api: lock configs
[pve-firewall.git] / src / PVE / API2 / Firewall / Groups.pm
1 package PVE::API2::Firewall::Groups;
2
3 use strict;
4 use warnings;
5 use PVE::JSONSchema qw(get_standard_option);
6 use PVE::Exception qw(raise raise_param_exc);
7
8 use PVE::Firewall;
9 use PVE::API2::Firewall::Rules;
10
11
12 use base qw(PVE::RESTHandler);
13
14 my $get_security_group_list = sub {
15     my ($cluster_conf) = @_;
16
17     my $res = [];
18     foreach my $group (sort keys %{$cluster_conf->{groups}}) {
19         my $data = {
20             group => $group,
21         };
22         if (my $comment = $cluster_conf->{group_comments}->{$group}) {
23             $data->{comment} = $comment;
24         }
25         push @$res, $data;
26     }
27
28     my ($list, $digest) = PVE::Firewall::copy_list_with_digest($res);
29
30     return wantarray ? ($list, $digest) : $list;
31 };
32
33 __PACKAGE__->register_method({
34     name => 'list_security_groups',
35     path => '',
36     method => 'GET',
37     description => "List security groups.",
38     permissions => { user => 'all' },
39     parameters => {
40         additionalProperties => 0,
41         properties => {},
42     },
43     returns => {
44         type => 'array',
45         items => {
46             type => "object",
47             properties => {
48                 group => get_standard_option('pve-security-group-name'),
49                 digest => get_standard_option('pve-config-digest', { optional => 0} ),
50                 comment => {
51                     type => 'string',
52                     optional => 1,
53                 }
54             },
55         },
56         links => [ { rel => 'child', href => "{group}" } ],
57     },
58     code => sub {
59         my ($param) = @_;
60
61         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
62
63         return &$get_security_group_list($cluster_conf);
64     }});
65
66 __PACKAGE__->register_method({
67     name => 'create_security_group',
68     path => '',
69     method => 'POST',
70     description => "Create new security group.",
71     protected => 1,
72     permissions => {
73         check => ['perm', '/', [ 'Sys.Modify' ]],
74     },
75     parameters => {
76         additionalProperties => 0,
77         properties => {
78             group => get_standard_option('pve-security-group-name'),
79             comment => {
80                 type => 'string',
81                 optional => 1,
82             },
83             rename => get_standard_option('pve-security-group-name', {
84                 description => "Rename/update an existing security group. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing group.",
85                 optional => 1,
86             }),
87             digest => get_standard_option('pve-config-digest'),
88         },
89     },
90     returns => { type => 'null' },
91     code => sub {
92         my ($param) = @_;
93
94         PVE::Firewall::lock_clusterfw_conf(10, sub {
95             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
96
97             if ($param->{rename}) {
98                 my (undef, $digest) = &$get_security_group_list($cluster_conf);
99                 PVE::Tools::assert_if_modified($digest, $param->{digest});
100
101                 raise_param_exc({ group => "Security group '$param->{rename}' does not exist" })
102                     if !$cluster_conf->{groups}->{$param->{rename}};
103
104                 # prevent overwriting an existing group
105                 raise_param_exc({ group => "Security group '$param->{group}' does already exist" })
106                     if $cluster_conf->{groups}->{$param->{group}} &&
107                     $param->{group} ne $param->{rename};
108
109                 my $data = delete $cluster_conf->{groups}->{$param->{rename}};
110                 $cluster_conf->{groups}->{$param->{group}} = $data;
111                 if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {
112                     $cluster_conf->{group_comments}->{$param->{group}} = $comment;
113                 }
114                 $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
115             } else {
116                 foreach my $name (keys %{$cluster_conf->{groups}}) {
117                     raise_param_exc({ group => "Security group '$name' already exists" })
118                         if $name eq $param->{group};
119                 }
120
121                 $cluster_conf->{groups}->{$param->{group}} = [];
122                 $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
123             }
124
125             PVE::Firewall::save_clusterfw_conf($cluster_conf);
126         });
127
128         return undef;
129     }});
130
131 __PACKAGE__->register_method ({
132     subclass => "PVE::API2::Firewall::GroupRules",
133     path => '{group}',
134 });
135
136 1;