+ $res->{$k} = $v;
+ $sha->add($k, ':', $v, "\n");
+ }
+
+ my $digest = $sha->hexdigest;
+
+ $res->{digest} = $digest;
+
+ return wantarray ? ($res, $digest) : $res;
+}
+
+sub copy_list_with_digest {
+ my ($list) = @_;
+
+ my $sha = Digest::SHA->new('sha1');
+
+ my $res = [];
+ foreach my $entry (@$list) {
+ my $data = {};
+ foreach my $k (sort keys %$entry) {
+ my $v = $entry->{$k};
+ next if !defined($v);
+ $data->{$k} = $v;
+ $sha->add($k, ':', $v, "\n");
+ }
+ push @$res, $data;
+ }
+
+ my $digest = $sha->hexdigest;
+
+ foreach my $entry (@$res) {
+ $entry->{digest} = $digest;
+ }
+
+ return wantarray ? ($res, $digest) : $res;
+}
+
+my $rule_properties = {
+ pos => {
+ description => "Update rule at position <pos>.",
+ type => 'integer',
+ minimum => 0,
+ optional => 1,
+ },
+ digest => get_standard_option('pve-config-digest'),
+ type => {
+ type => 'string',
+ optional => 1,
+ enum => ['in', 'out', 'group'],
+ },
+ action => {
+ description => "Rule action ('ACCEPT', 'DROP', 'REJECT') or security group name.",
+ type => 'string',
+ optional => 1,
+ pattern => $security_group_name_pattern,
+ maxLength => 20,
+ minLength => 2,
+ },
+ macro => {
+ type => 'string',
+ optional => 1,
+ maxLength => 128,
+ },
+ iface => get_standard_option('pve-iface', { optional => 1 }),
+ source => {
+ type => 'string', format => 'pve-fw-v4addr-spec',
+ optional => 1,
+ },
+ dest => {
+ type => 'string', format => 'pve-fw-v4addr-spec',
+ optional => 1,
+ },
+ proto => {
+ type => 'string', format => 'pve-fw-protocol-spec',
+ optional => 1,
+ },
+ enable => {
+ type => 'boolean',
+ optional => 1,
+ },
+ sport => {
+ type => 'string', format => 'pve-fw-port-spec',
+ optional => 1,
+ },
+ dport => {
+ type => 'string', format => 'pve-fw-port-spec',
+ optional => 1,
+ },
+ comment => {
+ type => 'string',
+ optional => 1,
+ },
+};
+
+sub add_rule_properties {
+ my ($properties) = @_;
+
+ foreach my $k (keys %$rule_properties) {
+ my $h = $rule_properties->{$k};
+ # copy data, so that we can modify later without side effects
+ foreach my $opt (keys %$h) { $properties->{$k}->{$opt} = $h->{$opt}; }
+ }
+
+ return $properties;
+}
+
+sub delete_rule_properties {
+ my ($rule, $delete_str) = @_;
+
+ foreach my $opt (PVE::Tools::split_list($delete_str)) {
+ raise_param_exc({ 'delete' => "no such property ('$opt')"})
+ if !defined($rule_properties->{$opt});
+ raise_param_exc({ 'delete' => "unable to delete required property '$opt'"})
+ if $opt eq 'type' || $opt eq 'action';
+ delete $rule->{$opt};
+ }
+
+ return $rule;
+}
+
+my $apply_macro = sub {
+ my ($macro_name, $param, $verify) = @_;
+
+ my $macro_rules = $pve_fw_parsed_macros->{$macro_name};
+ die "unknown macro '$macro_name'\n" if !$macro_rules; # should not happen
+
+ my $rules = [];
+
+ foreach my $templ (@$macro_rules) {
+ my $rule = {};
+ my $param_used = {};
+ foreach my $k (keys %$templ) {
+ my $v = $templ->{$k};
+ if ($v eq 'PARAM') {
+ $v = $param->{$k};
+ $param_used->{$k} = 1;
+ } elsif ($v eq 'DEST') {
+ $v = $param->{dest};
+ $param_used->{dest} = 1;
+ } elsif ($v eq 'SOURCE') {
+ $v = $param->{source};
+ $param_used->{source} = 1;
+ }
+
+ if (!defined($v)) {
+ my $msg = "missing parameter '$k' in macro '$macro_name'";
+ raise_param_exc({ macro => $msg }) if $verify;
+ die "$msg\n";
+ }
+ $rule->{$k} = $v;
+ }
+ foreach my $k (keys %$param) {
+ next if $k eq 'macro';
+ next if !defined($param->{$k});
+ next if $param_used->{$k};
+ if (defined($rule->{$k})) {
+ if ($rule->{$k} ne $param->{$k}) {
+ my $msg = "parameter '$k' already define in macro (value = '$rule->{$k}')";
+ raise_param_exc({ $k => $msg }) if $verify;
+ die "$msg\n";
+ }
+ } else {
+ $rule->{$k} = $param->{$k};
+ }
+ }
+ push @$rules, $rule;
+ }
+
+ return $rules;
+};
+
+sub verify_rule {
+ my ($rule, $allow_groups) = @_;
+
+ my $type = $rule->{type};
+
+ raise_param_exc({ type => "missing property"}) if !$type;
+ raise_param_exc({ action => "missing property"}) if !$rule->{action};
+
+ if ($type eq 'in' || $type eq 'out') {
+ raise_param_exc({ action => "unknown action '$rule->{action}'"})
+ if $rule->{action} !~ m/^(ACCEPT|DROP|REJECT)$/;
+ } elsif ($type eq 'group') {
+ raise_param_exc({ type => "security groups not allowed"})
+ if !$allow_groups;
+ raise_param_exc({ action => "invalid characters in security group name"})
+ if $rule->{action} !~ m/^${security_group_name_pattern}$/;
+ } else {
+ raise_param_exc({ type => "unknown rule type '$type'"});
+ }
+
+ # fixme: verify $rule->{iface}?
+
+ if ($rule->{macro}) {
+ my $preferred_name = $pve_fw_preferred_macro_names->{lc($rule->{macro})};
+ raise_param_exc({ macro => "unknown macro '$rule->{macro}'"}) if !$preferred_name;
+ $rule->{macro} = $preferred_name;
+ }
+
+ if ($rule->{dport}) {
+ eval { parse_port_name_number_or_range($rule->{dport}); };
+ raise_param_exc({ dport => $@ }) if $@;
+ }
+
+ if ($rule->{sport}) {
+ eval { parse_port_name_number_or_range($rule->{sport}); };
+ raise_param_exc({ sport => $@ }) if $@;
+ }
+
+ if ($rule->{source}) {
+ eval { parse_address_list($rule->{source}); };
+ raise_param_exc({ source => $@ }) if $@;
+ }
+
+ if ($rule->{dest}) {
+ eval { parse_address_list($rule->{dest}); };
+ raise_param_exc({ dest => $@ }) if $@;
+ }
+
+ if ($rule->{macro}) {
+ &$apply_macro($rule->{macro}, $rule, 1);
+ }
+
+ return $rule;
+}
+
+sub copy_rule_data {
+ my ($rule, $param) = @_;
+
+ foreach my $k (keys %$rule_properties) {
+ if (defined(my $v = $param->{$k})) {
+ if ($v eq '' || $v eq '-') {
+ delete $rule->{$k};
+ } else {
+ $rule->{$k} = $v;
+ }
+ } else {
+ delete $rule->{$k};
+ }