src/PVE/API2/Firewall/Rules.pm

   1 package PVE::API2::Firewall::RulesBase;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::JSONSchema qw(get_standard_option);
   6 use PVE::Exception qw(raise raise_param_exc);
   7
   8 use PVE::Firewall;
   9
  10 use base qw(PVE::RESTHandler);
  11
  12 my $api_properties = {
  13     pos => {
  14         description => "Rule position.",
  15         type => 'integer',
  16         minimum => 0,
  17     },
  18 };
  19
  20 sub load_config {
  21     my ($class, $param) = @_;
  22
  23     die "implement this in subclass";
  24
  25     #return ($cluster_conf, $fw_conf, $rules);
  26 }
  27
  28 sub save_rules {
  29     my ($class, $param, $fw_conf, $rules) = @_;
  30
  31     die "implement this in subclass";
  32 }
  33
  34 my $additional_param_hash = {};
  35
  36 sub rule_env {
  37     my ($class, $param) = @_;
  38
  39     die "implement this in subclass";
  40 }
  41
  42 sub additional_parameters {
  43     my ($class, $new_value) = @_;
  44
  45     if (defined($new_value)) {
  46         $additional_param_hash->{$class} = $new_value;
  47     }
  48
  49     # return a copy
  50     my $copy = {};
  51     my $org = $additional_param_hash->{$class} || {};
  52     foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
  53     return $copy;
  54 }
  55
  56 sub register_get_rules {
  57     my ($class) = @_;
  58
  59     my $properties = $class->additional_parameters();
  60
  61     $class->register_method({
  62         name => 'get_rules',
  63         path => '',
  64         method => 'GET',
  65         description => "List rules.",
  66         parameters => {
  67             additionalProperties => 0,
  68             properties => $properties,
  69         },
  70         returns => {
  71             type => 'array',
  72             items => {
  73                 type => "object",
  74                 properties => {
  75                     pos => {
  76                         type => 'integer',
  77                     }
  78                 },
  79             },
  80             links => [ { rel => 'child', href => "{pos}" } ],
  81         },
  82         code => sub {
  83             my ($param) = @_;
  84
  85             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
  86
  87             my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
  88
  89             my $ind = 0;
  90             foreach my $rule (@$list) {
  91                 $rule->{pos} = $ind++;
  92             }
  93
  94             return $list;
  95         }});
  96 }
  97
  98 sub register_get_rule {
  99     my ($class) = @_;
 100
 101     my $properties = $class->additional_parameters();
 102
 103     $properties->{pos} = $api_properties->{pos};
 104
 105     $class->register_method({
 106         name => 'get_rule',
 107         path => '{pos}',
 108         method => 'GET',
 109         description => "Get single rule data.",
 110         parameters => {
 111             additionalProperties => 0,
 112             properties => $properties,
 113         },
 114         returns => {
 115             type => "object",
 116             properties => {
 117                 pos => {
 118                     type => 'integer',
 119                 }
 120             },
 121         },
 122         code => sub {
 123             my ($param) = @_;
 124
 125             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 126
 127             my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 128
 129             die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$list);
 130
 131             my $rule = $list->[$param->{pos}];
 132             $rule->{pos} = $param->{pos};
 133
 134             return $rule;
 135         }});
 136 }
 137
 138 sub register_create_rule {
 139     my ($class) = @_;
 140
 141     my $properties = $class->additional_parameters();
 142
 143     my $create_rule_properties = PVE::Firewall::add_rule_properties($properties);
 144     $create_rule_properties->{action}->{optional} = 0;
 145     $create_rule_properties->{type}->{optional} = 0;
 146
 147     $class->register_method({
 148         name => 'create_rule',
 149         path => '',
 150         method => 'POST',
 151         description => "Create new rule.",
 152         protected => 1,
 153         parameters => {
 154             additionalProperties => 0,
 155             properties => $create_rule_properties,
 156         },
 157         returns => { type => "null" },
 158         code => sub {
 159             my ($param) = @_;
 160
 161             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 162
 163             my $rule = {};
 164
 165             PVE::Firewall::copy_rule_data($rule, $param);
 166             PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
 167
 168             $rule->{enable} = 0 if !defined($param->{enable});
 169
 170             unshift @$rules, $rule;
 171
 172             $class->save_rules($param, $fw_conf, $rules);
 173
 174             return undef;
 175         }});
 176 }
 177
 178 sub register_update_rule {
 179     my ($class) = @_;
 180
 181     my $properties = $class->additional_parameters();
 182
 183     $properties->{pos} = $api_properties->{pos};
 184
 185     $properties->{moveto} = {
 186         description => "Move rule to new position <moveto>. Other arguments are ignored.",
 187         type => 'integer',
 188         minimum => 0,
 189         optional => 1,
 190     };
 191
 192     $properties->{delete} = {
 193         type => 'string', format => 'pve-configid-list',
 194         description => "A list of settings you want to delete.",
 195         optional => 1,
 196     };
 197
 198     my $update_rule_properties = PVE::Firewall::add_rule_properties($properties);
 199
 200     $class->register_method({
 201         name => 'update_rule',
 202         path => '{pos}',
 203         method => 'PUT',
 204         description => "Modify rule data.",
 205         protected => 1,
 206         parameters => {
 207             additionalProperties => 0,
 208             properties => $update_rule_properties,
 209         },
 210         returns => { type => "null" },
 211         code => sub {
 212             my ($param) = @_;
 213
 214             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 215
 216             my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 217             PVE::Tools::assert_if_modified($digest, $param->{digest});
 218
 219             die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
 220
 221             my $rule = $rules->[$param->{pos}];
 222
 223             my $moveto = $param->{moveto};
 224             if (defined($moveto) && $moveto != $param->{pos}) {
 225                 my $newrules = [];
 226                 for (my $i = 0; $i < scalar(@$rules); $i++) {
 227                     next if $i == $param->{pos};
 228                     if ($i == $moveto) {
 229                         push @$newrules, $rule;
 230                     }
 231                     push @$newrules, $rules->[$i];
 232                 }
 233                 push @$newrules, $rule if $moveto >= scalar(@$rules);
 234                 $rules = $newrules;
 235             } else {
 236                 PVE::Firewall::copy_rule_data($rule, $param);
 237
 238                 PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
 239
 240                 PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
 241             }
 242
 243             $class->save_rules($param, $fw_conf, $rules);
 244
 245             return undef;
 246         }});
 247 }
 248
 249 sub register_delete_rule {
 250     my ($class) = @_;
 251
 252     my $properties = $class->additional_parameters();
 253
 254     $properties->{pos} = $api_properties->{pos};
 255
 256     $properties->{digest} = get_standard_option('pve-config-digest');
 257
 258     $class->register_method({
 259         name => 'delete_rule',
 260         path => '{pos}',
 261         method => 'DELETE',
 262         description => "Delete rule.",
 263         protected => 1,
 264         parameters => {
 265             additionalProperties => 0,
 266             properties => $properties,
 267         },
 268         returns => { type => "null" },
 269         code => sub {
 270             my ($param) = @_;
 271
 272             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 273
 274             my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 275             PVE::Tools::assert_if_modified($digest, $param->{digest});
 276
 277             die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
 278
 279             splice(@$rules, $param->{pos}, 1);
 280
 281             $class->save_rules($param, $fw_conf, $rules);
 282
 283             return undef;
 284         }});
 285 }
 286
 287 sub register_handlers {
 288     my ($class) = @_;
 289
 290     $class->register_get_rules();
 291     $class->register_get_rule();
 292     $class->register_create_rule();
 293     $class->register_update_rule();
 294     $class->register_delete_rule();
 295 }
 296
 297 package PVE::API2::Firewall::GroupRules;
 298
 299 use strict;
 300 use warnings;
 301 use PVE::JSONSchema qw(get_standard_option);
 302
 303 use base qw(PVE::API2::Firewall::RulesBase);
 304
 305 __PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });
 306
 307 sub rule_env {
 308     my ($class, $param) = @_;
 309
 310     return 'group';
 311 }
 312
 313 sub load_config {
 314     my ($class, $param) = @_;
 315
 316     my $fw_conf = PVE::Firewall::load_clusterfw_conf();
 317     my $rules = $fw_conf->{groups}->{$param->{group}};
 318     die "no such security group '$param->{group}'\n" if !defined($rules);
 319
 320     return (undef, $fw_conf, $rules);
 321 }
 322
 323 sub save_rules {
 324     my ($class, $param, $fw_conf, $rules) = @_;
 325
 326     $fw_conf->{groups}->{$param->{group}} = $rules;
 327     PVE::Firewall::save_clusterfw_conf($fw_conf);
 328 }
 329
 330 __PACKAGE__->register_handlers();
 331
 332 package PVE::API2::Firewall::ClusterRules;
 333
 334 use strict;
 335 use warnings;
 336
 337 use base qw(PVE::API2::Firewall::RulesBase);
 338
 339 sub rule_env {
 340     my ($class, $param) = @_;
 341
 342     return 'cluster';
 343 }
 344
 345 sub load_config {
 346     my ($class, $param) = @_;
 347
 348     my $fw_conf = PVE::Firewall::load_clusterfw_conf();
 349     my $rules = $fw_conf->{rules};
 350
 351     return (undef, $fw_conf, $rules);
 352 }
 353
 354 sub save_rules {
 355     my ($class, $param, $fw_conf, $rules) = @_;
 356
 357     $fw_conf->{rules} = $rules;
 358     PVE::Firewall::save_clusterfw_conf($fw_conf);
 359 }
 360
 361 __PACKAGE__->register_handlers();
 362
 363 package PVE::API2::Firewall::HostRules;
 364
 365 use strict;
 366 use warnings;
 367 use PVE::JSONSchema qw(get_standard_option);
 368
 369 use base qw(PVE::API2::Firewall::RulesBase);
 370
 371 __PACKAGE__->additional_parameters({ node => get_standard_option('pve-node')});
 372
 373 sub rule_env {
 374     my ($class, $param) = @_;
 375
 376     return 'host';
 377 }
 378
 379 sub load_config {
 380     my ($class, $param) = @_;
 381
 382     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 383     my $fw_conf = PVE::Firewall::load_hostfw_conf($cluster_conf);
 384     my $rules = $fw_conf->{rules};
 385
 386     return ($cluster_conf, $fw_conf, $rules);
 387 }
 388
 389 sub save_rules {
 390     my ($class, $param, $fw_conf, $rules) = @_;
 391
 392     $fw_conf->{rules} = $rules;
 393     PVE::Firewall::save_hostfw_conf($fw_conf);
 394 }
 395
 396 __PACKAGE__->register_handlers();
 397
 398 package PVE::API2::Firewall::VMRules;
 399
 400 use strict;
 401 use warnings;
 402 use PVE::JSONSchema qw(get_standard_option);
 403
 404 use base qw(PVE::API2::Firewall::RulesBase);
 405
 406 __PACKAGE__->additional_parameters({
 407     node => get_standard_option('pve-node'),
 408     vmid => get_standard_option('pve-vmid'),
 409 });
 410
 411 sub rule_env {
 412     my ($class, $param) = @_;
 413
 414     return 'vm';
 415 }
 416
 417 sub load_config {
 418     my ($class, $param) = @_;
 419
 420     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 421     my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
 422     my $rules = $fw_conf->{rules};
 423
 424     return ($cluster_conf, $fw_conf, $rules);
 425 }
 426
 427 sub save_rules {
 428     my ($class, $param, $fw_conf, $rules) = @_;
 429
 430     $fw_conf->{rules} = $rules;
 431     PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
 432 }
 433
 434 __PACKAGE__->register_handlers();
 435
 436 package PVE::API2::Firewall::CTRules;
 437
 438 use strict;
 439 use warnings;
 440 use PVE::JSONSchema qw(get_standard_option);
 441
 442 use base qw(PVE::API2::Firewall::RulesBase);
 443
 444 __PACKAGE__->additional_parameters({
 445     node => get_standard_option('pve-node'),
 446     vmid => get_standard_option('pve-vmid'),
 447 });
 448
 449 sub rule_env {
 450     my ($class, $param) = @_;
 451
 452     return 'ct';
 453 }
 454
 455 sub load_config {
 456     my ($class, $param) = @_;
 457
 458     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 459     my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
 460     my $rules = $fw_conf->{rules};
 461
 462     return ($cluster_conf, $fw_conf, $rules);
 463 }
 464
 465 sub save_rules {
 466     my ($class, $param, $fw_conf, $rules) = @_;
 467
 468     $fw_conf->{rules} = $rules;
 469     PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
 470 }
 471
 472 __PACKAGE__->register_handlers();
 473
 474 1;