[pve-firewall.git] / src / PVE / API2 / Firewall / IPSet.pm

package PVE::API2::Firewall::IPSetBase;

use strict;
use warnings;
use PVE::Exception qw(raise raise_param_exc);
use PVE::JSONSchema qw(get_standard_option);

use PVE::Firewall;

use base qw(PVE::RESTHandler);

my $api_properties = { 
    cidr => {
	description => "Network/IP specification in CIDR format.",
	type => 'string', format => 'IPv4orCIDRorAlias',
    },
    name => get_standard_option('ipset-name'),
    comment => {
	type => 'string',
	optional => 1,
    },
    nomatch => {
	type => 'boolean',
	optional => 1,
    },
};

sub load_config {
    my ($class, $param) = @_;

    die "implement this in subclass";

    #return ($cluster_conf, $fw_conf, $ipset);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    die "implement this in subclass";
}

sub rule_env {
    my ($class, $param) = @_;
    
    die "implement this in subclass";
}

sub save_ipset {
    my ($class, $param, $fw_conf, $ipset) = @_;

    if (!defined($ipset)) {
	delete $fw_conf->{ipset}->{$param->{name}};
    } else {
	$fw_conf->{ipset}->{$param->{name}} = $ipset;
    }

    $class->save_config($param, $fw_conf);
}

my $additional_param_hash = {};

sub additional_parameters {
    my ($class, $new_value) = @_;

    if (defined($new_value)) {
	$additional_param_hash->{$class} = $new_value;
    }

    # return a copy
    my $copy = {};
    my $org = $additional_param_hash->{$class} || {};
    foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
    return $copy;
}

sub register_get_ipset {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{name} = $api_properties->{name};

    $class->register_method({
	name => 'get_ipset',
	path => '',
	method => 'GET',
	description => "List IPSet content",
	permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => {
	    type => 'array',
	    items => {
		type => "object",
		properties => {
		    cidr => {
			type => 'string',
		    },
		    comment => {
			type => 'string',
			optional => 1,
		    },
		    nomatch => {
			type => 'boolean',
			optional => 1,
		    },
		    digest => get_standard_option('pve-config-digest', { optional => 0} ),	
		},
	    },
	    links => [ { rel => 'child', href => "{cidr}" } ],
	},
	code => sub {
	    my ($param) = @_;

	    my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);

	    return PVE::Firewall::copy_list_with_digest($ipset);
	}});
}

sub register_delete_ipset {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{name} = get_standard_option('ipset-name');

    $class->register_method({
	name => 'delete_ipset',
	path => '',
	method => 'DELETE',
	description => "Delete IPSet",
	protected => 1,
	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => { type => 'null' },
	code => sub {
	    my ($param) = @_;
	    
	    my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);

	    die "IPSet '$param->{name}' is not empty\n" 
		if scalar(@$ipset);

	    $class->save_ipset($param, $fw_conf, undef);

	    return undef;
	}});
}

sub register_create_ip {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{name} = $api_properties->{name};
    $properties->{cidr} = $api_properties->{cidr};
    $properties->{nomatch} = $api_properties->{nomatch};
    $properties->{comment} = $api_properties->{comment};

    $class->register_method({
	name => 'create_ip',
	path => '',
	method => 'POST',
	description => "Add IP or Network to IPSet.",
	protected => 1,
	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => { type => "null" },
	code => sub {
	    my ($param) = @_;

	    my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);

	    my $cidr = $param->{cidr};
	    
	    foreach my $entry (@$ipset) {
		raise_param_exc({ cidr => "address '$cidr' already exists" }) 
		    if $entry->{cidr} eq $cidr;
	    }

	    # make sure alias exists (if $cidr is an alias)
	    PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $cidr); 

	    my $data = { cidr => $cidr };

	    $data->{nomatch} = 1 if $param->{nomatch};
	    $data->{comment} = $param->{comment} if $param->{comment};

	    unshift @$ipset, $data;

	    $class->save_ipset($param, $fw_conf, $ipset);

	    return undef;
	}});
}

sub register_read_ip {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{name} = $api_properties->{name};
    $properties->{cidr} = $api_properties->{cidr};
    
    $class->register_method({
	name => 'read_ip',
	path => '{cidr}',
	method => 'GET',
	description => "Read IP or Network settings from IPSet.",
	permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
	protected => 1,
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => { type => "object" },
	code => sub {
	    my ($param) = @_;

	    my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);

	    my $list = PVE::Firewall::copy_list_with_digest($ipset);

	    foreach my $entry (@$list) {
		if ($entry->{cidr} eq $param->{cidr}) {
		    return $entry;
		}
	    }

	    raise_param_exc({ cidr => "no such IP/Network" });
	}});
}

sub register_update_ip {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{name} = $api_properties->{name};
    $properties->{cidr} = $api_properties->{cidr};
    $properties->{nomatch} = $api_properties->{nomatch};
    $properties->{comment} = $api_properties->{comment};
    $properties->{digest} = get_standard_option('pve-config-digest');

    $class->register_method({
	name => 'update_ip',
	path => '{cidr}',
	method => 'PUT',
	description => "Update IP or Network settings",
	protected => 1,
	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => { type => "null" },
	code => sub {
	    my ($param) = @_;

	    my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);

	    my (undef, $digest) = PVE::Firewall::copy_list_with_digest($ipset);
	    PVE::Tools::assert_if_modified($digest, $param->{digest});

	    foreach my $entry (@$ipset) {
		if($entry->{cidr} eq $param->{cidr}) {
		    $entry->{nomatch} = $param->{nomatch};
		    $entry->{comment} = $param->{comment};
		    $class->save_ipset($param, $fw_conf, $ipset);
		    return;
		}
	    }

	    raise_param_exc({ cidr => "no such IP/Network" });
	}});
}

sub register_delete_ip {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{name} = $api_properties->{name};
    $properties->{cidr} = $api_properties->{cidr};
    $properties->{digest} = get_standard_option('pve-config-digest');

    $class->register_method({
	name => 'remove_ip',
	path => '{cidr}',
	method => 'DELETE',
	description => "Remove IP or Network from IPSet.",
	protected => 1,
	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => { type => "null" },
	code => sub {
	    my ($param) = @_;

	    my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);

	    my (undef, $digest) = PVE::Firewall::copy_list_with_digest($ipset);
	    PVE::Tools::assert_if_modified($digest, $param->{digest});

	    my $new = [];
   
	    foreach my $entry (@$ipset) {
		push @$new, $entry if $entry->{cidr} ne $param->{cidr};
	    }

	    $class->save_ipset($param, $fw_conf, $new);
	    
	    return undef;
	}});
}

sub register_handlers {
    my ($class) = @_;

    $class->register_delete_ipset();
    $class->register_get_ipset();
    $class->register_create_ip();
    $class->register_read_ip();
    $class->register_update_ip();
    $class->register_delete_ip();
}

package PVE::API2::Firewall::ClusterIPset;

use strict;
use warnings;

use base qw(PVE::API2::Firewall::IPSetBase);

sub rule_env {
    my ($class, $param) = @_;
    
    return 'cluster';
}

sub load_config {
    my ($class, $param) = @_;

    my $fw_conf = PVE::Firewall::load_clusterfw_conf();
    my $ipset = $fw_conf->{ipset}->{$param->{name}};
    die "no such IPSet '$param->{name}'\n" if !defined($ipset);

    return (undef, $fw_conf, $ipset);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    PVE::Firewall::save_clusterfw_conf($fw_conf);
}

__PACKAGE__->register_handlers();

package PVE::API2::Firewall::VMIPset;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);

use base qw(PVE::API2::Firewall::IPSetBase);

sub rule_env {
    my ($class, $param) = @_;
    
    return 'vm';
}

__PACKAGE__->additional_parameters({ 
    node => get_standard_option('pve-node'),
    vmid => get_standard_option('pve-vmid'),				   
});

sub load_config {
    my ($class, $param) = @_;

    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
    my $ipset = $fw_conf->{ipset}->{$param->{name}};
    die "no such IPSet '$param->{name}'\n" if !defined($ipset);

    return ($cluster_conf, $fw_conf, $ipset);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
}

__PACKAGE__->register_handlers();

package PVE::API2::Firewall::CTIPset;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);

use base qw(PVE::API2::Firewall::IPSetBase);

sub rule_env {
    my ($class, $param) = @_;
    
    return 'ct';
}

__PACKAGE__->additional_parameters({ 
    node => get_standard_option('pve-node'),
    vmid => get_standard_option('pve-vmid'),				   
});

sub load_config {
    my ($class, $param) = @_;

    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
    my $ipset = $fw_conf->{ipset}->{$param->{name}};
    die "no such IPSet '$param->{name}'\n" if !defined($ipset);

    return ($cluster_conf, $fw_conf, $ipset);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
}

__PACKAGE__->register_handlers();

package PVE::API2::Firewall::BaseIPSetList;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);
use PVE::Exception qw(raise_param_exc);
use PVE::Firewall;

use base qw(PVE::RESTHandler);

sub load_config {
    my ($class, $param) = @_;
 
    die "implement this in subclass";

    #return ($cluster_conf, $fw_conf);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    die "implement this in subclass";
}

sub rule_env {
    my ($class, $param) = @_;
    
    die "implement this in subclass";
}

my $additional_param_hash_list = {};

sub additional_parameters {
    my ($class, $new_value) = @_;

    if (defined($new_value)) {
	$additional_param_hash_list->{$class} = $new_value;
    }

    # return a copy
    my $copy = {};
    my $org = $additional_param_hash_list->{$class} || {};
    foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
    return $copy;
}

my $get_ipset_list = sub {
    my ($fw_conf) = @_;

    my $res = [];
    foreach my $name (keys %{$fw_conf->{ipset}}) {
	my $data = { 
	    name => $name,
	};
	if (my $comment = $fw_conf->{ipset_comments}->{$name}) {
	    $data->{comment} = $comment;
	}
	push @$res, $data;
    }

    my ($list, $digest) = PVE::Firewall::copy_list_with_digest($res);

    return wantarray ? ($list, $digest) : $list;
};

sub register_index {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $class->register_method({
	name => 'ipset_index',
	path => '',
	method => 'GET',
	description => "List IPSets",
	permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => {
	    type => 'array',
	    items => {
		type => "object",
		properties => { 
		    name => get_standard_option('ipset-name'),
		    digest => get_standard_option('pve-config-digest', { optional => 0} ),
		    comment => { 
			type => 'string',
			optional => 1,
		    }
		},
	    },
	    links => [ { rel => 'child', href => "{name}" } ],
	},
	code => sub {
	    my ($param) = @_;
	    
	    my ($cluster_conf, $fw_conf) = $class->load_config($param);

	    return &$get_ipset_list($fw_conf); 
	}});
}

sub register_create {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{name} = get_standard_option('ipset-name');

    $properties->{comment} = { type => 'string', optional => 1 };

    $properties->{digest} = get_standard_option('pve-config-digest');

    $properties->{rename} = get_standard_option('ipset-name', {
	description => "Rename an existing IPSet. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing IPSet.",
	optional => 1 });

    $class->register_method({
	name => 'create_ipset',
	path => '',
	method => 'POST',
	description => "Create new IPSet",
	protected => 1,
	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => { type => 'null' },
	code => sub {
	    my ($param) = @_;
	    
	    my ($cluster_conf, $fw_conf) = $class->load_config($param);

	    if ($param->{rename}) {
		my (undef, $digest) = &$get_ipset_list($fw_conf);
		PVE::Tools::assert_if_modified($digest, $param->{digest});

		raise_param_exc({ name => "IPSet '$param->{rename}' does not exists" }) 
		    if !$fw_conf->{ipset}->{$param->{rename}};

		my $data = delete $fw_conf->{ipset}->{$param->{rename}};
		$fw_conf->{ipset}->{$param->{name}} = $data;
		if (my $comment = delete $fw_conf->{ipset_comments}->{$param->{rename}}) {
		    $fw_conf->{ipset_comments}->{$param->{name}} = $comment;
		}
		$fw_conf->{ipset_comments}->{$param->{name}} = $param->{comment} if defined($param->{comment});
	    } else { 
		foreach my $name (keys %{$fw_conf->{ipset}}) {
		    raise_param_exc({ name => "IPSet '$name' already exists" }) 
			if $name eq $param->{name};
		}

		$fw_conf->{ipset}->{$param->{name}} = [];
		$fw_conf->{ipset_comments}->{$param->{name}} = $param->{comment} if defined($param->{comment});
	    }

	    $class->save_config($param, $fw_conf);

	    return undef;
	}});
}

sub register_handlers {
    my ($class) = @_;

    $class->register_index();
    $class->register_create();
}

package PVE::API2::Firewall::ClusterIPSetList;

use strict;
use warnings;
use PVE::Firewall;

use base qw(PVE::API2::Firewall::BaseIPSetList);

sub rule_env {
    my ($class, $param) = @_;
    
    return 'cluster';
}

sub load_config {
    my ($class, $param) = @_;
 
    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
    return (undef, $cluster_conf);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    PVE::Firewall::save_clusterfw_conf($fw_conf);
}

__PACKAGE__->register_handlers();

__PACKAGE__->register_method ({
    subclass => "PVE::API2::Firewall::ClusterIPset",  
    path => '{name}',
    # set fragment delimiter (no subdirs) - we need that, because CIDR address contain a slash '/' 
    fragmentDelimiter => '', 
});

package PVE::API2::Firewall::VMIPSetList;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);
use PVE::Firewall;

use base qw(PVE::API2::Firewall::BaseIPSetList);

__PACKAGE__->additional_parameters({ 
    node => get_standard_option('pve-node'),
    vmid => get_standard_option('pve-vmid'),				   
});

sub rule_env {
    my ($class, $param) = @_;
    
    return 'vm';
}

sub load_config {
    my ($class, $param) = @_;
 
    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
    return ($cluster_conf, $fw_conf);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
}

__PACKAGE__->register_handlers();

__PACKAGE__->register_method ({
    subclass => "PVE::API2::Firewall::VMIPset",  
    path => '{name}',
    # set fragment delimiter (no subdirs) - we need that, because CIDR address contain a slash '/' 
    fragmentDelimiter => '', 
});

package PVE::API2::Firewall::CTIPSetList;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);
use PVE::Firewall;

use base qw(PVE::API2::Firewall::BaseIPSetList);

__PACKAGE__->additional_parameters({ 
    node => get_standard_option('pve-node'),
    vmid => get_standard_option('pve-vmid'),				   
});

sub rule_env {
    my ($class, $param) = @_;
    
    return 'ct';
}

sub load_config {
    my ($class, $param) = @_;
 
    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
    return ($cluster_conf, $fw_conf);
}

sub save_config {
    my ($class, $param, $fw_conf) = @_;

    PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
}

__PACKAGE__->register_handlers();

__PACKAGE__->register_method ({
    subclass => "PVE::API2::Firewall::CTIPset",  
    path => '{name}',
    # set fragment delimiter (no subdirs) - we need that, because CIDR address contain a slash '/' 
    fragmentDelimiter => '', 
});

1;
Commit	Line	Data
009ee3ac DM	1	package PVE::API2::Firewall::IPSetBase;
	2
	3	use strict;
	4	use warnings;
4a11bba5	5	use PVE::Exception qw(raise raise_param_exc);
009ee3ac DM	6	use PVE::JSONSchema qw(get_standard_option);
	7
	8	use PVE::Firewall;
	9
	10	use base qw(PVE::RESTHandler);
	11
	12	my $api_properties = {
	13	cidr => {
	14	description => "Network/IP specification in CIDR format.",
7c619bbb	15	type => 'string', format => 'IPv4orCIDRorAlias',
009ee3ac	16	},
e74a87f5	17	name => get_standard_option('ipset-name'),
009ee3ac DM	18	comment => {
	19	type => 'string',
	20	optional => 1,
	21	},
	22	nomatch => {
	23	type => 'boolean',
	24	optional => 1,
	25	},
	26	};
	27
	28	sub load_config {
	29	my ($class, $param) = @_;
	30
	31	die "implement this in subclass";
1210ae94 DM	32
1210ae94 DM	33	#return ($cluster_conf, $fw_conf, $ipset);
009ee3ac DM	34	}
009ee3ac DM	35
1210ae94 DM	36	sub save_config {
1210ae94 DM	37	my ($class, $param, $fw_conf) = @_;
009ee3ac DM	38
	39	die "implement this in subclass";
	40	}
	41
9f6845cf DM	42	sub rule_env {
	43	my ($class, $param) = @_;
	44
	45	die "implement this in subclass";
	46	}
	47
1210ae94 DM	48	sub save_ipset {
	49	my ($class, $param, $fw_conf, $ipset) = @_;
	50
	51	if (!defined($ipset)) {
	52	delete $fw_conf->{ipset}->{$param->{name}};
	53	} else {
	54	$fw_conf->{ipset}->{$param->{name}} = $ipset;
	55	}
	56
	57	$class->save_config($param, $fw_conf);
	58	}
	59
009ee3ac DM	60	my $additional_param_hash = {};
	61
	62	sub additional_parameters {
	63	my ($class, $new_value) = @_;
	64
	65	if (defined($new_value)) {
	66	$additional_param_hash->{$class} = $new_value;
	67	}
	68
	69	# return a copy
	70	my $copy = {};
	71	my $org = $additional_param_hash->{$class} \|\| {};
	72	foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
	73	return $copy;
	74	}
	75
	76	sub register_get_ipset {
	77	my ($class) = @_;
	78
	79	my $properties = $class->additional_parameters();
	80
	81	$properties->{name} = $api_properties->{name};
	82
	83	$class->register_method({
	84	name => 'get_ipset',
	85	path => '',
	86	method => 'GET',
	87	description => "List IPSet content",
9f6845cf	88	permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
009ee3ac DM	89	parameters => {
	90	additionalProperties => 0,
	91	properties => $properties,
	92	},
	93	returns => {
	94	type => 'array',
	95	items => {
	96	type => "object",
	97	properties => {
	98	cidr => {
	99	type => 'string',
	100	},
	101	comment => {
	102	type => 'string',
	103	optional => 1,
	104	},
	105	nomatch => {
	106	type => 'boolean',
	107	optional => 1,
d72c631c DM	108	},
d72c631c DM	109	digest => get_standard_option('pve-config-digest', { optional => 0} ),
009ee3ac DM	110	},
	111	},
	112	links => [ { rel => 'child', href => "{cidr}" } ],
	113	},
	114	code => sub {
	115	my ($param) = @_;
	116
1210ae94	117	my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
009ee3ac	118
5d38d64f	119	return PVE::Firewall::copy_list_with_digest($ipset);
009ee3ac DM	120	}});
	121	}
	122
1210ae94 DM	123	sub register_delete_ipset {
	124	my ($class) = @_;
	125
	126	my $properties = $class->additional_parameters();
	127
	128	$properties->{name} = get_standard_option('ipset-name');
	129
	130	$class->register_method({
	131	name => 'delete_ipset',
	132	path => '',
	133	method => 'DELETE',
	134	description => "Delete IPSet",
	135	protected => 1,
9f6845cf	136	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
1210ae94 DM	137	parameters => {
	138	additionalProperties => 0,
	139	properties => $properties,
	140	},
	141	returns => { type => 'null' },
	142	code => sub {
	143	my ($param) = @_;
	144
	145	my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
	146
	147	die "IPSet '$param->{name}' is not empty\n"
	148	if scalar(@$ipset);
	149
	150	$class->save_ipset($param, $fw_conf, undef);
	151
	152	return undef;
	153	}});
	154	}
	155
a33c74f6	156	sub register_create_ip {
009ee3ac DM	157	my ($class) = @_;
	158
	159	my $properties = $class->additional_parameters();
	160
	161	$properties->{name} = $api_properties->{name};
	162	$properties->{cidr} = $api_properties->{cidr};
	163	$properties->{nomatch} = $api_properties->{nomatch};
	164	$properties->{comment} = $api_properties->{comment};
d72c631c	165
009ee3ac	166	$class->register_method({
a33c74f6	167	name => 'create_ip',
009ee3ac DM	168	path => '',
	169	method => 'POST',
	170	description => "Add IP or Network to IPSet.",
	171	protected => 1,
9f6845cf	172	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
009ee3ac DM	173	parameters => {
	174	additionalProperties => 0,
	175	properties => $properties,
	176	},
	177	returns => { type => "null" },
	178	code => sub {
	179	my ($param) = @_;
	180
1210ae94	181	my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
009ee3ac	182
4a11bba5 DM	183	my $cidr = $param->{cidr};
	184
	185	foreach my $entry (@$ipset) {
	186	raise_param_exc({ cidr => "address '$cidr' already exists" })
	187	if $entry->{cidr} eq $cidr;
	188	}
	189
6c221576 DM	190	# make sure alias exists (if $cidr is an alias)
6c221576 DM	191	PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $cidr);
7c619bbb	192
4a11bba5	193	my $data = { cidr => $cidr };
7c619bbb	194
009ee3ac DM	195	$data->{nomatch} = 1 if $param->{nomatch};
	196	$data->{comment} = $param->{comment} if $param->{comment};
	197
009ee3ac DM	198	unshift @$ipset, $data;
	199
	200	$class->save_ipset($param, $fw_conf, $ipset);
	201
	202	return undef;
	203	}});
	204	}
	205
a33c74f6 DM	206	sub register_read_ip {
	207	my ($class) = @_;
	208
	209	my $properties = $class->additional_parameters();
	210
	211	$properties->{name} = $api_properties->{name};
	212	$properties->{cidr} = $api_properties->{cidr};
	213
	214	$class->register_method({
	215	name => 'read_ip',
	216	path => '{cidr}',
	217	method => 'GET',
	218	description => "Read IP or Network settings from IPSet.",
9f6845cf	219	permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
a33c74f6 DM	220	protected => 1,
	221	parameters => {
	222	additionalProperties => 0,
	223	properties => $properties,
	224	},
	225	returns => { type => "object" },
	226	code => sub {
	227	my ($param) = @_;
	228
1210ae94	229	my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
a33c74f6	230
5d38d64f DM	231	my $list = PVE::Firewall::copy_list_with_digest($ipset);
	232
	233	foreach my $entry (@$list) {
d72c631c	234	if ($entry->{cidr} eq $param->{cidr}) {
d72c631c DM	235	return $entry;
d72c631c DM	236	}
a33c74f6 DM	237	}
	238
	239	raise_param_exc({ cidr => "no such IP/Network" });
	240	}});
	241	}
	242
	243	sub register_update_ip {
	244	my ($class) = @_;
	245
	246	my $properties = $class->additional_parameters();
	247
	248	$properties->{name} = $api_properties->{name};
	249	$properties->{cidr} = $api_properties->{cidr};
	250	$properties->{nomatch} = $api_properties->{nomatch};
	251	$properties->{comment} = $api_properties->{comment};
d72c631c DM	252	$properties->{digest} = get_standard_option('pve-config-digest');
d72c631c DM	253
a33c74f6 DM	254	$class->register_method({
	255	name => 'update_ip',
	256	path => '{cidr}',
	257	method => 'PUT',
	258	description => "Update IP or Network settings",
	259	protected => 1,
9f6845cf	260	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
a33c74f6 DM	261	parameters => {
	262	additionalProperties => 0,
	263	properties => $properties,
	264	},
	265	returns => { type => "null" },
	266	code => sub {
	267	my ($param) = @_;
	268
1210ae94	269	my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
a33c74f6	270
5d38d64f DM	271	my (undef, $digest) = PVE::Firewall::copy_list_with_digest($ipset);
5d38d64f DM	272	PVE::Tools::assert_if_modified($digest, $param->{digest});
d72c631c	273
a33c74f6 DM	274	foreach my $entry (@$ipset) {
	275	if($entry->{cidr} eq $param->{cidr}) {
	276	$entry->{nomatch} = $param->{nomatch};
	277	$entry->{comment} = $param->{comment};
	278	$class->save_ipset($param, $fw_conf, $ipset);
	279	return;
	280	}
	281	}
	282
	283	raise_param_exc({ cidr => "no such IP/Network" });
	284	}});
	285	}
	286
	287	sub register_delete_ip {
009ee3ac DM	288	my ($class) = @_;
	289
	290	my $properties = $class->additional_parameters();
	291
	292	$properties->{name} = $api_properties->{name};
	293	$properties->{cidr} = $api_properties->{cidr};
d72c631c DM	294	$properties->{digest} = get_standard_option('pve-config-digest');
d72c631c DM	295
009ee3ac DM	296	$class->register_method({
	297	name => 'remove_ip',
	298	path => '{cidr}',
	299	method => 'DELETE',
	300	description => "Remove IP or Network from IPSet.",
	301	protected => 1,
9f6845cf	302	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
009ee3ac DM	303	parameters => {
	304	additionalProperties => 0,
	305	properties => $properties,
	306	},
	307	returns => { type => "null" },
	308	code => sub {
	309	my ($param) = @_;
	310
1210ae94	311	my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
009ee3ac	312
5d38d64f DM	313	my (undef, $digest) = PVE::Firewall::copy_list_with_digest($ipset);
5d38d64f DM	314	PVE::Tools::assert_if_modified($digest, $param->{digest});
d72c631c	315
4a11bba5 DM	316	my $new = [];
	317
	318	foreach my $entry (@$ipset) {
	319	push @$new, $entry if $entry->{cidr} ne $param->{cidr};
	320	}
009ee3ac	321
4a11bba5 DM	322	$class->save_ipset($param, $fw_conf, $new);
4a11bba5 DM	323
009ee3ac DM	324	return undef;
	325	}});
	326	}
	327
	328	sub register_handlers {
	329	my ($class) = @_;
	330
1210ae94	331	$class->register_delete_ipset();
009ee3ac	332	$class->register_get_ipset();
a33c74f6 DM	333	$class->register_create_ip();
	334	$class->register_read_ip();
	335	$class->register_update_ip();
	336	$class->register_delete_ip();
009ee3ac DM	337	}
	338
	339	package PVE::API2::Firewall::ClusterIPset;
	340
	341	use strict;
	342	use warnings;
	343
	344	use base qw(PVE::API2::Firewall::IPSetBase);
	345
9f6845cf DM	346	sub rule_env {
	347	my ($class, $param) = @_;
	348
	349	return 'cluster';
	350	}
	351
009ee3ac DM	352	sub load_config {
	353	my ($class, $param) = @_;
	354
	355	my $fw_conf = PVE::Firewall::load_clusterfw_conf();
	356	my $ipset = $fw_conf->{ipset}->{$param->{name}};
	357	die "no such IPSet '$param->{name}'\n" if !defined($ipset);
	358
1210ae94	359	return (undef, $fw_conf, $ipset);
009ee3ac DM	360	}
009ee3ac DM	361
1210ae94 DM	362	sub save_config {
1210ae94 DM	363	my ($class, $param, $fw_conf) = @_;
009ee3ac	364
009ee3ac DM	365	PVE::Firewall::save_clusterfw_conf($fw_conf);
	366	}
	367
	368	__PACKAGE__->register_handlers();
	369
1210ae94 DM	370	package PVE::API2::Firewall::VMIPset;
	371
	372	use strict;
	373	use warnings;
	374	use PVE::JSONSchema qw(get_standard_option);
	375
	376	use base qw(PVE::API2::Firewall::IPSetBase);
	377
9f6845cf DM	378	sub rule_env {
	379	my ($class, $param) = @_;
	380
	381	return 'vm';
	382	}
	383
1210ae94 DM	384	__PACKAGE__->additional_parameters({
	385	node => get_standard_option('pve-node'),
	386	vmid => get_standard_option('pve-vmid'),
	387	});
	388
	389	sub load_config {
	390	my ($class, $param) = @_;
	391
	392	my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
	393	my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
	394	my $ipset = $fw_conf->{ipset}->{$param->{name}};
	395	die "no such IPSet '$param->{name}'\n" if !defined($ipset);
	396
	397	return ($cluster_conf, $fw_conf, $ipset);
	398	}
	399
	400	sub save_config {
	401	my ($class, $param, $fw_conf) = @_;
	402
	403	PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
	404	}
	405
	406	__PACKAGE__->register_handlers();
	407
	408	package PVE::API2::Firewall::CTIPset;
	409
	410	use strict;
	411	use warnings;
	412	use PVE::JSONSchema qw(get_standard_option);
	413
	414	use base qw(PVE::API2::Firewall::IPSetBase);
	415
9f6845cf DM	416	sub rule_env {
	417	my ($class, $param) = @_;
	418
	419	return 'ct';
	420	}
	421
1210ae94 DM	422	__PACKAGE__->additional_parameters({
	423	node => get_standard_option('pve-node'),
	424	vmid => get_standard_option('pve-vmid'),
	425	});
	426
	427	sub load_config {
	428	my ($class, $param) = @_;
	429
	430	my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
	431	my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
	432	my $ipset = $fw_conf->{ipset}->{$param->{name}};
	433	die "no such IPSet '$param->{name}'\n" if !defined($ipset);
	434
	435	return ($cluster_conf, $fw_conf, $ipset);
	436	}
	437
	438	sub save_config {
	439	my ($class, $param, $fw_conf) = @_;
	440
	441	PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
	442	}
	443
	444	__PACKAGE__->register_handlers();
	445
c85c87f9 DM	446	package PVE::API2::Firewall::BaseIPSetList;
	447
	448	use strict;
	449	use warnings;
e74a87f5	450	use PVE::JSONSchema qw(get_standard_option);
c85c87f9	451	use PVE::Exception qw(raise_param_exc);
e74a87f5	452	use PVE::Firewall;
c85c87f9 DM	453
	454	use base qw(PVE::RESTHandler);
	455
1210ae94 DM	456	sub load_config {
	457	my ($class, $param) = @_;
	458
	459	die "implement this in subclass";
	460
	461	#return ($cluster_conf, $fw_conf);
	462	}
	463
	464	sub save_config {
	465	my ($class, $param, $fw_conf) = @_;
	466
	467	die "implement this in subclass";
	468	}
	469
9f6845cf DM	470	sub rule_env {
	471	my ($class, $param) = @_;
	472
	473	die "implement this in subclass";
	474	}
	475
1210ae94 DM	476	my $additional_param_hash_list = {};
	477
	478	sub additional_parameters {
	479	my ($class, $new_value) = @_;
	480
	481	if (defined($new_value)) {
	482	$additional_param_hash_list->{$class} = $new_value;
	483	}
	484
	485	# return a copy
	486	my $copy = {};
	487	my $org = $additional_param_hash_list->{$class} \|\| {};
	488	foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
	489	return $copy;
	490	}
	491
5d38d64f DM	492	my $get_ipset_list = sub {
	493	my ($fw_conf) = @_;
	494
	495	my $res = [];
	496	foreach my $name (keys %{$fw_conf->{ipset}}) {
	497	my $data = {
	498	name => $name,
	499	};
	500	if (my $comment = $fw_conf->{ipset_comments}->{$name}) {
	501	$data->{comment} = $comment;
	502	}
	503	push @$res, $data;
	504	}
	505
	506	my ($list, $digest) = PVE::Firewall::copy_list_with_digest($res);
	507
	508	return wantarray ? ($list, $digest) : $list;
	509	};
	510
c85c87f9 DM	511	sub register_index {
	512	my ($class) = @_;
	513
1210ae94 DM	514	my $properties = $class->additional_parameters();
1210ae94 DM	515
c85c87f9 DM	516	$class->register_method({
	517	name => 'ipset_index',
	518	path => '',
	519	method => 'GET',
	520	description => "List IPSets",
9f6845cf	521	permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
c85c87f9 DM	522	parameters => {
c85c87f9 DM	523	additionalProperties => 0,
1210ae94	524	properties => $properties,
c85c87f9 DM	525	},
	526	returns => {
	527	type => 'array',
	528	items => {
	529	type => "object",
	530	properties => {
e74a87f5	531	name => get_standard_option('ipset-name'),
d72c631c DM	532	digest => get_standard_option('pve-config-digest', { optional => 0} ),
	533	comment => {
	534	type => 'string',
	535	optional => 1,
	536	}
c85c87f9 DM	537	},
	538	},
	539	links => [ { rel => 'child', href => "{name}" } ],
	540	},
	541	code => sub {
	542	my ($param) = @_;
	543
1210ae94	544	my ($cluster_conf, $fw_conf) = $class->load_config($param);
c85c87f9	545
5d38d64f	546	return &$get_ipset_list($fw_conf);
c85c87f9 DM	547	}});
	548	}
	549
	550	sub register_create {
	551	my ($class) = @_;
	552
1210ae94 DM	553	my $properties = $class->additional_parameters();
	554
	555	$properties->{name} = get_standard_option('ipset-name');
	556
	557	$properties->{comment} = { type => 'string', optional => 1 };
	558
	559	$properties->{digest} = get_standard_option('pve-config-digest');
	560
	561	$properties->{rename} = get_standard_option('ipset-name', {
	562	description => "Rename an existing IPSet. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing IPSet.",
	563	optional => 1 });
	564
c85c87f9 DM	565	$class->register_method({
	566	name => 'create_ipset',
	567	path => '',
	568	method => 'POST',
	569	description => "Create new IPSet",
	570	protected => 1,
9f6845cf	571	permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
c85c87f9 DM	572	parameters => {
c85c87f9 DM	573	additionalProperties => 0,
1210ae94	574	properties => $properties,
c85c87f9 DM	575	},
	576	returns => { type => 'null' },
	577	code => sub {
	578	my ($param) = @_;
	579
1210ae94	580	my ($cluster_conf, $fw_conf) = $class->load_config($param);
c85c87f9	581
bc374ca7	582	if ($param->{rename}) {
5d38d64f DM	583	my (undef, $digest) = &$get_ipset_list($fw_conf);
	584	PVE::Tools::assert_if_modified($digest, $param->{digest});
	585
bc374ca7 DM	586	raise_param_exc({ name => "IPSet '$param->{rename}' does not exists" })
bc374ca7 DM	587	if !$fw_conf->{ipset}->{$param->{rename}};
5d38d64f	588
bc374ca7 DM	589	my $data = delete $fw_conf->{ipset}->{$param->{rename}};
bc374ca7 DM	590	$fw_conf->{ipset}->{$param->{name}} = $data;
d72c631c DM	591	if (my $comment = delete $fw_conf->{ipset_comments}->{$param->{rename}}) {
	592	$fw_conf->{ipset_comments}->{$param->{name}} = $comment;
	593	}
	594	$fw_conf->{ipset_comments}->{$param->{name}} = $param->{comment} if defined($param->{comment});
5d38d64f DM	595	} else {
	596	foreach my $name (keys %{$fw_conf->{ipset}}) {
	597	raise_param_exc({ name => "IPSet '$name' already exists" })
	598	if $name eq $param->{name};
	599	}
	600
bc374ca7	601	$fw_conf->{ipset}->{$param->{name}} = [];
d72c631c	602	$fw_conf->{ipset_comments}->{$param->{name}} = $param->{comment} if defined($param->{comment});
bc374ca7 DM	603	}
bc374ca7 DM	604
1210ae94	605	$class->save_config($param, $fw_conf);
c85c87f9 DM	606
	607	return undef;
	608	}});
	609	}
	610
1210ae94	611	sub register_handlers {
c85c87f9 DM	612	my ($class) = @_;
c85c87f9 DM	613
1210ae94 DM	614	$class->register_index();
	615	$class->register_create();
	616	}
c85c87f9	617
1210ae94	618	package PVE::API2::Firewall::ClusterIPSetList;
c85c87f9	619
1210ae94 DM	620	use strict;
	621	use warnings;
	622	use PVE::Firewall;
5d38d64f	623
1210ae94 DM	624	use base qw(PVE::API2::Firewall::BaseIPSetList);
1210ae94 DM	625
9f6845cf DM	626	sub rule_env {
	627	my ($class, $param) = @_;
	628
	629	return 'cluster';
	630	}
	631
1210ae94 DM	632	sub load_config {
	633	my ($class, $param) = @_;
	634
	635	my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
	636	return (undef, $cluster_conf);
	637	}
c85c87f9	638
1210ae94 DM	639	sub save_config {
1210ae94 DM	640	my ($class, $param, $fw_conf) = @_;
c85c87f9	641
1210ae94 DM	642	PVE::Firewall::save_clusterfw_conf($fw_conf);
1210ae94 DM	643	}
c85c87f9	644
1210ae94 DM	645	__PACKAGE__->register_handlers();
	646
	647	__PACKAGE__->register_method ({
	648	subclass => "PVE::API2::Firewall::ClusterIPset",
	649	path => '{name}',
	650	# set fragment delimiter (no subdirs) - we need that, because CIDR address contain a slash '/'
	651	fragmentDelimiter => '',
	652	});
	653
	654	package PVE::API2::Firewall::VMIPSetList;
	655
	656	use strict;
	657	use warnings;
	658	use PVE::JSONSchema qw(get_standard_option);
	659	use PVE::Firewall;
	660
	661	use base qw(PVE::API2::Firewall::BaseIPSetList);
	662
	663	__PACKAGE__->additional_parameters({
	664	node => get_standard_option('pve-node'),
	665	vmid => get_standard_option('pve-vmid'),
	666	});
	667
9f6845cf DM	668	sub rule_env {
	669	my ($class, $param) = @_;
	670
	671	return 'vm';
	672	}
	673
1210ae94 DM	674	sub load_config {
	675	my ($class, $param) = @_;
	676
	677	my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
	678	my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
	679	return ($cluster_conf, $fw_conf);
c85c87f9 DM	680	}
c85c87f9 DM	681
1210ae94 DM	682	sub save_config {
1210ae94 DM	683	my ($class, $param, $fw_conf) = @_;
c85c87f9	684
1210ae94	685	PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
c85c87f9 DM	686	}
c85c87f9 DM	687
1210ae94 DM	688	__PACKAGE__->register_handlers();
	689
	690	__PACKAGE__->register_method ({
	691	subclass => "PVE::API2::Firewall::VMIPset",
	692	path => '{name}',
	693	# set fragment delimiter (no subdirs) - we need that, because CIDR address contain a slash '/'
	694	fragmentDelimiter => '',
	695	});
	696
	697	package PVE::API2::Firewall::CTIPSetList;
c85c87f9 DM	698
	699	use strict;
	700	use warnings;
1210ae94	701	use PVE::JSONSchema qw(get_standard_option);
c85c87f9 DM	702	use PVE::Firewall;
	703
	704	use base qw(PVE::API2::Firewall::BaseIPSetList);
	705
1210ae94 DM	706	__PACKAGE__->additional_parameters({
	707	node => get_standard_option('pve-node'),
	708	vmid => get_standard_option('pve-vmid'),
	709	});
	710
9f6845cf DM	711	sub rule_env {
	712	my ($class, $param) = @_;
	713
	714	return 'ct';
	715	}
	716
c85c87f9	717	sub load_config {
1210ae94	718	my ($class, $param) = @_;
c85c87f9	719
1210ae94 DM	720	my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
	721	my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
	722	return ($cluster_conf, $fw_conf);
c85c87f9 DM	723	}
	724
	725	sub save_config {
1210ae94	726	my ($class, $param, $fw_conf) = @_;
c85c87f9	727
1210ae94	728	PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
c85c87f9 DM	729	}
	730
	731	__PACKAGE__->register_handlers();
	732
	733	__PACKAGE__->register_method ({
1210ae94	734	subclass => "PVE::API2::Firewall::CTIPset",
c85c87f9 DM	735	path => '{name}',
	736	# set fragment delimiter (no subdirs) - we need that, because CIDR address contain a slash '/'
	737	fragmentDelimiter => '',
	738	});
	739
009ee3ac	740	1;