]> git.proxmox.com Git - pve-firewall.git/blob - src/PVE/API2/Firewall/Cluster.pm
move option definition to PVE::Firewall
[pve-firewall.git] / src / PVE / API2 / Firewall / Cluster.pm
1 package PVE::API2::Firewall::Cluster;
2
3 use strict;
4 use warnings;
5 use PVE::Exception qw(raise raise_param_exc raise_perm_exc);
6 use PVE::JSONSchema qw(get_standard_option);
7
8 use PVE::Firewall;
9 use PVE::API2::Firewall::Aliases;
10 use PVE::API2::Firewall::Rules;
11 use PVE::API2::Firewall::Groups;
12 use PVE::API2::Firewall::IPSet;
13
14 #fixme: locking?
15
16 use Data::Dumper; # fixme: remove
17
18 use base qw(PVE::RESTHandler);
19
20 __PACKAGE__->register_method ({
21 subclass => "PVE::API2::Firewall::Groups",
22 path => 'groups',
23 });
24
25 __PACKAGE__->register_method ({
26 subclass => "PVE::API2::Firewall::ClusterRules",
27 path => 'rules',
28 });
29
30 __PACKAGE__->register_method ({
31 subclass => "PVE::API2::Firewall::ClusterIPSetList",
32 path => 'ipset',
33 });
34
35 __PACKAGE__->register_method ({
36 subclass => "PVE::API2::Firewall::ClusterAliases",
37 path => 'aliases',
38 });
39
40
41 __PACKAGE__->register_method({
42 name => 'index',
43 path => '',
44 method => 'GET',
45 permissions => { user => 'all' },
46 description => "Directory index.",
47 parameters => {
48 additionalProperties => 0,
49 },
50 returns => {
51 type => 'array',
52 items => {
53 type => "object",
54 properties => {},
55 },
56 links => [ { rel => 'child', href => "{name}" } ],
57 },
58 code => sub {
59 my ($param) = @_;
60
61 my $result = [
62 { name => 'aliases' },
63 { name => 'rules' },
64 { name => 'options' },
65 { name => 'groups' },
66 { name => 'ipset' },
67 { name => 'macros' },
68 { name => 'refs' },
69 ];
70
71 return $result;
72 }});
73
74 my $option_properties = $PVE::Firewall::cluster_option_properties;
75
76 my $add_option_properties = sub {
77 my ($properties) = @_;
78
79 foreach my $k (keys %$option_properties) {
80 $properties->{$k} = $option_properties->{$k};
81 }
82
83 return $properties;
84 };
85
86
87 __PACKAGE__->register_method({
88 name => 'get_options',
89 path => 'options',
90 method => 'GET',
91 description => "Get Firewall options.",
92 permissions => {
93 check => ['perm', '/', [ 'Sys.Audit' ]],
94 },
95 parameters => {
96 additionalProperties => 0,
97 },
98 returns => {
99 type => "object",
100 #additionalProperties => 1,
101 properties => $option_properties,
102 },
103 code => sub {
104 my ($param) = @_;
105
106 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
107
108 return PVE::Firewall::copy_opject_with_digest($cluster_conf->{options});
109 }});
110
111
112 __PACKAGE__->register_method({
113 name => 'set_options',
114 path => 'options',
115 method => 'PUT',
116 description => "Set Firewall options.",
117 protected => 1,
118 permissions => {
119 check => ['perm', '/', [ 'Sys.Modify' ]],
120 },
121 parameters => {
122 additionalProperties => 0,
123 properties => &$add_option_properties({
124 delete => {
125 type => 'string', format => 'pve-configid-list',
126 description => "A list of settings you want to delete.",
127 optional => 1,
128 },
129 digest => get_standard_option('pve-config-digest'),
130 }),
131 },
132 returns => { type => "null" },
133 code => sub {
134 my ($param) = @_;
135
136 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
137
138 my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($cluster_conf->{options});
139 PVE::Tools::assert_if_modified($digest, $param->{digest});
140
141 if ($param->{delete}) {
142 foreach my $opt (PVE::Tools::split_list($param->{delete})) {
143 raise_param_exc({ delete => "no such option '$opt'" })
144 if !$option_properties->{$opt};
145 delete $cluster_conf->{options}->{$opt};
146 }
147 }
148
149 if (defined($param->{enable}) && ($param->{enable} > 1)) {
150 $param->{enable} = time();
151 }
152
153 foreach my $k (keys %$option_properties) {
154 next if !defined($param->{$k});
155 $cluster_conf->{options}->{$k} = $param->{$k};
156 }
157
158 PVE::Firewall::save_clusterfw_conf($cluster_conf);
159
160 # instant firewall update when using double (anti-lockout) API call
161 # -> not waiting for a firewall update at the first (timestamp enable) set
162 if (defined($param->{enable}) && ($param->{enable} > 1)) {
163 PVE::Firewall::update();
164 }
165
166 return undef;
167 }});
168
169 __PACKAGE__->register_method({
170 name => 'get_macros',
171 path => 'macros',
172 method => 'GET',
173 description => "List available macros",
174 permissions => { user => 'all' },
175 parameters => {
176 additionalProperties => 0,
177 },
178 returns => {
179 type => 'array',
180 items => {
181 type => "object",
182 properties => {
183 macro => {
184 description => "Macro name.",
185 type => 'string',
186 },
187 descr => {
188 description => "More verbose description (if available).",
189 type => 'string',
190 }
191 },
192 },
193 },
194 code => sub {
195 my ($param) = @_;
196
197 my $res = [];
198
199 my ($macros, $descr) = PVE::Firewall::get_macros();
200
201 foreach my $macro (keys %$macros) {
202 push @$res, { macro => $macro, descr => $descr->{$macro} || $macro };
203 }
204
205 return $res;
206 }});
207
208 __PACKAGE__->register_method({
209 name => 'refs',
210 path => 'refs',
211 method => 'GET',
212 description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
213 permissions => {
214 check => ['perm', '/', [ 'Sys.Audit' ]],
215 },
216 parameters => {
217 additionalProperties => 0,
218 properties => {
219 type => {
220 description => "Only list references of specified type.",
221 type => 'string',
222 enum => ['alias', 'ipset'],
223 optional => 1,
224 },
225 },
226 },
227 returns => {
228 type => 'array',
229 items => {
230 type => "object",
231 properties => {
232 type => {
233 type => 'string',
234 enum => ['alias', 'ipset'],
235 },
236 name => {
237 type => 'string',
238 },
239 ref => {
240 type => 'string',
241 },
242 comment => {
243 type => 'string',
244 optional => 1,
245 },
246 },
247 },
248 },
249 code => sub {
250 my ($param) = @_;
251
252 my $conf = PVE::Firewall::load_clusterfw_conf();
253
254 my $res = [];
255
256 if (!$param->{type} || $param->{type} eq 'ipset') {
257 foreach my $name (keys %{$conf->{ipset}}) {
258 my $data = {
259 type => 'ipset',
260 name => $name,
261 ref => "+$name",
262 };
263 if (my $comment = $conf->{ipset_comments}->{$name}) {
264 $data->{comment} = $comment;
265 }
266 push @$res, $data;
267 }
268 }
269
270 if (!$param->{type} || $param->{type} eq 'alias') {
271 foreach my $name (keys %{$conf->{aliases}}) {
272 my $e = $conf->{aliases}->{$name};
273 my $data = {
274 type => 'alias',
275 name => $name,
276 ref => $name,
277 };
278 $data->{comment} = $e->{comment} if $e->{comment};
279 push @$res, $data;
280 }
281 }
282
283 return $res;
284 }});
285
286 1;