src/PVE/API2/Firewall/Aliases.pm

   1 package PVE::API2::Firewall::AliasesBase;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Exception qw(raise raise_param_exc);
   6 use PVE::JSONSchema qw(get_standard_option);
   7
   8 use PVE::Firewall;
   9
  10 use base qw(PVE::RESTHandler);
  11
  12 my $api_properties = {
  13     cidr => {
  14         description => "Network/IP specification in CIDR format.",
  15         type => 'string', format => 'IPorCIDR',
  16     },
  17     name => get_standard_option('pve-fw-alias'),
  18     rename => get_standard_option('pve-fw-alias', {
  19         description => "Rename an existing alias.",
  20         optional => 1,
  21     }),
  22     comment => {
  23         type => 'string',
  24         optional => 1,
  25     },
  26 };
  27
  28 sub load_config {
  29     my ($class, $param) = @_;
  30
  31     die "implement this in subclass";
  32
  33     #return ($fw_conf, $rules);
  34 }
  35
  36 sub save_aliases {
  37     my ($class, $param, $fw_conf, $aliases) = @_;
  38
  39     die "implement this in subclass";
  40 }
  41
  42 sub rule_env {
  43     my ($class, $param) = @_;
  44
  45     die "implement this in subclass";
  46 }
  47
  48 my $additional_param_hash = {};
  49
  50 sub additional_parameters {
  51     my ($class, $new_value) = @_;
  52
  53     if (defined($new_value)) {
  54         $additional_param_hash->{$class} = $new_value;
  55     }
  56
  57     # return a copy
  58     my $copy = {};
  59     my $org = $additional_param_hash->{$class} || {};
  60     foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
  61     return $copy;
  62 }
  63
  64 my $aliases_to_list = sub {
  65     my ($aliases) = @_;
  66
  67     my $list = [];
  68     foreach my $k (sort keys %$aliases) {
  69         push @$list, $aliases->{$k};
  70     }
  71     return $list;
  72 };
  73
  74 sub register_get_aliases {
  75     my ($class) = @_;
  76
  77     my $properties = $class->additional_parameters();
  78
  79     $class->register_method({
  80         name => 'get_aliases',
  81         path => '',
  82         method => 'GET',
  83         description => "List aliases",
  84         permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
  85         parameters => {
  86             additionalProperties => 0,
  87             properties => $properties,
  88         },
  89         returns => {
  90             type => 'array',
  91             items => {
  92                 type => "object",
  93                 properties => {
  94                     name => { type => 'string' },
  95                     cidr => { type => 'string' },
  96                     comment => {
  97                         type => 'string',
  98                         optional => 1,
  99                     },
 100                     digest => get_standard_option('pve-config-digest', { optional => 0} ),
 101                 },
 102             },
 103             links => [ { rel => 'child', href => "{name}" } ],
 104         },
 105         code => sub {
 106             my ($param) = @_;
 107
 108             my ($fw_conf, $aliases) = $class->load_config($param);
 109
 110             my $list = &$aliases_to_list($aliases);
 111
 112             return PVE::Firewall::copy_list_with_digest($list);
 113         }});
 114 }
 115
 116 sub register_create_alias {
 117     my ($class) = @_;
 118
 119     my $properties = $class->additional_parameters();
 120
 121     $properties->{name} = $api_properties->{name};
 122     $properties->{cidr} = $api_properties->{cidr};
 123     $properties->{comment} = $api_properties->{comment};
 124
 125     $class->register_method({
 126         name => 'create_alias',
 127         path => '',
 128         method => 'POST',
 129         description => "Create IP or Network Alias.",
 130         permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
 131         protected => 1,
 132         parameters => {
 133             additionalProperties => 0,
 134             properties => $properties,
 135         },
 136         returns => { type => "null" },
 137         code => sub {
 138             my ($param) = @_;
 139
 140             my ($fw_conf, $aliases) = $class->load_config($param);
 141
 142             my $name = lc($param->{name});
 143
 144             raise_param_exc({ name => "alias '$param->{name}' already exists" })
 145                 if defined($aliases->{$name});
 146
 147             my $data = { name => $param->{name}, cidr => $param->{cidr} };
 148             $data->{comment} = $param->{comment} if $param->{comment};
 149
 150             $aliases->{$name} = $data;
 151
 152             $class->save_aliases($param, $fw_conf, $aliases);
 153
 154             return undef;
 155         }});
 156 }
 157
 158 sub register_read_alias {
 159     my ($class) = @_;
 160
 161     my $properties = $class->additional_parameters();
 162
 163     $properties->{name} = $api_properties->{name};
 164
 165     $class->register_method({
 166         name => 'read_alias',
 167         path => '{name}',
 168         method => 'GET',
 169         description => "Read alias.",
 170         permissions => PVE::Firewall::rules_audit_permissions($class->rule_env()),
 171         parameters => {
 172             additionalProperties => 0,
 173             properties => $properties,
 174         },
 175         returns => { type => "object" },
 176         code => sub {
 177             my ($param) = @_;
 178
 179             my ($fw_conf, $aliases) = $class->load_config($param);
 180
 181             my $name = lc($param->{name});
 182
 183             raise_param_exc({ name => "no such alias" })
 184                 if !defined($aliases->{$name});
 185
 186             return $aliases->{$name};
 187         }});
 188 }
 189
 190 sub register_update_alias {
 191     my ($class) = @_;
 192
 193     my $properties = $class->additional_parameters();
 194
 195     $properties->{name} = $api_properties->{name};
 196     $properties->{rename} = $api_properties->{rename};
 197     $properties->{cidr} = $api_properties->{cidr};
 198     $properties->{comment} = $api_properties->{comment};
 199     $properties->{digest} = get_standard_option('pve-config-digest');
 200
 201     $class->register_method({
 202         name => 'update_alias',
 203         path => '{name}',
 204         method => 'PUT',
 205         description => "Update IP or Network alias.",
 206         permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
 207         protected => 1,
 208         parameters => {
 209             additionalProperties => 0,
 210             properties => $properties,
 211         },
 212         returns => { type => "null" },
 213         code => sub {
 214             my ($param) = @_;
 215
 216             my ($fw_conf, $aliases) = $class->load_config($param);
 217
 218             my $list = &$aliases_to_list($aliases);
 219
 220             my (undef, $digest) = PVE::Firewall::copy_list_with_digest($list);
 221
 222             PVE::Tools::assert_if_modified($digest, $param->{digest});
 223
 224             my $name = lc($param->{name});
 225
 226             raise_param_exc({ name => "no such alias" }) if !$aliases->{$name};
 227
 228             my $data = { name => $param->{name}, cidr => $param->{cidr} };
 229             $data->{comment} = $param->{comment} if $param->{comment};
 230
 231             $aliases->{$name} = $data;
 232
 233             my $rename = lc($param->{rename});
 234
 235             if ($rename && ($name ne $rename)) {
 236                 raise_param_exc({ name => "alias '$param->{rename}' already exists" })
 237                     if defined($aliases->{$rename});
 238                 $aliases->{$name}->{name} = $param->{rename};
 239                 $aliases->{$rename} = $aliases->{$name};
 240                 delete $aliases->{$name};
 241             }
 242
 243             $class->save_aliases($param, $fw_conf, $aliases);
 244
 245             return undef;
 246         }});
 247 }
 248
 249 sub register_delete_alias {
 250     my ($class) = @_;
 251
 252     my $properties = $class->additional_parameters();
 253
 254     $properties->{name} = $api_properties->{name};
 255     $properties->{digest} = get_standard_option('pve-config-digest');
 256
 257     $class->register_method({
 258         name => 'remove_alias',
 259         path => '{name}',
 260         method => 'DELETE',
 261         description => "Remove IP or Network alias.",
 262         permissions => PVE::Firewall::rules_modify_permissions($class->rule_env()),
 263         protected => 1,
 264         parameters => {
 265             additionalProperties => 0,
 266             properties => $properties,
 267         },
 268         returns => { type => "null" },
 269         code => sub {
 270             my ($param) = @_;
 271
 272             my ($fw_conf, $aliases) = $class->load_config($param);
 273
 274             my $list = &$aliases_to_list($aliases);
 275             my (undef, $digest) = PVE::Firewall::copy_list_with_digest($list);
 276             PVE::Tools::assert_if_modified($digest, $param->{digest});
 277
 278             my $name = lc($param->{name});
 279             delete $aliases->{$name};
 280
 281             $class->save_aliases($param, $fw_conf, $aliases);
 282
 283             return undef;
 284         }});
 285 }
 286
 287 sub register_handlers {
 288     my ($class) = @_;
 289
 290     $class->register_get_aliases();
 291     $class->register_create_alias();
 292     $class->register_read_alias();
 293     $class->register_update_alias();
 294     $class->register_delete_alias();
 295 }
 296
 297 package PVE::API2::Firewall::ClusterAliases;
 298
 299 use strict;
 300 use warnings;
 301
 302 use base qw(PVE::API2::Firewall::AliasesBase);
 303
 304 sub rule_env {
 305     my ($class, $param) = @_;
 306
 307     return 'cluster';
 308 }
 309
 310 sub load_config {
 311     my ($class, $param) = @_;
 312
 313     my $fw_conf = PVE::Firewall::load_clusterfw_conf();
 314     my $aliases = $fw_conf->{aliases};
 315
 316     return ($fw_conf, $aliases);
 317 }
 318
 319 sub save_aliases {
 320     my ($class, $param, $fw_conf, $aliases) = @_;
 321
 322     $fw_conf->{aliases} = $aliases;
 323     PVE::Firewall::save_clusterfw_conf($fw_conf);
 324 }
 325
 326 __PACKAGE__->register_handlers();
 327
 328 package PVE::API2::Firewall::VMAliases;
 329
 330 use strict;
 331 use warnings;
 332 use PVE::JSONSchema qw(get_standard_option);
 333
 334 use base qw(PVE::API2::Firewall::AliasesBase);
 335
 336 sub rule_env {
 337     my ($class, $param) = @_;
 338
 339     return 'vm';
 340 }
 341
 342 __PACKAGE__->additional_parameters({
 343     node => get_standard_option('pve-node'),
 344     vmid => get_standard_option('pve-vmid'),
 345 });
 346
 347 sub load_config {
 348     my ($class, $param) = @_;
 349
 350     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 351     my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
 352     my $aliases = $fw_conf->{aliases};
 353
 354     return ($fw_conf, $aliases);
 355 }
 356
 357 sub save_aliases {
 358     my ($class, $param, $fw_conf, $aliases) = @_;
 359
 360     $fw_conf->{aliases} = $aliases;
 361     PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
 362 }
 363
 364 __PACKAGE__->register_handlers();
 365
 366 package PVE::API2::Firewall::CTAliases;
 367
 368 use strict;
 369 use warnings;
 370 use PVE::JSONSchema qw(get_standard_option);
 371
 372 use base qw(PVE::API2::Firewall::AliasesBase);
 373
 374 sub rule_env {
 375     my ($class, $param) = @_;
 376
 377     return 'ct';
 378 }
 379
 380 __PACKAGE__->additional_parameters({
 381     node => get_standard_option('pve-node'),
 382     vmid => get_standard_option('pve-vmid'),
 383 });
 384
 385 sub load_config {
 386     my ($class, $param) = @_;
 387
 388     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 389     my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
 390     my $aliases = $fw_conf->{aliases};
 391
 392     return ($fw_conf, $aliases);
 393 }
 394
 395 sub save_aliases {
 396     my ($class, $param, $fw_conf, $aliases) = @_;
 397
 398     $fw_conf->{aliases} = $aliases;
 399     PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
 400 }
 401
 402 __PACKAGE__->register_handlers();
 403
 404 1;