remove shorewall rule compiler
[pve-firewall.git] / PVE / Firewall.pm
CommitLineData
b6360c3f
DM
1package PVE::Firewall;
2
3use warnings;
4use strict;
5use Data::Dumper;
f789653a 6use PVE::Tools;
b6360c3f 7use PVE::QemuServer;
5e1267a5
DM
8use File::Path;
9use IO::File;
ecbea048 10use Net::IP;
06320eb0 11use PVE::Tools qw(run_command lock_file);
ecbea048 12
5e1267a5 13use Data::Dumper;
b6360c3f 14
06320eb0
DM
15my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
16
9aab3127 17my $macros;
3a616aa0
AD
18my @ruleset = ();
19
a332200b
DM
20# todo: implement some kind of MACROS, like shorewall /usr/share/shorewall/macro.*
21sub get_firewall_macros {
9aab3127
DM
22
23 return $macros if $macros;
24
a332200b
DM
25 #foreach my $path (</usr/share/shorewall/macro.*>) {
26 # if ($path =~ m|/macro\.(\S+)$|) {
27 # $macros->{$1} = 1;
28 # }
29 #}
30
31 $macros = {}; # fixme: implemet me
32
9aab3127
DM
33 return $macros;
34}
35
fcba0beb
DM
36my $etc_services;
37
38sub get_etc_services {
39
40 return $etc_services if $etc_services;
41
42 my $filename = "/etc/services";
43
44 my $fh = IO::File->new($filename, O_RDONLY);
45 if (!$fh) {
46 warn "unable to read '$filename' - $!\n";
47 return {};
48 }
49
50 my $services = {};
51
52 while (my $line = <$fh>) {
53 chomp ($line);
54 next if $line =~m/^#/;
55 next if ($line =~m/^\s*$/);
56
57 if ($line =~ m!^(\S+)\s+(\S+)/(tcp|udp).*$!) {
58 $services->{byid}->{$2}->{name} = $1;
59 $services->{byid}->{$2}->{$3} = 1;
60 $services->{byname}->{$1} = $services->{byid}->{$2};
61 }
62 }
63
64 close($fh);
65
66 $etc_services = $services;
67
3a616aa0 68
fcba0beb
DM
69 return $etc_services;
70}
71
72my $etc_protocols;
73
74sub get_etc_protocols {
75 return $etc_protocols if $etc_protocols;
76
77 my $filename = "/etc/protocols";
78
79 my $fh = IO::File->new($filename, O_RDONLY);
80 if (!$fh) {
81 warn "unable to read '$filename' - $!\n";
82 return {};
83 }
84
85 my $protocols = {};
86
87 while (my $line = <$fh>) {
88 chomp ($line);
89 next if $line =~m/^#/;
90 next if ($line =~m/^\s*$/);
91
92 if ($line =~ m!^(\S+)\s+(\d+)\s+.*$!) {
93 $protocols->{byid}->{$2}->{name} = $1;
94 $protocols->{byname}->{$1} = $protocols->{byid}->{$2};
95 }
96 }
97
98 close($fh);
99
100 $etc_protocols = $protocols;
101
102 return $etc_protocols;
103}
104
ecbea048
DM
105sub parse_address_list {
106 my ($str) = @_;
107
d6de1dc2 108 my $nbaor = 0;
ecbea048
DM
109 foreach my $aor (split(/,/, $str)) {
110 if (!Net::IP->new($aor)) {
111 my $err = Net::IP::Error();
112 die "invalid IP address: $err\n";
d6de1dc2
AD
113 }else{
114 $nbaor++;
ecbea048
DM
115 }
116 }
d6de1dc2 117 return $nbaor;
ecbea048 118}
dddd9413 119
fcba0beb
DM
120sub parse_port_name_number_or_range {
121 my ($str) = @_;
122
123 my $services = PVE::Firewall::get_etc_services();
4cdbb3b7 124 my $nbports = 0;
fcba0beb 125 foreach my $item (split(/,/, $str)) {
4cdbb3b7 126 my $portlist = "";
fcba0beb 127 foreach my $pon (split(':', $item, 2)) {
4cdbb3b7
AD
128 if ($pon =~ m/^\d+$/){
129 die "invalid port '$pon'\n" if $pon < 0 && $pon > 65536;
130 }else{
131 die "invalid port $services->{byname}->{$pon}\n" if !$services->{byname}->{$pon};
132 }
133 $nbports++;
fcba0beb
DM
134 }
135 }
136
4cdbb3b7 137 return ($nbports);
fcba0beb
DM
138}
139
8cebfa6f 140my $rule_format = "%-15s %-30s %-30s %-15s %-15s %-15s\n";
dddd9413 141
3a616aa0
AD
142sub iptables {
143 my ($cmd) = @_;
144
145 run_command("/sbin/iptables $cmd", outfunc => sub {}, errfunc => sub {});
146}
147
148sub iptables_restore {
149
150 unshift (@ruleset, '*filter');
151 push (@ruleset, 'COMMIT');
152
153 my $cmdlist = join("\n", @ruleset);
154
2cfe0eb1 155 run_command("/sbin/iptables-restore -n", input => $cmdlist, outfunc => sub {});
3a616aa0
AD
156}
157
158sub iptables_addrule {
159 my ($rule) = @_;
160
161 push (@ruleset, $rule);
162}
163
164sub iptables_chain_exist {
165 my ($chain) = @_;
166
167 eval{
168 iptables("-n --list $chain");
169 };
170 return undef if $@;
171
172 return 1;
173}
174
175sub iptables_rule_exist {
176 my ($rule) = @_;
177
178 eval{
179 iptables("-C $rule");
180 };
181 return undef if $@;
182
183 return 1;
184}
185
186sub iptables_generate_rule {
187 my ($chain, $rule) = @_;
188
189 my $cmd = "-A $chain";
190
d6de1dc2 191 $cmd .= " -m iprange --src-range" if $rule->{nbsource} && $rule->{nbsource} > 1;
3a616aa0 192 $cmd .= " -s $rule->{source}" if $rule->{source};
d6de1dc2 193 $cmd .= " -m iprange --dst-range" if $rule->{nbdest} && $rule->{nbdest} > 1;
3a616aa0
AD
194 $cmd .= " -d $rule->{dest}" if $rule->{destination};
195 $cmd .= " -p $rule->{proto}" if $rule->{proto};
4cdbb3b7 196 $cmd .= " --match multiport" if $rule->{nbdport} && $rule->{nbdport} > 1;
3a616aa0 197 $cmd .= " --dport $rule->{dport}" if $rule->{dport};
4cdbb3b7 198 $cmd .= " --match multiport" if $rule->{nbsport} && $rule->{nbsport} > 1;
3a616aa0
AD
199 $cmd .= " --sport $rule->{sport}" if $rule->{sport};
200 $cmd .= " -j $rule->{action}" if $rule->{action};
201
202 iptables_addrule($cmd);
203
204}
205
206sub generate_bridge_rules {
207 my ($bridge) = @_;
208
209 if(!iptables_chain_exist("BRIDGEFW-OUT")){
210 iptables_addrule(":BRIDGEFW-OUT - [0:0]");
211 }
212
213 if(!iptables_chain_exist("BRIDGEFW-IN")){
214 iptables_addrule(":BRIDGEFW-IN - [0:0]");
215 }
216
217 if(!iptables_chain_exist("proxmoxfw-FORWARD")){
218 iptables_addrule(":proxmoxfw-FORWARD - [0:0]");
219 iptables_addrule("-I FORWARD -j proxmoxfw-FORWARD");
220 iptables_addrule("-A proxmoxfw-FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT");
221 iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-in --physdev-is-bridged -j BRIDGEFW-OUT");
222 iptables_addrule("-A proxmoxfw-FORWARD -m physdev --physdev-is-out --physdev-is-bridged -j BRIDGEFW-IN");
223
224 }
225
226 generate_proxmoxfwinput();
227
228 if(!iptables_chain_exist("$bridge-IN")){
229 iptables_addrule(":$bridge-IN - [0:0]");
230 iptables_addrule("-A proxmoxfw-FORWARD -i $bridge -j DROP"); #disable interbridge routing
231 iptables_addrule("-A BRIDGEFW-IN -j $bridge-IN");
232 iptables_addrule("-A $bridge-IN -j ACCEPT");
233
234 }
235
236 if(!iptables_chain_exist("$bridge-OUT")){
237 iptables_addrule(":$bridge-OUT - [0:0]");
238 iptables_addrule("-A proxmoxfw-FORWARD -o $bridge -j DROP"); # disable interbridge routing
239 iptables_addrule("-A BRIDGEFW-OUT -j $bridge-OUT");
240
241 }
242
243}
244
245
246sub generate_tap_rules_direction {
247 my ($iface, $netid, $rules, $bridge, $direction) = @_;
248
249 my $tapchain = "$iface-$direction";
250
251 iptables_addrule(":$tapchain - [0:0]");
252
253 iptables_addrule("-A $tapchain -m state --state INVALID -j DROP");
254 iptables_addrule("-A $tapchain -m state --state RELATED,ESTABLISHED -j ACCEPT");
255
256 if (scalar(@$rules)) {
257 foreach my $rule (@$rules) {
258 next if $rule->{iface} && $rule->{iface} ne $netid;
259 if($rule->{action} =~ m/^(GROUP-(\S+))$/){
260 $rule->{action} .= "-$direction";
261 #generate empty group rule if don't exist
262 if(!iptables_chain_exist($rule->{action})){
263 generate_group_rules($2);
264 }
265 }
266 #we go to vmbr-IN if accept in out rules
267 $rule->{action} = "$bridge-IN" if $rule->{action} eq 'ACCEPT' && $direction eq 'OUT';
268 iptables_generate_rule($tapchain, $rule);
269 }
270 }
271
272 iptables_addrule("-A $tapchain -j LOG --log-prefix \"$tapchain-dropped: \" --log-level 4");
273 iptables_addrule("-A $tapchain -j DROP");
274
275 #plug the tap chain to bridge chain
276 my $physdevdirection = $direction eq 'IN' ? "out":"in";
277 my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain";
278
279 if(!iptables_rule_exist($rule)){
280 iptables_addrule("-I $rule");
281 }
282
283 if($direction eq 'OUT'){
284 #add tap->host rules
285 my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain";
286
287 if(!iptables_rule_exist($rule)){
288 iptables_addrule("-A $rule");
289 }
290 }
291}
292
293sub generate_tap_rules {
294 my ($net, $netid, $vmid) = @_;
295
296 my $filename = "/etc/pve/firewall/$vmid.fw";
297 my $fh = IO::File->new($filename, O_RDONLY);
298 return if !$fh;
299
300 #generate bridge rules
301 my $bridge = $net->{bridge};
302 my $tag = $net->{tag};
303 $bridge .= "v$tag" if $tag;
304
305 #generate tap chain
306 my $rules = parse_fw_rules($filename, $fh);
307
308 my $inrules = $rules->{in};
309 my $outrules = $rules->{out};
310
311 my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/;
312
313 generate_bridge_rules($bridge);
314 generate_tap_rules_direction($iface, $netid, $inrules, $bridge, 'IN');
315 generate_tap_rules_direction($iface, $netid, $outrules, $bridge, 'OUT');
316 iptables_restore();
317}
318
319sub flush_tap_rules {
320 my ($net, $netid, $vmid) = @_;
321
322 my $bridge = $net->{bridge};
323 my $iface = "tap".$vmid."i".$1 if $netid =~ m/net(\d+)/;
324
325 flush_tap_rules_direction($iface, $bridge, 'IN');
326 flush_tap_rules_direction($iface, $bridge, 'OUT');
327 iptables_restore();
328}
329
330sub flush_tap_rules_direction {
331 my ($iface, $bridge, $direction) = @_;
332
333 my $tapchain = "$iface-$direction";
334
335 if(iptables_chain_exist($tapchain)){
336 iptables_addrule("-F $tapchain");
337
338 my $physdevdirection = $direction eq 'IN' ? "out":"in";
339 my $rule = "$bridge-$direction -m physdev --physdev-$physdevdirection $iface --physdev-is-bridged -j $tapchain";
340 if(iptables_rule_exist($rule)){
341 iptables_addrule("-D $rule");
342 }
343
344 if($direction eq 'OUT'){
345 my $rule = "proxmoxfw-INPUT -m physdev --physdev-$physdevdirection $iface -j $tapchain";
462a6553 346 if(iptables_rule_exist($rule)){
3a616aa0
AD
347 iptables_addrule("-D $rule");
348 }
349 }
350
351 iptables_addrule("-X $tapchain");
352 }
353}
354
0bd5f137
AD
355sub enablehostfw {
356
357 generate_proxmoxfwinput();
358 generate_proxmoxfwoutput();
359
360 my $filename = "/etc/pve/local/host.fw";
361 my $fh = IO::File->new($filename, O_RDONLY);
362 return if !$fh;
363
364 my $rules = parse_fw_rules($filename, $fh);
365 my $inrules = $rules->{in};
366 my $outrules = $rules->{out};
367
368 #host inbound firewall
369 iptables_addrule(":host-IN - [0:0]");
370 iptables_addrule("-A host-IN -m state --state INVALID -j DROP");
371 iptables_addrule("-A host-IN -m state --state RELATED,ESTABLISHED -j ACCEPT");
372 iptables_addrule("-A host-IN -i lo -j ACCEPT");
373 iptables_addrule("-A host-IN -m addrtype --dst-type MULTICAST -j ACCEPT");
374 iptables_addrule("-A host-IN -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT");
375 iptables_addrule("-A host-IN -p udp -m udp --dport 9000 -j ACCEPT"); #corosync
376
377 if (scalar(@$inrules)) {
378 foreach my $rule (@$inrules) {
379 #we use RETURN because we need to check also tap rules
380 $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT';
381 iptables_generate_rule('host-IN', $rule);
382 }
383 }
384
385 iptables_addrule("-A host-IN -j LOG --log-prefix \"kvmhost-IN dropped: \" --log-level 4");
386 iptables_addrule("-A host-IN -j DROP");
387
388 #host outbound firewall
389 iptables_addrule(":host-OUT - [0:0]");
390 iptables_addrule("-A host-OUT -m state --state INVALID -j DROP");
391 iptables_addrule("-A host-OUT -m state --state RELATED,ESTABLISHED -j ACCEPT");
392 iptables_addrule("-A host-OUT -o lo -j ACCEPT");
393 iptables_addrule("-A host-OUT -m addrtype --dst-type MULTICAST -j ACCEPT");
394 iptables_addrule("-A host-OUT -p udp -m state --state NEW -m multiport --dports 5404,5405 -j ACCEPT");
395 iptables_addrule("-A host-OUT -p udp -m udp --dport 9000 -j ACCEPT"); #corosync
396
397 if (scalar(@$outrules)) {
398 foreach my $rule (@$outrules) {
399 #we use RETURN because we need to check also tap rules
400 $rule->{action} = 'RETURN' if $rule->{action} eq 'ACCEPT';
401 iptables_generate_rule('host-OUT', $rule);
402 }
403 }
404
405 iptables_addrule("-A host-OUT -j LOG --log-prefix \"kvmhost-OUT dropped: \" --log-level 4");
406 iptables_addrule("-A host-OUT -j DROP");
407
408
409 my $rule = "proxmoxfw-INPUT -j host-IN";
410 if(!iptables_rule_exist($rule)){
411 iptables_addrule("-I $rule");
412 }
413
414 $rule = "proxmoxfw-OUTPUT -j host-OUT";
415 if(!iptables_rule_exist($rule)){
416 iptables_addrule("-I $rule");
417 }
418
419 iptables_restore();
420
421
422}
423
424sub disablehostfw {
425
426 my $chain = "host-IN";
427
428 my $rule = "proxmoxfw-INPUT -j $chain";
429 if(iptables_rule_exist($rule)){
430 iptables_addrule("-D $rule");
431 }
432
433 if(iptables_chain_exist($chain)){
434 iptables_addrule("-F $chain");
435 iptables_addrule("-X $chain");
436 }
437
438 $chain = "host-OUT";
439
440 $rule = "proxmoxfw-OUTPUT -j $chain";
441 if(iptables_rule_exist($rule)){
442 iptables_addrule("-D $rule");
443 }
444
445 if(iptables_chain_exist($chain)){
446 iptables_addrule("-F $chain");
447 iptables_addrule("-X $chain");
448 }
449
450 iptables_restore();
451}
452
453sub generate_proxmoxfwinput {
454
455 if(!iptables_chain_exist("proxmoxfw-INPUT")){
456 iptables_addrule(":proxmoxfw-INPUT - [0:0]");
457 iptables_addrule("-I INPUT -j proxmoxfw-INPUT");
458 iptables_addrule("-A INPUT -j ACCEPT");
459 }
460}
461
462sub generate_proxmoxfwoutput {
463
464 if(!iptables_chain_exist("proxmoxfw-OUTPUT")){
465 iptables_addrule(":proxmoxfw-OUTPUT - [0:0]");
466 iptables_addrule("-I OUTPUT -j proxmoxfw-OUTPUT");
467 iptables_addrule("-A OUTPUT -j ACCEPT");
468 }
469
470}
471
9d31b418
AD
472sub enable_group_rules {
473 my ($group) = @_;
474
475 generate_group_rules($group);
476 iptables_restore();
477}
478
479sub generate_group_rules {
480 my ($group) = @_;
481
482 my $filename = "/etc/pve/firewall/groups.fw";
483 my $fh = IO::File->new($filename, O_RDONLY);
484 return if !$fh;
485
486 my $rules = parse_fw_rules($filename, $fh, $group);
487 my $inrules = $rules->{in};
488 my $outrules = $rules->{out};
489
490 my $chain = "GROUP-".$group."-IN";
491
492 iptables_addrule(":$chain - [0:0]");
493
494 if (scalar(@$inrules)) {
495 foreach my $rule (@$inrules) {
496 iptables_generate_rule($chain, $rule);
497 }
498 }
499
500 $chain = "GROUP-".$group."-OUT";
501
502 iptables_addrule(":$chain - [0:0]");
503
504 if(!iptables_chain_exist("BRIDGEFW-OUT")){
505 iptables_addrule(":BRIDGEFW-OUT - [0:0]");
506 }
507
508 if(!iptables_chain_exist("BRIDGEFW-IN")){
509 iptables_addrule(":BRIDGEFW-IN - [0:0]");
510 }
511
512 if (scalar(@$outrules)) {
513 foreach my $rule (@$outrules) {
514 #we go the BRIDGEFW-IN because we need to check also other tap rules
515 #(and group rules can be set on any bridge, so we can't go to VMBRXX-IN)
516 $rule->{action} = 'BRIDGEFW-IN' if $rule->{action} eq 'ACCEPT';
517 iptables_generate_rule($chain, $rule);
518 }
519 }
520
521}
522
523sub disable_group_rules {
524 my ($group) = @_;
525
526 my $chain = "GROUP-".$group."-IN";
527
528 if(iptables_chain_exist($chain)){
529 iptables_addrule("-F $chain");
530 iptables_addrule("-X $chain");
531 }
532
533 $chain = "GROUP-".$group."-OUT";
534
535 if(iptables_chain_exist($chain)){
536 iptables_addrule("-F $chain");
537 iptables_addrule("-X $chain");
538 }
539
540 #iptables_restore will die if security group is linked in a tap chain
541 #maybe can we improve that, parsing each vm config, or parsing iptables -S
542 #to see if the security group is linked or not
543 iptables_restore();
544}
545
5e1267a5 546sub parse_fw_rules {
9d31b418 547 my ($filename, $fh, $group) = @_;
5e1267a5
DM
548
549 my $section;
9d31b418
AD
550 my $securitygroup;
551 my $securitygroupexist;
5e1267a5
DM
552
553 my $res = { in => [], out => [] };
554
a332200b 555 my $macros = get_firewall_macros();
fcba0beb
DM
556 my $protocols = get_etc_protocols();
557
5e1267a5
DM
558 while (defined(my $line = <$fh>)) {
559 next if $line =~ m/^#/;
560 next if $line =~ m/^\s*$/;
561
9d31b418 562 if ($line =~ m/^\[(in|out)(:(\S+))?\]\s*$/i) {
5e1267a5 563 $section = lc($1);
9d31b418
AD
564 $securitygroup = lc($3) if $3;
565 $securitygroupexist = 1 if $securitygroup && $securitygroup eq $group;
5e1267a5
DM
566 next;
567 }
568 next if !$section;
9d31b418 569 next if $group && $securitygroup ne $group;
5e1267a5
DM
570
571 my ($action, $iface, $source, $dest, $proto, $dport, $sport) =
572 split(/\s+/, $line);
573
574 if (!$action) {
575 warn "skip incomplete line\n";
576 next;
577 }
578
579 my $service;
3a616aa0 580 if ($action =~ m/^(ACCEPT|DROP|REJECT|GROUP-(\S+))$/) {
5e1267a5
DM
581 # OK
582 } elsif ($action =~ m/^(\S+)\((ACCEPT|DROP|REJECT)\)$/) {
583 ($service, $action) = ($1, $2);
584 if (!$macros->{$service}) {
585 warn "unknown service '$service'\n";
586 next;
587 }
588 } else {
589 warn "unknown action '$action'\n";
590 next;
591 }
592
593 $iface = undef if $iface && $iface eq '-';
594 if ($iface && $iface !~ m/^(net0|net1|net2|net3|net4|net5)$/) {
595 warn "unknown interface '$iface'\n";
596 next;
597 }
598
599 $proto = undef if $proto && $proto eq '-';
fcba0beb
DM
600 if ($proto && !(defined($protocols->{byname}->{$proto}) ||
601 defined($protocols->{byid}->{$proto}))) {
5e1267a5
DM
602 warn "unknown protokol '$proto'\n";
603 next;
604 }
605
606 $source = undef if $source && $source eq '-';
5e1267a5 607 $dest = undef if $dest && $dest eq '-';
5e1267a5
DM
608
609 $dport = undef if $dport && $dport eq '-';
610 $sport = undef if $sport && $sport eq '-';
4cdbb3b7
AD
611 my $nbdport = undef;
612 my $nbsport = undef;
d6de1dc2
AD
613 my $nbsource = undef;
614 my $nbdest = undef;
5e1267a5 615
ecbea048 616 eval {
d6de1dc2
AD
617 $nbsource = parse_address_list($source) if $source;
618 $nbdest = parse_address_list($dest) if $dest;
4cdbb3b7
AD
619 $nbdport = parse_port_name_number_or_range($dport) if $dport;
620 $nbsport = parse_port_name_number_or_range($sport) if $sport;
ecbea048
DM
621 };
622 if (my $err = $@) {
623 warn $err;
624 next;
625
626 }
627
628
5e1267a5
DM
629 my $rule = {
630 action => $action,
631 service => $service,
632 iface => $iface,
633 source => $source,
634 dest => $dest,
d6de1dc2
AD
635 nbsource => $nbsource,
636 nbdest => $nbdest,
5e1267a5
DM
637 proto => $proto,
638 dport => $dport,
639 sport => $sport,
4cdbb3b7
AD
640 nbdport => $nbdport,
641 nbsport => $nbsport,
642
5e1267a5
DM
643 };
644
645 push @{$res->{$section}}, $rule;
646 }
647
9d31b418 648 die "security group $group don't exist" if $group && !$securitygroupexist;
5e1267a5
DM
649 return $res;
650}
651
06320eb0
DM
652sub run_locked {
653 my ($code, @param) = @_;
654
655 my $timeout = 10;
656
657 my $res = lock_file($pve_fw_lock_filename, $timeout, $code, @param);
658
659 die $@ if $@;
660
661 return $res;
662}
663
5e1267a5
DM
664sub read_local_vm_config {
665
666 my $openvz = {};
667
668 my $qemu = {};
669
670 my $list = PVE::QemuServer::config_list();
671
672 foreach my $vmid (keys %$list) {
b9b06789 673 #next if !($vmid eq '100' || $vmid eq '102');
5e1267a5
DM
674 my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
675 if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
676 $qemu->{$vmid} = $conf;
677 }
678 }
679
680 my $vmdata = { openvz => $openvz, qemu => $qemu };
681
682 return $vmdata;
683};
684
685sub read_vm_firewall_rules {
686 my ($vmdata) = @_;
687 my $rules = {};
688 foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
689 my $filename = "/etc/pve/firewall/$vmid.fw";
690 my $fh = IO::File->new($filename, O_RDONLY);
691 next if !$fh;
692
693 $rules->{$vmid} = parse_fw_rules($filename, $fh);
694 }
695
696 return $rules;
697}
698
699sub compile {
5e1267a5
DM
700 my $vmdata = read_local_vm_config();
701 my $rules = read_vm_firewall_rules($vmdata);
702
703 # print Dumper($vmdata);
704
a332200b 705 die "implement me";
b6360c3f
DM
706}
707
5e1267a5
DM
708sub compile_and_start {
709 my ($restart) = @_;
886aba9c 710
5e1267a5 711 compile();
b6360c3f 712
a332200b 713 die "implement me";
b6360c3f
DM
714}
715
b6360c3f 7161;