grammar fix: s/does not exists/does not exist/g

[pve-firewall.git] / src / PVE / API2 / Firewall / Rules.pm

diff --git a/src/PVE/API2/Firewall/Rules.pm b/src/PVE/API2/Firewall/Rules.pm
index ec93dec2b1ba71e0a4afeba65e20e13e20c6890d..0e93a4ab3faa12f1f5b8dee707734f180bce4c86 100644 (file)
--- a/src/PVE/API2/Firewall/Rules.pm
+++ b/src/PVE/API2/Firewall/Rules.pm
@@ -9,7 +9,7 @@ use PVE::Firewall;
 
 use base qw(PVE::RESTHandler);
 
-my $api_properties = { 
+my $api_properties = {
     pos => {
        description => "Rule position.",
        type => 'integer',
@@ -35,7 +35,7 @@ my $additional_param_hash = {};
 
 sub rule_env {
     my ($class, $param) = @_;
-    
+
     die "implement this in subclass";
 }
 
@@ -53,46 +53,6 @@ sub additional_parameters {
     return $copy;
 }
 
-my $rules_modify_permissions = sub {
-    my ($rule_env) = @_;
-
-    if ($rule_env eq 'host') {
-       return {
-           check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
-       };
-    } elsif ($rule_env eq 'cluster' || $rule_env eq 'group') {
-       return {
-           check => ['perm', '/', [ 'Sys.Modify' ]],
-       };
-    } elsif ($rule_env eq 'vm' ||   $rule_env eq 'ct') {
-       return {
-           check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]],
-       }
-    }
-
-    return undef;
-};
-
-my $rules_audit_permissions = sub {
-    my ($rule_env) = @_;
-
-    if ($rule_env eq 'host') {
-       return {
-           check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
-       };
-    } elsif ($rule_env eq 'cluster' || $rule_env eq 'group') {
-       return {
-           check => ['perm', '/', [ 'Sys.Audit' ]],
-       };
-    } elsif ($rule_env eq 'vm' ||   $rule_env eq 'ct') {
-       return {
-           check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
-       }
-    }
-
-    return undef;
-};
-
 sub register_get_rules {
     my ($class) = @_;
 
@@ -105,7 +65,7 @@ sub register_get_rules {
        path => '',
        method => 'GET',
        description => "List rules.",
-       permissions => &$rules_audit_permissions($rule_env),
+       permissions => PVE::Firewall::rules_audit_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $properties,
@@ -145,7 +105,7 @@ sub register_get_rule {
     my $properties = $class->additional_parameters();
 
     $properties->{pos} = $api_properties->{pos};
-    
+
     my $rule_env = $class->rule_env();
 
     $class->register_method({
@@ -153,7 +113,7 @@ sub register_get_rule {
        path => '{pos}',
        method => 'GET',
        description => "Get single rule data.",
-       permissions => &$rules_audit_permissions($rule_env),
+       permissions => PVE::Firewall::rules_audit_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $properties,
@@ -162,9 +122,58 @@ sub register_get_rule {
        returns => {
            type => "object",
            properties => {
+               action => {
+                   type => 'string',
+               },
+               comment => {
+                   type => 'string',
+                   optional => 1,
+               },
+               dest => {
+                   type => 'string',
+                   optional => 1,
+               },
+               dport => {
+                   type => 'string',
+                   optional => 1,
+               },
+               enable => {
+                   type => 'integer',
+                   optional => 1,
+               },
+               log => PVE::Firewall::get_standard_option('pve-fw-loglevel', {
+                   description => 'Log level for firewall rule',
+               }),
+               iface => {
+                   type => 'string',
+                   optional => 1,
+               },
+               ipversion => {
+                   type => 'integer',
+                   optional => 1,
+               },
+               macro => {
+                   type => 'string',
+                   optional => 1,
+               },
                pos => {
                    type => 'integer',
-               }
+               },
+               proto => {
+                   type => 'string',
+                   optional => 1,
+               },
+               source => {
+                   type => 'string',
+                   optional => 1,
+               },
+               sport => {
+                   type => 'string',
+                   optional => 1,
+               },
+               type => {
+                   type => 'string',
+               },
            },
        },
        code => sub {
@@ -173,9 +182,9 @@ sub register_get_rule {
            my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
-       
+
            die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$list);
-       
+
            my $rule = $list->[$param->{pos}];
            $rule->{pos} = $param->{pos};
 
@@ -191,7 +200,7 @@ sub register_create_rule {
     my $create_rule_properties = PVE::Firewall::add_rule_properties($properties);
     $create_rule_properties->{action}->{optional} = 0;
     $create_rule_properties->{type}->{optional} = 0;
-    
+
     my $rule_env = $class->rule_env();
 
     $class->register_method({
@@ -200,7 +209,7 @@ sub register_create_rule {
        method => 'POST',
        description => "Create new rule.",
        protected => 1,
-       permissions => &$rules_modify_permissions($rule_env),
+       permissions => PVE::Firewall::rules_modify_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $create_rule_properties,
@@ -233,7 +242,7 @@ sub register_update_rule {
     my $properties = $class->additional_parameters();
 
     $properties->{pos} = $api_properties->{pos};
-    
+
     my $rule_env = $class->rule_env();
 
     $properties->{moveto} = {
@@ -257,7 +266,7 @@ sub register_update_rule {
        method => 'PUT',
        description => "Modify rule data.",
        protected => 1,
-       permissions => &$rules_modify_permissions($rule_env),
+       permissions => PVE::Firewall::rules_modify_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $update_rule_properties,
@@ -273,7 +282,7 @@ sub register_update_rule {
            PVE::Tools::assert_if_modified($digest, $param->{digest});
 
            die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
-       
+
            my $rule = $rules->[$param->{pos}];
 
            my $moveto = $param->{moveto};
@@ -290,7 +299,7 @@ sub register_update_rule {
                $rules = $newrules;
            } else {
                PVE::Firewall::copy_rule_data($rule, $param);
-               
+
                PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
 
                PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
@@ -310,7 +319,7 @@ sub register_delete_rule {
     $properties->{pos} = $api_properties->{pos};
 
     $properties->{digest} = get_standard_option('pve-config-digest');
-    
+
     my $rule_env = $class->rule_env();
 
     $class->register_method({
@@ -319,7 +328,7 @@ sub register_delete_rule {
        method => 'DELETE',
        description => "Delete rule.",
        protected => 1,
-       permissions => &$rules_modify_permissions($rule_env),
+       permissions => PVE::Firewall::rules_modify_permissions($rule_env),
        parameters => {
            additionalProperties => 0,
            properties => $properties,
@@ -333,11 +342,11 @@ sub register_delete_rule {
 
            my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
            PVE::Tools::assert_if_modified($digest, $param->{digest});
-       
+
            die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
-       
+
            splice(@$rules, $param->{pos}, 1);
-           
+
            $class->save_rules($param, $fw_conf, $rules);
 
            return undef;
@@ -367,7 +376,7 @@ __PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-
 
 sub rule_env {
     my ($class, $param) = @_;
-    
+
     return 'group';
 }
 
@@ -399,19 +408,22 @@ __PACKAGE__->register_method({
     method => 'DELETE',
     description => "Delete security group.",
     protected => 1,
+    permissions => {
+       check => ['perm', '/', [ 'Sys.Modify' ]],
+    },
     parameters => {
        additionalProperties => 0,
-       properties => { 
+       properties => {
            group => get_standard_option('pve-security-group-name'),
        },
     },
     returns => { type => 'null' },
     code => sub {
        my ($param) = @_;
-           
+
        my (undef, $cluster_conf, $rules) = __PACKAGE__->load_config($param);
 
-       die "Security group '$param->{group}' is not empty\n" 
+       die "Security group '$param->{group}' is not empty\n"
            if scalar(@$rules);
 
        __PACKAGE__->save_rules($param, $cluster_conf, undef);
@@ -430,7 +442,7 @@ use base qw(PVE::API2::Firewall::RulesBase);
 
 sub rule_env {
     my ($class, $param) = @_;
-    
+
     return 'cluster';
 }
 
@@ -464,7 +476,7 @@ __PACKAGE__->additional_parameters({ node => get_standard_option('pve-node')});
 
 sub rule_env {
     my ($class, $param) = @_;
-    
+
     return 'host';
 }
 
@@ -495,14 +507,14 @@ use PVE::JSONSchema qw(get_standard_option);
 
 use base qw(PVE::API2::Firewall::RulesBase);
 
-__PACKAGE__->additional_parameters({ 
+__PACKAGE__->additional_parameters({
     node => get_standard_option('pve-node'),
-    vmid => get_standard_option('pve-vmid'),                              
+    vmid => get_standard_option('pve-vmid'),
 });
 
 sub rule_env {
     my ($class, $param) = @_;
-    
+
     return 'vm';
 }
 
@@ -533,14 +545,14 @@ use PVE::JSONSchema qw(get_standard_option);
 
 use base qw(PVE::API2::Firewall::RulesBase);
 
-__PACKAGE__->additional_parameters({ 
+__PACKAGE__->additional_parameters({
     node => get_standard_option('pve-node'),
-    vmid => get_standard_option('pve-vmid'),                              
+    vmid => get_standard_option('pve-vmid'),
 });
 
 sub rule_env {
     my ($class, $param) = @_;
-    
+
     return 'ct';
 }