cleanup chain names
[pve-firewall.git] / pvefw
1 #!/usr/bin/perl -w
2
3 use strict;
4 use lib qw(.);
5 use PVE::Firewall;
6
7 use PVE::SafeSyslog;
8 use PVE::Cluster;
9 use PVE::INotify;
10 use PVE::RPCEnvironment;
11
12 use PVE::JSONSchema qw(get_standard_option);
13
14 use PVE::CLIHandler;
15
16 use base qw(PVE::CLIHandler);
17
18 $ENV{'PATH'} = '/sbin:/bin:/usr/sbin:/usr/bin';
19
20 initlog ('pvefw');
21
22 die "please run as root\n" if $> != 0;
23
24 PVE::INotify::inotify_init();
25
26 my $rpcenv = PVE::RPCEnvironment->init('cli');
27
28 $rpcenv->init_request();
29 $rpcenv->set_language($ENV{LANG});
30 $rpcenv->set_user('root@pam');
31
32 __PACKAGE__->register_method ({
33 name => 'compile',
34 path => 'compile',
35 method => 'POST',
36 description => "Compile amd print firewall rules. This is only for testing.",
37 parameters => {
38 additionalProperties => 0,
39 properties => {
40 verbose => {
41 description => "Verbose output.",
42 type => "boolean",
43 optional => 1,
44 default => 0,
45 },
46 },
47 },
48 returns => { type => 'null' },
49
50 code => sub {
51 my ($param) = @_;
52
53 my $code = sub {
54 my $ruleset = PVE::Firewall::compile();
55 PVE::Firewall::get_ruleset_status($ruleset, 1) if $param->{verbose};
56 };
57
58 PVE::Firewall::run_locked($code);
59
60 return undef;
61 }});
62
63 __PACKAGE__->register_method ({
64 name => 'start',
65 path => 'start',
66 method => 'POST',
67 description => "Start (or restart if already active) firewall.",
68 parameters => {
69 additionalProperties => 0,
70 properties => {
71 verbose => {
72 description => "Verbose output.",
73 type => "boolean",
74 optional => 1,
75 default => 0,
76 },
77 },
78 },
79 returns => { type => 'null' },
80
81 code => sub {
82 my ($param) = @_;
83
84 my $code = sub {
85 PVE::Firewall::compile_and_start($param->{verbose});
86 };
87
88 PVE::Firewall::run_locked($code);
89
90 return undef;
91 }});
92
93 __PACKAGE__->register_method ({
94 name => 'stop',
95 path => 'stop',
96 method => 'POST',
97 description => "Stop firewall. This will remove all rules installed by this script. The host is then unprotected.",
98 parameters => {
99 additionalProperties => 0,
100 properties => {},
101 },
102 returns => { type => 'null' },
103
104 code => sub {
105 my ($param) = @_;
106
107 my $code = sub {
108 my $chash = PVE::Firewall::iptables_get_chains();
109 my $cmdlist = "*filter\n";
110 my $rule = "INPUT -j PVEFW-INPUT";
111 if (PVE::Firewall::iptables_rule_exist($rule)) {
112 $cmdlist .= "-D $rule\n";
113 }
114 $rule = "OUTPUT -j PVEFW-OUTPUT";
115 if (PVE::Firewall::iptables_rule_exist($rule)) {
116 $cmdlist .= "-D $rule\n";
117 }
118
119 $rule = "FORWARD -j PVEFW-FORWARD";
120 if (PVE::Firewall::iptables_rule_exist($rule)) {
121 $cmdlist .= "-D $rule\n";
122 }
123
124 foreach my $chain (keys %$chash) {
125 $cmdlist .= "-F $chain\n";
126 }
127 foreach my $chain (keys %$chash) {
128 $cmdlist .= "-X $chain\n";
129 }
130 $cmdlist .= "COMMIT\n";
131
132 PVE::Firewall::iptables_restore_cmdlist($cmdlist);
133 };
134
135 PVE::Firewall::run_locked($code);
136
137 return undef;
138 }});
139
140 my $nodename = PVE::INotify::nodename();
141
142 my $cmddef = {
143 compile => [ __PACKAGE__, 'compile', []],
144 start => [ __PACKAGE__, 'start', []],
145 stop => [ __PACKAGE__, 'stop', []],
146 };
147
148 my $cmd = shift;
149
150 PVE::CLIHandler::handle_cmd($cmddef, "pvefw", $cmd, \@ARGV, undef, $0);
151
152 exit(0);
153