src/PVE/API2/Firewall/VM.pm

   1 package PVE::API2::Firewall::VMBase;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::JSONSchema qw(get_standard_option);
   6 use PVE::Cluster;
   7 use PVE::Firewall;
   8 use PVE::API2::Firewall::Rules;
   9 use PVE::API2::Firewall::Aliases;
  10
  11 use Data::Dumper; # fixme: remove
  12
  13 use base qw(PVE::RESTHandler);
  14
  15 my $option_properties = {
  16     enable => {
  17         description => "Enable host firewall rules.",
  18         type => 'boolean',
  19         optional => 1,
  20     },
  21     macfilter => {
  22         description => "Enable/disable MAC address filter.",
  23         type => 'boolean',
  24         optional => 1,
  25     },
  26     dhcp => {
  27         description => "Enable DHCP.",
  28         type => 'boolean',
  29         optional => 1,
  30     },
  31     policy_in => {
  32         description => "Input policy.",
  33         type => 'string',
  34         optional => 1,
  35         enum => ['ACCEPT', 'REJECT', 'DROP'],
  36     },
  37     policy_out => {
  38         description => "Output policy.",
  39         type => 'string',
  40         optional => 1,
  41         enum => ['ACCEPT', 'REJECT', 'DROP'],
  42     },
  43     log_level_in =>  get_standard_option('pve-fw-loglevel', {
  44         description => "Log level for incoming traffic." }),
  45     log_level_out =>  get_standard_option('pve-fw-loglevel', {
  46         description => "Log level for outgoing traffic." }),
  47
  48 };
  49
  50 my $add_option_properties = sub {
  51     my ($properties) = @_;
  52
  53     foreach my $k (keys %$option_properties) {
  54         $properties->{$k} = $option_properties->{$k};
  55     }
  56
  57     return $properties;
  58 };
  59
  60 sub register_handlers {
  61     my ($class, $rule_env) = @_;
  62
  63     $class->register_method({
  64         name => 'index',
  65         path => '',
  66         method => 'GET',
  67         permissions => { user => 'all' },
  68         description => "Directory index.",
  69         parameters => {
  70             additionalProperties => 0,
  71             properties => {
  72                 node => get_standard_option('pve-node'),
  73                 vmid => get_standard_option('pve-vmid'),
  74             },
  75         },
  76         returns => {
  77             type => 'array',
  78             items => {
  79                 type => "object",
  80                 properties => {},
  81             },
  82             links => [ { rel => 'child', href => "{name}" } ],
  83         },
  84         code => sub {
  85             my ($param) = @_;
  86
  87             my $result = [
  88                 { name => 'rules' },
  89                 { name => 'aliases' },
  90                 { name => 'ipset' },
  91                 { name => 'refs' },
  92                 { name => 'options' },
  93                 ];
  94
  95             return $result;
  96         }});
  97
  98
  99     $class->register_method({
 100         name => 'get_options',
 101         path => 'options',
 102         method => 'GET',
 103         description => "Get VM firewall options.",
 104         proxyto => 'node',
 105         parameters => {
 106             additionalProperties => 0,
 107             properties => {
 108                 node => get_standard_option('pve-node'),
 109                 vmid => get_standard_option('pve-vmid'),
 110             },
 111         },
 112         returns => {
 113             type => "object",
 114             #additionalProperties => 1,
 115             properties => $option_properties,
 116         },
 117         code => sub {
 118             my ($param) = @_;
 119
 120             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 121             my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 122
 123             return PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
 124         }});
 125
 126     $class->register_method({
 127         name => 'set_options',
 128         path => 'options',
 129         method => 'PUT',
 130         description => "Set Firewall options.",
 131         protected => 1,
 132         proxyto => 'node',
 133         parameters => {
 134             additionalProperties => 0,
 135             properties => &$add_option_properties({
 136                 node => get_standard_option('pve-node'),
 137                 vmid => get_standard_option('pve-vmid'),
 138                 delete => {
 139                     type => 'string', format => 'pve-configid-list',
 140                     description => "A list of settings you want to delete.",
 141                     optional => 1,
 142                 },
 143                 digest => get_standard_option('pve-config-digest'),
 144             }),
 145         },
 146         returns => { type => "null" },
 147         code => sub {
 148             my ($param) = @_;
 149
 150
 151             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 152             my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 153
 154             my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
 155             PVE::Tools::assert_if_modified($digest, $param->{digest});
 156
 157             if ($param->{delete}) {
 158                 foreach my $opt (PVE::Tools::split_list($param->{delete})) {
 159                     raise_param_exc({ delete => "no such option '$opt'" })
 160                         if !$option_properties->{$opt};
 161                     delete $vmfw_conf->{options}->{$opt};
 162                 }
 163             }
 164
 165             if (defined($param->{enable})) {
 166                 $param->{enable} = $param->{enable} ? 1 : 0;
 167             }
 168
 169             foreach my $k (keys %$option_properties) {
 170                 next if !defined($param->{$k});
 171                 $vmfw_conf->{options}->{$k} = $param->{$k};
 172             }
 173
 174             PVE::Firewall::save_vmfw_conf($param->{vmid}, $vmfw_conf);
 175
 176             return undef;
 177         }});
 178
 179     $class->register_method({
 180         name => 'log',
 181         path => 'log',
 182         method => 'GET',
 183         description => "Read firewall log",
 184         proxyto => 'node',
 185         permissions => {
 186             check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 187         },
 188         protected => 1,
 189         parameters => {
 190             additionalProperties => 0,
 191             properties => {
 192                 node => get_standard_option('pve-node'),
 193                 vmid => get_standard_option('pve-vmid'),
 194                 start => {
 195                     type => 'integer',
 196                     minimum => 0,
 197                     optional => 1,
 198                 },
 199                 limit => {
 200                     type => 'integer',
 201                     minimum => 0,
 202                     optional => 1,
 203                 },
 204             },
 205         },
 206         returns => {
 207             type => 'array',
 208             items => {
 209                 type => "object",
 210                 properties => {
 211                     n => {
 212                         description=>  "Line number",
 213                         type=> 'integer',
 214                     },
 215                     t => {
 216                         description=>  "Line text",
 217                         type => 'string',
 218                     }
 219                 }
 220             }
 221         },
 222         code => sub {
 223             my ($param) = @_;
 224
 225             my $rpcenv = PVE::RPCEnvironment::get();
 226             my $user = $rpcenv->get_user();
 227             my $vmid = $param->{vmid};
 228
 229             my ($count, $lines) = PVE::Tools::dump_logfile("/var/log/pve-firewall.log",
 230                                                            $param->{start}, $param->{limit},
 231                                                            "^$vmid ");
 232
 233             $rpcenv->set_result_attrib('total', $count);
 234
 235             return $lines;
 236         }});
 237
 238
 239     $class->register_method({
 240         name => 'refs',
 241         path => 'refs',
 242         method => 'GET',
 243         description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
 244         parameters => {
 245             additionalProperties => 0,
 246             properties => {
 247                 node => get_standard_option('pve-node'),
 248                 vmid => get_standard_option('pve-vmid'),
 249             },
 250         },
 251         returns => {
 252             type => 'array',
 253             items => {
 254                 type => "object",
 255                 properties => {
 256                     type => {
 257                         type => 'string',
 258                         enum => ['alias', 'ipset'],
 259                     },
 260                     name => {
 261                         type => 'string',
 262                     },
 263                     comment => {
 264                         type => 'string',
 265                         optional => 1,
 266                     },
 267                 },
 268             },
 269         },
 270         code => sub {
 271             my ($param) = @_;
 272
 273             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 274             my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 275
 276             my $ipsets = {};
 277             my $aliases = {};
 278
 279             foreach my $conf (($cluster_conf, $fw_conf)) {
 280                 next if !$conf;
 281                 foreach my $name (keys %{$conf->{ipset}}) {
 282                     my $data = {
 283                         type => 'ipset',
 284                         name => $name,
 285                         ref => "+$name",
 286                     };
 287                     if (my $comment = $conf->{ipset_comments}->{$name}) {
 288                         $data->{comment} = $comment;
 289                     }
 290                     $ipsets->{$name} = $data;
 291                 }
 292
 293                 foreach my $name (keys %{$conf->{aliases}}) {
 294                     my $e = $conf->{aliases}->{$name};
 295                     my $data = {
 296                         type => 'alias',
 297                         name => $name,
 298                         ref => $name,
 299                     };
 300                     $data->{comment} = $e->{comment} if $e->{comment};
 301                     $aliases->{$name} = $data;
 302                 }
 303             }
 304
 305             my $res = [];
 306             foreach my $e (values %$ipsets) { push @$res, $e; };
 307             foreach my $e (values %$aliases) { push @$res, $e; };
 308
 309             return $res;
 310         }});
 311 }
 312
 313 package PVE::API2::Firewall::VM;
 314
 315 use strict;
 316 use warnings;
 317
 318 use base qw(PVE::API2::Firewall::VMBase);
 319
 320 __PACKAGE__->register_method ({
 321     subclass => "PVE::API2::Firewall::VMRules",
 322     path => 'rules',
 323 });
 324
 325 __PACKAGE__->register_method ({
 326     subclass => "PVE::API2::Firewall::VMAliases",
 327     path => 'aliases',
 328 });
 329
 330 __PACKAGE__->register_method ({
 331     subclass => "PVE::API2::Firewall::VMIPSetList",
 332     path => 'ipset',
 333 });
 334
 335 __PACKAGE__->register_handlers('vm');
 336
 337 package PVE::API2::Firewall::CT;
 338
 339 use strict;
 340 use warnings;
 341
 342 use base qw(PVE::API2::Firewall::VMBase);
 343
 344 __PACKAGE__->register_method ({
 345     subclass => "PVE::API2::Firewall::CTRules",
 346     path => 'rules',
 347 });
 348
 349 __PACKAGE__->register_method ({
 350     subclass => "PVE::API2::Firewall::CTAliases",
 351     path => 'aliases',
 352 });
 353
 354 __PACKAGE__->register_method ({
 355     subclass => "PVE::API2::Firewall::CTIPSetList",
 356     path => 'ipset',
 357 });
 358
 359 __PACKAGE__->register_handlers('vm');
 360
 361 1;