83190b4f3886e59d2564b4d65f2dfca275a98ae4
[pve-firewall.git] / src / PVE / API2 / Firewall / Rules.pm
1 package PVE::API2::Firewall::RulesBase;
2
3 use strict;
4 use warnings;
5 use PVE::JSONSchema qw(get_standard_option);
6 use PVE::Exception qw(raise raise_param_exc);
7
8 use PVE::Firewall;
9
10 use base qw(PVE::RESTHandler);
11
12 my $api_properties = {
13 pos => {
14 description => "Rule position.",
15 type => 'integer',
16 minimum => 0,
17 },
18 };
19
20 sub load_config {
21 my ($class, $param) = @_;
22
23 die "implement this in subclass";
24
25 #return ($cluster_conf, $fw_conf, $rules);
26 }
27
28 sub save_rules {
29 my ($class, $param, $fw_conf, $rules) = @_;
30
31 die "implement this in subclass";
32 }
33
34 my $additional_param_hash = {};
35
36 sub rule_env {
37 my ($class, $param) = @_;
38
39 die "implement this in subclass";
40 }
41
42 sub additional_parameters {
43 my ($class, $new_value) = @_;
44
45 if (defined($new_value)) {
46 $additional_param_hash->{$class} = $new_value;
47 }
48
49 # return a copy
50 my $copy = {};
51 my $org = $additional_param_hash->{$class} || {};
52 foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
53 return $copy;
54 }
55
56 sub register_get_rules {
57 my ($class) = @_;
58
59 my $properties = $class->additional_parameters();
60
61 $class->register_method({
62 name => 'get_rules',
63 path => '',
64 method => 'GET',
65 description => "List rules.",
66 parameters => {
67 additionalProperties => 0,
68 properties => $properties,
69 },
70 proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
71 returns => {
72 type => 'array',
73 items => {
74 type => "object",
75 properties => {
76 pos => {
77 type => 'integer',
78 }
79 },
80 },
81 links => [ { rel => 'child', href => "{pos}" } ],
82 },
83 code => sub {
84 my ($param) = @_;
85
86 my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
87
88 my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
89
90 my $ind = 0;
91 foreach my $rule (@$list) {
92 $rule->{pos} = $ind++;
93 }
94
95 return $list;
96 }});
97 }
98
99 sub register_get_rule {
100 my ($class) = @_;
101
102 my $properties = $class->additional_parameters();
103
104 $properties->{pos} = $api_properties->{pos};
105
106 $class->register_method({
107 name => 'get_rule',
108 path => '{pos}',
109 method => 'GET',
110 description => "Get single rule data.",
111 parameters => {
112 additionalProperties => 0,
113 properties => $properties,
114 },
115 proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
116 returns => {
117 type => "object",
118 properties => {
119 pos => {
120 type => 'integer',
121 }
122 },
123 },
124 code => sub {
125 my ($param) = @_;
126
127 my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
128
129 my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
130
131 die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$list);
132
133 my $rule = $list->[$param->{pos}];
134 $rule->{pos} = $param->{pos};
135
136 return $rule;
137 }});
138 }
139
140 sub register_create_rule {
141 my ($class) = @_;
142
143 my $properties = $class->additional_parameters();
144
145 my $create_rule_properties = PVE::Firewall::add_rule_properties($properties);
146 $create_rule_properties->{action}->{optional} = 0;
147 $create_rule_properties->{type}->{optional} = 0;
148
149 $class->register_method({
150 name => 'create_rule',
151 path => '',
152 method => 'POST',
153 description => "Create new rule.",
154 protected => 1,
155 parameters => {
156 additionalProperties => 0,
157 properties => $create_rule_properties,
158 },
159 proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
160 returns => { type => "null" },
161 code => sub {
162 my ($param) = @_;
163
164 my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
165
166 my $rule = {};
167
168 PVE::Firewall::copy_rule_data($rule, $param);
169 PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
170
171 $rule->{enable} = 0 if !defined($param->{enable});
172
173 unshift @$rules, $rule;
174
175 $class->save_rules($param, $fw_conf, $rules);
176
177 return undef;
178 }});
179 }
180
181 sub register_update_rule {
182 my ($class) = @_;
183
184 my $properties = $class->additional_parameters();
185
186 $properties->{pos} = $api_properties->{pos};
187
188 $properties->{moveto} = {
189 description => "Move rule to new position <moveto>. Other arguments are ignored.",
190 type => 'integer',
191 minimum => 0,
192 optional => 1,
193 };
194
195 $properties->{delete} = {
196 type => 'string', format => 'pve-configid-list',
197 description => "A list of settings you want to delete.",
198 optional => 1,
199 };
200
201 my $update_rule_properties = PVE::Firewall::add_rule_properties($properties);
202
203 $class->register_method({
204 name => 'update_rule',
205 path => '{pos}',
206 method => 'PUT',
207 description => "Modify rule data.",
208 protected => 1,
209 parameters => {
210 additionalProperties => 0,
211 properties => $update_rule_properties,
212 },
213 proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
214 returns => { type => "null" },
215 code => sub {
216 my ($param) = @_;
217
218 my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
219
220 my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
221 PVE::Tools::assert_if_modified($digest, $param->{digest});
222
223 die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
224
225 my $rule = $rules->[$param->{pos}];
226
227 my $moveto = $param->{moveto};
228 if (defined($moveto) && $moveto != $param->{pos}) {
229 my $newrules = [];
230 for (my $i = 0; $i < scalar(@$rules); $i++) {
231 next if $i == $param->{pos};
232 if ($i == $moveto) {
233 push @$newrules, $rule;
234 }
235 push @$newrules, $rules->[$i];
236 }
237 push @$newrules, $rule if $moveto >= scalar(@$rules);
238 $rules = $newrules;
239 } else {
240 PVE::Firewall::copy_rule_data($rule, $param);
241
242 PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
243
244 PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
245 }
246
247 $class->save_rules($param, $fw_conf, $rules);
248
249 return undef;
250 }});
251 }
252
253 sub register_delete_rule {
254 my ($class) = @_;
255
256 my $properties = $class->additional_parameters();
257
258 $properties->{pos} = $api_properties->{pos};
259
260 $properties->{digest} = get_standard_option('pve-config-digest');
261
262 $class->register_method({
263 name => 'delete_rule',
264 path => '{pos}',
265 method => 'DELETE',
266 description => "Delete rule.",
267 protected => 1,
268 parameters => {
269 additionalProperties => 0,
270 properties => $properties,
271 },
272 proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
273 returns => { type => "null" },
274 code => sub {
275 my ($param) = @_;
276
277 my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
278
279 my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
280 PVE::Tools::assert_if_modified($digest, $param->{digest});
281
282 die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
283
284 splice(@$rules, $param->{pos}, 1);
285
286 $class->save_rules($param, $fw_conf, $rules);
287
288 return undef;
289 }});
290 }
291
292 sub register_handlers {
293 my ($class) = @_;
294
295 $class->register_get_rules();
296 $class->register_get_rule();
297 $class->register_create_rule();
298 $class->register_update_rule();
299 $class->register_delete_rule();
300 }
301
302 package PVE::API2::Firewall::GroupRules;
303
304 use strict;
305 use warnings;
306 use PVE::JSONSchema qw(get_standard_option);
307
308 use base qw(PVE::API2::Firewall::RulesBase);
309
310 __PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });
311
312
313 sub rule_env {
314 my ($class, $param) = @_;
315
316 return 'group';
317 }
318
319 sub load_config {
320 my ($class, $param) = @_;
321
322 my $fw_conf = PVE::Firewall::load_clusterfw_conf();
323 my $rules = $fw_conf->{groups}->{$param->{group}};
324 die "no such security group '$param->{group}'\n" if !defined($rules);
325
326 return (undef, $fw_conf, $rules);
327 }
328
329 sub save_rules {
330 my ($class, $param, $fw_conf, $rules) = @_;
331
332 if (!defined($rules)) {
333 delete $fw_conf->{groups}->{$param->{group}};
334 } else {
335 $fw_conf->{groups}->{$param->{group}} = $rules;
336 }
337
338 PVE::Firewall::save_clusterfw_conf($fw_conf);
339 }
340
341 __PACKAGE__->register_method({
342 name => 'delete_security_group',
343 path => '',
344 method => 'DELETE',
345 description => "Delete security group.",
346 protected => 1,
347 parameters => {
348 additionalProperties => 0,
349 properties => {
350 group => get_standard_option('pve-security-group-name'),
351 },
352 },
353 returns => { type => 'null' },
354 code => sub {
355 my ($param) = @_;
356
357 my (undef, $cluster_conf, $rules) = __PACKAGE__->load_config($param);
358
359 die "Security group '$param->{group}' is not empty\n"
360 if scalar(@$rules);
361
362 __PACKAGE__->save_rules($param, $cluster_conf, undef);
363
364 return undef;
365 }});
366
367 __PACKAGE__->register_handlers();
368
369 package PVE::API2::Firewall::ClusterRules;
370
371 use strict;
372 use warnings;
373
374 use base qw(PVE::API2::Firewall::RulesBase);
375
376 sub rule_env {
377 my ($class, $param) = @_;
378
379 return 'cluster';
380 }
381
382 sub load_config {
383 my ($class, $param) = @_;
384
385 my $fw_conf = PVE::Firewall::load_clusterfw_conf();
386 my $rules = $fw_conf->{rules};
387
388 return (undef, $fw_conf, $rules);
389 }
390
391 sub save_rules {
392 my ($class, $param, $fw_conf, $rules) = @_;
393
394 $fw_conf->{rules} = $rules;
395 PVE::Firewall::save_clusterfw_conf($fw_conf);
396 }
397
398 __PACKAGE__->register_handlers();
399
400 package PVE::API2::Firewall::HostRules;
401
402 use strict;
403 use warnings;
404 use PVE::JSONSchema qw(get_standard_option);
405
406 use base qw(PVE::API2::Firewall::RulesBase);
407
408 __PACKAGE__->additional_parameters({ node => get_standard_option('pve-node')});
409
410 sub rule_env {
411 my ($class, $param) = @_;
412
413 return 'host';
414 }
415
416 sub load_config {
417 my ($class, $param) = @_;
418
419 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
420 my $fw_conf = PVE::Firewall::load_hostfw_conf($cluster_conf);
421 my $rules = $fw_conf->{rules};
422
423 return ($cluster_conf, $fw_conf, $rules);
424 }
425
426 sub save_rules {
427 my ($class, $param, $fw_conf, $rules) = @_;
428
429 $fw_conf->{rules} = $rules;
430 PVE::Firewall::save_hostfw_conf($fw_conf);
431 }
432
433 __PACKAGE__->register_handlers();
434
435 package PVE::API2::Firewall::VMRules;
436
437 use strict;
438 use warnings;
439 use PVE::JSONSchema qw(get_standard_option);
440
441 use base qw(PVE::API2::Firewall::RulesBase);
442
443 __PACKAGE__->additional_parameters({
444 node => get_standard_option('pve-node'),
445 vmid => get_standard_option('pve-vmid'),
446 });
447
448 sub rule_env {
449 my ($class, $param) = @_;
450
451 return 'vm';
452 }
453
454 sub load_config {
455 my ($class, $param) = @_;
456
457 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
458 my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
459 my $rules = $fw_conf->{rules};
460
461 return ($cluster_conf, $fw_conf, $rules);
462 }
463
464 sub save_rules {
465 my ($class, $param, $fw_conf, $rules) = @_;
466
467 $fw_conf->{rules} = $rules;
468 PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
469 }
470
471 __PACKAGE__->register_handlers();
472
473 package PVE::API2::Firewall::CTRules;
474
475 use strict;
476 use warnings;
477 use PVE::JSONSchema qw(get_standard_option);
478
479 use base qw(PVE::API2::Firewall::RulesBase);
480
481 __PACKAGE__->additional_parameters({
482 node => get_standard_option('pve-node'),
483 vmid => get_standard_option('pve-vmid'),
484 });
485
486 sub rule_env {
487 my ($class, $param) = @_;
488
489 return 'ct';
490 }
491
492 sub load_config {
493 my ($class, $param) = @_;
494
495 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
496 my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
497 my $rules = $fw_conf->{rules};
498
499 return ($cluster_conf, $fw_conf, $rules);
500 }
501
502 sub save_rules {
503 my ($class, $param, $fw_conf, $rules) = @_;
504
505 $fw_conf->{rules} = $rules;
506 PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
507 }
508
509 __PACKAGE__->register_handlers();
510
511 1;