pvefw

   1 #!/usr/bin/perl -w
   2
   3 use strict;
   4 use lib qw(.);
   5 use PVE::Firewall;
   6
   7 use PVE::SafeSyslog;
   8 use PVE::Cluster;
   9 use PVE::INotify;
  10 use PVE::RPCEnvironment;
  11
  12 use PVE::JSONSchema qw(get_standard_option);
  13
  14 use PVE::CLIHandler;
  15
  16 use base qw(PVE::CLIHandler);
  17
  18 $ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
  19
  20 initlog ('pvefw');
  21
  22 die "please run as root\n" if $> != 0;
  23
  24 PVE::INotify::inotify_init();
  25
  26 my $rpcenv = PVE::RPCEnvironment->init('cli');
  27
  28 $rpcenv->init_request();
  29 $rpcenv->set_language($ENV{LANG});
  30 $rpcenv->set_user('root@pam');
  31
  32 __PACKAGE__->register_method ({
  33     name => 'compile',
  34     path => 'compile',
  35     method => 'POST',
  36     description => "Compile amd print firewall rules. This is only for testing.",
  37     parameters => {
  38         additionalProperties => 0,
  39         properties => {
  40             verbose => {
  41                 description => "Verbose output.",
  42                 type => "boolean",
  43                 optional => 1,
  44                 default => 0,
  45             },
  46         },
  47     },
  48     returns => { type => 'null' },
  49
  50     code => sub {
  51         my ($param) = @_;
  52
  53         my $code = sub {
  54             my $ruleset = PVE::Firewall::compile();
  55             PVE::Firewall::get_ruleset_status($ruleset, 1) if $param->{verbose};
  56         };
  57
  58         PVE::Firewall::run_locked($code);
  59
  60         return undef;
  61     }});
  62
  63 __PACKAGE__->register_method ({
  64     name => 'start',
  65     path => 'start',
  66     method => 'POST',
  67     description => "Start (or restart if already active) firewall.",
  68     parameters => {
  69         additionalProperties => 0,
  70         properties => {
  71             verbose => {
  72                 description => "Verbose output.",
  73                 type => "boolean",
  74                 optional => 1,
  75                 default => 0,
  76             },
  77         },
  78     },
  79     returns => { type => 'null' },
  80
  81     code => sub {
  82         my ($param) = @_;
  83
  84         my $code = sub {
  85             PVE::Firewall::compile_and_start($param->{verbose});
  86         };
  87
  88         PVE::Firewall::run_locked($code);
  89
  90         return undef;
  91     }});
  92
  93 __PACKAGE__->register_method ({
  94     name => 'stop',
  95     path => 'stop',
  96     method => 'POST',
  97     description => "Stop firewall. This will remove all rules installed by this script. The host is then unprotected.",
  98     parameters => {
  99         additionalProperties => 0,
 100         properties => {},
 101     },
 102     returns => { type => 'null' },
 103
 104     code => sub {
 105         my ($param) = @_;
 106
 107         my $code = sub {
 108             my $chash = PVE::Firewall::iptables_get_chains();
 109             my $cmdlist = "*filter\n";
 110             my $rule = "INPUT -j PVEFW-INPUT";
 111             if (PVE::Firewall::iptables_rule_exist($rule)) {
 112                 $cmdlist .= "-D $rule\n";
 113             }
 114             $rule = "OUTPUT -j PVEFW-OUTPUT";
 115             if (PVE::Firewall::iptables_rule_exist($rule)) {
 116                 $cmdlist .= "-D $rule\n";
 117             }
 118
 119             $rule = "FORWARD -j PVEFW-FORWARD";
 120             if (PVE::Firewall::iptables_rule_exist($rule)) {
 121                 $cmdlist .= "-D $rule\n";
 122             }
 123
 124             foreach my $chain (keys %$chash) {
 125                 $cmdlist .= "-F $chain\n";
 126             }
 127             foreach my $chain (keys %$chash) {
 128                 $cmdlist .= "-X $chain\n";
 129             }
 130             $cmdlist .= "COMMIT\n";
 131
 132             PVE::Firewall::iptables_restore_cmdlist($cmdlist);
 133         };
 134
 135         PVE::Firewall::run_locked($code);
 136
 137         return undef;
 138     }});
 139
 140 my $nodename = PVE::INotify::nodename();
 141
 142 my $cmddef = {
 143     compile => [ __PACKAGE__, 'compile', []],
 144     start => [ __PACKAGE__, 'start', []],
 145     stop => [ __PACKAGE__, 'stop', []],
 146 };
 147
 148 my $cmd = shift;
 149
 150 PVE::CLIHandler::handle_cmd($cmddef, "pvefw", $cmd, \@ARGV, undef, $0);
 151
 152 exit(0);
 153