start host API

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index fa2581576fb1cdcb5338f69844159a8f27b64167..3c8d687bf008f4f43afcb53a8476ab8d14146832 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -30,8 +30,6 @@ eval {
 
 use Data::Dumper;
 
-# fixme: remove loglevel settings? NFLOG does not have --loglevel
-
 my $nodename = PVE::INotify::nodename();
 
 my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
@@ -637,6 +635,25 @@ sub parse_port_name_number_or_range {
     return ($nbports);
 }
 
+# helper function for API
+sub cleanup_fw_rule {
+    my ($rule, $digest, $pos) = @_;
+
+    my $r = {};
+
+    foreach my $k (keys %$rule) {
+       next if $k eq 'nbdport';
+       next if $k eq 'nbsport';
+       my $v = $rule->{$k};
+       next if !defined($v);
+       $r->{$k} = $v;
+       $r->{digest} = $digest;
+       $r->{pos} = $pos;
+    }
+
+    return $r;
+}
+
 my $bridge_firewall_enabled = 0;
 
 sub enable_bridge_firewall {
@@ -1156,7 +1173,7 @@ sub generate_group_rules {
 
     die "no such security group '$group'\n" if !$groups_conf->{$group};
 
-    my $rules = $groups_conf->{$group}->{rules};
+    my $rules = $groups_conf->{rules}->{$group};
 
     my $chain = "GROUP-${group}-IN";
 
@@ -1431,7 +1448,11 @@ sub parse_host_fw_rules {
 
     my $section;
 
+    my $digest = Digest::SHA->new('sha1');
+
     while (defined(my $line = <$fh>)) {
+       $digest->add($line);
+
        next if $line =~ m/^#/;
        next if $line =~ m/^\s*$/;
 
@@ -1469,6 +1490,8 @@ sub parse_host_fw_rules {
        push @{$res->{$section}}, @$rules;
     }
 
+    $res->{digest} = $digest->b64digest;
+
     return $res;
 }
 
@@ -1478,9 +1501,13 @@ sub parse_group_fw_rules {
     my $section;
     my $group;
 
-    my $res = { rules => [] };
+    my $res = { rules => {} };
+
+    my $digest = Digest::SHA->new('sha1');
 
     while (defined(my $line = <$fh>)) {
+       $digest->add($line);
+
        next if $line =~ m/^#/;
        next if $line =~ m/^\s*$/;
 
@@ -1504,9 +1531,11 @@ sub parse_group_fw_rules {
            next;
        }
 
-       push @{$res->{$group}->{$section}}, @$rules;
+       push @{$res->{$section}->{$group}}, @$rules;
     }
 
+    $res->{digest} = $digest->b64digest;
+
     return $res;
 }
 
@@ -1672,11 +1701,7 @@ sub read_proc_net_route {
     return $res;
 }
 
-sub compile {
-    my $vmdata = read_local_vm_config();
-    my $vmfw_configs = read_vm_firewall_configs($vmdata);
-
-    my $routing_table = read_proc_net_route();
+sub load_security_groups {
 
     my $groups_conf = {};
     my $filename = "/etc/pve/firewall/groups.fw";
@@ -1684,6 +1709,27 @@ sub compile {
        $groups_conf = parse_group_fw_rules($filename, $fh);
     }
 
+    return $groups_conf;
+}
+
+sub load_hostfw_conf {
+
+    my $hostfw_conf = {};
+    my $filename = "/etc/pve/local/host.fw";
+    if (my $fh = IO::File->new($filename, O_RDONLY)) {
+       $hostfw_conf = parse_host_fw_rules($filename, $fh);
+    }
+    return $hostfw_conf;
+}
+
+sub compile {
+    my $vmdata = read_local_vm_config();
+    my $vmfw_configs = read_vm_firewall_configs($vmdata);
+
+    my $routing_table = read_proc_net_route();
+
+    my $groups_conf = load_security_groups();
+
     my $ruleset = {};
 
     ruleset_create_chain($ruleset, "PVEFW-INPUT");
@@ -1691,14 +1737,8 @@ sub compile {
 
     ruleset_create_chain($ruleset, "PVEFW-FORWARD");
 
-    my $hostfw_options = {};
-    my $hostfw_conf = {};
-
-    $filename = "/etc/pve/local/host.fw";
-    if (my $fh = IO::File->new($filename, O_RDONLY)) {
-       $hostfw_conf = parse_host_fw_rules($filename, $fh);
-       $hostfw_options = $hostfw_conf->{options};
-    }
+    my $hostfw_conf = load_hostfw_conf();
+    my $hostfw_options = $hostfw_conf->{options} || {};
 
     generate_std_chains($ruleset, $hostfw_options);