fix #967: source: dest: limit length
[pve-firewall.git] / src / PVE / API2 / Firewall / Aliases.pm
1 package PVE::API2::Firewall::AliasesBase;
2
3 use strict;
4 use warnings;
5 use PVE::Exception qw(raise raise_param_exc);
6 use PVE::JSONSchema qw(get_standard_option);
7
8 use PVE::Firewall;
9
10 use base qw(PVE::RESTHandler);
11
12 my $api_properties = {
13 cidr => {
14 description => "Network/IP specification in CIDR format.",
15 type => 'string', format => 'IPorCIDR',
16 },
17 name => get_standard_option('pve-fw-alias'),
18 rename => get_standard_option('pve-fw-alias', {
19 description => "Rename an existing alias.",
20 optional => 1,
21 }),
22 comment => {
23 type => 'string',
24 optional => 1,
25 },
26 };
27
28 sub lock_config {
29 my ($class, $param, $code) = @_;
30
31 die "implement this in subclass";
32 }
33
34 sub load_config {
35 my ($class, $param) = @_;
36
37 die "implement this in subclass";
38
39 #return ($fw_conf, $rules);
40 }
41
42 sub save_aliases {
43 my ($class, $param, $fw_conf, $aliases) = @_;
44
45 die "implement this in subclass";
46 }
47
48 sub rule_env {
49 my ($class, $param) = @_;
50
51 die "implement this in subclass";
52 }
53
54 my $additional_param_hash = {};
55
56 sub additional_parameters {
57 my ($class, $new_value) = @_;
58
59 if (defined($new_value)) {
60 $additional_param_hash->{$class} = $new_value;
61 }
62
63 # return a copy
64 my $copy = {};
65 my $org = $additional_param_hash->{$class} || {};
66 foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
67 return $copy;
68 }
69
70 my $aliases_to_list = sub {
71 my ($aliases) = @_;
72
73 my $list = [];
74 foreach my $k (sort keys %$aliases) {
75 push @$list, $aliases->{$k};
76 }
77 return $list;
78 };
79
80 sub register_get_aliases {
81 my ($class) = @_;
82
83 my $properties = $class->additional_parameters();
84
85 $class->register_method({
86 name => 'get_aliases',
87 path => '',
88 method => 'GET',
89 description => "List aliases",
90 permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
91 parameters => {
92 additionalProperties => 0,
93 properties => $properties,
94 },
95 returns => {
96 type => 'array',
97 items => {
98 type => "object",
99 properties => {
100 name => { type => 'string' },
101 cidr => { type => 'string' },
102 comment => {
103 type => 'string',
104 optional => 1,
105 },
106 digest => get_standard_option('pve-config-digest', { optional => 0} ),
107 },
108 },
109 links => [ { rel => 'child', href => "{name}" } ],
110 },
111 code => sub {
112 my ($param) = @_;
113
114 my ($fw_conf, $aliases) = $class->load_config($param);
115
116 my $list = &$aliases_to_list($aliases);
117
118 return PVE::Firewall::copy_list_with_digest($list);
119 }});
120 }
121
122 sub register_create_alias {
123 my ($class) = @_;
124
125 my $properties = $class->additional_parameters();
126
127 $properties->{name} = $api_properties->{name};
128 $properties->{cidr} = $api_properties->{cidr};
129 $properties->{comment} = $api_properties->{comment};
130
131 $class->register_method({
132 name => 'create_alias',
133 path => '',
134 method => 'POST',
135 description => "Create IP or Network Alias.",
136 permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
137 protected => 1,
138 parameters => {
139 additionalProperties => 0,
140 properties => $properties,
141 },
142 returns => { type => "null" },
143 code => sub {
144 my ($param) = @_;
145
146 $class->lock_config($param, sub {
147 my ($param) = @_;
148
149 my ($fw_conf, $aliases) = $class->load_config($param);
150
151 my $name = lc($param->{name});
152
153 raise_param_exc({ name => "alias '$param->{name}' already exists" })
154 if defined($aliases->{$name});
155
156 my $data = { name => $param->{name}, cidr => $param->{cidr} };
157 $data->{comment} = $param->{comment} if $param->{comment};
158
159 $aliases->{$name} = $data;
160
161 $class->save_aliases($param, $fw_conf, $aliases);
162 });
163
164 return undef;
165 }});
166 }
167
168 sub register_read_alias {
169 my ($class) = @_;
170
171 my $properties = $class->additional_parameters();
172
173 $properties->{name} = $api_properties->{name};
174
175 $class->register_method({
176 name => 'read_alias',
177 path => '{name}',
178 method => 'GET',
179 description => "Read alias.",
180 permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
181 parameters => {
182 additionalProperties => 0,
183 properties => $properties,
184 },
185 returns => { type => "object" },
186 code => sub {
187 my ($param) = @_;
188
189 my ($fw_conf, $aliases) = $class->load_config($param);
190
191 my $name = lc($param->{name});
192
193 raise_param_exc({ name => "no such alias" })
194 if !defined($aliases->{$name});
195
196 return $aliases->{$name};
197 }});
198 }
199
200 sub register_update_alias {
201 my ($class) = @_;
202
203 my $properties = $class->additional_parameters();
204
205 $properties->{name} = $api_properties->{name};
206 $properties->{rename} = $api_properties->{rename};
207 $properties->{cidr} = $api_properties->{cidr};
208 $properties->{comment} = $api_properties->{comment};
209 $properties->{digest} = get_standard_option('pve-config-digest');
210
211 $class->register_method({
212 name => 'update_alias',
213 path => '{name}',
214 method => 'PUT',
215 description => "Update IP or Network alias.",
216 permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
217 protected => 1,
218 parameters => {
219 additionalProperties => 0,
220 properties => $properties,
221 },
222 returns => { type => "null" },
223 code => sub {
224 my ($param) = @_;
225
226 $class->lock_config($param, sub {
227 my ($param) = @_;
228
229 my ($fw_conf, $aliases) = $class->load_config($param);
230
231 my $list = &$aliases_to_list($aliases);
232
233 my (undef, $digest) = PVE::Firewall::copy_list_with_digest($list);
234
235 PVE::Tools::assert_if_modified($digest, $param->{digest});
236
237 my $name = lc($param->{name});
238
239 raise_param_exc({ name => "no such alias" }) if !$aliases->{$name};
240
241 my $data = { name => $param->{name}, cidr => $param->{cidr} };
242 $data->{comment} = $param->{comment} if $param->{comment};
243
244 $aliases->{$name} = $data;
245
246 my $rename = $param->{rename};
247 $rename = lc($rename) if $rename;
248
249 if ($rename && ($name ne $rename)) {
250 raise_param_exc({ name => "alias '$param->{rename}' already exists" })
251 if defined($aliases->{$rename});
252 $aliases->{$name}->{name} = $param->{rename};
253 $aliases->{$rename} = $aliases->{$name};
254 delete $aliases->{$name};
255 }
256
257 $class->save_aliases($param, $fw_conf, $aliases);
258 });
259
260 return undef;
261 }});
262 }
263
264 sub register_delete_alias {
265 my ($class) = @_;
266
267 my $properties = $class->additional_parameters();
268
269 $properties->{name} = $api_properties->{name};
270 $properties->{digest} = get_standard_option('pve-config-digest');
271
272 $class->register_method({
273 name => 'remove_alias',
274 path => '{name}',
275 method => 'DELETE',
276 description => "Remove IP or Network alias.",
277 permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
278 protected => 1,
279 parameters => {
280 additionalProperties => 0,
281 properties => $properties,
282 },
283 returns => { type => "null" },
284 code => sub {
285 my ($param) = @_;
286
287 $class->lock_config($param, sub {
288 my ($param) = @_;
289
290 my ($fw_conf, $aliases) = $class->load_config($param);
291
292 my $list = &$aliases_to_list($aliases);
293 my (undef, $digest) = PVE::Firewall::copy_list_with_digest($list);
294 PVE::Tools::assert_if_modified($digest, $param->{digest});
295
296 my $name = lc($param->{name});
297 delete $aliases->{$name};
298
299 $class->save_aliases($param, $fw_conf, $aliases);
300 });
301
302 return undef;
303 }});
304 }
305
306 sub register_handlers {
307 my ($class) = @_;
308
309 $class->register_get_aliases();
310 $class->register_create_alias();
311 $class->register_read_alias();
312 $class->register_update_alias();
313 $class->register_delete_alias();
314 }
315
316 package PVE::API2::Firewall::ClusterAliases;
317
318 use strict;
319 use warnings;
320
321 use base qw(PVE::API2::Firewall::AliasesBase);
322
323 sub rule_env {
324 my ($class, $param) = @_;
325
326 return 'cluster';
327 }
328
329 sub lock_config {
330 my ($class, $param, $code) = @_;
331
332 PVE::Firewall::lock_clusterfw_conf(10, $code, $param);
333 }
334
335 sub load_config {
336 my ($class, $param) = @_;
337
338 my $fw_conf = PVE::Firewall::load_clusterfw_conf();
339 my $aliases = $fw_conf->{aliases};
340
341 return ($fw_conf, $aliases);
342 }
343
344 sub save_aliases {
345 my ($class, $param, $fw_conf, $aliases) = @_;
346
347 $fw_conf->{aliases} = $aliases;
348 PVE::Firewall::save_clusterfw_conf($fw_conf);
349 }
350
351 __PACKAGE__->register_handlers();
352
353 package PVE::API2::Firewall::VMAliases;
354
355 use strict;
356 use warnings;
357 use PVE::JSONSchema qw(get_standard_option);
358
359 use base qw(PVE::API2::Firewall::AliasesBase);
360
361 sub rule_env {
362 my ($class, $param) = @_;
363
364 return 'vm';
365 }
366
367 __PACKAGE__->additional_parameters({
368 node => get_standard_option('pve-node'),
369 vmid => get_standard_option('pve-vmid'),
370 });
371
372 sub lock_config {
373 my ($class, $param, $code) = @_;
374
375 PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, $code, $param);
376 }
377
378 sub load_config {
379 my ($class, $param) = @_;
380
381 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
382 my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
383 my $aliases = $fw_conf->{aliases};
384
385 return ($fw_conf, $aliases);
386 }
387
388 sub save_aliases {
389 my ($class, $param, $fw_conf, $aliases) = @_;
390
391 $fw_conf->{aliases} = $aliases;
392 PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
393 }
394
395 __PACKAGE__->register_handlers();
396
397 package PVE::API2::Firewall::CTAliases;
398
399 use strict;
400 use warnings;
401 use PVE::JSONSchema qw(get_standard_option);
402
403 use base qw(PVE::API2::Firewall::AliasesBase);
404
405 sub rule_env {
406 my ($class, $param) = @_;
407
408 return 'ct';
409 }
410
411 __PACKAGE__->additional_parameters({
412 node => get_standard_option('pve-node'),
413 vmid => get_standard_option('pve-vmid'),
414 });
415
416 sub lock_config {
417 my ($class, $param, $code) = @_;
418
419 PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, $code, $param);
420 }
421
422 sub load_config {
423 my ($class, $param) = @_;
424
425 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
426 my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
427 my $aliases = $fw_conf->{aliases};
428
429 return ($fw_conf, $aliases);
430 }
431
432 sub save_aliases {
433 my ($class, $param, $fw_conf, $aliases) = @_;
434
435 $fw_conf->{aliases} = $aliases;
436 PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
437 }
438
439 __PACKAGE__->register_handlers();
440
441 1;