[pve-devel] [PATCH v2 firewall] Don't change external ebtables rules

Stoiko Ivanov s.ivanov at proxmox.com
Wed May 23 19:22:08 CEST 2018


  * Fixes #1764
  * Introduces ebtables_enable option to cluster config
  * All ebtables chains not created by PVE are left in place

Signed-off-by: Stoiko Ivanov <s.ivanov at proxmox.com>
---
Changes from V1:
* externally defined rules (those not in chains matching
  $pve_ebtables_chainname_regex) are ignored (taken and restored as is)
* setting ebtables_enable to 1 in the cluster config now cleans the ebtable
  rules generated by PVE.

I'm not too fond of the introduced code duplication
(get_ebtables_ruleset_status), but since we need the actual rule texts from
the ebtables output in this case as well it seemed like a fair compromise
(the alternative being a quite larger refactoring of the other parts which use
get_ruleset_status.



src/PVE/Firewall.pm | 100 ++++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 73 insertions(+), 27 deletions(-)

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 96cf9bd..56b99c4 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1827,11 +1827,12 @@ sub ipset_get_chains {
     return $res;
 }
 
+my $pve_ebtables_chainname_regex = qr/PVEFW-\S+|(?:tab|veth)\d+i\d+-(?:IN|OUT)/;
+
 sub ebtables_get_chains {
 
     my $res = {};
     my $chains = {};
-
     my $parser = sub {
 	my $line = shift;
 	return if $line =~ m/^#/;
@@ -1839,15 +1840,11 @@ sub ebtables_get_chains {
 	if ($line =~ m/^:(\S+)\s\S+$/) {
 	    # Make sure we know chains exist even if they're empty.
 	    $chains->{$1} //= [];
-	} elsif ($line =~ m/^(?:\S+)\s(PVEFW-\S+)\s(?:\S+).*/) {
+	} elsif ($line =~ m/^(?:\S+)\s($pve_ebtables_chainname_regex)\s(?:\S+).*/) {
 	    my $chain = $1;
 	    $line =~ s/\s+$//;
 	    push @{$chains->{$chain}}, $line;
-	} elsif ($line =~ m/^(?:\S+)\s(tap\d+i\d+-(:?IN|OUT))\s(?:\S+).*/) {
-	    my $chain = $1;
-	    $line =~ s/\s+$//;
-	    push @{$chains->{$chain}}, $line;
-	} elsif ($line =~ m/^(?:\S+)\s(veth\d+i\d+-(:?IN|OUT))\s(?:\S+).*/) {
+	} elsif ($line =~ m/^(?:\S+)\s(\S+)\s(?:\S+).*/) {
 	    my $chain = $1;
 	    $line =~ s/\s+$//;
 	    push @{$chains->{$chain}}, $line;
@@ -1858,10 +1855,10 @@ sub ebtables_get_chains {
     };
 
     run_command("/sbin/ebtables-save", outfunc => $parser);
-
-    # compute digest for each chain
+    # compute digest for each chain and store rules as well
     foreach my $chain (keys %$chains) {
-	$res->{$chain} = iptables_chain_digest($chains->{$chain});
+	$res->{$chain}->{'rules'} = $chains->{$chain};
+	$res->{$chain}->{'digest'} = iptables_chain_digest($chains->{$chain});
     }
     return $res;
 }
@@ -2667,6 +2664,9 @@ sub parse_clusterfw_option {
 	if (($value > 1) && ((time() - $value) > 60)) {
 	    $value = 0
 	}
+    } elsif ($line =~ m/^(ebtables_enable):\s*(0|1)\s*$/i) {
+	$opt = lc($1);
+	$value = int($2);
     } elsif ($line =~ m/^(policy_(in|out)):\s*(ACCEPT|DROP|REJECT)\s*$/i) {
 	$opt = lc($1);
 	$value = uc($3);
@@ -3422,7 +3422,7 @@ sub compile {
 	$vmfw_configs = read_vm_firewall_configs($cluster_conf, $vmdata, undef, $verbose);
     }
 
-    return ({},{},{}) if !$cluster_conf->{options}->{enable};
+    return ({},{},{},{}) if !$cluster_conf->{options}->{enable};
 
     my $localnet;
     if ($cluster_conf->{aliases}->{local_network}) {
@@ -3431,7 +3431,7 @@ sub compile {
 	my $localnet_ver;
 	($localnet, $localnet_ver) = parse_ip_or_cidr(local_network() || '127.0.0.0/8');
 
-	$cluster_conf->{aliases}->{local_network} = { 
+	$cluster_conf->{aliases}->{local_network} = {
 	    name => 'local_network', cidr => $localnet, ipversion => $localnet_ver };
     }
 
@@ -3657,13 +3657,14 @@ sub compile_ipsets {
 sub compile_ebtables_filter {
     my ($cluster_conf, $hostfw_conf, $vmfw_configs, $vmdata, $verbose) = @_;
 
-    return ({}, {}) if !$cluster_conf->{options}->{enable};
+    if (!($cluster_conf->{options}->{ebtables_enable} // 1)) {
+	return {};
+    }
 
     my $ruleset = {};
 
     ruleset_create_chain($ruleset, "PVEFW-FORWARD");
 
-
     ruleset_create_chain($ruleset, "PVEFW-FWBR-OUT");
     #for ipv4 and ipv6, check macaddress in iptables, so we use conntrack 'ESTABLISHED', to speedup rules
     ruleset_addrule($ruleset, 'PVEFW-FORWARD', '-p IPv4', '-j ACCEPT');
@@ -3848,6 +3849,50 @@ sub get_ruleset_cmdlist {
 
     return wantarray ? ($cmdlist, $changes) : $cmdlist;
 }
+sub get_ebtables_ruleset_status {
+    my ($ruleset, $active_chains, $digest_fn, $verbose) = @_;
+
+    my $statushash = {};
+
+    foreach my $chain (sort keys %$ruleset) {
+	my $digest = &$digest_fn($ruleset->{$chain});
+
+	$statushash->{$chain}->{digest} = $digest;
+
+	my $olddigest = $active_chains->{$chain}->{digest};
+	if (defined($olddigest) && ($olddigest eq $digest) ) {
+	    $statushash->{$chain}->{action} = 'exists';
+	} else {
+	    $statushash->{$chain}->{action} = 'create/update';
+	}
+	$statushash->{$chain}->{rules} = $ruleset->{$chain};
+	if ($verbose) {
+	    print "$statushash->{$chain}->{action} $chain ($digest)\n";
+	    foreach my $cmd (@{$ruleset->{$chain}}) {
+		print "\t$cmd\n";
+	    }
+	}
+    }
+
+    foreach my $chain (sort keys %$active_chains) {
+	my $action;
+	if (!defined($ruleset->{$chain})) {
+	    if ($chain =~ m/$pve_ebtables_chainname_regex/) {
+		$action = 'delete';
+	    } else {
+		$action = 'ignore';
+	    }
+	    $statushash->{$chain}->{action} = $action;
+	    my $digest = $active_chains->{$chain}->{digest};
+	    $statushash->{$chain}->{digest} = $digest;
+	    $statushash->{$chain}->{rules} = $active_chains->{$chain}->{rules};
+	    print "$action $chain ($digest)\n" if $verbose;
+	}
+    }
+
+    return $statushash;
+}
+
 
 sub get_ebtables_cmdlist {
     my ($ruleset, $verbose) = @_;
@@ -3856,28 +3901,29 @@ sub get_ebtables_cmdlist {
     my $cmdlist = "*filter\n";
 
     my ($active_chains, $hooks) = ebtables_get_chains();
-    my $statushash = get_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, $verbose);
+    my $statushash = get_ebtables_ruleset_status($ruleset, $active_chains, \&iptables_chain_digest, $verbose);
 
     # create chains first
-    foreach my $chain (sort keys %$ruleset) {
-	my $stat = $statushash->{$chain};
-	die "internal error" if !$stat;
+    foreach my $chain (sort keys %$statushash) {
+	next if ($statushash->{$chain}->{action} eq 'delete');
 	$cmdlist .= ":$chain ACCEPT\n";
     }
 
-    if ($ruleset->{'PVEFW-FORWARD'}) {
-	$cmdlist .= "-A FORWARD -j PVEFW-FORWARD\n";
-    }
-
-    foreach my $chain (sort keys %$ruleset) {
+    foreach my $chain (sort keys %$statushash) {
 	my $stat = $statushash->{$chain};
-	die "internal error" if !$stat;
-	$changes = 1 if ($stat->{action} ne 'exists');
+	next if ($stat->{action} eq 'delete');
+	$changes = 1 if ($stat->{action} !~ 'ignore|exists');
 
-	foreach my $cmd (@{$ruleset->{$chain}}) {
+	foreach my $cmd (@{$statushash->{$chain}->{'rules'}}) {
 	    $cmdlist .= "$cmd\n";
 	}
     }
+    my $append_pve_to_forward = "-A FORWARD -j PVEFW-FORWARD\n";
+    if ($ruleset->{'PVEFW-FORWARD'}) {
+	$cmdlist .= $append_pve_to_forward if $cmdlist !~ $append_pve_to_forward;
+    } else {
+	$cmdlist =~ s/$append_pve_to_forward//;
+    }
 
     return wantarray ? ($cmdlist, $changes) : $cmdlist;
 }
@@ -4025,7 +4071,7 @@ sub apply_ruleset {
     }
 
     my $active_ebtables_chains = ebtables_get_chains();
-    my $ebtables_statushash = get_ruleset_status($ebtables_ruleset, $active_ebtables_chains, \&iptables_chain_digest, 0);
+    my $ebtables_statushash = get_ebtables_ruleset_status($ebtables_ruleset, $active_ebtables_chains, \&iptables_chain_digest, 0);
 
     foreach my $chain (sort keys %$ebtables_ruleset) {
 	my $stat = $ebtables_statushash->{$chain};
-- 
2.11.0




More information about the pve-devel mailing list