fix #967: source: dest: limit length
[pve-firewall.git] / src / PVE / API2 / Firewall / VM.pm
CommitLineData
b6b8e6ad 1package PVE::API2::Firewall::VMBase;
e7b35711
DM
2
3use strict;
4use warnings;
f6163c2e
TL
5
6use PVE::Exception qw(raise_param_exc);
e7b35711
DM
7use PVE::JSONSchema qw(get_standard_option);
8use PVE::Cluster;
9use PVE::Firewall;
464f933e 10use PVE::API2::Firewall::Rules;
e76a9f53 11use PVE::API2::Firewall::Aliases;
e7b35711 12
e7b35711
DM
13
14use base qw(PVE::RESTHandler);
15
e313afe0 16my $option_properties = $PVE::Firewall::vm_option_properties;
2822f5c4
DM
17
18my $add_option_properties = sub {
19 my ($properties) = @_;
20
21 foreach my $k (keys %$option_properties) {
22 $properties->{$k} = $option_properties->{$k};
23 }
75a12a9d 24
2822f5c4
DM
25 return $properties;
26};
b6b8e6ad
DM
27
28sub register_handlers {
29 my ($class, $rule_env) = @_;
30
31 $class->register_method({
32 name => 'index',
33 path => '',
34 method => 'GET',
35 permissions => { user => 'all' },
36 description => "Directory index.",
37 parameters => {
38 additionalProperties => 0,
39 properties => {
40 node => get_standard_option('pve-node'),
41 vmid => get_standard_option('pve-vmid'),
42 },
e7b35711 43 },
b6b8e6ad
DM
44 returns => {
45 type => 'array',
46 items => {
47 type => "object",
48 properties => {},
2822f5c4 49 },
b6b8e6ad
DM
50 links => [ { rel => 'child', href => "{name}" } ],
51 },
52 code => sub {
53 my ($param) = @_;
e7b35711 54
b6b8e6ad
DM
55 my $result = [
56 { name => 'rules' },
57 { name => 'aliases' },
947d6ea2
DM
58 { name => 'ipset' },
59 { name => 'refs' },
b6b8e6ad
DM
60 { name => 'options' },
61 ];
e7b35711 62
b6b8e6ad
DM
63 return $result;
64 }});
2822f5c4 65
b6b8e6ad
DM
66
67 $class->register_method({
68 name => 'get_options',
69 path => 'options',
70 method => 'GET',
71 description => "Get VM firewall options.",
72 proxyto => 'node',
16c8f5d7
DM
73 permissions => {
74 check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
75 },
b6b8e6ad
DM
76 parameters => {
77 additionalProperties => 0,
78 properties => {
79 node => get_standard_option('pve-node'),
80 vmid => get_standard_option('pve-vmid'),
2822f5c4
DM
81 },
82 },
b6b8e6ad 83 returns => {
2822f5c4 84 type => "object",
b6b8e6ad
DM
85 #additionalProperties => 1,
86 properties => $option_properties,
87 },
88 code => sub {
89 my ($param) = @_;
90
42ec8178
DM
91 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
92 my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
b6b8e6ad
DM
93
94 return PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
95 }});
96
97 $class->register_method({
98 name => 'set_options',
99 path => 'options',
100 method => 'PUT',
101 description => "Set Firewall options.",
102 protected => 1,
103 proxyto => 'node',
16c8f5d7
DM
104 permissions => {
105 check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]],
106 },
b6b8e6ad
DM
107 parameters => {
108 additionalProperties => 0,
109 properties => &$add_option_properties({
110 node => get_standard_option('pve-node'),
111 vmid => get_standard_option('pve-vmid'),
112 delete => {
113 type => 'string', format => 'pve-configid-list',
114 description => "A list of settings you want to delete.",
115 optional => 1,
2822f5c4 116 },
b6b8e6ad
DM
117 digest => get_standard_option('pve-config-digest'),
118 }),
119 },
120 returns => { type => "null" },
121 code => sub {
122 my ($param) = @_;
123
a38849e6
FG
124 PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, sub {
125 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
126 my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
127
128 my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
129 PVE::Tools::assert_if_modified($digest, $param->{digest});
130
131 if ($param->{delete}) {
132 foreach my $opt (PVE::Tools::split_list($param->{delete})) {
133 raise_param_exc({ delete => "no such option '$opt'" })
134 if !$option_properties->{$opt};
135 delete $vmfw_conf->{options}->{$opt};
136 }
2822f5c4 137 }
2822f5c4 138
a38849e6
FG
139 if (defined($param->{enable})) {
140 $param->{enable} = $param->{enable} ? 1 : 0;
141 }
b6b8e6ad 142
a38849e6
FG
143 foreach my $k (keys %$option_properties) {
144 next if !defined($param->{$k});
145 $vmfw_conf->{options}->{$k} = $param->{$k};
146 }
b6b8e6ad 147
a38849e6
FG
148 PVE::Firewall::save_vmfw_conf($param->{vmid}, $vmfw_conf);
149 });
75a12a9d 150
b6b8e6ad
DM
151 return undef;
152 }});
2822f5c4 153
b6b8e6ad 154 $class->register_method({
75a12a9d
TL
155 name => 'log',
156 path => 'log',
b6b8e6ad
DM
157 method => 'GET',
158 description => "Read firewall log",
159 proxyto => 'node',
160 permissions => {
161 check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
162 },
163 protected => 1,
164 parameters => {
165 additionalProperties => 0,
166 properties => {
167 node => get_standard_option('pve-node'),
168 vmid => get_standard_option('pve-vmid'),
169 start => {
170 type => 'integer',
171 minimum => 0,
172 optional => 1,
173 },
174 limit => {
175 type => 'integer',
176 minimum => 0,
177 optional => 1,
178 },
179 },
180 },
181 returns => {
182 type => 'array',
75a12a9d 183 items => {
b6b8e6ad
DM
184 type => "object",
185 properties => {
186 n => {
187 description=> "Line number",
188 type=> 'integer',
189 },
190 t => {
191 description=> "Line text",
192 type => 'string',
193 }
194 }
195 }
196 },
197 code => sub {
198 my ($param) = @_;
e7b35711 199
b6b8e6ad
DM
200 my $rpcenv = PVE::RPCEnvironment::get();
201 my $user = $rpcenv->get_user();
202 my $vmid = $param->{vmid};
203
75a12a9d 204 my ($count, $lines) = PVE::Tools::dump_logfile("/var/log/pve-firewall.log",
b6b8e6ad
DM
205 $param->{start}, $param->{limit},
206 "^$vmid ");
75a12a9d 207
b6b8e6ad 208 $rpcenv->set_result_attrib('total', $count);
75a12a9d
TL
209
210 return $lines;
b6b8e6ad 211 }});
947d6ea2
DM
212
213
214 $class->register_method({
215 name => 'refs',
216 path => 'refs',
217 method => 'GET',
218 description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
16c8f5d7
DM
219 permissions => {
220 check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
221 },
947d6ea2
DM
222 parameters => {
223 additionalProperties => 0,
224 properties => {
225 node => get_standard_option('pve-node'),
226 vmid => get_standard_option('pve-vmid'),
f2c0865c
DM
227 type => {
228 description => "Only list references of specified type.",
229 type => 'string',
230 enum => ['alias', 'ipset'],
231 optional => 1,
232 },
947d6ea2
DM
233 },
234 },
235 returns => {
236 type => 'array',
237 items => {
238 type => "object",
75a12a9d 239 properties => {
947d6ea2
DM
240 type => {
241 type => 'string',
242 enum => ['alias', 'ipset'],
243 },
244 name => {
245 type => 'string',
246 },
75a12a9d 247 comment => {
947d6ea2
DM
248 type => 'string',
249 optional => 1,
250 },
251 },
252 },
253 },
254 code => sub {
255 my ($param) = @_;
75a12a9d 256
947d6ea2
DM
257 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
258 my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
259
260 my $ipsets = {};
261 my $aliases = {};
262
263 foreach my $conf (($cluster_conf, $fw_conf)) {
264 next if !$conf;
f2c0865c
DM
265 if (!$param->{type} || $param->{type} eq 'ipset') {
266 foreach my $name (keys %{$conf->{ipset}}) {
75a12a9d 267 my $data = {
f2c0865c
DM
268 type => 'ipset',
269 name => $name,
270 ref => "+$name",
271 };
272 if (my $comment = $conf->{ipset_comments}->{$name}) {
273 $data->{comment} = $comment;
274 }
275 $ipsets->{$name} = $data;
947d6ea2 276 }
947d6ea2
DM
277 }
278
f2c0865c
DM
279 if (!$param->{type} || $param->{type} eq 'alias') {
280 foreach my $name (keys %{$conf->{aliases}}) {
281 my $e = $conf->{aliases}->{$name};
75a12a9d 282 my $data = {
f2c0865c
DM
283 type => 'alias',
284 name => $name,
285 ref => $name,
286 };
287 $data->{comment} = $e->{comment} if $e->{comment};
288 $aliases->{$name} = $data;
289 }
947d6ea2
DM
290 }
291 }
292
293 my $res = [];
294 foreach my $e (values %$ipsets) { push @$res, $e; };
295 foreach my $e (values %$aliases) { push @$res, $e; };
75a12a9d
TL
296
297 return $res;
947d6ea2 298 }});
b6b8e6ad
DM
299}
300
301package PVE::API2::Firewall::VM;
302
303use strict;
304use warnings;
305
306use base qw(PVE::API2::Firewall::VMBase);
307
308__PACKAGE__->register_method ({
75a12a9d 309 subclass => "PVE::API2::Firewall::VMRules",
b6b8e6ad
DM
310 path => 'rules',
311});
312
313__PACKAGE__->register_method ({
75a12a9d 314 subclass => "PVE::API2::Firewall::VMAliases",
b6b8e6ad
DM
315 path => 'aliases',
316});
317
1210ae94 318__PACKAGE__->register_method ({
75a12a9d 319 subclass => "PVE::API2::Firewall::VMIPSetList",
1210ae94
DM
320 path => 'ipset',
321});
322
b6b8e6ad
DM
323__PACKAGE__->register_handlers('vm');
324
325package PVE::API2::Firewall::CT;
326
327use strict;
328use warnings;
329
330use base qw(PVE::API2::Firewall::VMBase);
331
332__PACKAGE__->register_method ({
75a12a9d 333 subclass => "PVE::API2::Firewall::CTRules",
b6b8e6ad
DM
334 path => 'rules',
335});
336
337__PACKAGE__->register_method ({
75a12a9d 338 subclass => "PVE::API2::Firewall::CTAliases",
b6b8e6ad
DM
339 path => 'aliases',
340});
341
1210ae94 342__PACKAGE__->register_method ({
75a12a9d 343 subclass => "PVE::API2::Firewall::CTIPSetList",
1210ae94
DM
344 path => 'ipset',
345});
346
b6b8e6ad 347__PACKAGE__->register_handlers('vm');
e7b35711
DM
348
3491;