src/PVE/API2/Firewall/Cluster.pm

   1 package PVE::API2::Firewall::Cluster;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
   6 use PVE::JSONSchema qw(get_standard_option);
   7
   8 use PVE::Firewall;
   9 use PVE::API2::Firewall::Rules;
  10 use PVE::API2::Firewall::Groups;
  11 use PVE::API2::Firewall::IPSet;
  12
  13 #fixme: locking?
  14
  15 use Data::Dumper; # fixme: remove
  16
  17 use base qw(PVE::RESTHandler);
  18
  19 __PACKAGE__->register_method ({
  20     subclass => "PVE::API2::Firewall::Groups",
  21     path => 'groups',
  22 });
  23
  24 __PACKAGE__->register_method ({
  25     subclass => "PVE::API2::Firewall::ClusterRules",
  26     path => 'rules',
  27 });
  28
  29 __PACKAGE__->register_method ({
  30     subclass => "PVE::API2::Firewall::ClusterIPSetList",
  31     path => 'ipset',
  32 });
  33
  34 __PACKAGE__->register_method({
  35     name => 'index',
  36     path => '',
  37     method => 'GET',
  38     permissions => { user => 'all' },
  39     description => "Directory index.",
  40     parameters => {
  41         additionalProperties => 0,
  42     },
  43     returns => {
  44         type => 'array',
  45         items => {
  46             type => "object",
  47             properties => {},
  48         },
  49         links => [ { rel => 'child', href => "{name}" } ],
  50     },
  51     code => sub {
  52         my ($param) = @_;
  53
  54         my $result = [
  55             { name => 'rules' },
  56             { name => 'options' },
  57             { name => 'groups' },
  58             { name => 'ipset' },
  59             { name => 'macros' },
  60             ];
  61
  62         return $result;
  63     }});
  64
  65 __PACKAGE__->register_method({
  66     name => 'get_options',
  67     path => 'options',
  68     method => 'GET',
  69     description => "Get Firewall options.",
  70     parameters => {
  71         additionalProperties => 0,
  72     },
  73     returns => {
  74         type => "object",
  75         #additionalProperties => 1,
  76         properties => {
  77             enable => {
  78                 type => 'boolean',
  79                 optional => 1,
  80             },
  81         },
  82     },
  83     code => sub {
  84         my ($param) = @_;
  85
  86         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
  87
  88         my $options = $cluster_conf->{options};
  89
  90         return $options;
  91     }});
  92
  93 my $option_properties = {
  94     enable => {
  95         type => 'boolean',
  96         optional => 1,
  97     },
  98 };
  99
 100 my $add_option_properties = sub {
 101     my ($properties) = @_;
 102
 103     foreach my $k (keys %$option_properties) {
 104         $properties->{$k} = $option_properties->{$k};
 105     }
 106
 107     return $properties;
 108 };
 109
 110 __PACKAGE__->register_method({
 111     name => 'set_options',
 112     path => 'options',
 113     method => 'PUT',
 114     description => "Set Firewall options.",
 115     protected => 1,
 116     parameters => {
 117         additionalProperties => 0,
 118         properties => &$add_option_properties({
 119             delete => {
 120                 type => 'string', format => 'pve-configid-list',
 121                 description => "A list of settings you want to delete.",
 122                 optional => 1,
 123             },
 124         }),
 125     },
 126     returns => { type => "null" },
 127     code => sub {
 128         my ($param) = @_;
 129
 130         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 131
 132         if ($param->{delete}) {
 133             foreach my $opt (PVE::Tools::split_list($param->{delete})) {
 134                 raise_param_exc({ delete => "no such option '$opt'" })
 135                     if !$option_properties->{$opt};
 136                 delete $cluster_conf->{options}->{$opt};
 137             }
 138         }
 139
 140         if (defined($param->{enable})) {
 141             $cluster_conf->{options}->{enable} = $param->{enable} ? 1 : 0;
 142         }
 143
 144         PVE::Firewall::save_clusterfw_conf($cluster_conf);
 145
 146         return undef;
 147     }});
 148
 149 __PACKAGE__->register_method({
 150     name => 'get_macros',
 151     path => 'macros',
 152     method => 'GET',
 153     description => "List available macros",
 154     parameters => {
 155         additionalProperties => 0,
 156     },
 157     returns => {
 158         type => 'array',
 159         items => {
 160             type => "object",
 161             properties => {
 162                 macro => {
 163                     description => "Macro name.",
 164                     type => 'string',
 165                 },
 166                 descr => {
 167                     description => "More verbose description (if available).",
 168                     type => 'string',
 169                 }
 170             },
 171         },
 172     },
 173     code => sub {
 174         my ($param) = @_;
 175
 176         my $res = [];
 177
 178         my ($macros, $descr) = PVE::Firewall::get_macros();
 179
 180         foreach my $macro (keys %$macros) {
 181             push @$res, { macro => $macro, descr => $descr->{$macro} || $macro };
 182         }
 183
 184         return $res;
 185     }});
 186
 187 1;