From dddd9413980599d04520a4c8202fe6ee1453face Mon Sep 17 00:00:00 2001 From: Dietmar Maurer Date: Mon, 6 Aug 2012 12:15:48 +0200 Subject: [PATCH 1/1] compile simple rules --- PVE/Firewall.pm | 79 ++++++++++++++++++++++++++++++++++++++++++++----- config/100.fw | 14 ++++++++- fwtest.pl | 79 ++++++++++++++++++++++++++++++++++++++++++++++++- 3 files changed, 162 insertions(+), 10 deletions(-) diff --git a/PVE/Firewall.pm b/PVE/Firewall.pm index c10aab3..bf1b840 100644 --- a/PVE/Firewall.pm +++ b/PVE/Firewall.pm @@ -6,11 +6,42 @@ use Data::Dumper; use PVE::Tools; use PVE::QemuServer; + +my $rule_format = "%-15s %-15s %-15s %-15s %-15s %-15s\n"; + +my $generate_input_rule = sub { + my ($zoneinfo, $rule, $net, $netid) = @_; + + die "not implemented" if $rule->{source} ne 'any'; + die "not implemented" if $rule->{dest} ne 'any'; + + my $zone = $net->{zone} || die "internal error"; + my $zid = $zoneinfo->{$zone}->{id} || die "internal error"; + my $tap = $net->{tap} || die "internal error"; + + return sprintf($rule_format, $rule->{action}, $rule->{source}, "$zid:$tap", + $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-'); +}; + +my $generate_output_rule = sub { + my ($zoneinfo, $rule, $net, $netid) = @_; + + die "not implemented" if $rule->{source} ne 'any'; + die "not implemented" if $rule->{dest} ne 'any'; + + my $zone = $net->{zone} || die "internal error"; + my $zid = $zoneinfo->{$zone}->{id} || die "internal error"; + my $tap = $net->{tap} || die "internal error"; + + return sprintf($rule_format, $rule->{action}, "$zid:$tap", $rule->{dest}, + $rule->{proto} || '-', $rule->{dport} || '-', $rule->{sport} || '-'); +}; + # we need complete VM configuration of all VMs (openvz/qemu) # in vmdata sub compile { - my ($targetdir, $vmdata) = @_; + my ($targetdir, $vmdata, $rules) = @_; my $netinfo; @@ -61,14 +92,15 @@ sub compile { my $conf = $vmdata->{qemu}->{$vmid}; foreach my $opt (keys %$conf) { next if $opt !~ m/^net(\d+)$/; - my $netid = $1; + my $netnum = $1; my $net = PVE::QemuServer::parse_net($conf->{$opt}); next if !$net; die "implement me" if !$net->{bridge}; my $vmzone = $conf->{zone} || "vm$vmid"; - $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, "tap${vmid}i${netid}"); - $netinfo->{$vmid}->{$netid} = $net; + $net->{tap} = "tap${vmid}i${netnum}"; + $net->{zone} = &$register_bridge_port($net->{bridge}, $net->{tag}, $vmzone, $net->{tap}); + $netinfo->{$vmid}->{$opt} = $net; } } @@ -89,6 +121,10 @@ sub compile { return $zonemap->{$zone}; }; + foreach my $z (sort keys %$zoneinfo) { + $zoneinfo->{$z}->{id} = &$lookup_zonename($z); + } + # dump zone file my $out; @@ -97,14 +133,14 @@ sub compile { $out = sprintf($format, '#ZONE', 'TYPE', 'OPTIONS'); foreach my $z (sort keys %$zoneinfo) { - my $zid = &$lookup_zonename($z); + my $zid = $zoneinfo->{$z}->{id}; if ($zoneinfo->{$z}->{type} eq 'firewall') { $out .= sprintf($format, $zid, $zoneinfo->{$z}->{type}, ''); } elsif ($zoneinfo->{$z}->{type} eq 'bridge') { - $out .= sprintf($format, &$lookup_zonename($z), 'ipv4', ''); + $out .= sprintf($format, $zid, 'ipv4', ''); } elsif ($zoneinfo->{$z}->{type} eq 'bport') { my $bridge_zone = $zoneinfo->{$z}->{bridge_zone} || die "internal error"; - my $bzid = &$lookup_zonename($bridge_zone); + my $bzid = $zoneinfo->{$bridge_zone}->{id} || die "internal error"; $out .= sprintf($format, "$zid:$bzid", 'bport', ''); } else { die "internal error"; @@ -121,7 +157,7 @@ sub compile { $out = sprintf($format, '#ZONE', 'INTERFACE', 'BROADCAST', 'OPTIONS'); foreach my $z (sort keys %$zoneinfo) { - my $zid = &$lookup_zonename($z); + my $zid = $zoneinfo->{$z}->{id}; if ($zoneinfo->{$z}->{type} eq 'firewall') { # do nothing; } elsif ($zoneinfo->{$z}->{type} eq 'bridge') { @@ -153,6 +189,33 @@ sub compile { PVE::Tools::file_set_contents("$targetdir/policy", $out); + # dump rules + $out = ''; + + $out = sprintf($rule_format, '#ACTION', 'SOURCE', 'DEST', 'PROTO', 'DPORT', 'SPORT'); + foreach my $vmid (sort keys %$rules) { + if (my $inrules = $rules->{$vmid}->{in}) { + foreach my $rule (@$inrules) { + foreach my $netid (keys %{$netinfo->{$vmid}}) { + my $net = $netinfo->{$vmid}->{$netid}; + next if !($rule->{iface} eq 'any' || $rule->{iface} eq $netid); + $out .= &$generate_input_rule($zoneinfo, $rule, $net, $netid); + } + } + } + + if (my $outrules = $rules->{$vmid}->{out}) { + foreach my $rule (@$outrules) { + foreach my $netid (keys %{$netinfo->{$vmid}}) { + my $net = $netinfo->{$vmid}->{$netid}; + next if !($rule->{iface} eq 'any' || $rule->{iface} eq $netid); + $out .= &$generate_output_rule($zoneinfo, $rule, $net, $netid); + } + } + } + } + + PVE::Tools::file_set_contents("$targetdir/rules", $out); } diff --git a/config/100.fw b/config/100.fw index 9cef8fc..30903cb 100644 --- a/config/100.fw +++ b/config/100.fw @@ -1 +1,13 @@ -# Example VM firewall configuration \ No newline at end of file +# Example VM firewall configuration +#ACTION SOURCE DEST + +[IN] + +ACCEPT net0 any any tcp 80 + +[OUT] + +ACCEPT net0 any any + + + diff --git a/fwtest.pl b/fwtest.pl index 867e21b..47d0683 100755 --- a/fwtest.pl +++ b/fwtest.pl @@ -4,6 +4,8 @@ use strict; use lib qw(.); use PVE::Firewall; use File::Path; +use IO::File; + my $vmdata = { qemu => { @@ -26,11 +28,86 @@ my $vmdata = { }, }; +sub parse_fw_rules { + my ($filename, $fh) = @_; + + my $section; + + my $res = { in => [], out => [] }; + + while (defined(my $line = <$fh>)) { + next if $line =~ m/^#/; + next if $line =~ m/^\s*$/; + + if ($line =~ m/^\[(in|out)\]\s*$/i) { + $section = lc($1); + next; + } + next if !$section; + + my ($action, $iface, $source, $dest, $proto, $dport, $sport) = + split(/\s+/, $line); + + if (!($action && $iface && $source && $dest)) { + warn "skip incomplete line\n"; + next; + } + + if ($action !~ m/^(ACCEPT|DROP)$/) { + warn "unknown action '$action'\n"; + next; + } + + if ($iface !~ m/^(all|net0|net1|net2|net3|net4|net5)$/) { + warn "unknown interface '$iface'\n"; + next; + } + + if ($proto && $proto !~ m/^(icmp|tcp|udp)$/) { + warn "unknown protokol '$proto'\n"; + next; + } + + if ($source !~ m/^(any)$/) { + warn "unknown source '$source'\n"; + next; + } + + if ($dest !~ m/^(any)$/) { + warn "unknown destination '$dest'\n"; + next; + } + + my $rule = { + action => $action, + iface => $iface, + source => $source, + dest => $dest, + proto => $proto, + dport => $dport, + sport => $sport, + }; + + push @{$res->{$section}}, $rule; + } + + return $res; +} + my $testdir = "./testdir"; rmtree($testdir); mkdir $testdir; -PVE::Firewall::compile($testdir, $vmdata); +my $rules = {}; +foreach my $vmid (keys %{$vmdata->{qemu}}) { + my $filename = "config/$vmid.fw"; + my $fh = IO::File->new($filename, O_RDONLY); + next if !$fh; + + $rules->{$vmid} = parse_fw_rules($filename, $fh); +} + +PVE::Firewall::compile($testdir, $vmdata, $rules); PVE::Tools::run_command(['shorewall', 'check', $testdir]); -- 2.39.2