src/PVE/API2/Firewall/Rules.pm

   1 package PVE::API2::Firewall::RulesBase;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::JSONSchema qw(get_standard_option);
   6 use PVE::Exception qw(raise raise_param_exc);
   7
   8 use PVE::Firewall;
   9
  10 use base qw(PVE::RESTHandler);
  11
  12 my $api_properties = {
  13     pos => {
  14         description => "Rule position.",
  15         type => 'integer',
  16         minimum => 0,
  17     },
  18 };
  19
  20 sub lock_config {
  21     my ($class, $param, $code) = @_;
  22
  23     die "implement this in subclass";
  24 }
  25
  26 sub load_config {
  27     my ($class, $param) = @_;
  28
  29     die "implement this in subclass";
  30
  31     #return ($cluster_conf, $fw_conf, $rules);
  32 }
  33
  34 sub save_rules {
  35     my ($class, $param, $fw_conf, $rules) = @_;
  36
  37     die "implement this in subclass";
  38 }
  39
  40 my $additional_param_hash = {};
  41
  42 sub rule_env {
  43     my ($class, $param) = @_;
  44
  45     die "implement this in subclass";
  46 }
  47
  48 sub additional_parameters {
  49     my ($class, $new_value) = @_;
  50
  51     if (defined($new_value)) {
  52         $additional_param_hash->{$class} = $new_value;
  53     }
  54
  55     # return a copy
  56     my $copy = {};
  57     my $org = $additional_param_hash->{$class} || {};
  58     foreach my $p (keys %$org) { $copy->{$p} = $org->{$p}; }
  59     return $copy;
  60 }
  61
  62 sub register_get_rules {
  63     my ($class) = @_;
  64
  65     my $properties = $class->additional_parameters();
  66
  67     my $rule_env = $class->rule_env();
  68
  69     $class->register_method({
  70         name => 'get_rules',
  71         path => '',
  72         method => 'GET',
  73         description => "List rules.",
  74         permissions => PVE::Firewall::rules_audit_permissions($rule_env),
  75         parameters => {
  76             additionalProperties => 0,
  77             properties => $properties,
  78         },
  79         proxyto => $rule_env eq 'host' ? 'node' : undef,
  80         returns => {
  81             type => 'array',
  82             items => {
  83                 type => "object",
  84                 properties => {
  85                     pos => {
  86                         type => 'integer',
  87                     }
  88                 },
  89             },
  90             links => [ { rel => 'child', href => "{pos}" } ],
  91         },
  92         code => sub {
  93             my ($param) = @_;
  94
  95             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
  96
  97             my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
  98
  99             my $ind = 0;
 100             foreach my $rule (@$list) {
 101                 $rule->{pos} = $ind++;
 102             }
 103
 104             return $list;
 105         }});
 106 }
 107
 108 sub register_get_rule {
 109     my ($class) = @_;
 110
 111     my $properties = $class->additional_parameters();
 112
 113     $properties->{pos} = $api_properties->{pos};
 114
 115     my $rule_env = $class->rule_env();
 116
 117     $class->register_method({
 118         name => 'get_rule',
 119         path => '{pos}',
 120         method => 'GET',
 121         description => "Get single rule data.",
 122         permissions => PVE::Firewall::rules_audit_permissions($rule_env),
 123         parameters => {
 124             additionalProperties => 0,
 125             properties => $properties,
 126         },
 127         proxyto => $rule_env eq 'host' ? 'node' : undef,
 128         returns => {
 129             type => "object",
 130             properties => {
 131                 action => {
 132                     type => 'string',
 133                 },
 134                 comment => {
 135                     type => 'string',
 136                     optional => 1,
 137                 },
 138                 dest => {
 139                     type => 'string',
 140                     optional => 1,
 141                 },
 142                 dport => {
 143                     type => 'string',
 144                     optional => 1,
 145                 },
 146                 enable => {
 147                     type => 'integer',
 148                     optional => 1,
 149                 },
 150                 log => PVE::Firewall::get_standard_option('pve-fw-loglevel', {
 151                     description => 'Log level for firewall rule',
 152                 }),
 153                 iface => {
 154                     type => 'string',
 155                     optional => 1,
 156                 },
 157                 ipversion => {
 158                     type => 'integer',
 159                     optional => 1,
 160                 },
 161                 macro => {
 162                     type => 'string',
 163                     optional => 1,
 164                 },
 165                 pos => {
 166                     type => 'integer',
 167                 },
 168                 proto => {
 169                     type => 'string',
 170                     optional => 1,
 171                 },
 172                 source => {
 173                     type => 'string',
 174                     optional => 1,
 175                 },
 176                 sport => {
 177                     type => 'string',
 178                     optional => 1,
 179                 },
 180                 type => {
 181                     type => 'string',
 182                 },
 183             },
 184         },
 185         code => sub {
 186             my ($param) = @_;
 187
 188             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 189
 190             my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 191
 192             die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$list);
 193
 194             my $rule = $list->[$param->{pos}];
 195             $rule->{pos} = $param->{pos};
 196
 197             return $rule;
 198         }});
 199 }
 200
 201 sub register_create_rule {
 202     my ($class) = @_;
 203
 204     my $properties = $class->additional_parameters();
 205
 206     my $create_rule_properties = PVE::Firewall::add_rule_properties($properties);
 207     $create_rule_properties->{action}->{optional} = 0;
 208     $create_rule_properties->{type}->{optional} = 0;
 209
 210     my $rule_env = $class->rule_env();
 211
 212     $class->register_method({
 213         name => 'create_rule',
 214         path => '',
 215         method => 'POST',
 216         description => "Create new rule.",
 217         protected => 1,
 218         permissions => PVE::Firewall::rules_modify_permissions($rule_env),
 219         parameters => {
 220             additionalProperties => 0,
 221             properties => $create_rule_properties,
 222         },
 223         proxyto => $rule_env eq 'host' ? 'node' : undef,
 224         returns => { type => "null" },
 225         code => sub {
 226             my ($param) = @_;
 227
 228             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 229
 230             my $rule = {};
 231
 232             PVE::Firewall::copy_rule_data($rule, $param);
 233             PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
 234
 235             $rule->{enable} = 0 if !defined($param->{enable});
 236
 237             unshift @$rules, $rule;
 238
 239             $class->save_rules($param, $fw_conf, $rules);
 240
 241             return undef;
 242         }});
 243 }
 244
 245 sub register_update_rule {
 246     my ($class) = @_;
 247
 248     my $properties = $class->additional_parameters();
 249
 250     $properties->{pos} = $api_properties->{pos};
 251
 252     my $rule_env = $class->rule_env();
 253
 254     $properties->{moveto} = {
 255         description => "Move rule to new position <moveto>. Other arguments are ignored.",
 256         type => 'integer',
 257         minimum => 0,
 258         optional => 1,
 259     };
 260
 261     $properties->{delete} = {
 262         type => 'string', format => 'pve-configid-list',
 263         description => "A list of settings you want to delete.",
 264         optional => 1,
 265     };
 266
 267     my $update_rule_properties = PVE::Firewall::add_rule_properties($properties);
 268
 269     $class->register_method({
 270         name => 'update_rule',
 271         path => '{pos}',
 272         method => 'PUT',
 273         description => "Modify rule data.",
 274         protected => 1,
 275         permissions => PVE::Firewall::rules_modify_permissions($rule_env),
 276         parameters => {
 277             additionalProperties => 0,
 278             properties => $update_rule_properties,
 279         },
 280         proxyto => $rule_env eq 'host' ? 'node' : undef,
 281         returns => { type => "null" },
 282         code => sub {
 283             my ($param) = @_;
 284
 285             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 286
 287             my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 288             PVE::Tools::assert_if_modified($digest, $param->{digest});
 289
 290             die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
 291
 292             my $rule = $rules->[$param->{pos}];
 293
 294             my $moveto = $param->{moveto};
 295             if (defined($moveto) && $moveto != $param->{pos}) {
 296                 my $newrules = [];
 297                 for (my $i = 0; $i < scalar(@$rules); $i++) {
 298                     next if $i == $param->{pos};
 299                     if ($i == $moveto) {
 300                         push @$newrules, $rule;
 301                     }
 302                     push @$newrules, $rules->[$i];
 303                 }
 304                 push @$newrules, $rule if $moveto >= scalar(@$rules);
 305                 $rules = $newrules;
 306             } else {
 307                 PVE::Firewall::copy_rule_data($rule, $param);
 308
 309                 PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
 310
 311                 PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
 312             }
 313
 314             $class->save_rules($param, $fw_conf, $rules);
 315
 316             return undef;
 317         }});
 318 }
 319
 320 sub register_delete_rule {
 321     my ($class) = @_;
 322
 323     my $properties = $class->additional_parameters();
 324
 325     $properties->{pos} = $api_properties->{pos};
 326
 327     $properties->{digest} = get_standard_option('pve-config-digest');
 328
 329     my $rule_env = $class->rule_env();
 330
 331     $class->register_method({
 332         name => 'delete_rule',
 333         path => '{pos}',
 334         method => 'DELETE',
 335         description => "Delete rule.",
 336         protected => 1,
 337         permissions => PVE::Firewall::rules_modify_permissions($rule_env),
 338         parameters => {
 339             additionalProperties => 0,
 340             properties => $properties,
 341         },
 342         proxyto => $rule_env eq 'host' ? 'node' : undef,
 343         returns => { type => "null" },
 344         code => sub {
 345             my ($param) = @_;
 346
 347             my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 348
 349             my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 350             PVE::Tools::assert_if_modified($digest, $param->{digest});
 351
 352             die "no rule at position $param->{pos}\n" if $param->{pos} >= scalar(@$rules);
 353
 354             splice(@$rules, $param->{pos}, 1);
 355
 356             $class->save_rules($param, $fw_conf, $rules);
 357
 358             return undef;
 359         }});
 360 }
 361
 362 sub register_handlers {
 363     my ($class) = @_;
 364
 365     $class->register_get_rules();
 366     $class->register_get_rule();
 367     $class->register_create_rule();
 368     $class->register_update_rule();
 369     $class->register_delete_rule();
 370 }
 371
 372 package PVE::API2::Firewall::GroupRules;
 373
 374 use strict;
 375 use warnings;
 376 use PVE::JSONSchema qw(get_standard_option);
 377
 378 use base qw(PVE::API2::Firewall::RulesBase);
 379
 380 __PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });
 381
 382
 383 sub rule_env {
 384     my ($class, $param) = @_;
 385
 386     return 'group';
 387 }
 388
 389 sub lock_config {
 390     my ($class, $param, $code) = @_;
 391
 392     PVE::Firewall::lock_clusterfw_conf(10, $code, $param);
 393 }
 394
 395 sub load_config {
 396     my ($class, $param) = @_;
 397
 398     my $fw_conf = PVE::Firewall::load_clusterfw_conf();
 399     my $rules = $fw_conf->{groups}->{$param->{group}};
 400     die "no such security group '$param->{group}'\n" if !defined($rules);
 401
 402     return (undef, $fw_conf, $rules);
 403 }
 404
 405 sub save_rules {
 406     my ($class, $param, $fw_conf, $rules) = @_;
 407
 408     if (!defined($rules)) {
 409         delete $fw_conf->{groups}->{$param->{group}};
 410     } else {
 411         $fw_conf->{groups}->{$param->{group}} = $rules;
 412     }
 413
 414     PVE::Firewall::save_clusterfw_conf($fw_conf);
 415 }
 416
 417 __PACKAGE__->register_method({
 418     name => 'delete_security_group',
 419     path => '',
 420     method => 'DELETE',
 421     description => "Delete security group.",
 422     protected => 1,
 423     permissions => {
 424         check => ['perm', '/', [ 'Sys.Modify' ]],
 425     },
 426     parameters => {
 427         additionalProperties => 0,
 428         properties => {
 429             group => get_standard_option('pve-security-group-name'),
 430         },
 431     },
 432     returns => { type => 'null' },
 433     code => sub {
 434         my ($param) = @_;
 435
 436         my (undef, $cluster_conf, $rules) = __PACKAGE__->load_config($param);
 437
 438         die "Security group '$param->{group}' is not empty\n"
 439             if scalar(@$rules);
 440
 441         __PACKAGE__->save_rules($param, $cluster_conf, undef);
 442
 443         return undef;
 444     }});
 445
 446 __PACKAGE__->register_handlers();
 447
 448 package PVE::API2::Firewall::ClusterRules;
 449
 450 use strict;
 451 use warnings;
 452
 453 use base qw(PVE::API2::Firewall::RulesBase);
 454
 455 sub rule_env {
 456     my ($class, $param) = @_;
 457
 458     return 'cluster';
 459 }
 460
 461 sub lock_config {
 462     my ($class, $param, $code) = @_;
 463
 464     PVE::Firewall::lock_clusterfw_conf(10, $code, $param);
 465 }
 466
 467 sub load_config {
 468     my ($class, $param) = @_;
 469
 470     my $fw_conf = PVE::Firewall::load_clusterfw_conf();
 471     my $rules = $fw_conf->{rules};
 472
 473     return (undef, $fw_conf, $rules);
 474 }
 475
 476 sub save_rules {
 477     my ($class, $param, $fw_conf, $rules) = @_;
 478
 479     $fw_conf->{rules} = $rules;
 480     PVE::Firewall::save_clusterfw_conf($fw_conf);
 481 }
 482
 483 __PACKAGE__->register_handlers();
 484
 485 package PVE::API2::Firewall::HostRules;
 486
 487 use strict;
 488 use warnings;
 489 use PVE::JSONSchema qw(get_standard_option);
 490
 491 use base qw(PVE::API2::Firewall::RulesBase);
 492
 493 __PACKAGE__->additional_parameters({ node => get_standard_option('pve-node')});
 494
 495 sub rule_env {
 496     my ($class, $param) = @_;
 497
 498     return 'host';
 499 }
 500
 501 sub lock_config {
 502     my ($class, $param, $code) = @_;
 503
 504     PVE::Firewall::lock_hostfw_conf(10, $code, $param);
 505 }
 506
 507 sub load_config {
 508     my ($class, $param) = @_;
 509
 510     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 511     my $fw_conf = PVE::Firewall::load_hostfw_conf($cluster_conf);
 512     my $rules = $fw_conf->{rules};
 513
 514     return ($cluster_conf, $fw_conf, $rules);
 515 }
 516
 517 sub save_rules {
 518     my ($class, $param, $fw_conf, $rules) = @_;
 519
 520     $fw_conf->{rules} = $rules;
 521     PVE::Firewall::save_hostfw_conf($fw_conf);
 522 }
 523
 524 __PACKAGE__->register_handlers();
 525
 526 package PVE::API2::Firewall::VMRules;
 527
 528 use strict;
 529 use warnings;
 530 use PVE::JSONSchema qw(get_standard_option);
 531
 532 use base qw(PVE::API2::Firewall::RulesBase);
 533
 534 __PACKAGE__->additional_parameters({
 535     node => get_standard_option('pve-node'),
 536     vmid => get_standard_option('pve-vmid'),
 537 });
 538
 539 sub rule_env {
 540     my ($class, $param) = @_;
 541
 542     return 'vm';
 543 }
 544
 545 sub lock_config {
 546     my ($class, $param, $code) = @_;
 547
 548     PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, $code, $param);
 549 }
 550
 551 sub load_config {
 552     my ($class, $param) = @_;
 553
 554     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 555     my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
 556     my $rules = $fw_conf->{rules};
 557
 558     return ($cluster_conf, $fw_conf, $rules);
 559 }
 560
 561 sub save_rules {
 562     my ($class, $param, $fw_conf, $rules) = @_;
 563
 564     $fw_conf->{rules} = $rules;
 565     PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
 566 }
 567
 568 __PACKAGE__->register_handlers();
 569
 570 package PVE::API2::Firewall::CTRules;
 571
 572 use strict;
 573 use warnings;
 574 use PVE::JSONSchema qw(get_standard_option);
 575
 576 use base qw(PVE::API2::Firewall::RulesBase);
 577
 578 __PACKAGE__->additional_parameters({
 579     node => get_standard_option('pve-node'),
 580     vmid => get_standard_option('pve-vmid'),
 581 });
 582
 583 sub rule_env {
 584     my ($class, $param) = @_;
 585
 586     return 'ct';
 587 }
 588
 589 sub lock_config {
 590     my ($class, $param, $code) = @_;
 591
 592     PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, $code, $param);
 593 }
 594
 595 sub load_config {
 596     my ($class, $param) = @_;
 597
 598     my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 599     my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
 600     my $rules = $fw_conf->{rules};
 601
 602     return ($cluster_conf, $fw_conf, $rules);
 603 }
 604
 605 sub save_rules {
 606     my ($class, $param, $fw_conf, $rules) = @_;
 607
 608     $fw_conf->{rules} = $rules;
 609     PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
 610 }
 611
 612 __PACKAGE__->register_handlers();
 613
 614 1;