Proxmox/pve-firewall
5
0
Fork 0
mirror of git://git.proxmox.com/git/pve-firewall.git synced 2025-01-04 09:17:58 +03:00
Code Releases Activity

add support for loading sdn firewall configuration

Browse Source 
This also includes support for parsing rules referencing IPSets in the
new SDN scope and generating those IPSets in the firewall. We always
load the new configuration, since loading the configuration always
includes validating the loaded rules. Validation fails without
including the SDN ipsets, leading to syslog error messages.

In the API, we only use the IPSets the user is actually allowed to use
for validating the rules - preventing users from using autogenerated
IPSets they have no permission for.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
This commit is contained in:
Stefan Hanreich 2024-11-19 13:17:19 +01:00 committed by Thomas Lamprecht
parent 632d02a8e2
commit 9734f890c4
5 changed files with 112 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
src/PVE/API2/Firewall/Helpers.pm Normal file
View File

@ -0,0 +1,50 @@
package PVE::API2::Firewall::Helpers;
use strict;
use warnings;
use PVE::Cluster;
use PVE::Network::SDN::Vnets;
use PVE::RPCEnvironment;
sub get_allowed_vnets {
my $rpcenv = eval { PVE::RPCEnvironment::get() };
if ($@) {
warn "could not initialize RPCEnvironment";
return {};
}
my $authuser = $rpcenv->get_user();
my $vnets = PVE::Network::SDN::Vnets::config(1);
my $privs = [ 'SDN.Audit', 'SDN.Allocate' ];
my $allowed_vnets = [];
foreach my $vnet (sort keys %{$vnets->{ids}}) {
my $zone = $vnets->{ids}->{$vnet}->{zone};
next if !$rpcenv->check_any($authuser, "/sdn/zones/$zone/$vnet", $privs, 1);
push @$allowed_vnets, $vnet;
}
return $allowed_vnets;
}
sub get_allowed_vms {
my $rpcenv = eval { PVE::RPCEnvironment::get() };
if ($@) {
warn "could not initialize RPCEnvironment";
return {};
}
my $authuser = $rpcenv->get_user();
my $guests = PVE::Cluster::get_vmlist();
return [
grep { $rpcenv->check($authuser, "/vms/$_", [ 'VM.Audit' ], 1) } sort keys $guests->{ids}->%*
];
}
1;

1
src/PVE/API2/Firewall/Makefile
View File

@ -4,6 +4,7 @@ PERLDIR=$(DESTDIR)/$(PREFIX)/share/perl5
LIB_SOURCES= \
Aliases.pm \
Helpers.pm \
IPSet.pm \
Rules.pm \
Cluster.pm \

25
src/PVE/API2/Firewall/Rules.pm
View File

@ -7,6 +7,7 @@ use PVE::JSONSchema qw(get_standard_option);
use PVE::Exception qw(raise raise_param_exc);
use PVE::Firewall;
use PVE::API2::Firewall::Helpers;
use base qw(PVE::RESTHandler);
@ -237,6 +238,18 @@ sub register_create_rule {
my $rule = {};
# reloading the scoped SDN config for verification, so users can
# only use IPSets they have permissions for
my $allowed_vms = PVE::API2::Firewall::Helpers::get_allowed_vms();
my $allowed_vnets = PVE::API2::Firewall::Helpers::get_allowed_vnets();
my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
if ($cluster_conf) {
$cluster_conf->{sdn} = $sdn_conf;
} else {
$fw_conf->{sdn} = $sdn_conf;
}
PVE::Firewall::copy_rule_data($rule, $param);
PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
@ -320,6 +333,18 @@ sub register_update_rule {
PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
# reloading the scoped SDN config for verification, so users can
# only use IPSets they have permissions for
my $allowed_vms = PVE::API2::Firewall::Helpers::get_allowed_vms();
my $allowed_vnets = PVE::API2::Firewall::Helpers::get_allowed_vnets();
my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
if ($cluster_conf) {
$cluster_conf->{sdn} = $sdn_conf;
} else {
$fw_conf->{sdn} = $sdn_conf;
}
PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
}

42
src/PVE/Firewall.pm
View File

@ -25,6 +25,7 @@ use PVE::Tools qw($IPV4RE $IPV6RE);
use PVE::Tools qw(run_command lock_file dir_glob_foreach);
use PVE::Firewall::Helpers;
use PVE::RS::Firewall::SDN;
my $pvefw_conf_dir = "/etc/pve/firewall";
my $clusterfw_conf_filename = "$pvefw_conf_dir/cluster.fw";
@ -1689,10 +1690,15 @@ sub verify_rule {
if (my $value = $rule->{$name}) {
if ($value =~ m/^\+/) {
if ($value =~ m@^\+(guest/|dc/)?(${ipset_name_pattern})$@) {
&$add_error($name, "no such ipset '$2'")
if !($cluster_conf->{ipset}->{$2} || ($fw_conf && $fw_conf->{ipset}->{$2}));
if ($value =~ m@^\+(guest/|dc/|sdn/)?(${ipset_name_pattern})$@) {
if (
!($cluster_conf->{ipset}->{$2})
&& !($fw_conf && $fw_conf->{ipset}->{$2})
&& !($cluster_conf->{sdn} && $cluster_conf->{sdn}->{ipset}->{$2})
&& !($fw_conf->{sdn} && $fw_conf->{sdn}->{ipset}->{$2})
) {
$add_error->($name, "no such ipset '$2'")
}
} else {
&$add_error($name, "invalid ipset name '$value'");
}
@ -2108,13 +2114,18 @@ sub ipt_gen_src_or_dst_match {
my $match;
if ($adr =~ m/^\+/) {
if ($adr =~ m@^\+(guest/|dc/)?(${ipset_name_pattern})$@) {
if ($adr =~ m@^\+(guest/|dc/|sdn/)?(${ipset_name_pattern})$@) {
my $scope = $1 // "";
my $name = $2;
my $ipset_chain;
if ($scope ne 'dc/' && $fw_conf && $fw_conf->{ipset}->{$name}) {
my $is_scope = sub { return !$scope || $scope eq "$_[0]/" };
if ($is_scope->('guest') && $fw_conf && $fw_conf->{ipset}->{$name}) {
$ipset_chain = compute_ipset_chain_name($fw_conf->{vmid}, $name, $ipversion);
} elsif ($scope ne 'guest/' && $cluster_conf && $cluster_conf->{ipset}->{$name}) {
} elsif ($is_scope->('dc') && $cluster_conf && $cluster_conf->{ipset}->{$name}) {
$ipset_chain = compute_ipset_chain_name(0, $name, $ipversion);
} elsif ($is_scope->('sdn') && $cluster_conf->{sdn} && $cluster_conf->{sdn}->{ipset}->{$name}) {
$ipset_chain = compute_ipset_chain_name(0, $name, $ipversion);
} else {
die "no such ipset '$name'\n";
@ -3655,6 +3666,7 @@ sub load_clusterfw_conf {
group_comments => {},
ipset => {} ,
ipset_comments => {},
sdn => load_sdn_conf(),
};
my $cluster_conf = generic_fw_config_parser($filename, $empty_conf, $empty_conf, 'cluster');
@ -3663,6 +3675,19 @@ sub load_clusterfw_conf {
return $cluster_conf;
}
sub load_sdn_conf {
my ($allowed_vms, $allowed_vnets) = @_;
my $empty_sdn_config = { ipset => {} , ipset_comments => {} };
my $sdn_config = eval {
PVE::RS::Firewall::SDN::config($allowed_vnets, $allowed_vms)
};
warn $@ if $@;
return $sdn_config // $empty_sdn_config;
}
sub save_clusterfw_conf {
my ($cluster_conf) = @_;
@ -3768,7 +3793,7 @@ sub compile {
$vmfw_configs = read_vm_firewall_configs($cluster_conf, $vmdata, $testdir);
} else { # normal operation
$cluster_conf = load_clusterfw_conf(undef) if !$cluster_conf;
$cluster_conf = load_clusterfw_conf() if !$cluster_conf;
$hostfw_conf = load_hostfw_conf($cluster_conf, undef) if !$hostfw_conf;
@ -4043,6 +4068,7 @@ sub compile_ipsets {
}
generate_ipset_chains($ipset_ruleset, undef, $cluster_conf, undef, $cluster_conf->{ipset});
generate_ipset_chains($ipset_ruleset, undef, $cluster_conf, undef, $cluster_conf->{sdn}->{ipset});
return $ipset_ruleset;
}

4
src/PVE/Service/pve_firewall.pm
View File

@ -158,7 +158,7 @@ __PACKAGE__->register_method ({
PVE::Firewall::set_verbose(1); # show syntax errors
my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
$res->{enable} = $cluster_conf->{options}->{enable} ? 1 : 0;
if ($status eq 'running') {
@ -202,7 +202,7 @@ __PACKAGE__->register_method ({
PVE::Firewall::set_verbose(1);
my $cluster_conf = PVE::Firewall::load_clusterfw_conf(undef);
my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
print "ipset cmdlist:\n";