add objectgroup attributes and/invert

add a new table Objectgroup_Attributes where we can save additional
attributes for objectgroups (like the Attribut tables for objects).

Adds two new attributes for the groups:
* and
* invert

These will modify the match behaviour for object groups

Add the table to cluster sync, backup and factory reset.

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>

diff --git a/src/PMG/API2/ObjectGroupHelpers.pm b/src/PMG/API2/ObjectGroupHelpers.pm
index 48078fb26daf2c99665abec622410ca4afe6df5c..a08a6a366ce271972abf28bf1c6611789bc2e2b5 100644 (file)
--- a/src/PMG/API2/ObjectGroupHelpers.pm
+++ b/src/PMG/API2/ObjectGroupHelpers.pm
@@ -46,13 +46,29 @@ sub format_object_group {
 
     my $res = [];
     foreach my $og (@$ogroups) {
-       push @$res, {
-           id => $og->{id}, name => $og->{name}, info => $og->{info}
-       };
+       my $group = { id => $og->{id}, name => $og->{name}, info => $og->{info} };
+       $group->{and} = $og->{and} if defined($og->{and});
+       $group->{invert} = $og->{invert} if defined($og->{invert});
+       push @$res, $group;
     }
     return $res;
 }
 
+my $group_attributes = {
+    and => {
+       description => "If set to 1, objects in this group are 'and' combined.",
+       type => 'boolean',
+       default => 0,
+       optional => 1,
+    },
+    invert => {
+       description => "If set to 1, the resulting match is inverted.",
+       type => 'boolean',
+       default => 0,
+       optional => 1,
+    },
+};
+
 sub register_group_list_api {
     my ($apiclass, $oclass) = @_;
 
@@ -86,6 +102,11 @@ sub register_group_list_api {
            return format_object_group($ogroups);
        }});
 
+    my $additional_parameters = {};
+    if ($oclass =~ /^(?:what|when|who)$/i) {
+       $additional_parameters = { $group_attributes->%* };
+    }
+
     $apiclass->register_method({
        name => "create_${oclass}_group",
        path => $oclass,
@@ -108,6 +129,7 @@ sub register_group_list_api {
                    maxLength => 255,
                    optional => 1,
                },
+               $additional_parameters->%*,
            },
        },
        returns => { type => 'integer' },
@@ -119,6 +141,10 @@ sub register_group_list_api {
            my $og = PMG::RuleDB::Group->new(
                $param->{name}, $param->{info} // '', $oclass);
 
+           for my $prop (qw(and invert)) {
+               $og->{$prop} = $param->{$prop} if defined($param->{$prop});
+           }
+
            return $rdb->save_group($og);
        }});
 }
@@ -199,6 +225,11 @@ sub register_object_group_config_api {
 
        }});
 
+    my $additional_parameters = {};
+    if ($oclass =~ /^(?:what|when|who)$/i) {
+       $additional_parameters = { $group_attributes->%* };
+    }
+
     $apiclass->register_method({
        name => 'set_config',
        path => $path,
@@ -226,6 +257,7 @@ sub register_object_group_config_api {
                    maxLength => 255,
                    optional => 1,
                },
+               $additional_parameters->%*,
            },
        },
        returns => { type => "null" },
@@ -243,8 +275,9 @@ sub register_object_group_config_api {
            my $og = shift @$list ||
                die "$oclass group '$ogroup' not found\n";
 
-           $og->{name} = $param->{name} if defined($param->{name});
-           $og->{info} = $param->{info} if defined($param->{info});
+           for my $prop (qw(name info and invert)) {
+               $og->{$prop} = $param->{$prop} if defined($param->{$prop});
+           }
 
            $rdb->save_group($og);
 

diff --git a/src/PMG/Backup.pm b/src/PMG/Backup.pm
index e41832eacdeb79eb187e42d2dd6343bfdd12634d..9fc91f88d9380f942dc5e8dfac86d42e4cf6adbf 100644 (file)
--- a/src/PMG/Backup.pm
+++ b/src/PMG/Backup.pm
@@ -94,6 +94,7 @@ sub dumpdb {
        $dbh->do("SET TRANSACTION ISOLATION LEVEL SERIALIZABLE");
 
        dump_table($dbh, 'attribut', $ofh);
+       dump_table($dbh, 'objectgroup_attributes', $ofh);
        dump_table($dbh, 'object', $ofh, 'object_id_seq', 'id');
        dump_table($dbh, 'objectgroup', $ofh, 'objectgroup_id_seq', 'id');
        dump_table($dbh, 'rule', $ofh, 'rule_id_seq', 'id');

diff --git a/src/PMG/Cluster.pm b/src/PMG/Cluster.pm
index 015e66addbf750ee06b7cd345beb4db512ba23cb..ac50cff36b10037866e51c8adceb90a1ccec039e 100644 (file)
--- a/src/PMG/Cluster.pm
+++ b/src/PMG/Cluster.pm
@@ -532,6 +532,7 @@ sub sync_ruledb_from_master {
        $ldb->do("DELETE FROM ObjectGroup");
        $ldb->do("DELETE FROM Object");
        $ldb->do("DELETE FROM Attribut");
+       $ldb->do("DELETE FROM Objectgroup_Attributes");
 
        eval {
            $rdb->begin_work;
@@ -544,6 +545,7 @@ sub sync_ruledb_from_master {
            PMG::DBTools::copy_table($ldb, $rdb, "ObjectGroup");
            PMG::DBTools::copy_table($ldb, $rdb, "Object", 'value');
            PMG::DBTools::copy_table($ldb, $rdb, "Attribut", 'value');
+           PMG::DBTools::copy_table($ldb, $rdb, "Objectgroup_Attributes");
        };
 
        $rdb->rollback; # end transaction

diff --git a/src/PMG/DBTools.pm b/src/PMG/DBTools.pm
index 9e133bc89ee2a1703bd670e2a29d10f237c9b76a..3c8d18141d2e241509c2c1ee5425a6799b469d8d 100644 (file)
--- a/src/PMG/DBTools.pm
+++ b/src/PMG/DBTools.pm
@@ -295,6 +295,18 @@ my $userprefs_ctablecmd =  <<__EOD;
 
 __EOD
 
+my $object_group_attributes_cmd = <<__EOD;
+    CREATE TABLE Objectgroup_Attributes (
+      Objectgroup_ID INTEGER NOT NULL,
+      Name VARCHAR(20) NOT NULL,
+      Value BYTEA NULL,
+      PRIMARY KEY (Objectgroup_ID, Name)
+    );
+
+    CREATE INDEX Objectgroup_Attributes_Objectgroup_ID_Index ON Objectgroup_Attributes(Objectgroup_ID);
+
+__EOD
+
 sub cond_create_dbtable {
     my ($dbh, $name, $ctablecmd) = @_;
 
@@ -439,6 +451,8 @@ sub create_ruledb {
         $userprefs_ctablecmd;
 
         $virusinfo_stat_ctablecmd;
+
+        $object_group_attributes_cmd;
 EOD
     );
 
@@ -494,6 +508,7 @@ sub upgradedb {
        'CStatistic', $cstatistic_ctablecmd,
        'ClusterInfo', $clusterinfo_ctablecmd,
        'VirusInfo', $virusinfo_stat_ctablecmd,
+       'Objectgroup_Attributes', $object_group_attributes_cmd,
     };
 
     foreach my $table (keys %$tables) {
@@ -605,6 +620,7 @@ sub init_ruledb {
        $dbh->do(
            "DELETE FROM Rule;"
            ." DELETE FROM RuleGroup;"
+           ." DELETE FROM Objectgroup_Attributes;"
            ." DELETE FROM Attribut WHERE Object_ID NOT IN ($glids);"
            ." DELETE FROM Object WHERE ID NOT IN ($glids);"
            ." DELETE FROM Objectgroup WHERE class != 'greylist';"

diff --git a/src/PMG/RuleDB.pm b/src/PMG/RuleDB.pm
index a6b0b791afc63cc04f654ed3f4fee35612282f66..0b112b47e319c08f7de79d910370aab0a328ca46 100644 (file)
--- a/src/PMG/RuleDB.pm
+++ b/src/PMG/RuleDB.pm
@@ -160,6 +160,30 @@ sub load_groups_by_name {
     };
 }
 
+sub update_group_attributes {
+    my ($self, $og) = @_;
+
+    my $attributes = [qw(and invert)];
+
+    for my $attribute ($attributes->@*) {
+       # only save the values if they're set to 1
+       if ($og->{$attribute}) {
+           $self->{dbh}->do(
+               "INSERT INTO Objectgroup_Attributes (Objectgroup_ID, Name, Value) " .
+               "VALUES (?, ?, ?) ".
+               "ON CONFLICT (Objectgroup_ID, Name) DO UPDATE SET Value = ?", undef,
+               $og->{id}, $attribute, $og->{$attribute}, $og->{$attribute},
+           );
+       } else {
+           $self->{dbh}->do(
+               "DELETE FROM Objectgroup_Attributes " .
+               "WHERE Objectgroup_ID = ? AND Name = ?", undef,
+               $og->{id}, $attribute,
+           );
+       }
+    }
+}
+
 sub save_group {
     my ($self, $og) = @_;
 
@@ -171,27 +195,51 @@ sub save_group {
        die "undefined group attribute - class: ERROR";
 
     if (defined($og->{id})) {
+       $self->{dbh}->begin_work;
+
+       eval {
+           $self->{dbh}->do("UPDATE Objectgroup " .
+                            "SET Name = ?, Info = ? " .
+                            "WHERE ID = ?", undef,
+                            encode('UTF-8', $og->{name}),
+                            encode('UTF-8', $og->{info}),
+                            $og->{id});
 
-       $self->{dbh}->do("UPDATE Objectgroup " .
-                        "SET Name = ?, Info = ? " .
-                        "WHERE ID = ?", undef,
-                        encode('UTF-8', $og->{name}),
-                        encode('UTF-8', $og->{info}),
-                        $og->{id});
+           $self->update_group_attributes($og);
 
-       return $og->{id};
+           $self->{dbh}->commit;
+       };
 
+       if (my $err = $@) {
+           $self->{dbh}->rollback;
+           syslog('err', $err);
+           return undef;
+       }
     } else {
-       my $sth = $self->{dbh}->prepare(
-           "INSERT INTO Objectgroup (Name, Info, Class) " .
-           "VALUES (?, ?, ?);");
+       $self->{dbh}->begin_work;
+
+       eval {
+           my $sth = $self->{dbh}->prepare(
+               "INSERT INTO Objectgroup (Name, Info, Class) " .
+               "VALUES (?, ?, ?);");
 
-       $sth->execute(encode('UTF-8', $og->name), encode('UTF-8', $og->info), $og->class);
+           $sth->execute(encode('UTF-8', $og->name), encode('UTF-8', $og->info), $og->class);
 
-       return $og->{id} = PMG::Utils::lastid($self->{dbh}, 'objectgroup_id_seq');
+           $og->{id} = PMG::Utils::lastid($self->{dbh}, 'objectgroup_id_seq');
+
+           $self->update_group_attributes($og);
+
+           $self->{dbh}->commit;
+       };
+
+       if (my $err = $@) {
+           $self->{dbh}->rollback;
+           syslog('err', $err);
+           return undef;
+       }
     }
 
-    return undef;
+    return $og->{id};
 }
 
 sub delete_group {
@@ -228,6 +276,9 @@ sub delete_group {
        $self->{dbh}->do("DELETE FROM RuleGroup " .
                         "WHERE Objectgroup_ID = ?", undef, $groupid);
 
+       $self->{dbh}->do("DELETE FROM Objectgroup_Attributes " .
+                        "WHERE Objectgroup_ID = ?", undef, $groupid);
+
        $sth = $self->{dbh}->prepare("SELECT * FROM Object " .
                                      "where Objectgroup_ID = ?");
        $sth->execute($groupid);
@@ -252,6 +303,18 @@ sub delete_group {
     return undef;
 }
 
+sub load_group_attributes {
+    my ($self, $og) = @_;
+
+    my $attribute_sth = $self->{dbh}->prepare("SELECT * FROM Objectgroup_Attributes WHERE Objectgroup_ID = ?");
+    $attribute_sth->execute($og->{id});
+
+    while (my $ref = $attribute_sth->fetchrow_hashref()) {
+       $og->{and} = $ref->{value} if $ref->{name} eq 'and';
+       $og->{invert} = $ref->{value} if $ref->{name} eq 'invert';
+    }
+}
+
 sub load_objectgroups {
     my ($self, $class, $id) = @_;
 
@@ -259,34 +322,47 @@ sub load_objectgroups {
 
     defined($class) || die "undefined object class";
 
-    if (!(defined($id))) {
-        $sth = $self->{dbh}->prepare(
-           "SELECT * FROM Objectgroup where Class = ? ORDER BY name");
-        $sth->execute($class);
-
-    } else {
-        $sth = $self->{dbh}->prepare(
-           "SELECT * FROM Objectgroup where Class like ? and id = ? " .
-           "order by name");
-        $sth->execute($class,$id);
-    }
+    $self->{dbh}->begin_work;
 
     my $arr_og = ();
-    while (my $ref = $sth->fetchrow_hashref()) {
-       my $og = PMG::RuleDB::Group->new($ref->{name}, $ref->{info},
-                                        $ref->{class});
-       $og->{id} = $ref->{id};
 
-       if ($class eq 'action') {
-           my $objects = $self->load_group_objects($og->{id});
-           my $obj = @$objects[0];
-           defined($obj) || die "undefined action object: ERROR";
-           $og->{action} = $obj;
+    eval {
+       if (!(defined($id))) {
+           $sth = $self->{dbh}->prepare(
+               "SELECT * FROM Objectgroup where Class = ? ORDER BY name");
+           $sth->execute($class);
+
+       } else {
+           $sth = $self->{dbh}->prepare(
+               "SELECT * FROM Objectgroup where Class like ? and id = ? " .
+               "order by name");
+           $sth->execute($class,$id);
        }
-       push @$arr_og, $og;
-    }
 
-    $sth->finish();
+       while (my $ref = $sth->fetchrow_hashref()) {
+           my $og = PMG::RuleDB::Group->new($ref->{name}, $ref->{info},
+                                            $ref->{class});
+           $og->{id} = $ref->{id};
+
+           if ($class eq 'action') {
+               my $objects = $self->load_group_objects($og->{id});
+               my $obj = @$objects[0];
+               defined($obj) || die "undefined action object: ERROR";
+               $og->{action} = $obj;
+           } else {
+               $self->load_group_attributes($og);
+           }
+           push @$arr_og, $og;
+       }
+
+       $sth->finish();
+    };
+
+    my $err = $@;
+
+    $self->{dbh}->rollback; # finish transaction
+
+    die $err if $err;
 
     return $arr_og;
 }