fix #967: source: dest: limit length
[pve-firewall.git] / src / PVE / API2 / Firewall / Cluster.pm
CommitLineData
b4366f00
DM
1package PVE::API2::Firewall::Cluster;
2
3use strict;
4use warnings;
1df4ba7e 5use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
b4366f00
DM
6use PVE::JSONSchema qw(get_standard_option);
7
8use PVE::Firewall;
81d574a7 9use PVE::API2::Firewall::Aliases;
86791289 10use PVE::API2::Firewall::Rules;
b4366f00 11use PVE::API2::Firewall::Groups;
009ee3ac 12use PVE::API2::Firewall::IPSet;
b4366f00 13
1df4ba7e
DM
14#fixme: locking?
15
b4366f00
DM
16
17use base qw(PVE::RESTHandler);
18
19__PACKAGE__->register_method ({
947d6ea2 20 subclass => "PVE::API2::Firewall::Groups",
b4366f00
DM
21 path => 'groups',
22});
23
86791289 24__PACKAGE__->register_method ({
947d6ea2 25 subclass => "PVE::API2::Firewall::ClusterRules",
86791289
DM
26 path => 'rules',
27});
28
c85c87f9 29__PACKAGE__->register_method ({
947d6ea2 30 subclass => "PVE::API2::Firewall::ClusterIPSetList",
c85c87f9
DM
31 path => 'ipset',
32});
33
81d574a7 34__PACKAGE__->register_method ({
947d6ea2 35 subclass => "PVE::API2::Firewall::ClusterAliases",
81d574a7
DM
36 path => 'aliases',
37});
38
39
b4366f00
DM
40__PACKAGE__->register_method({
41 name => 'index',
42 path => '',
43 method => 'GET',
44 permissions => { user => 'all' },
45 description => "Directory index.",
46 parameters => {
47 additionalProperties => 0,
48 },
49 returns => {
50 type => 'array',
51 items => {
52 type => "object",
53 properties => {},
54 },
55 links => [ { rel => 'child', href => "{name}" } ],
56 },
57 code => sub {
58 my ($param) = @_;
59
60 my $result = [
81d574a7 61 { name => 'aliases' },
b4366f00
DM
62 { name => 'rules' },
63 { name => 'options' },
64 { name => 'groups' },
9d6f90e6 65 { name => 'ipset' },
ebd54ae9 66 { name => 'macros' },
947d6ea2 67 { name => 'refs' },
b4366f00
DM
68 ];
69
70 return $result;
71 }});
1df4ba7e 72
e313afe0 73my $option_properties = $PVE::Firewall::cluster_option_properties;
271f287b
DM
74
75my $add_option_properties = sub {
76 my ($properties) = @_;
77
78 foreach my $k (keys %$option_properties) {
79 $properties->{$k} = $option_properties->{$k};
80 }
947d6ea2 81
271f287b
DM
82 return $properties;
83};
84
85
1df4ba7e
DM
86__PACKAGE__->register_method({
87 name => 'get_options',
88 path => 'options',
89 method => 'GET',
90 description => "Get Firewall options.",
0ec56841
DM
91 permissions => {
92 check => ['perm', '/', [ 'Sys.Audit' ]],
93 },
1df4ba7e
DM
94 parameters => {
95 additionalProperties => 0,
96 },
97 returns => {
98 type => "object",
99 #additionalProperties => 1,
271f287b 100 properties => $option_properties,
1df4ba7e
DM
101 },
102 code => sub {
103 my ($param) = @_;
104
105 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
106
5d38d64f 107 return PVE::Firewall::copy_opject_with_digest($cluster_conf->{options});
1df4ba7e
DM
108 }});
109
1df4ba7e
DM
110
111__PACKAGE__->register_method({
112 name => 'set_options',
113 path => 'options',
114 method => 'PUT',
115 description => "Set Firewall options.",
68c90e21 116 protected => 1,
0ec56841
DM
117 permissions => {
118 check => ['perm', '/', [ 'Sys.Modify' ]],
119 },
1df4ba7e
DM
120 parameters => {
121 additionalProperties => 0,
122 properties => &$add_option_properties({
123 delete => {
124 type => 'string', format => 'pve-configid-list',
125 description => "A list of settings you want to delete.",
126 optional => 1,
127 },
5d38d64f 128 digest => get_standard_option('pve-config-digest'),
1df4ba7e
DM
129 }),
130 },
131 returns => { type => "null" },
132 code => sub {
133 my ($param) = @_;
134
a38849e6
FG
135 PVE::Firewall::lock_clusterfw_conf(10, sub {
136 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
137
138 my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($cluster_conf->{options});
139 PVE::Tools::assert_if_modified($digest, $param->{digest});
140
141 if ($param->{delete}) {
142 foreach my $opt (PVE::Tools::split_list($param->{delete})) {
143 raise_param_exc({ delete => "no such option '$opt'" })
144 if !$option_properties->{$opt};
145 delete $cluster_conf->{options}->{$opt};
146 }
1df4ba7e 147 }
1df4ba7e 148
a38849e6
FG
149 if (defined($param->{enable}) && ($param->{enable} > 1)) {
150 $param->{enable} = time();
151 }
271f287b 152
a38849e6
FG
153 foreach my $k (keys %$option_properties) {
154 next if !defined($param->{$k});
155 $cluster_conf->{options}->{$k} = $param->{$k};
156 }
1df4ba7e 157
a38849e6
FG
158 PVE::Firewall::save_clusterfw_conf($cluster_conf);
159 });
1df4ba7e 160
c05492d6
AG
161 # instant firewall update when using double (anti-lockout) API call
162 # -> not waiting for a firewall update at the first (timestamp enable) set
163 if (defined($param->{enable}) && ($param->{enable} > 1)) {
164 PVE::Firewall::update();
165 }
166
1df4ba7e
DM
167 return undef;
168 }});
ebd54ae9
DM
169
170__PACKAGE__->register_method({
171 name => 'get_macros',
172 path => 'macros',
173 method => 'GET',
174 description => "List available macros",
0ec56841 175 permissions => { user => 'all' },
ebd54ae9
DM
176 parameters => {
177 additionalProperties => 0,
178 },
179 returns => {
180 type => 'array',
181 items => {
182 type => "object",
183 properties => {
184 macro => {
185 description => "Macro name.",
186 type => 'string',
187 },
188 descr => {
189 description => "More verbose description (if available).",
190 type => 'string',
191 }
192 },
193 },
194 },
195 code => sub {
196 my ($param) = @_;
197
198 my $res = [];
199
200 my ($macros, $descr) = PVE::Firewall::get_macros();
201
202 foreach my $macro (keys %$macros) {
203 push @$res, { macro => $macro, descr => $descr->{$macro} || $macro };
204 }
205
206 return $res;
207 }});
208
947d6ea2
DM
209__PACKAGE__->register_method({
210 name => 'refs',
211 path => 'refs',
212 method => 'GET',
213 description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
0ec56841
DM
214 permissions => {
215 check => ['perm', '/', [ 'Sys.Audit' ]],
216 },
947d6ea2
DM
217 parameters => {
218 additionalProperties => 0,
f2c0865c
DM
219 properties => {
220 type => {
221 description => "Only list references of specified type.",
222 type => 'string',
223 enum => ['alias', 'ipset'],
224 optional => 1,
225 },
226 },
947d6ea2
DM
227 },
228 returns => {
229 type => 'array',
230 items => {
231 type => "object",
232 properties => {
233 type => {
234 type => 'string',
235 enum => ['alias', 'ipset'],
236 },
237 name => {
238 type => 'string',
239 },
240 ref => {
241 type => 'string',
242 },
243 comment => {
244 type => 'string',
245 optional => 1,
246 },
247 },
248 },
249 },
250 code => sub {
251 my ($param) = @_;
252
253 my $conf = PVE::Firewall::load_clusterfw_conf();
254
255 my $res = [];
256
f2c0865c
DM
257 if (!$param->{type} || $param->{type} eq 'ipset') {
258 foreach my $name (keys %{$conf->{ipset}}) {
259 my $data = {
260 type => 'ipset',
261 name => $name,
262 ref => "+$name",
263 };
264 if (my $comment = $conf->{ipset_comments}->{$name}) {
265 $data->{comment} = $comment;
266 }
267 push @$res, $data;
947d6ea2 268 }
947d6ea2
DM
269 }
270
f2c0865c
DM
271 if (!$param->{type} || $param->{type} eq 'alias') {
272 foreach my $name (keys %{$conf->{aliases}}) {
273 my $e = $conf->{aliases}->{$name};
274 my $data = {
275 type => 'alias',
276 name => $name,
277 ref => $name,
278 };
279 $data->{comment} = $e->{comment} if $e->{comment};
280 push @$res, $data;
281 }
947d6ea2
DM
282 }
283
284 return $res;
285 }});
286
ebd54ae9 2871;