cleanup firewall service implementation
[pve-firewall.git] / src / PVE / API2 / Firewall / Groups.pm
1 package PVE::API2::Firewall::Groups;
2
3 use strict;
4 use warnings;
5 use PVE::JSONSchema qw(get_standard_option);
6 use PVE::Exception qw(raise raise_param_exc);
7
8 use PVE::Firewall;
9 use PVE::API2::Firewall::Rules;
10
11 use Data::Dumper; # fixme: remove
12
13 use base qw(PVE::RESTHandler);
14
15 my $get_security_group_list = sub {
16 my ($cluster_conf) = @_;
17
18 my $res = [];
19 foreach my $group (keys %{$cluster_conf->{groups}}) {
20 my $data = {
21 group => $group,
22 };
23 if (my $comment = $cluster_conf->{group_comments}->{$group}) {
24 $data->{comment} = $comment;
25 }
26 push @$res, $data;
27 }
28
29 my ($list, $digest) = PVE::Firewall::copy_list_with_digest($res);
30
31 return wantarray ? ($list, $digest) : $list;
32 };
33
34 __PACKAGE__->register_method({
35 name => 'list_security_groups',
36 path => '',
37 method => 'GET',
38 description => "List security groups.",
39 parameters => {
40 additionalProperties => 0,
41 properties => {},
42 },
43 returns => {
44 type => 'array',
45 items => {
46 type => "object",
47 properties => {
48 group => get_standard_option('pve-security-group-name'),
49 digest => get_standard_option('pve-config-digest', { optional => 0} ),
50 comment => {
51 type => 'string',
52 optional => 1,
53 }
54 },
55 },
56 links => [ { rel => 'child', href => "{group}" } ],
57 },
58 code => sub {
59 my ($param) = @_;
60
61 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
62
63 return &$get_security_group_list($cluster_conf);
64 }});
65
66 __PACKAGE__->register_method({
67 name => 'create_security_group',
68 path => '',
69 method => 'POST',
70 description => "Create new security group.",
71 protected => 1,
72 parameters => {
73 additionalProperties => 0,
74 properties => {
75 group => get_standard_option('pve-security-group-name'),
76 comment => {
77 type => 'string',
78 optional => 1,
79 },
80 rename => get_standard_option('pve-security-group-name', {
81 description => "Rename/update an existing security group. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing group.",
82 optional => 1,
83 }),
84 digest => get_standard_option('pve-config-digest'),
85 },
86 },
87 returns => { type => 'null' },
88 code => sub {
89 my ($param) = @_;
90
91 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
92
93 if ($param->{rename}) {
94 my (undef, $digest) = &$get_security_group_list($cluster_conf);
95 PVE::Tools::assert_if_modified($digest, $param->{digest});
96
97 raise_param_exc({ group => "Security group '$param->{rename}' does not exists" })
98 if !$cluster_conf->{groups}->{$param->{rename}};
99
100 my $data = delete $cluster_conf->{groups}->{$param->{rename}};
101 $cluster_conf->{groups}->{$param->{group}} = $data;
102 if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {
103 $cluster_conf->{group_comments}->{$param->{group}} = $comment;
104 }
105 $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
106 } else {
107 foreach my $name (keys %{$cluster_conf->{groups}}) {
108 raise_param_exc({ group => "Security group '$name' already exists" })
109 if $name eq $param->{group};
110 }
111
112 $cluster_conf->{groups}->{$param->{group}} = [];
113 $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
114 }
115
116 PVE::Firewall::save_clusterfw_conf($cluster_conf);
117
118 return undef;
119 }});
120
121 __PACKAGE__->register_method({
122 name => 'delete_security_group',
123 path => '{group}',
124 method => 'DELETE',
125 description => "Delete security group.",
126 protected => 1,
127 parameters => {
128 additionalProperties => 0,
129 properties => {
130 group => get_standard_option('pve-security-group-name'),
131 digest => get_standard_option('pve-config-digest'),
132 },
133 },
134 returns => { type => 'null' },
135 code => sub {
136 my ($param) = @_;
137
138 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
139
140 return undef if !$cluster_conf->{groups}->{$param->{group}};
141
142 my (undef, $digest) = &$get_security_group_list($cluster_conf);
143 PVE::Tools::assert_if_modified($digest, $param->{digest});
144
145 die "Security group '$param->{group}' is not empty\n"
146 if scalar(@{$cluster_conf->{groups}->{$param->{group}}});
147
148 delete $cluster_conf->{groups}->{$param->{group}};
149
150 PVE::Firewall::save_clusterfw_conf($cluster_conf);
151
152 return undef;
153 }});
154
155 __PACKAGE__->register_method ({
156 subclass => "PVE::API2::Firewall::GroupRules",
157 path => '{group}',
158 });
159
160 1;