', $@) if $@; - &$check_ipset_or_alias_property('source'); + &$check_ipset_or_alias_property('source', $ipversion); } if ($rule->{dest}) { eval { my $dest_ipversion = parse_address_list($rule->{dest}); - die "detected mixed ipv4/ipv6 adresses in rule\n" - if defined($ipversion) && ($dest_ipversion != $ipversion); - $ipversion = $dest_ipversion; + &$set_ip_version($dest_ipversion); }; &$add_error('dest', $@) if $@; - &$check_ipset_or_alias_property('dest'); + &$check_ipset_or_alias_property('dest', $ipversion); } + $rule->{ipversion} = $ipversion if $ipversion; + if ($rule->{macro} && !$error_count) { - eval { &$apply_macro($rule->{macro}, $rule, 1); }; + eval { &$apply_macro($rule->{macro}, $rule, 1, $ipversion); }; if (my $err = $@) { if (ref($err) eq "PVE::Exception" && $err->{errors}) { my $eh = $err->{errors}; @@ -1214,7 +1364,6 @@ sub verify_rule { } $rule->{errors} = $errors if $error_count; - $rule->{ipversion} = $ipversion if $ipversion; return $rule; } @@ -1296,16 +1445,25 @@ my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n"; sub iptables_restore_cmdlist { my ($cmdlist) = @_; - run_command("/sbin/iptables-restore -n", input => $cmdlist); + run_command("/sbin/iptables-restore -n", input => $cmdlist, errmsg => "iptables_restore_cmdlist"); +} + +sub ip6tables_restore_cmdlist { + my ($cmdlist) = @_; + + run_command("/sbin/ip6tables-restore -n", input => $cmdlist, errmsg => "iptables_restore_cmdlist"); } sub ipset_restore_cmdlist { my ($cmdlist) = @_; - run_command("/usr/sbin/ipset restore", input => $cmdlist); + run_command("/usr/sbin/ipset restore", input => $cmdlist, errmsg => "ipset_restore_cmdlist"); } sub iptables_get_chains { + my ($iptablescmd) = @_; + + $iptablescmd = "iptables" if !$iptablescmd; my $res = {}; @@ -1360,7 +1518,7 @@ sub iptables_get_chains { } }; - run_command("/sbin/iptables-save", outfunc => $parser); + run_command("/sbin/$iptablescmd-save", outfunc => $parser); return wantarray ? ($res, $hooks) : $res; } @@ -1415,7 +1573,7 @@ sub ipset_get_chains { } sub ruleset_generate_cmdstr { - my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; return if defined($rule->{enable}) && !$rule->{enable}; return if $rule->{errors}; @@ -1438,10 +1596,10 @@ sub ruleset_generate_cmdstr { if ($source =~ m/^\+(${ipset_name_pattern})$/) { my $name = $1; if ($fw_conf && $fw_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name); + my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} src"; } elsif ($cluster_conf && $cluster_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name(0, $name); + my $ipset_chain = compute_ipset_chain_name(0, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} src"; } else { die "no such ipset '$name'\n"; @@ -1451,7 +1609,7 @@ sub ruleset_generate_cmdstr { } } elsif ($source =~ m/^${ip_alias_pattern}$/){ my $alias = lc($source); - my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; die "no such alias '$source'\n" if !$e; push @cmd, "-s $e->{cidr}"; @@ -1467,10 +1625,10 @@ sub ruleset_generate_cmdstr { if ($dest =~ m/^\+(${ipset_name_pattern})$/) { my $name = $1; if ($fw_conf && $fw_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name); + my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} dst"; } elsif ($cluster_conf && $cluster_conf->{ipset}->{$name}) { - my $ipset_chain = compute_ipset_chain_name(0, $name); + my $ipset_chain = compute_ipset_chain_name(0, $name, $ipversion); push @cmd, "-m set --match-set ${ipset_chain} dst"; } else { die "no such ipset '$name'\n"; @@ -1480,7 +1638,7 @@ sub ruleset_generate_cmdstr { } } elsif ($dest =~ m/^${ip_alias_pattern}$/){ my $alias = lc($dest); - my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; die "no such alias '$dest'\n" if !$e; push @cmd, "-d $e->{cidr}"; @@ -1508,6 +1666,10 @@ sub ruleset_generate_cmdstr { # Note: we use dport to store --icmp-type die "unknown icmp-type '$rule->{dport}'\n" if !defined($icmp_type_names->{$rule->{dport}}); push @cmd, "-m icmp --icmp-type $rule->{dport}"; + } elsif ($rule->{proto} && $rule->{proto} eq 'icmpv6') { + # Note: we use dport to store --icmpv6-type + die "unknown icmpv6-type '$rule->{dport}'\n" if !defined($icmpv6_type_names->{$rule->{dport}}); + push @cmd, "-m icmpv6 --icmpv6-type $rule->{dport}"; } else { if ($nbdport > 1) { if ($multiport == 2) { @@ -1545,12 +1707,12 @@ sub ruleset_generate_cmdstr { } sub ruleset_generate_rule { - my ($ruleset, $chain, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto, $cluster_conf, $fw_conf) = @_; my $rules; if ($rule->{macro}) { - $rules = &$apply_macro($rule->{macro}, $rule); + $rules = &$apply_macro($rule->{macro}, $rule, 0, $ipversion); } else { $rules = [ $rule ]; } @@ -1559,7 +1721,7 @@ sub ruleset_generate_rule { my @cmds = (); foreach my $tmp (@$rules) { - if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $tmp, $actions, $goto, $cluster_conf, $fw_conf)) { + if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $ipversion, $tmp, $actions, $goto, $cluster_conf, $fw_conf)) { push @cmds, $cmdstr; } } @@ -1570,11 +1732,11 @@ sub ruleset_generate_rule { } sub ruleset_generate_rule_insert { - my ($ruleset, $chain, $rule, $actions, $goto) = @_; + my ($ruleset, $chain, $ipversion, $rule, $actions, $goto) = @_; die "implement me" if $rule->{macro}; # not implemented, because not needed so far - if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $rule, $actions, $goto)) { + if (my $cmdstr = ruleset_generate_cmdstr($ruleset, $chain, $ipversion, $rule, $actions, $goto)) { ruleset_insertrule($ruleset, $chain, $cmdstr); } } @@ -1638,11 +1800,11 @@ sub ruleset_addlog { } sub ruleset_add_chain_policy { - my ($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action) = @_; + my ($ruleset, $chain, $ipversion, $vmid, $policy, $loglevel, $accept_action) = @_; if ($policy eq 'ACCEPT') { - ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT' }, + ruleset_generate_rule($ruleset, $chain, $ipversion, { action => 'ACCEPT' }, { ACCEPT => $accept_action}); } elsif ($policy eq 'DROP') { @@ -1672,7 +1834,7 @@ sub ruleset_chain_add_conn_filters { } sub ruleset_chain_add_input_filters { - my ($ruleset, $chain, $options, $cluster_conf, $loglevel) = @_; + my ($ruleset, $chain, $ipversion, $options, $cluster_conf, $loglevel) = @_; if ($cluster_conf->{ipset}->{blacklist}){ if (!ruleset_chain_exist($ruleset, "PVEFW-blacklist")) { @@ -1680,12 +1842,14 @@ sub ruleset_chain_add_input_filters { ruleset_addlog($ruleset, "PVEFW-blacklist", 0, "DROP: ", $loglevel) if $loglevel; ruleset_addrule($ruleset, "PVEFW-blacklist", "-j DROP"); } - my $ipset_chain = compute_ipset_chain_name(0, 'blacklist'); + my $ipset_chain = compute_ipset_chain_name(0, 'blacklist', $ipversion); ruleset_addrule($ruleset, $chain, "-m set --match-set ${ipset_chain} src -j PVEFW-blacklist"); } if (!(defined($options->{nosmurfs}) && $options->{nosmurfs} == 0)) { - ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs"); + if ($ipversion == 4) { + ruleset_addrule($ruleset, $chain, "-m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs"); + } } if ($options->{tcpflags}) { @@ -1694,18 +1858,20 @@ sub ruleset_chain_add_input_filters { } sub ruleset_create_vm_chain { - my ($ruleset, $chain, $options, $macaddr, $ipfilter_ipset, $direction) = @_; + my ($ruleset, $chain, $ipversion, $options, $macaddr, $ipfilter_ipset, $direction) = @_; ruleset_create_chain($ruleset, $chain); my $accept = generate_nfqueue($options); if (!(defined($options->{dhcp}) && $options->{dhcp} == 0)) { if ($direction eq 'OUT') { - ruleset_generate_rule($ruleset, $chain, { action => 'PVEFW-SET-ACCEPT-MARK', - proto => 'udp', sport => 68, dport => 67 }); + ruleset_generate_rule($ruleset, $chain, $ipversion, + { action => 'PVEFW-SET-ACCEPT-MARK', + proto => 'udp', sport => 68, dport => 67 }); } else { - ruleset_generate_rule($ruleset, $chain, { action => 'ACCEPT', - proto => 'udp', sport => 67, dport => 68 }); + ruleset_generate_rule($ruleset, $chain, $ipversion, + { action => 'ACCEPT', + proto => 'udp', sport => 67, dport => 68 }); } } @@ -1721,12 +1887,12 @@ sub ruleset_create_vm_chain { } sub ruleset_add_group_rule { - my ($ruleset, $cluster_conf, $chain, $rule, $direction, $action) = @_; + my ($ruleset, $cluster_conf, $chain, $rule, $direction, $action, $ipversion) = @_; my $group = $rule->{action}; my $group_chain = "GROUP-$group-$direction"; if(!ruleset_chain_exist($ruleset, $group_chain)){ - generate_group_rules($ruleset, $cluster_conf, $group); + generate_group_rules($ruleset, $cluster_conf, $group, $ipversion); } if ($direction eq 'OUT' && $rule->{iface_out}) { @@ -1754,16 +1920,16 @@ sub ruleset_generate_vm_rules { if ($rule->{type} eq 'group') { ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, $direction, - $direction eq 'OUT' ? 'RETURN' : $in_accept); + $direction eq 'OUT' ? 'RETURN' : $in_accept, $ipversion); } else { next if $rule->{type} ne $lc_direction; eval { if ($direction eq 'OUT') { - ruleset_generate_rule($ruleset, $chain, $rule, + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, undef, $cluster_conf, $vmfw_conf); } else { - ruleset_generate_rule($ruleset, $chain, $rule, + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, { ACCEPT => $in_accept , REJECT => "PVEFW-reject" }, undef, $cluster_conf, $vmfw_conf); } @@ -1818,7 +1984,7 @@ sub generate_venet_rules_direction { my $chain = "venet0-$vmid-$direction"; - ruleset_create_vm_chain($ruleset, $chain, $options, undef, undef, $direction); + ruleset_create_vm_chain($ruleset, $chain, $ipversion, $options, undef, undef, $direction); ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $chain, 'venet', $direction, undef, $ipversion); @@ -1833,15 +1999,15 @@ sub generate_venet_rules_direction { my $accept = generate_nfqueue($options); my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : $accept; - ruleset_add_chain_policy($ruleset, $chain, $vmid, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, $ipversion, $vmid, $policy, $loglevel, $accept_action); if ($direction eq 'OUT') { - ruleset_generate_rule_insert($ruleset, "PVEFW-VENET-OUT", { + ruleset_generate_rule_insert($ruleset, "PVEFW-VENET-OUT", $ipversion, { action => $chain, source => $ip, iface_in => 'venet0'}); } else { - ruleset_generate_rule($ruleset, "PVEFW-VENET-IN", { + ruleset_generate_rule($ruleset, "PVEFW-VENET-IN", $ipversion, { action => $chain, dest => $ip, iface_out => 'venet0'}); @@ -1861,11 +2027,11 @@ sub generate_tap_rules_direction { my $tapchain = "$iface-$direction"; my $ipfilter_name = compute_ipfilter_ipset_name($netid); - my $ipfilter_ipset = compute_ipset_chain_name($vmid, $ipfilter_name) + my $ipfilter_ipset = compute_ipset_chain_name($vmid, $ipfilter_name, $ipversion) if $vmfw_conf->{ipset}->{$ipfilter_name}; # create chain with mac and ip filter - ruleset_create_vm_chain($ruleset, $tapchain, $options, $macaddr, $ipfilter_ipset, $direction); + ruleset_create_vm_chain($ruleset, $tapchain, $ipversion, $options, $macaddr, $ipfilter_ipset, $direction); if ($options->{enable}) { ruleset_generate_vm_rules($ruleset, $rules, $cluster_conf, $vmfw_conf, $tapchain, $netid, $direction, $options, $ipversion); @@ -1883,10 +2049,10 @@ sub generate_tap_rules_direction { my $accept = generate_nfqueue($options); my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : $accept; - ruleset_add_chain_policy($ruleset, $tapchain, $vmid, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $tapchain, $ipversion, $vmid, $policy, $loglevel, $accept_action); } else { my $accept_action = $direction eq 'OUT' ? "PVEFW-SET-ACCEPT-MARK" : 'ACCEPT'; - ruleset_add_chain_policy($ruleset, $tapchain, $vmid, 'ACCEPT', $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $tapchain, $ipversion, $vmid, 'ACCEPT', $loglevel, $accept_action); } # plug the tap chain to bridge chain @@ -1900,7 +2066,7 @@ sub generate_tap_rules_direction { } sub enable_host_firewall { - my ($ruleset, $hostfw_conf, $cluster_conf) = @_; + my ($ruleset, $hostfw_conf, $cluster_conf, $ipversion) = @_; my $options = $hostfw_conf->{options}; my $cluster_options = $cluster_conf->{options}; @@ -1916,7 +2082,7 @@ sub enable_host_firewall { ruleset_addrule($ruleset, $chain, "-i lo -j ACCEPT"); ruleset_chain_add_conn_filters($ruleset, $chain, 'ACCEPT'); - ruleset_chain_add_input_filters($ruleset, $chain, $options, $cluster_conf, $loglevel); + ruleset_chain_add_input_filters($ruleset, $chain, $ipversion, $options, $cluster_conf, $loglevel); # we use RETURN because we need to check also tap rules my $accept_action = 'RETURN'; @@ -1926,14 +2092,16 @@ sub enable_host_firewall { # add host rules first, so that cluster wide rules can be overwritten foreach my $rule (@$rules, @$cluster_rules) { next if !$rule->{enable} || $rule->{errors}; + next if $rule->{ipversion} && ($rule->{ipversion} != $ipversion); $rule->{iface_in} = $rule->{iface} if $rule->{iface}; eval { if ($rule->{type} eq 'group') { - ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'IN', $accept_action); + ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'IN', $accept_action, $ipversion); } elsif ($rule->{type} eq 'in') { - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, + { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf, $hostfw_conf); } }; @@ -1942,17 +2110,17 @@ sub enable_host_firewall { } # allow standard traffic for management ipset (includes cluster network) - my $mngmnt_ipset_chain = compute_ipset_chain_name(0, "management"); + my $mngmnt_ipset_chain = compute_ipset_chain_name(0, "management", $ipversion); my $mngmntsrc = "-m set --match-set ${mngmnt_ipset_chain} src"; ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 8006 -j $accept_action"); # PVE API ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 3128 -j $accept_action"); # SPICE Proxy ruleset_addrule($ruleset, $chain, "$mngmntsrc -p tcp --dport 22 -j $accept_action"); # SSH - my $localnet = local_network(); + my ($localnet, $localnet_ver) = parse_ip_or_cidr(local_network()); # corosync - if ($localnet) { + if ($localnet && ($ipversion == $localnet_ver)) { my $corosync_rule = "-p udp --dport 5404:5405 -j $accept_action"; ruleset_addrule($ruleset, $chain, "-s $localnet -d $localnet $corosync_rule"); ruleset_addrule($ruleset, $chain, "-s $localnet -m addrtype --dst-type MULTICAST $corosync_rule"); @@ -1960,7 +2128,7 @@ sub enable_host_firewall { # implement input policy my $policy = $cluster_options->{policy_in} || 'DROP'; # allow nothing by default - ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, $ipversion, 0, $policy, $loglevel, $accept_action); # host outbound firewall $chain = "PVEFW-HOST-OUT"; @@ -1980,13 +2148,15 @@ sub enable_host_firewall { # add host rules first, so that cluster wide rules can be overwritten foreach my $rule (@$rules, @$cluster_rules) { next if !$rule->{enable} || $rule->{errors}; + next if $rule->{ipversion} && ($rule->{ipversion} != $ipversion); $rule->{iface_out} = $rule->{iface} if $rule->{iface}; eval { if ($rule->{type} eq 'group') { - ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'OUT', $accept_action); + ruleset_add_group_rule($ruleset, $cluster_conf, $chain, $rule, 'OUT', $accept_action, $ipversion); } elsif ($rule->{type} eq 'out') { - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, + ruleset_generate_rule($ruleset, $chain, $ipversion, + $rule, { ACCEPT => $accept_action, REJECT => "PVEFW-reject" }, undef, $cluster_conf, $hostfw_conf); } }; @@ -1995,7 +2165,7 @@ sub enable_host_firewall { } # allow standard traffic on cluster network - if ($localnet) { + if ($localnet && ($ipversion == $localnet_ver)) { ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 8006 -j $accept_action"); # PVE API ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 22 -j $accept_action"); # SSH ruleset_addrule($ruleset, $chain, "-d $localnet -p tcp --dport 5900:5999 -j $accept_action"); # PVE VNC Console @@ -2008,14 +2178,14 @@ sub enable_host_firewall { # implement output policy $policy = $cluster_options->{policy_out} || 'ACCEPT'; # allow everything by default - ruleset_add_chain_policy($ruleset, $chain, 0, $policy, $loglevel, $accept_action); + ruleset_add_chain_policy($ruleset, $chain, $ipversion, 0, $policy, $loglevel, $accept_action); ruleset_addrule($ruleset, "PVEFW-OUTPUT", "-j PVEFW-HOST-OUT"); ruleset_addrule($ruleset, "PVEFW-INPUT", "-j PVEFW-HOST-IN"); } sub generate_group_rules { - my ($ruleset, $cluster_conf, $group) = @_; + my ($ruleset, $cluster_conf, $group, $ipversion) = @_; my $rules = $cluster_conf->{groups}->{$group}; @@ -2031,7 +2201,10 @@ sub generate_group_rules { foreach my $rule (@$rules) { next if $rule->{type} ne 'in'; - ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, undef, $cluster_conf); + next if $rule->{ipversion} && $rule->{ipversion} ne $ipversion; + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, + { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, + undef, $cluster_conf); } $chain = "GROUP-${group}-OUT"; @@ -2041,10 +2214,12 @@ sub generate_group_rules { foreach my $rule (@$rules) { next if $rule->{type} ne 'out'; + next if $rule->{ipversion} && $rule->{ipversion} ne $ipversion; # we use PVEFW-SET-ACCEPT-MARK (Instead of ACCEPT) because we need to # check also other tap rules later - ruleset_generate_rule($ruleset, $chain, $rule, - { ACCEPT => 'PVEFW-SET-ACCEPT-MARK', REJECT => "PVEFW-reject" }, undef, $cluster_conf); + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, + { ACCEPT => 'PVEFW-SET-ACCEPT-MARK', REJECT => "PVEFW-reject" }, + undef, $cluster_conf); } } @@ -2200,16 +2375,31 @@ sub parse_clusterfw_option { sub resolve_alias { my ($clusterfw_conf, $fw_conf, $cidr) = @_; - if ($cidr !~ m/^\d/) { - my $alias = lc($cidr); - my $e = $fw_conf->{aliases}->{$alias} if $fw_conf; - $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf; - return $e->{cidr} if $e; - - die "no such alias '$cidr'\n"; + my $alias = lc($cidr); + my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; + $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf; + + die "no such alias '$cidr'\n" if !$e;; + + return wantarray ? ($e->{cidr}, $e->{ipversion}) : $e->{cidr}; +} + +sub parse_ip_or_cidr { + my ($cidr) = @_; + + my $ipversion; + + if ($cidr =~ m!^(?:$IPV6RE)(/(\d+))?$!) { + $cidr =~ s|/128$||; + $ipversion = 6; + } elsif ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) { + $cidr =~ s|/32$||; + $ipversion = 4; + } else { + die "value does not look like a valid IP address or CIDR network\n"; } - return $cidr; + return wantarray ? ($cidr, $ipversion) : $cidr; } sub parse_alias { @@ -2220,11 +2410,14 @@ sub parse_alias { if ($line =~ m/^(\S+)\s(\S+)$/) { my ($name, $cidr) = ($1, $2); - $cidr =~ s|/32$||; - pve_verify_ipv4_or_cidr($cidr); + my $ipversion; + + ($cidr, $ipversion) = parse_ip_or_cidr($cidr); + my $data = { name => $name, cidr => $cidr, + ipversion => $ipversion, }; $data->{comment} = $comment if $comment; return $data; @@ -2362,8 +2555,7 @@ sub generic_fw_config_parser { if ($cidr =~ m/^${ip_alias_pattern}$/) { resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists } else { - $cidr =~ s|/32$||; - pve_verify_ipv4_or_cidr_or_alias($cidr); + $cidr = parse_ip_or_cidr($cidr); } }; if (my $err = $@) { @@ -2694,7 +2886,7 @@ sub generate_std_chains { ruleset_create_chain($ruleset, $chain); foreach my $rule (@{$std_chains->{$chain}}) { if (ref($rule)) { - ruleset_generate_rule($ruleset, $chain, $rule); + ruleset_generate_rule($ruleset, $chain, $ipversion, $rule); } else { ruleset_addrule($ruleset, $chain, $rule); } @@ -2703,51 +2895,67 @@ sub generate_std_chains { } sub generate_ipset_chains { - my ($ipset_ruleset, $clusterfw_conf, $fw_conf) = @_; + my ($ipset_ruleset, $clusterfw_conf, $fw_conf) = @_; #fixme foreach my $ipset (keys %{$fw_conf->{ipset}}) { - my $ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $ipset); - generate_ipset($ipset_ruleset, $ipset_chain, $fw_conf->{ipset}->{$ipset}, $clusterfw_conf, $fw_conf); - } -} - -sub generate_ipset { - my ($ipset_ruleset, $name, $options, $clusterfw_conf, $fw_conf) = @_; - die "duplicate ipset chain '$name'\n" if defined($ipset_ruleset->{$name}); + my $options = $fw_conf->{ipset}->{$ipset}; - my $hashsize = scalar(@$options); - if ($hashsize <= 64) { - $hashsize = 64; - } else { - $hashsize = round_powerof2($hashsize); - } + # remove duplicates + my $nethash = {}; + foreach my $entry (@$options) { + next if $entry->{errors}; # skip entries with errors + eval { + my ($cidr, $ver); + if ($entry->{cidr} =~ m/^${ip_alias_pattern}$/) { + ($cidr, $ver) = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr}); + } else { + ($cidr, $ver) = parse_ip_or_cidr($entry->{cidr}); + } + #http://backreference.org/2013/03/01/ipv6-address-normalization/ + if ($ver == 6) { + my $ipv6 = inet_pton(AF_INET6, lc($cidr)); + $cidr = inet_ntop(AF_INET6, $ipv6); + $cidr =~ s|/128$||; + } else { + $cidr =~ s|/32$||; + } - $ipset_ruleset->{$name} = ["create $name hash:net family inet hashsize $hashsize maxelem $hashsize"]; + $nethash->{$ver}->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} }; + }; + warn $@ if $@; + } - # remove duplicates - my $nethash = {}; - foreach my $entry (@$options) { - next if $entry->{errors}; # skip entries with errors - eval { - my $cidr = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr}); - $nethash->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} }; - }; - warn $@ if $@; - } + foreach my $ipversion (4, 6) { + my $data = $nethash->{$ipversion}; - foreach my $cidr (sort keys %$nethash) { - my $entry = $nethash->{$cidr}; + my $name = compute_ipset_chain_name($fw_conf->{vmid}, $ipset, $ipversion); - my $cmd = "add $name $cidr"; - if ($entry->{nomatch}) { - if ($feature_ipset_nomatch) { - push @{$ipset_ruleset->{$name}}, "$cmd nomatch"; + my $hashsize = scalar(@$options); + if ($hashsize <= 64) { + $hashsize = 64; } else { - warn "ignore !$cidr - nomatch not supported by kernel\n"; + $hashsize = round_powerof2($hashsize); + } + + my $family = $ipversion == "6" ? "inet6" : "inet"; + + $ipset_ruleset->{$name} = ["create $name hash:net family $family hashsize $hashsize maxelem $hashsize"]; + + foreach my $cidr (sort keys %$data) { + my $entry = $data->{$cidr}; + + my $cmd = "add $name $cidr"; + if ($entry->{nomatch}) { + if ($feature_ipset_nomatch) { + push @{$ipset_ruleset->{$name}}, "$cmd nomatch"; + } else { + warn "ignore !$cidr - nomatch not supported by kernel\n"; + } + } else { + push @{$ipset_ruleset->{$name}}, $cmd; + } } - } else { - push @{$ipset_ruleset->{$name}}, $cmd; } } } @@ -2866,14 +3074,16 @@ sub compile { } my ($ruleset, $ipset_ruleset) = compile_iptables_filter($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, 4, $verbose); - return ($ruleset, $ipset_ruleset); + my ($rulesetv6) = compile_iptables_filter($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, 6, $verbose); + + return ($ruleset, $ipset_ruleset, $rulesetv6); } sub compile_iptables_filter { my ($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, $ipversion, $verbose) = @_; $cluster_conf->{ipset}->{venet0} = []; - my $venet0_ipset_chain = compute_ipset_chain_name(0, 'venet0'); + my $venet0_ipset_chain = compute_ipset_chain_name(0, 'venet0', $ipversion); my $localnet; if ($cluster_conf->{aliases}->{local_network}) { @@ -2907,7 +3117,7 @@ sub compile_iptables_filter { ruleset_addrule($ruleset, "PVEFW-INPUT", "-i venet0 -m set --match-set ${venet0_ipset_chain} src -j PVEFW-VENET-OUT"); ruleset_create_chain($ruleset, "PVEFW-FWBR-IN"); - ruleset_chain_add_input_filters($ruleset, "PVEFW-FWBR-IN", $hostfw_options, $cluster_conf, $loglevel); + ruleset_chain_add_input_filters($ruleset, "PVEFW-FWBR-IN", $ipversion, $hostfw_options, $cluster_conf, $loglevel); ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-in fwln+ -j PVEFW-FWBR-IN"); @@ -2915,7 +3125,7 @@ sub compile_iptables_filter { ruleset_addrule($ruleset, "PVEFW-FORWARD", "-m physdev --physdev-is-bridged --physdev-out fwln+ -j PVEFW-FWBR-OUT"); ruleset_create_chain($ruleset, "PVEFW-VENET-IN"); - ruleset_chain_add_input_filters($ruleset, "PVEFW-VENET-IN", $hostfw_options, $cluster_conf, $loglevel); + ruleset_chain_add_input_filters($ruleset, "PVEFW-VENET-IN", $ipversion, $hostfw_options, $cluster_conf, $loglevel); ruleset_addrule($ruleset, "PVEFW-FORWARD", "-o venet0 -m set --match-set ${venet0_ipset_chain} dst -j PVEFW-VENET-IN"); @@ -2926,7 +3136,7 @@ sub compile_iptables_filter { my $ipset_ruleset = {}; if ($hostfw_enable) { - eval { enable_host_firewall($ruleset, $hostfw_conf, $cluster_conf); }; + eval { enable_host_firewall($ruleset, $hostfw_conf, $cluster_conf, $ipversion); }; warn $@ if $@; # just to be sure - should not happen } @@ -2971,18 +3181,20 @@ sub compile_iptables_filter { if ($conf->{ip_address} && $conf->{ip_address}->{value}) { my $ip = $conf->{ip_address}->{value}; $ip =~ s/\s+/,/g; - parse_address_list($ip); # make sure we have a valid $ip list - my @ips = split(',', $ip); + my @ips = (); - foreach my $singleip (@ips) { - my $venet0ipset = {}; - $venet0ipset->{cidr} = $singleip; - push @{$cluster_conf->{ipset}->{venet0}}, $venet0ipset; + foreach my $singleip (split(',', $ip)) { + my $singleip_ver = parse_address_list($singleip); # make sure we have a valid $ip list + push @{$cluster_conf->{ipset}->{venet0}}, { cidr => $singleip }; + push @ips, $singleip if $singleip_ver == $ipversion; } - generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'IN', $ipversion); - generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip, 'OUT', $ipversion); + if (scalar(@ips)) { + my $ip_list = join(',', @ips); + generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip_list, 'IN', $ipversion); + generate_venet_rules_direction($ruleset, $cluster_conf, $vmfw_conf, $vmid, $ip_list, 'OUT', $ipversion); + } } } @@ -3059,11 +3271,11 @@ sub print_sig_rule { } sub get_ruleset_cmdlist { - my ($ruleset, $verbose) = @_; + my ($ruleset, $verbose, $iptablescmd) = @_; my $cmdlist = "*filter\n"; # we pass this to iptables-restore; - my ($active_chains, $hooks) = iptables_get_chains(); + my ($active_chains, $hooks) = iptables_get_chains($iptablescmd); my $statushash = get_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, $verbose); # create missing chains first @@ -3137,7 +3349,7 @@ sub get_ipset_cmdlist { } } - foreach my $chain (sort keys %$ruleset) { + foreach my $chain (keys %$ruleset) { my $stat = $statushash->{$chain}; die "internal error" if !$stat; @@ -3146,6 +3358,11 @@ sub get_ipset_cmdlist { $cmdlist .= "$cmd\n"; } } + } + + foreach my $chain (keys %$ruleset) { + my $stat = $statushash->{$chain}; + die "internal error" if !$stat; if ($stat->{action} eq 'update') { my $chain_swap = $chain."_swap"; @@ -3158,9 +3375,9 @@ sub get_ipset_cmdlist { $cmdlist .= "flush $chain_swap\n"; $cmdlist .= "destroy $chain_swap\n"; } - } + # the remove unused chains foreach my $chain (keys %$statushash) { next if $statushash->{$chain}->{action} ne 'delete'; @@ -3174,7 +3391,7 @@ sub get_ipset_cmdlist { } sub apply_ruleset { - my ($ruleset, $hostfw_conf, $ipset_ruleset, $verbose) = @_; + my ($ruleset, $hostfw_conf, $ipset_ruleset, $rulesetv6, $verbose) = @_; enable_bridge_firewall(); @@ -3182,6 +3399,7 @@ sub apply_ruleset { get_ipset_cmdlist($ipset_ruleset, undef, $verbose); my ($cmdlist, $changes) = get_ruleset_cmdlist($ruleset, $verbose); + my ($cmdlistv6, $changesv6) = get_ruleset_cmdlist($rulesetv6, $verbose, "ip6tables"); if ($verbose) { if ($ipset_changes) { @@ -3194,12 +3412,31 @@ sub apply_ruleset { print "iptables changes:\n"; print $cmdlist; } + + if ($changesv6) { + print "ip6tables changes:\n"; + print $cmdlistv6; + } } + my $tmpfile = "$pve_fw_status_dir/ipsetcmdlist1"; + PVE::Tools::file_set_contents($tmpfile, $ipset_create_cmdlist || ''); + ipset_restore_cmdlist($ipset_create_cmdlist); + $tmpfile = "$pve_fw_status_dir/ip4cmdlist"; + PVE::Tools::file_set_contents($tmpfile, $cmdlist || ''); + iptables_restore_cmdlist($cmdlist); + $tmpfile = "$pve_fw_status_dir/ip6cmdlist"; + PVE::Tools::file_set_contents($tmpfile, $cmdlistv6 || ''); + + ip6tables_restore_cmdlist($cmdlistv6); + + $tmpfile = "$pve_fw_status_dir/ipsetcmdlist2"; + PVE::Tools::file_set_contents($tmpfile, $ipset_delete_cmdlist || ''); + ipset_restore_cmdlist($ipset_delete_cmdlist) if $ipset_delete_cmdlist; # test: re-read status and check if everything is up to date @@ -3215,6 +3452,17 @@ sub apply_ruleset { } } + my $active_chainsv6 = iptables_get_chains("ip6tables"); + my $statushashv6 = get_ruleset_status($rulesetv6, $active_chainsv6, \&iptables_chain_digest, 0); + + foreach my $chain (sort keys %$rulesetv6) { + my $stat = $statushashv6->{$chain}; + if ($stat->{action} ne 'exists') { + warn "unable to update chain '$chain'\n"; + $errors = 1; + } + } + die "unable to apply firewall changes\n" if $errors; update_nf_conntrack_max($hostfw_conf); @@ -3259,7 +3507,16 @@ sub update_nf_conntrack_tcp_timeout_established { sub remove_pvefw_chains { - my ($chash, $hooks) = iptables_get_chains(); + PVE::Firewall::remove_pvefw_chains_iptables("iptables"); + PVE::Firewall::remove_pvefw_chains_iptables("ip6tables"); + PVE::Firewall::remove_pvefw_chains_ipset(); + +} + +sub remove_pvefw_chains_iptables { + my ($iptablescmd) = @_; + + my ($chash, $hooks) = iptables_get_chains($iptablescmd); my $cmdlist = "*filter\n"; foreach my $h (qw(INPUT OUTPUT FORWARD)) { @@ -3277,18 +3534,25 @@ sub remove_pvefw_chains { } $cmdlist .= "COMMIT\n"; - iptables_restore_cmdlist($cmdlist); + if($iptablescmd eq "ip6tables") { + ip6tables_restore_cmdlist($cmdlist); + } else { + iptables_restore_cmdlist($cmdlist); + } +} + +sub remove_pvefw_chains_ipset { my $ipset_chains = ipset_get_chains(); - $cmdlist = ""; + my $cmdlist = ""; foreach my $chain (keys %$ipset_chains) { - $cmdlist .= "flush $chain\n"; - $cmdlist .= "destroy $chain\n"; + $cmdlist .= "flush $chain\n"; + $cmdlist .= "destroy $chain\n"; } - ipset_restore_cmdlist($cmdlist) if $cmdlist; + ipset_restore_cmdlist($cmdlist) if $cmdlist; } sub init { @@ -3312,11 +3576,11 @@ sub update { return; } - my $hostfw_conf = load_hostfw_conf(); + my $hostfw_conf = load_hostfw_conf($cluster_conf); - my ($ruleset, $ipset_ruleset) = compile($cluster_conf, $hostfw_conf); + my ($ruleset, $ipset_ruleset, $rulesetv6) = compile($cluster_conf, $hostfw_conf); - apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset); + apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $rulesetv6); }; run_locked($code);