src/PVE/API2/Firewall/Groups.pm

   1 package PVE::API2::Firewall::Groups;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::JSONSchema qw(get_standard_option);
   6 use PVE::Exception qw(raise raise_param_exc);
   7
   8 use PVE::Firewall;
   9 use PVE::API2::Firewall::Rules;
  10
  11
  12 use base qw(PVE::RESTHandler);
  13
  14 my $get_security_group_list = sub {
  15     my ($cluster_conf) = @_;
  16
  17     my $res = [];
  18     foreach my $group (sort keys %{$cluster_conf->{groups}}) {
  19         my $data = {
  20             group => $group,
  21         };
  22         if (my $comment = $cluster_conf->{group_comments}->{$group}) {
  23             $data->{comment} = $comment;
  24         }
  25         push @$res, $data;
  26     }
  27
  28     my ($list, $digest) = PVE::Firewall::copy_list_with_digest($res);
  29
  30     return wantarray ? ($list, $digest) : $list;
  31 };
  32
  33 __PACKAGE__->register_method({
  34     name => 'list_security_groups',
  35     path => '',
  36     method => 'GET',
  37     description => "List security groups.",
  38     permissions => { user => 'all' },
  39     parameters => {
  40         additionalProperties => 0,
  41         properties => {},
  42     },
  43     returns => {
  44         type => 'array',
  45         items => {
  46             type => "object",
  47             properties => {
  48                 group => get_standard_option('pve-security-group-name'),
  49                 digest => get_standard_option('pve-config-digest', { optional => 0} ),
  50                 comment => {
  51                     type => 'string',
  52                     optional => 1,
  53                 }
  54             },
  55         },
  56         links => [ { rel => 'child', href => "{group}" } ],
  57     },
  58     code => sub {
  59         my ($param) = @_;
  60
  61         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
  62
  63         return &$get_security_group_list($cluster_conf);
  64     }});
  65
  66 __PACKAGE__->register_method({
  67     name => 'create_security_group',
  68     path => '',
  69     method => 'POST',
  70     description => "Create new security group.",
  71     protected => 1,
  72     permissions => {
  73         check => ['perm', '/', [ 'Sys.Modify' ]],
  74     },
  75     parameters => {
  76         additionalProperties => 0,
  77         properties => {
  78             group => get_standard_option('pve-security-group-name'),
  79             comment => {
  80                 type => 'string',
  81                 optional => 1,
  82             },
  83             rename => get_standard_option('pve-security-group-name', {
  84                 description => "Rename/update an existing security group. You can set 'rename' to the same value as 'name' to update the 'comment' of an existing group.",
  85                 optional => 1,
  86             }),
  87             digest => get_standard_option('pve-config-digest'),
  88         },
  89     },
  90     returns => { type => 'null' },
  91     code => sub {
  92         my ($param) = @_;
  93
  94         my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
  95
  96         if ($param->{rename}) {
  97             my (undef, $digest) = &$get_security_group_list($cluster_conf);
  98             PVE::Tools::assert_if_modified($digest, $param->{digest});
  99
 100             raise_param_exc({ group => "Security group '$param->{rename}' does not exists" })
 101                 if !$cluster_conf->{groups}->{$param->{rename}};
 102
 103             # prevent overwriting an existing group
 104             raise_param_exc({ group => "Security group '$param->{group}' does already exist" })
 105                 if $cluster_conf->{groups}->{$param->{group}} &&
 106                 $param->{group} ne $param->{rename};
 107
 108             my $data = delete $cluster_conf->{groups}->{$param->{rename}};
 109             $cluster_conf->{groups}->{$param->{group}} = $data;
 110             if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {
 111                 $cluster_conf->{group_comments}->{$param->{group}} = $comment;
 112             }
 113             $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
 114         } else {
 115             foreach my $name (keys %{$cluster_conf->{groups}}) {
 116                 raise_param_exc({ group => "Security group '$name' already exists" })
 117                     if $name eq $param->{group};
 118             }
 119
 120             $cluster_conf->{groups}->{$param->{group}} = [];
 121             $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
 122         }
 123
 124         PVE::Firewall::save_clusterfw_conf($cluster_conf);
 125
 126         return undef;
 127     }});
 128
 129 __PACKAGE__->register_method ({
 130     subclass => "PVE::API2::Firewall::GroupRules",
 131     path => '{group}',
 132 });
 133
 134 1;