[PATCH pve-network v3 24/45] sdn: microseg: enforce the policy on guest NICs

[Hannes Laimer <h.laimer@proxmox.com>]

A guest NIC is enforced when it is plugged, and if attaching the
enforcement fails, so does the guest start. A full pass enforces
every guest NIC of the node. The package runs one when it is
configured and when libpve-rs-perl is upgraded, since the BPF
programs are compiled into that library.

A running config without a microseg block, as a version without
microseg support writes it, says nothing about the policy. A pass and
a plug leave enforcement as it is and warn where a policy is
configured.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 debian/libpve-network-perl.postinst | 21 ++++++++++
 debian/triggers                     |  1 +
 src/PVE/Network/SDN/Microseg.pm     | 65 ++++++++++++++++++++++++++++-
 src/PVE/Network/SDN/Zones.pm        |  5 +++
 4 files changed, 91 insertions(+), 1 deletion(-)

diff --git a/debian/libpve-network-perl.postinst b/debian/libpve-network-perl.postinst
index 99faedf48f56..88e9675b6928 100644
--- a/debian/libpve-network-perl.postinst
+++ b/debian/libpve-network-perl.postinst
@@ -22,6 +22,18 @@ migrate_mac_cache() {
   fi
 }
 
+# The BPF programs are compiled into libpve-rs-perl, whose upgrade fires the
+# pve-microseg-update trigger so a full pass installs the new build. When both
+# packages are upgraded in one run, this package is only unpacked when the
+# library is set up, so dpkg drops the trigger and the configure runs the pass.
+apply_microseg() {
+  test -f /etc/pve/local/pve-ssl.pem || return 0
+  test -e /proxmox_install_mode && return 0
+
+  perl -MPVE::Network::SDN::Microseg -e 'PVE::Network::SDN::Microseg::apply_all()' \
+    || echo "applying the microsegmentation policy failed, run an SDN apply or a network reload"
+}
+
 case "$1" in
   configure)
     # TODO: remove with PVE 9+
@@ -29,6 +41,15 @@ case "$1" in
       migrate_ipam_db
       migrate_mac_cache
     fi
+    apply_microseg
+  ;;
+
+  triggered)
+    case " $2 " in
+      *" pve-microseg-update "*)
+        apply_microseg
+      ;;
+    esac
   ;;
 esac
 
diff --git a/debian/triggers b/debian/triggers
index 59dd6885a5f9..30113fe73944 100644
--- a/debian/triggers
+++ b/debian/triggers
@@ -1 +1,2 @@
 activate-noawait pve-api-updates
+interest-noawait pve-microseg-update
diff --git a/src/PVE/Network/SDN/Microseg.pm b/src/PVE/Network/SDN/Microseg.pm
index 05c432d4eec7..3cd9c3a8ed35 100644
--- a/src/PVE/Network/SDN/Microseg.pm
+++ b/src/PVE/Network/SDN/Microseg.pm
@@ -5,10 +5,13 @@ use warnings;
 
 use PVE::Cluster qw(cfs_register_file cfs_read_file cfs_write_file);
 use PVE::JSONSchema qw(get_standard_option);
+use PVE::RESTEnvironment qw(log_warn);
 use PVE::RPCEnvironment;
 use PVE::Tools;
 
 use PVE::RS::SDN::Microseg;
+use PVE::RS::SDN::Microseg::ExclusiveLock;
+use PVE::RS::SDN::Microseg::SharedLock;
 
 PVE::JSONSchema::register_format(
     'pve-sdn-microseg-id',
@@ -245,9 +248,11 @@ sub optional_properties {
 }
 
 sub guest_inventory {
+    my (%opts) = @_;
+
     my @props = map { "net$_" } 0 .. $MAX_NIC_INDEX;
 
-    my $by_vmid = PVE::Cluster::get_guest_config_properties(\@props);
+    my $by_vmid = PVE::Cluster::get_guest_config_properties(\@props, $opts{vmid});
 
     my $inventory = [];
     for my $vmid (sort { $a <=> $b } keys %$by_vmid) {
@@ -279,4 +284,62 @@ sub type_matches {
     return (grep { $_ eq $got } @$want) ? 1 : 0;
 }
 
+my sub parse_guest_nic {
+    my ($iface) = @_;
+
+    return $iface =~ m/^(?:tap|veth)(\d+)i(\d+)$/;
+}
+
+# the guest as the inventory lists it, with nothing but its vmid when it has no NICs
+my sub guest_info {
+    my ($vmid) = @_;
+
+    my ($guest) = guest_inventory(vmid => $vmid)->@*;
+
+    return $guest // { vmid => int($vmid), nics => [] };
+}
+
+# an unmounted pmxcfs reads like a config that was never committed, and enforcement would be dropped
+my sub read_running_config {
+    PVE::Cluster::check_cfs_is_mounted();
+    return PVE::Cluster::get_config('sdn/.running-config');
+}
+
+# a config that cannot be read may still hold a policy
+my sub is_configured {
+    my $sections = eval { config()->to_sections() };
+    return !defined($sections) || scalar(%$sections);
+}
+
+sub apply_interface {
+    my ($iface, $firewall_bridge) = @_;
+
+    my ($vmid) = parse_guest_nic($iface);
+    return if !defined($vmid);
+
+    $firewall_bridge = $firewall_bridge ? 1 : 0;
+
+    my $lock = PVE::RS::SDN::Microseg::SharedLock->new();
+    my $raw = read_running_config();
+    my $guest = guest_info($vmid);
+    if (!$lock->apply_iface($raw, $guest, $iface, $firewall_bridge)) {
+        log_warn("microseg: the running config carries no microseg block,"
+                . " '$iface' stays unenforced. looks like a node is running an older version")
+            if is_configured();
+    }
+}
+
+sub apply_all {
+    eval {
+        my $lock = PVE::RS::SDN::Microseg::ExclusiveLock->new();
+        my $raw = read_running_config();
+        $lock->apply($raw, guest_inventory())
+            or !is_configured()
+            or log_warn("microseg: the running config carries no microseg block, as written"
+                . " before the upgrade or by a node without microsegmentation support, leaving"
+                . " enforcement unchanged");
+    };
+    die "microseg: failed to apply running config: $@" if $@;
+}
+
 1;
diff --git a/src/PVE/Network/SDN/Zones.pm b/src/PVE/Network/SDN/Zones.pm
index efcbeb3c1444..da24ef16dddb 100644
--- a/src/PVE/Network/SDN/Zones.pm
+++ b/src/PVE/Network/SDN/Zones.pm
@@ -11,6 +11,7 @@ use PVE::IPRoute2;
 use PVE::Network;
 
 use PVE::Network::SDN::Vnets;
+use PVE::Network::SDN::Microseg;
 use PVE::Network::SDN::Zones::VlanPlugin;
 use PVE::Network::SDN::Zones::QinQPlugin;
 use PVE::Network::SDN::Zones::VxlanPlugin;
@@ -364,6 +365,10 @@ sub veth_create {
 sub tap_plug {
     my ($iface, $bridge, $tag, $firewall, $trunks, $rate) = @_;
 
+    # attach enforcement before bridging, so an assigned NIC never passes traffic unenforced
+    eval { PVE::Network::SDN::Microseg::apply_interface($iface, $firewall) };
+    die "microseg: refusing to bring up '$iface' unenforced: $@" if $@;
+
     my $vnet = PVE::Network::SDN::Vnets::get_vnet($bridge, 1);
     if (!$vnet) { # fallback for classic bridge
         my $interfaces_config = PVE::INotify::read_file('interfaces');
-- 
2.47.3