fix #967: source: dest: limit length
[pve-firewall.git] / src / PVE / API2 / Firewall / Groups.pm
1 package PVE::API2::Firewall::Groups;
2
3 use strict;
4 use warnings;
5 use PVE::JSONSchema qw(get_standard_option);
6 use PVE::Exception qw(raise raise_param_exc);
7
8 use PVE::Firewall;
9 use PVE::API2::Firewall::Rules;
10
11
12 use base qw(PVE::RESTHandler);
13
14 my $get_security_group_list = sub {
15 my ($cluster_conf) = @_;
16
17 my $res = [];
18 foreach my $group (sort keys %{$cluster_conf->{groups}}) {
19 my $data = {
20 group => $group,
21 };
22 if (my $comment = $cluster_conf->{group_comments}->{$group}) {
23 $data->{comment} = $comment;
24 }
25 push @$res, $data;
26 }
27
28 my ($list, $digest) = PVE::Firewall::copy_list_with_digest($res);
29
30 return wantarray ? ($list, $digest) : $list;
31 };
32
33 __PACKAGE__->register_method({
34 name => 'list_security_groups',
35 path => '',
36 method => 'GET',
37 description => "List security groups.",
38 permissions => { user => 'all' },
39 parameters => {
40 additionalProperties => 0,
41 properties => {},
42 },
43 returns => {
44 type => 'array',
45 items => {
46 type => "object",
47 properties => {
48 group => get_standard_option('pve-security-group-name'),
49 digest => get_standard_option('pve-config-digest', { optional => 0} ),
50 comment => {
51 type => 'string',
52 optional => 1,
53 }
54 },
55 },
56 links => [ { rel => 'child', href => "{group}" } ],
57 },
58 code => sub {
59 my ($param) = @_;
60
61 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
62
63 return &$get_security_group_list($cluster_conf);
64 }});
65
66 __PACKAGE__->register_method({
67 name => 'create_security_group',
68 path => '',
69 method => 'POST',
70 description => "Create new security group.",
71 protected => 1,
72 permissions => {
73 check => ['perm', '/', [ 'Sys.Modify' ]],
74 },
75 parameters => {
76 additionalProperties => 0,
77 properties => {
78 group => get_standard_option('pve-security-group-name'),
79 comment => {
80 type => 'string',
81 optional => 1,
82 },
83 rename => get_standard_option('pve-security-group-name', {
84 description => "Rename/update an existing security group. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing group.",
85 optional => 1,
86 }),
87 digest => get_standard_option('pve-config-digest'),
88 },
89 },
90 returns => { type => 'null' },
91 code => sub {
92 my ($param) = @_;
93
94 PVE::Firewall::lock_clusterfw_conf(10, sub {
95 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
96
97 if ($param->{rename}) {
98 my (undef, $digest) = &$get_security_group_list($cluster_conf);
99 PVE::Tools::assert_if_modified($digest, $param->{digest});
100
101 raise_param_exc({ group => "Security group '$param->{rename}' does not exist" })
102 if !$cluster_conf->{groups}->{$param->{rename}};
103
104 # prevent overwriting an existing group
105 raise_param_exc({ group => "Security group '$param->{group}' does already exist" })
106 if $cluster_conf->{groups}->{$param->{group}} &&
107 $param->{group} ne $param->{rename};
108
109 my $data = delete $cluster_conf->{groups}->{$param->{rename}};
110 $cluster_conf->{groups}->{$param->{group}} = $data;
111 if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {
112 $cluster_conf->{group_comments}->{$param->{group}} = $comment;
113 }
114 $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
115 } else {
116 foreach my $name (keys %{$cluster_conf->{groups}}) {
117 raise_param_exc({ group => "Security group '$name' already exists" })
118 if $name eq $param->{group};
119 }
120
121 $cluster_conf->{groups}->{$param->{group}} = [];
122 $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
123 }
124
125 PVE::Firewall::save_clusterfw_conf($cluster_conf);
126 });
127
128 return undef;
129 }});
130
131 __PACKAGE__->register_method ({
132 subclass => "PVE::API2::Firewall::GroupRules",
133 path => '{group}',
134 });
135
136 1;