[pve-firewall.git] / src / PVE / API2 / Firewall / Rules.pm

package PVE::API2::Firewall::RulesBase;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);
use PVE::Exception qw(raise raise_param_exc);

use PVE::Firewall;

use base qw(PVE::RESTHandler);

my $api_properties = { 
    pos => {
	description => "Rule position.",
	type => 'integer',
	minimum => 0,
    },
};

sub load_config {
    my ($class, $param) = @_;

    die "implement this in subclass";

    #return ($fw_conf, $rules);
}

sub save_rules {
    my ($class, $param, $fw_conf, $rules) = @_;

    die "implement this in subclass";
}

my $additional_param_hash = {};

sub allow_groups {
    return 1;
}

sub additional_parameters {
    my ($class, $new_value) = @_;

    if (defined($new_value)) {
	$additional_param_hash->{$class} = $new_value;
    }

    # return a copy
    my $copy = {};
    my $org = $additional_param_hash->{$class} || {};
    foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
    return $copy;
}

sub register_get_rules {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $class->register_method({
	name => 'get_rules',
	path => '',
	method => 'GET',
	description => "List rules.",
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => {
	    type => 'array',
	    items => {
		type => "object",
		properties => {
		    pos => {
			type => 'integer',
		    }
		},
	    },
	    links => [ { rel => 'child', href => "{pos}" } ],
	},
	code => sub {
	    my ($param) = @_;

	    my ($fw_conf, $rules) = $class->load_config($param);

	    my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);

	    my $ind = 0;
	    foreach my $rule (@$list) {
		$rule->{pos} = $ind++;
	    }

	    return $list;
	}});
}

sub register_get_rule {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{pos} = $api_properties->{pos};
    
    $class->register_method({
	name => 'get_rule',
	path => '{pos}',
	method => 'GET',
	description => "Get single rule data.",
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => {
	    type => "object",
	    properties => {
		pos => {
		    type => 'integer',
		}
	    },
	},
	code => sub {
	    my ($param) = @_;

	    my ($fw_conf, $rules) = $class->load_config($param);

	    my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
	
	    die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$list);
	
	    my $rule = $list->[$param->{pos}];
	    $rule->{pos} = $param->{pos};

	    return $rule;
	}});
}

sub register_create_rule {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    my $create_rule_properties = PVE::Firewall::add_rule_properties($properties);
    $create_rule_properties->{action}->{optional} = 0;
    $create_rule_properties->{type}->{optional} = 0;
    
    $class->register_method({
	name => 'create_rule',
	path => '',
	method => 'POST',
	description => "Create new rule.",
	protected => 1,
	parameters => {
	    additionalProperties => 0,
	    properties => $create_rule_properties,
	},
	returns => { type => "null" },
	code => sub {
	    my ($param) = @_;

	    my ($fw_conf, $rules) = $class->load_config($param);

	    my $rule = {};

	    PVE::Firewall::copy_rule_data($rule, $param);
	    PVE::Firewall::verify_rule($rule, $class->allow_groups());

	    $rule->{enable} = 0 if !defined($param->{enable});

	    unshift @$rules, $rule;

	    $class->save_rules($param, $fw_conf, $rules);

	    return undef;
	}});
}

sub register_update_rule {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{pos} = $api_properties->{pos};
    
    $properties->{moveto} = {
	description => "Move rule to new position <moveto>. Other arguments are ignored.",
	type => 'integer',
	minimum => 0,
	optional => 1,
    };

    $properties->{delete} = {
	type => 'string', format => 'pve-configid-list',
	description => "A list of settings you want to delete.",
	optional => 1,
    };

    my $update_rule_properties = PVE::Firewall::add_rule_properties($properties);

    $class->register_method({
	name => 'update_rule',
	path => '{pos}',
	method => 'PUT',
	description => "Modify rule data.",
	protected => 1,
	parameters => {
	    additionalProperties => 0,
	    properties => $update_rule_properties,
	},
	returns => { type => "null" },
	code => sub {
	    my ($param) = @_;

	    my ($fw_conf, $rules) = $class->load_config($param);

	    my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
	    PVE::Tools::assert_if_modified($digest, $param->{digest});

	    die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
	
	    my $rule = $rules->[$param->{pos}];

	    my $moveto = $param->{moveto};
	    if (defined($moveto) && $moveto != $param->{pos}) {
		my $newrules = [];
		for (my $i = 0; $i < scalar(@$rules); $i++) {
		    next if $i == $param->{pos};
		    if ($i == $moveto) {
			push @$newrules, $rule;
		    }
		    push @$newrules, $rules->[$i];
		}
		push @$newrules, $rule if $moveto >= scalar(@$rules);
		$rules = $newrules;
	    } else {
		raise_param_exc({ type => "property is missing"})
		    if !defined($param->{type});
		raise_param_exc({ action => "property is missing"})
		    if !defined($param->{action});

		PVE::Firewall::copy_rule_data($rule, $param);
		
		PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};

		PVE::Firewall::verify_rule($rule, $class->allow_groups());
	    }

	    $class->save_rules($param, $fw_conf, $rules);

	    return undef;
	}});
}

sub register_delete_rule {
    my ($class) = @_;

    my $properties = $class->additional_parameters();

    $properties->{pos} = $api_properties->{pos};

    $properties->{digest} = get_standard_option('pve-config-digest');
    
    $class->register_method({
	name => 'delete_rule',
	path => '{pos}',
	method => 'DELETE',
	description => "Delete rule.",
	protected => 1,
	parameters => {
	    additionalProperties => 0,
	    properties => $properties,
	},
	returns => { type => "null" },
	code => sub {
	    my ($param) = @_;

	    my ($fw_conf, $rules) = $class->load_config($param);

	    my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
	    PVE::Tools::assert_if_modified($digest, $param->{digest});
	
	    die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
	
	    splice(@$rules, $param->{pos}, 1);
	    
	    $class->save_rules($param, $fw_conf, $rules);

	    return undef;
	}});
}

sub register_handlers {
    my ($class) = @_;

    $class->register_get_rules();
    $class->register_get_rule();
    $class->register_create_rule();
    $class->register_update_rule();
    $class->register_delete_rule();
}

package PVE::API2::Firewall::GroupRules;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);

use base qw(PVE::API2::Firewall::RulesBase);

__PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });

sub allow_groups {
    return 0;
}

sub load_config {
    my ($class, $param) = @_;

    my $fw_conf = PVE::Firewall::load_clusterfw_conf();
    my $rules = $fw_conf->{groups}->{$param->{group}};
    die "no such security group '$param->{group}'\n" if !defined($rules);

    return ($fw_conf, $rules);
}

sub save_rules {
    my ($class, $param, $fw_conf, $rules) = @_;

    $fw_conf->{groups}->{$param->{group}} = $rules;
    PVE::Firewall::save_clusterfw_conf($fw_conf);
}

__PACKAGE__->register_handlers();

package PVE::API2::Firewall::ClusterRules;

use strict;
use warnings;

use base qw(PVE::API2::Firewall::RulesBase);

sub load_config {
    my ($class, $param) = @_;

    my $fw_conf = PVE::Firewall::load_clusterfw_conf();
    my $rules = $fw_conf->{rules};

    return ($fw_conf, $rules);
}

sub save_rules {
    my ($class, $param, $fw_conf, $rules) = @_;

    $fw_conf->{rules} = $rules;
    PVE::Firewall::save_clusterfw_conf($fw_conf);
}

__PACKAGE__->register_handlers();

package PVE::API2::Firewall::HostRules;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);

use base qw(PVE::API2::Firewall::RulesBase);

__PACKAGE__->additional_parameters({ node => get_standard_option('pve-node')});

sub load_config {
    my ($class, $param) = @_;

    my $fw_conf = PVE::Firewall::load_hostfw_conf();
    my $rules = $fw_conf->{rules};

    return ($fw_conf, $rules);
}

sub save_rules {
    my ($class, $param, $fw_conf, $rules) = @_;

    $fw_conf->{rules} = $rules;
    PVE::Firewall::save_hostfw_conf($fw_conf);
}

__PACKAGE__->register_handlers();

package PVE::API2::Firewall::VMRules;

use strict;
use warnings;
use PVE::JSONSchema qw(get_standard_option);

use base qw(PVE::API2::Firewall::RulesBase);

__PACKAGE__->additional_parameters({ 
    node => get_standard_option('pve-node'),
    vmid => get_standard_option('pve-vmid'),				   
});

sub load_config {
    my ($class, $param) = @_;

    my $fw_conf = PVE::Firewall::load_vmfw_conf($param->{vmid});
    my $rules = $fw_conf->{rules};

    return ($fw_conf, $rules);
}

sub save_rules {
    my ($class, $param, $fw_conf, $rules) = @_;

    $fw_conf->{rules} = $rules;
    PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
}

__PACKAGE__->register_handlers();

1;
Commit	Line	Data
86791289 DM	1	package PVE::API2::Firewall::RulesBase;
	2
	3	use strict;
	4	use warnings;
	5	use PVE::JSONSchema qw(get_standard_option);
0d22acb3	6	use PVE::Exception qw(raise raise_param_exc);
86791289 DM	7
	8	use PVE::Firewall;
	9
	10	use base qw(PVE::RESTHandler);
	11
	12	my $api_properties = {
86791289 DM	13	pos => {
	14	description => "Rule position.",
	15	type => 'integer',
	16	minimum => 0,
	17	},
	18	};
	19
	20	sub load_config {
	21	my ($class, $param) = @_;
	22
	23	die "implement this in subclass";
	24
	25	#return ($fw_conf, $rules);
	26	}
	27
	28	sub save_rules {
	29	my ($class, $param, $fw_conf, $rules) = @_;
	30
	31	die "implement this in subclass";
	32	}
	33
63c91681	34	my $additional_param_hash = {};
86791289	35
7ca36671 DM	36	sub allow_groups {
	37	return 1;
	38	}
	39
63c91681	40	sub additional_parameters {
86791289 DM	41	my ($class, $new_value) = @_;
86791289 DM	42
63c91681 DM	43	if (defined($new_value)) {
	44	$additional_param_hash->{$class} = $new_value;
	45	}
86791289	46
63c91681 DM	47	# return a copy
	48	my $copy = {};
	49	my $org = $additional_param_hash->{$class} \|\| {};
	50	foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
	51	return $copy;
86791289 DM	52	}
	53
	54	sub register_get_rules {
	55	my ($class) = @_;
	56
63c91681	57	my $properties = $class->additional_parameters();
86791289 DM	58
	59	$class->register_method({
	60	name => 'get_rules',
	61	path => '',
	62	method => 'GET',
	63	description => "List rules.",
	64	parameters => {
	65	additionalProperties => 0,
	66	properties => $properties,
	67	},
	68	returns => {
	69	type => 'array',
	70	items => {
	71	type => "object",
	72	properties => {
	73	pos => {
	74	type => 'integer',
	75	}
	76	},
	77	},
	78	links => [ { rel => 'child', href => "{pos}" } ],
	79	},
	80	code => sub {
	81	my ($param) = @_;
	82
	83	my ($fw_conf, $rules) = $class->load_config($param);
	84
5d38d64f	85	my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
86791289 DM	86
86791289 DM	87	my $ind = 0;
5d38d64f DM	88	foreach my $rule (@$list) {
5d38d64f DM	89	$rule->{pos} = $ind++;
86791289 DM	90	}
86791289 DM	91
5d38d64f	92	return $list;
86791289 DM	93	}});
	94	}
	95
	96	sub register_get_rule {
	97	my ($class) = @_;
	98
63c91681	99	my $properties = $class->additional_parameters();
86791289 DM	100
	101	$properties->{pos} = $api_properties->{pos};
	102
86791289 DM	103	$class->register_method({
	104	name => 'get_rule',
	105	path => '{pos}',
	106	method => 'GET',
	107	description => "Get single rule data.",
	108	parameters => {
	109	additionalProperties => 0,
	110	properties => $properties,
	111	},
	112	returns => {
	113	type => "object",
	114	properties => {
	115	pos => {
	116	type => 'integer',
	117	}
	118	},
	119	},
	120	code => sub {
	121	my ($param) = @_;
	122
	123	my ($fw_conf, $rules) = $class->load_config($param);
	124
5d38d64f	125	my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
86791289	126
5d38d64f	127	die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$list);
86791289	128
5d38d64f DM	129	my $rule = $list->[$param->{pos}];
	130	$rule->{pos} = $param->{pos};
	131
	132	return $rule;
86791289 DM	133	}});
	134	}
	135
	136	sub register_create_rule {
	137	my ($class) = @_;
	138
63c91681	139	my $properties = $class->additional_parameters();
86791289 DM	140
86791289 DM	141	my $create_rule_properties = PVE::Firewall::add_rule_properties($properties);
3655b01f DM	142	$create_rule_properties->{action}->{optional} = 0;
	143	$create_rule_properties->{type}->{optional} = 0;
	144
86791289 DM	145	$class->register_method({
	146	name => 'create_rule',
	147	path => '',
	148	method => 'POST',
	149	description => "Create new rule.",
	150	protected => 1,
	151	parameters => {
	152	additionalProperties => 0,
	153	properties => $create_rule_properties,
	154	},
	155	returns => { type => "null" },
	156	code => sub {
	157	my ($param) = @_;
	158
	159	my ($fw_conf, $rules) = $class->load_config($param);
	160
3655b01f	161	my $rule = {};
86791289 DM	162
86791289 DM	163	PVE::Firewall::copy_rule_data($rule, $param);
7ca36671	164	PVE::Firewall::verify_rule($rule, $class->allow_groups());
86791289	165
3655b01f DM	166	$rule->{enable} = 0 if !defined($param->{enable});
3655b01f DM	167
86791289 DM	168	unshift @$rules, $rule;
	169
	170	$class->save_rules($param, $fw_conf, $rules);
	171
	172	return undef;
	173	}});
	174	}
	175
	176	sub register_update_rule {
	177	my ($class) = @_;
	178
63c91681	179	my $properties = $class->additional_parameters();
86791289 DM	180
	181	$properties->{pos} = $api_properties->{pos};
	182
86791289 DM	183	$properties->{moveto} = {
	184	description => "Move rule to new position <moveto>. Other arguments are ignored.",
	185	type => 'integer',
	186	minimum => 0,
	187	optional => 1,
	188	};
	189
5b7974df DM	190	$properties->{delete} = {
	191	type => 'string', format => 'pve-configid-list',
	192	description => "A list of settings you want to delete.",
	193	optional => 1,
	194	};
	195
86791289 DM	196	my $update_rule_properties = PVE::Firewall::add_rule_properties($properties);
	197
	198	$class->register_method({
	199	name => 'update_rule',
	200	path => '{pos}',
	201	method => 'PUT',
	202	description => "Modify rule data.",
	203	protected => 1,
	204	parameters => {
	205	additionalProperties => 0,
	206	properties => $update_rule_properties,
	207	},
	208	returns => { type => "null" },
	209	code => sub {
	210	my ($param) = @_;
	211
	212	my ($fw_conf, $rules) = $class->load_config($param);
	213
5d38d64f DM	214	my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
5d38d64f DM	215	PVE::Tools::assert_if_modified($digest, $param->{digest});
ddf1e07d	216
86791289 DM	217	die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
	218
	219	my $rule = $rules->[$param->{pos}];
	220
	221	my $moveto = $param->{moveto};
	222	if (defined($moveto) && $moveto != $param->{pos}) {
	223	my $newrules = [];
	224	for (my $i = 0; $i < scalar(@$rules); $i++) {
	225	next if $i == $param->{pos};
	226	if ($i == $moveto) {
	227	push @$newrules, $rule;
	228	}
	229	push @$newrules, $rules->[$i];
	230	}
	231	push @$newrules, $rule if $moveto >= scalar(@$rules);
	232	$rules = $newrules;
	233	} else {
3655b01f DM	234	raise_param_exc({ type => "property is missing"})
	235	if !defined($param->{type});
	236	raise_param_exc({ action => "property is missing"})
	237	if !defined($param->{action});
	238
86791289	239	PVE::Firewall::copy_rule_data($rule, $param);
5b7974df DM	240
5b7974df DM	241	PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
7ca36671 DM	242
7ca36671 DM	243	PVE::Firewall::verify_rule($rule, $class->allow_groups());
86791289 DM	244	}
	245
	246	$class->save_rules($param, $fw_conf, $rules);
	247
	248	return undef;
	249	}});
	250	}
	251
	252	sub register_delete_rule {
	253	my ($class) = @_;
	254
63c91681	255	my $properties = $class->additional_parameters();
86791289 DM	256
86791289 DM	257	$properties->{pos} = $api_properties->{pos};
ddf1e07d DM	258
ddf1e07d DM	259	$properties->{digest} = get_standard_option('pve-config-digest');
86791289	260
86791289 DM	261	$class->register_method({
	262	name => 'delete_rule',
	263	path => '{pos}',
	264	method => 'DELETE',
	265	description => "Delete rule.",
	266	protected => 1,
	267	parameters => {
	268	additionalProperties => 0,
	269	properties => $properties,
	270	},
	271	returns => { type => "null" },
	272	code => sub {
	273	my ($param) = @_;
	274
	275	my ($fw_conf, $rules) = $class->load_config($param);
	276
5d38d64f DM	277	my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
5d38d64f DM	278	PVE::Tools::assert_if_modified($digest, $param->{digest});
86791289 DM	279
	280	die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
	281
	282	splice(@$rules, $param->{pos}, 1);
	283
	284	$class->save_rules($param, $fw_conf, $rules);
	285
	286	return undef;
	287	}});
	288	}
	289
	290	sub register_handlers {
	291	my ($class) = @_;
	292
	293	$class->register_get_rules();
	294	$class->register_get_rule();
	295	$class->register_create_rule();
	296	$class->register_update_rule();
	297	$class->register_delete_rule();
	298	}
	299
	300	package PVE::API2::Firewall::GroupRules;
	301
	302	use strict;
	303	use warnings;
387d0ffc	304	use PVE::JSONSchema qw(get_standard_option);
86791289 DM	305
	306	use base qw(PVE::API2::Firewall::RulesBase);
	307
387d0ffc	308	__PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });
86791289	309
7ca36671 DM	310	sub allow_groups {
	311	return 0;
	312	}
	313
86791289 DM	314	sub load_config {
	315	my ($class, $param) = @_;
	316
	317	my $fw_conf = PVE::Firewall::load_clusterfw_conf();
	318	my $rules = $fw_conf->{groups}->{$param->{group}};
	319	die "no such security group '$param->{group}'\n" if !defined($rules);
	320
	321	return ($fw_conf, $rules);
	322	}
	323
	324	sub save_rules {
	325	my ($class, $param, $fw_conf, $rules) = @_;
	326
	327	$fw_conf->{groups}->{$param->{group}} = $rules;
	328	PVE::Firewall::save_clusterfw_conf($fw_conf);
	329	}
	330
63c91681	331	__PACKAGE__->register_handlers();
86791289 DM	332
	333	package PVE::API2::Firewall::ClusterRules;
	334
	335	use strict;
	336	use warnings;
	337
	338	use base qw(PVE::API2::Firewall::RulesBase);
	339
	340	sub load_config {
	341	my ($class, $param) = @_;
	342
	343	my $fw_conf = PVE::Firewall::load_clusterfw_conf();
	344	my $rules = $fw_conf->{rules};
	345
	346	return ($fw_conf, $rules);
	347	}
	348
	349	sub save_rules {
	350	my ($class, $param, $fw_conf, $rules) = @_;
	351
	352	$fw_conf->{rules} = $rules;
	353	PVE::Firewall::save_clusterfw_conf($fw_conf);
	354	}
	355
63c91681 DM	356	__PACKAGE__->register_handlers();
	357
	358	package PVE::API2::Firewall::HostRules;
	359
	360	use strict;
	361	use warnings;
	362	use PVE::JSONSchema qw(get_standard_option);
	363
	364	use base qw(PVE::API2::Firewall::RulesBase);
	365
	366	__PACKAGE__->additional_parameters({ node => get_standard_option('pve-node')});
	367
	368	sub load_config {
	369	my ($class, $param) = @_;
	370
	371	my $fw_conf = PVE::Firewall::load_hostfw_conf();
	372	my $rules = $fw_conf->{rules};
	373
	374	return ($fw_conf, $rules);
	375	}
	376
	377	sub save_rules {
	378	my ($class, $param, $fw_conf, $rules) = @_;
	379
	380	$fw_conf->{rules} = $rules;
	381	PVE::Firewall::save_hostfw_conf($fw_conf);
	382	}
	383
	384	__PACKAGE__->register_handlers();
86791289	385
464f933e DM	386	package PVE::API2::Firewall::VMRules;
	387
	388	use strict;
	389	use warnings;
	390	use PVE::JSONSchema qw(get_standard_option);
	391
	392	use base qw(PVE::API2::Firewall::RulesBase);
	393
	394	__PACKAGE__->additional_parameters({
	395	node => get_standard_option('pve-node'),
	396	vmid => get_standard_option('pve-vmid'),
	397	});
	398
	399	sub load_config {
	400	my ($class, $param) = @_;
	401
	402	my $fw_conf = PVE::Firewall::load_vmfw_conf($param->{vmid});
	403	my $rules = $fw_conf->{rules};
	404
	405	return ($fw_conf, $rules);
	406	}
	407
	408	sub save_rules {
	409	my ($class, $param, $fw_conf, $rules) = @_;
	410
	411	$fw_conf->{rules} = $rules;
	412	PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
	413	}
	414
	415	__PACKAGE__->register_handlers();
	416
86791289	417	1;