From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 634241FF37F for ; Thu, 18 Apr 2024 18:16:30 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id DEAE93137A; Thu, 18 Apr 2024 18:15:02 +0200 (CEST) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Date: Thu, 18 Apr 2024 18:14:24 +0200 Message-Id: <20240418161434.709473-30-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240418161434.709473-1-s.hanreich@proxmox.com> References: <20240418161434.709473-1-s.hanreich@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.281 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Subject: [pve-devel] [PATCH proxmox-firewall v3 29/39] firewall: add rule generation logic X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Cc: Wolfgang Bumiller Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" ToNftRules is basically a conversion trait for firewall config structs to convert them into the respective nftables statements. We are passing a list of rules to the method, which then modifies the list of rules such that all relevant rules in the list have statements appended that apply the configured constraints from the firewall config. This is particularly relevant for the rule generation logic for ipsets. Due to how sets work in nftables we need to generate two rules for every ipset: a rule for the v4 ipset and a rule for the v6 ipset. This is because sets can only contain either v4 or v6 addresses. By passing a list of all generated rules we can duplicate all rules and then add a statement for the v4 or v6 set respectively. This also enables us to start with multiple rules, which is required for using log statements in conjunction with limit statements. Reviewed-by: Lukas Wagner Reviewed-by: Max Carrara Co-authored-by: Wolfgang Bumiller Signed-off-by: Stefan Hanreich --- proxmox-firewall/src/main.rs | 1 + proxmox-firewall/src/rule.rs | 761 +++++++++++++++++++++++++++++ proxmox-nftables/src/expression.rs | 4 + 3 files changed, 766 insertions(+) create mode 100644 proxmox-firewall/src/rule.rs diff --git a/proxmox-firewall/src/main.rs b/proxmox-firewall/src/main.rs index 656ac15..ae832e3 100644 --- a/proxmox-firewall/src/main.rs +++ b/proxmox-firewall/src/main.rs @@ -1,6 +1,7 @@ use anyhow::Error; mod config; +mod rule; fn main() -> Result<(), Error> { env_logger::init(); diff --git a/proxmox-firewall/src/rule.rs b/proxmox-firewall/src/rule.rs new file mode 100644 index 0000000..c8099d0 --- /dev/null +++ b/proxmox-firewall/src/rule.rs @@ -0,0 +1,761 @@ +use std::ops::{Deref, DerefMut}; + +use anyhow::{format_err, Error}; +use proxmox_nftables::{ + expression::{Ct, IpFamily, Meta, Payload, Prefix}, + statement::{Log, LogLevel, Match, Operator}, + types::{AddRule, ChainPart, SetName}, + Expression, Statement, +}; +use proxmox_ve_config::{ + firewall::{ + ct_helper::CtHelperMacro, + fw_macros::{get_macro, FwMacro}, + types::{ + address::Family, + alias::AliasName, + ipset::{Ipfilter, IpsetName}, + log::LogRateLimit, + rule::{Direction, Kind, RuleGroup}, + rule_match::{ + Icmp, Icmpv6, IpAddrMatch, IpMatch, Ports, Protocol, RuleMatch, Sctp, Tcp, Udp, + }, + Alias, Rule, + }, + }, + guest::types::Vmid, +}; + +use crate::config::FirewallConfig; + +#[derive(Debug, Clone)] +pub(crate) struct NftRule { + family: Option, + statements: Vec, + terminal_statements: Vec, +} + +impl NftRule { + pub fn from_terminal_statements(terminal_statements: Vec) -> Self { + Self { + family: None, + statements: Vec::new(), + terminal_statements, + } + } + + pub fn new(terminal_statement: Statement) -> Self { + Self { + family: None, + statements: Vec::new(), + terminal_statements: vec![terminal_statement], + } + } + + pub fn from_config_rule(rule: &Rule, env: &NftRuleEnv) -> Result, Error> { + let mut rules = Vec::new(); + + if rule.disabled() { + return Ok(rules); + } + + rule.to_nft_rules(&mut rules, env)?; + + Ok(rules) + } + + pub fn from_ct_helper( + ct_helper: &CtHelperMacro, + env: &NftRuleEnv, + ) -> Result, Error> { + let mut rules = Vec::new(); + ct_helper.to_nft_rules(&mut rules, env)?; + Ok(rules) + } + + pub fn from_ipfilter(ipfilter: &Ipfilter, env: &NftRuleEnv) -> Result, Error> { + let mut rules = Vec::new(); + ipfilter.to_nft_rules(&mut rules, env)?; + Ok(rules) + } +} + +impl Deref for NftRule { + type Target = Vec; + + fn deref(&self) -> &Self::Target { + &self.statements + } +} + +impl DerefMut for NftRule { + fn deref_mut(&mut self) -> &mut Self::Target { + &mut self.statements + } +} + +impl NftRule { + pub fn into_add_rule(self, chain: ChainPart) -> AddRule { + let statements = self.statements.into_iter().chain(self.terminal_statements); + + AddRule::from_statements(chain, statements) + } + + pub fn family(&self) -> Option { + self.family + } + + pub fn set_family(&mut self, family: Family) { + self.family = Some(family); + } +} + +pub(crate) struct NftRuleEnv<'a> { + pub(crate) chain: ChainPart, + pub(crate) direction: Direction, + pub(crate) firewall_config: &'a FirewallConfig, + pub(crate) vmid: Option, +} + +impl NftRuleEnv<'_> { + fn alias(&self, name: &AliasName) -> Option<&Alias> { + self.firewall_config.alias(name, self.vmid) + } + + fn iface_name(&self, rule_iface: &str) -> String { + match &self.vmid { + Some(vmid) => { + if let Some(config) = self.firewall_config.guests().get(vmid) { + if let Ok(name) = config.iface_name_by_key(rule_iface) { + return name; + } + } + + log::warn!("Unable to resolve interface name {rule_iface} for VM #{vmid}"); + + rule_iface.to_string() + } + None => rule_iface.to_string(), + } + } + + fn default_log_limit(&self) -> Option { + self.firewall_config.cluster().log_ratelimit() + } + + fn contains_family(&self, family: Family) -> bool { + self.chain.table().family().families().contains(&family) + } +} + +pub(crate) trait ToNftRules { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error>; +} + +impl ToNftRules for Rule { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + log::trace!("generating nft rules for config rule {self:?}"); + + match self.kind() { + Kind::Match(rule) => rule.to_nft_rules(rules, env)?, + Kind::Group(group) => group.to_nft_rules(rules, env)?, + }; + + Ok(()) + } +} + +fn handle_iface(rules: &mut [NftRule], env: &NftRuleEnv, name: &str) -> Result<(), Error> { + let iface_key = match (env.vmid, env.direction) { + (Some(_), Direction::In) => "oifname", + (Some(_), Direction::Out) => "iifname", + (None, Direction::In) => "iifname", + (None, Direction::Out) => "oifname", + }; + + let iface_name = env.iface_name(name); + + log::trace!("adding interface: {iface_name}"); + + for rule in rules.iter_mut() { + rule.push( + Match::new_eq( + Expression::from(Meta::new(iface_key.to_string())), + Expression::from(iface_name.clone()), + ) + .into(), + ) + } + + Ok(()) +} + +impl ToNftRules for RuleGroup { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + let chain_name = format!("group-{}-{}", self.group(), env.direction); + + rules.push(NftRule::new(Statement::jump(chain_name))); + + if let Some(name) = &self.iface() { + handle_iface(rules, env, name)?; + } + + Ok(()) + } +} + +impl ToNftRules for RuleMatch { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + if env.direction != self.direction() { + return Ok(()); + } + + if let Some(log) = self.log() { + if let Ok(log_level) = LogLevel::try_from(log) { + let mut terminal_statements = Vec::new(); + + if let Some(limit) = env.default_log_limit() { + terminal_statements.push(Statement::from(limit)); + } + + terminal_statements.push( + Log::new_nflog( + Log::generate_prefix(env.vmid, log_level, env.chain.name(), self.verdict()), + 0, + ) + .into(), + ); + + rules.push(NftRule::from_terminal_statements(terminal_statements)); + } + } + + rules.push(NftRule::new(Statement::from(self.verdict()))); + + if let Some(name) = &self.iface() { + handle_iface(rules, env, name)?; + } + + if let Some(protocol) = self.proto() { + protocol.to_nft_rules(rules, env)?; + } + + if let Some(name) = self.fw_macro() { + let fw_macro = + get_macro(name).ok_or_else(|| format_err!("cannot find macro {name}"))?; + + fw_macro.to_nft_rules(rules, env)?; + } + + if let Some(ip) = self.ip() { + ip.to_nft_rules(rules, env)?; + } + + Ok(()) + } +} + +fn handle_set( + rules: &mut Vec, + name: &IpsetName, + field_name: &str, + env: &NftRuleEnv, + contains: bool, +) -> Result<(), Error> { + let mut new_rules = rules + .drain(..) + .flat_map(|rule| { + let mut new_rules = Vec::new(); + + if matches!(rule.family(), Some(Family::V4) | None) && env.contains_family(Family::V4) { + let field = Payload::field("ip", field_name); + + let mut rule = rule.clone(); + rule.set_family(Family::V4); + + rule.append(&mut vec![ + Match::new( + if contains { Operator::Eq } else { Operator::Ne }, + field.clone(), + Expression::set_name(&SetName::ipset_name( + Family::V4, + name, + env.vmid, + false, + )), + ) + .into(), + Match::new( + if contains { Operator::Ne } else { Operator::Eq }, + field, + Expression::set_name(&SetName::ipset_name( + Family::V4, + name, + env.vmid, + true, + )), + ) + .into(), + ]); + + new_rules.push(rule); + } + + if matches!(rule.family(), Some(Family::V6) | None) && env.contains_family(Family::V6) { + let field = Payload::field("ip6", field_name); + + let mut rule = rule; + rule.set_family(Family::V6); + + rule.append(&mut vec![ + Match::new( + if contains { Operator::Eq } else { Operator::Ne }, + field.clone(), + Expression::set_name(&SetName::ipset_name( + Family::V6, + name, + env.vmid, + false, + )), + ) + .into(), + Match::new( + if contains { Operator::Ne } else { Operator::Eq }, + field, + Expression::set_name(&SetName::ipset_name( + Family::V6, + name, + env.vmid, + true, + )), + ) + .into(), + ]); + + new_rules.push(rule); + } + + new_rules + }) + .collect::>(); + + rules.append(&mut new_rules); + + Ok(()) +} + +fn handle_match( + rules: &mut Vec, + ip: &IpAddrMatch, + field_name: &str, + env: &NftRuleEnv, +) -> Result<(), Error> { + match ip { + IpAddrMatch::Ip(list) => { + if !env.contains_family(list.family()) { + return Ok(()); + } + + let field = match list.family() { + Family::V4 => Payload::field("ip", field_name), + Family::V6 => Payload::field("ip6", field_name), + }; + + for rule in rules { + match rule.family() { + None => { + rule.push(Match::new_eq(field.clone(), Expression::from(list)).into()); + + rule.set_family(list.family()); + } + Some(rule_family) if rule_family == list.family() => { + rule.push(Match::new_eq(field.clone(), Expression::from(list)).into()); + } + _ => (), + }; + } + + Ok(()) + } + IpAddrMatch::Alias(alias_name) => { + let alias = env + .alias(alias_name) + .ok_or_else(|| format_err!("could not find alias {alias_name}"))?; + + if !env.contains_family(alias.address().family()) { + return Ok(()); + } + + let field = match alias.address().family() { + Family::V4 => Payload::field("ip", field_name), + Family::V6 => Payload::field("ip6", field_name), + }; + + for rule in rules { + match rule.family() { + None => { + rule.push( + Match::new_eq( + field.clone(), + Expression::from(Prefix::from(alias.address())), + ) + .into(), + ); + + rule.set_family(alias.address().family()); + } + Some(rule_family) if rule_family == alias.address().family() => { + rule.push( + Match::new_eq( + field.clone(), + Expression::from(Prefix::from(alias.address())), + ) + .into(), + ); + } + _ => (), + } + } + + Ok(()) + } + IpAddrMatch::Set(name) => handle_set(rules, name, field_name, env, true), + } +} + +impl ToNftRules for IpMatch { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + log::trace!("adding ip match: {self:?}"); + + if let Some(src) = self.src() { + log::trace!("adding src: {src:?}"); + handle_match(rules, src, "saddr", env)?; + } + + if let Some(dst) = self.dst() { + log::trace!("adding dst: {dst:?}"); + handle_match(rules, dst, "daddr", env)?; + } + + Ok(()) + } +} + +fn handle_protocol(rules: &mut [NftRule], _env: &NftRuleEnv, name: &str) -> Result<(), Error> { + for rule in rules.iter_mut() { + rule.push(Match::new_eq(Meta::new("l4proto"), Expression::from(name)).into()); + } + + Ok(()) +} + +impl ToNftRules for Protocol { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + log::trace!("adding protocol: {self:?}"); + + match self { + Protocol::Tcp(tcp) => tcp.to_nft_rules(rules, env), + Protocol::Udp(udp) => udp.to_nft_rules(rules, env), + Protocol::Dccp(ports) => { + handle_protocol(rules, env, "dccp")?; + ports.to_nft_rules(rules, env) + } + Protocol::UdpLite(ports) => { + handle_protocol(rules, env, "udplite")?; + ports.to_nft_rules(rules, env) + } + Protocol::Sctp(sctp) => sctp.to_nft_rules(rules, env), + Protocol::Icmp(icmp) => icmp.to_nft_rules(rules, env), + Protocol::Icmpv6(icmpv6) => icmpv6.to_nft_rules(rules, env), + Protocol::Named(name) => handle_protocol(rules, env, name), + Protocol::Numeric(id) => { + for rule in rules.iter_mut() { + rule.push(Match::new_eq(Meta::new("l4proto"), Expression::from(*id)).into()); + } + + Ok(()) + } + } + } +} + +impl ToNftRules for Tcp { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + handle_protocol(rules, env, "tcp")?; + self.ports().to_nft_rules(rules, env) + } +} + +impl ToNftRules for Udp { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + handle_protocol(rules, env, "udp")?; + self.ports().to_nft_rules(rules, env) + } +} + +impl ToNftRules for Sctp { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + handle_protocol(rules, env, "sctp")?; + self.ports().to_nft_rules(rules, env) + } +} + +impl ToNftRules for Icmp { + fn to_nft_rules(&self, rules: &mut Vec, _env: &NftRuleEnv) -> Result<(), Error> { + for rule in rules.iter_mut() { + if matches!(rule.family(), Some(Family::V4) | None) { + if let Some(icmp_code) = self.code() { + rule.push( + Match::new_eq(Payload::field("icmp", "code"), Expression::from(icmp_code)) + .into(), + ); + } else if let Some(icmp_type) = self.ty() { + rule.push( + Match::new_eq(Payload::field("icmp", "type"), Expression::from(icmp_type)) + .into(), + ); + } else { + rule.push(Match::new_eq(Meta::new("l4proto"), Expression::from("icmp")).into()); + } + + rule.set_family(Family::V4); + } + } + + Ok(()) + } +} + +impl ToNftRules for Icmpv6 { + fn to_nft_rules(&self, rules: &mut Vec, _env: &NftRuleEnv) -> Result<(), Error> { + log::trace!("applying icmpv6: {self:?}"); + + for rule in rules.iter_mut() { + if matches!(rule.family(), Some(Family::V6) | None) { + if let Some(icmp_code) = self.code() { + rule.push( + Match::new_eq( + Payload::field("icmpv6", "code"), + Expression::from(icmp_code), + ) + .into(), + ); + } else if let Some(icmp_type) = self.ty() { + rule.push( + Match::new_eq( + Payload::field("icmpv6", "type"), + Expression::from(icmp_type), + ) + .into(), + ); + } else { + rule.push( + Match::new_eq(Meta::new("l4proto"), Expression::from("icmpv6")).into(), + ); + } + + rule.set_family(Family::V6); + } + } + + Ok(()) + } +} + +impl ToNftRules for Ports { + fn to_nft_rules(&self, rules: &mut Vec, _env: &NftRuleEnv) -> Result<(), Error> { + log::trace!("applying ports: {self:?}"); + + for rule in rules { + if let Some(sport) = self.sport() { + log::trace!("applying sport: {sport:?}"); + + rule.push( + Match::new_eq( + Expression::from(Payload::field("th", "sport")), + Expression::from(sport), + ) + .into(), + ) + } + + if let Some(dport) = self.dport() { + log::trace!("applying dport: {dport:?}"); + + rule.push( + Match::new_eq( + Expression::from(Payload::field("th", "dport")), + Expression::from(dport), + ) + .into(), + ) + } + } + + Ok(()) + } +} + +impl ToNftRules for Ipfilter<'_> { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + let vmid = env + .vmid + .ok_or_else(|| format_err!("can only create ipfilter for guests"))?; + + let guest_config = env + .firewall_config + .guests() + .get(&vmid) + .ok_or_else(|| format_err!("no guest config found!"))?; + + if !guest_config.ipfilter() { + return Ok(()); + } + + match env.direction { + Direction::In => { + if env.contains_family(Family::V4) { + let mut rule = NftRule::new(Statement::make_drop()); + rule.set_family(Family::V4); + + rule.append(&mut vec![ + Match::new_eq( + Expression::from(Meta::new("oifname")), + guest_config.iface_name_by_index(self.index()), + ) + .into(), + Match::new_ne( + Payload::field("arp", "daddr ip"), + Expression::set_name(&SetName::ipset_name( + Family::V4, + self.ipset().name(), + env.vmid, + false, + )), + ) + .into(), + ]); + + rules.push(rule); + } + } + Direction::Out => { + let mut base_rule = NftRule::new(Statement::make_drop()); + + base_rule.push( + Match::new_eq( + Expression::from(Meta::new("iifname")), + guest_config.iface_name_by_index(self.index()), + ) + .into(), + ); + + let mut ipfilter_rules = vec![base_rule.clone()]; + handle_set( + &mut ipfilter_rules, + self.ipset().name(), + "saddr", + env, + false, + )?; + rules.append(&mut ipfilter_rules); + + if env.contains_family(Family::V4) { + base_rule.set_family(Family::V4); + + base_rule.append(&mut vec![Match::new_ne( + Payload::field("arp", "saddr ip"), + Expression::set_name(&SetName::ipset_name( + Family::V4, + self.ipset().name(), + env.vmid, + false, + )), + ) + .into()]); + + rules.push(base_rule); + } + } + } + + Ok(()) + } +} + +impl ToNftRules for CtHelperMacro { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + if let Some(family) = self.family() { + if !env.contains_family(family) { + return Ok(()); + } + } + + if self.tcp().is_none() && self.udp().is_none() { + return Ok(()); + } + + log::trace!("applying ct helper: {self:?}"); + + let ip_family = self.family().map(IpFamily::from); + + if let Some(protocol) = self.tcp() { + let base_rule = NftRule::from_terminal_statements(vec![ + Match::new_eq( + Ct::new("state", None), + Expression::List(vec!["new".into(), "established".into()]), + ) + .into(), + Statement::make_accept(), + ]); + + let helper_rule = NftRule::new(Statement::CtHelper(self.tcp_helper_name())); + + let mut ct_rules = vec![base_rule, helper_rule]; + protocol.to_nft_rules(&mut ct_rules, env)?; + rules.append(&mut ct_rules); + } + + if let Some(protocol) = self.udp() { + let base_rule = NftRule::from_terminal_statements(vec![ + Match::new_eq( + Ct::new("state", None), + Expression::List(vec!["new".into(), "established".into()]), + ) + .into(), + Statement::make_accept(), + ]); + + let helper_rule = NftRule::new(Statement::CtHelper(self.udp_helper_name())); + + let mut ct_rules = vec![base_rule, helper_rule]; + protocol.to_nft_rules(&mut ct_rules, env)?; + rules.append(&mut ct_rules); + } + + let mut ct_helper_rule = NftRule::new(Statement::make_accept()); + + ct_helper_rule.push(Match::new_eq(Ct::new("helper", ip_family), self.name()).into()); + + rules.push(ct_helper_rule); + + Ok(()) + } +} + +impl ToNftRules for FwMacro { + fn to_nft_rules(&self, rules: &mut Vec, env: &NftRuleEnv) -> Result<(), Error> { + log::trace!("applying macro: {self:?}"); + + let initial_rules: Vec = rules.drain(..).collect(); + + for protocol in &self.code { + let mut new_rules = initial_rules.to_vec(); + protocol.to_nft_rules(&mut new_rules, env)?; + + rules.append(&mut new_rules); + } + + Ok(()) + } +} diff --git a/proxmox-nftables/src/expression.rs b/proxmox-nftables/src/expression.rs index 3b8ade0..20559e8 100644 --- a/proxmox-nftables/src/expression.rs +++ b/proxmox-nftables/src/expression.rs @@ -57,6 +57,10 @@ impl Expression { pub fn concat(expressions: impl IntoIterator) -> Self { Expression::Concat(Vec::from_iter(expressions)) } + + pub fn set_name(name: &str) -> Self { + Expression::String(format!("@{name}")) + } } impl From for Expression { -- 2.39.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel