src/PVE/API2/Firewall/VM.pm

   1 package PVE::API2::Firewall::VMBase;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::Exception qw(raise_param_exc);
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Cluster;
   9 use PVE::Firewall;
  10 use PVE::API2::Firewall::Rules;
  11 use PVE::API2::Firewall::Aliases;
  12
  13
  14 use base qw(PVE::RESTHandler);
  15
  16 my $option_properties = $PVE::Firewall::vm_option_properties;
  17
  18 my $add_option_properties = sub {
  19     my ($properties) = @_;
  20
  21     foreach my $k (keys %$option_properties) {
  22         $properties->{$k} = $option_properties->{$k};
  23     }
  24
  25     return $properties;
  26 };
  27
  28 sub register_handlers {
  29     my ($class, $rule_env) = @_;
  30
  31     $class->register_method({
  32         name => 'index',
  33         path => '',
  34         method => 'GET',
  35         permissions => { user => 'all' },
  36         description => "Directory index.",
  37         parameters => {
  38             additionalProperties => 0,
  39             properties => {
  40                 node => get_standard_option('pve-node'),
  41                 vmid => get_standard_option('pve-vmid'),
  42             },
  43         },
  44         returns => {
  45             type => 'array',
  46             items => {
  47                 type => "object",
  48                 properties => {},
  49             },
  50             links => [ { rel => 'child', href => "{name}" } ],
  51         },
  52         code => sub {
  53             my ($param) = @_;
  54
  55             my $result = [
  56                 { name => 'rules' },
  57                 { name => 'aliases' },
  58                 { name => 'ipset' },
  59                 { name => 'refs' },
  60                 { name => 'options' },
  61                 ];
  62
  63             return $result;
  64         }});
  65
  66
  67     $class->register_method({
  68         name => 'get_options',
  69         path => 'options',
  70         method => 'GET',
  71         description => "Get VM firewall options.",
  72         proxyto => 'node',
  73         permissions => {
  74             check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
  75         },
  76         parameters => {
  77             additionalProperties => 0,
  78             properties => {
  79                 node => get_standard_option('pve-node'),
  80                 vmid => get_standard_option('pve-vmid'),
  81             },
  82         },
  83         returns => {
  84             type => "object",
  85             #additionalProperties => 1,
  86             properties => $option_properties,
  87         },
  88         code => sub {
  89             my ($param) = @_;
  90
  91             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
  92             my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
  93
  94             return PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
  95         }});
  96
  97     $class->register_method({
  98         name => 'set_options',
  99         path => 'options',
 100         method => 'PUT',
 101         description => "Set Firewall options.",
 102         protected => 1,
 103         proxyto => 'node',
 104         permissions => {
 105             check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]],
 106         },
 107         parameters => {
 108             additionalProperties => 0,
 109             properties => &$add_option_properties({
 110                 node => get_standard_option('pve-node'),
 111                 vmid => get_standard_option('pve-vmid'),
 112                 delete => {
 113                     type => 'string', format => 'pve-configid-list',
 114                     description => "A list of settings you want to delete.",
 115                     optional => 1,
 116                 },
 117                 digest => get_standard_option('pve-config-digest'),
 118             }),
 119         },
 120         returns => { type => "null" },
 121         code => sub {
 122             my ($param) = @_;
 123
 124             PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, sub {
 125                 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 126                 my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 127
 128                 my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
 129                 PVE::Tools::assert_if_modified($digest, $param->{digest});
 130
 131                 if ($param->{delete}) {
 132                     foreach my $opt (PVE::Tools::split_list($param->{delete})) {
 133                         raise_param_exc({ delete => "no such option '$opt'" })
 134                             if !$option_properties->{$opt};
 135                         delete $vmfw_conf->{options}->{$opt};
 136                     }
 137                 }
 138
 139                 if (defined($param->{enable})) {
 140                     $param->{enable} = $param->{enable} ? 1 : 0;
 141                 }
 142
 143                 foreach my $k (keys %$option_properties) {
 144                     next if !defined($param->{$k});
 145                     $vmfw_conf->{options}->{$k} = $param->{$k};
 146                 }
 147
 148                 PVE::Firewall::save_vmfw_conf($param->{vmid}, $vmfw_conf);
 149             });
 150
 151             return undef;
 152         }});
 153
 154     $class->register_method({
 155         name => 'log',
 156         path => 'log',
 157         method => 'GET',
 158         description => "Read firewall log",
 159         proxyto => 'node',
 160         permissions => {
 161             check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 162         },
 163         protected => 1,
 164         parameters => {
 165             additionalProperties => 0,
 166             properties => {
 167                 node => get_standard_option('pve-node'),
 168                 vmid => get_standard_option('pve-vmid'),
 169                 start => {
 170                     type => 'integer',
 171                     minimum => 0,
 172                     optional => 1,
 173                 },
 174                 limit => {
 175                     type => 'integer',
 176                     minimum => 0,
 177                     optional => 1,
 178                 },
 179                 since => {
 180                     type => 'integer',
 181                     minimum => 0,
 182                     description => "Display log since this UNIX epoch.",
 183                     optional => 1,
 184                 },
 185                 until => {
 186                     type => 'integer',
 187                     minimum => 0,
 188                     description => "Display log until this UNIX epoch.",
 189                     optional => 1,
 190                 },
 191             },
 192         },
 193         returns => {
 194             type => 'array',
 195             items => {
 196                 type => "object",
 197                 properties => {
 198                     n => {
 199                         description=>  "Line number",
 200                         type=> 'integer',
 201                     },
 202                     t => {
 203                         description=>  "Line text",
 204                         type => 'string',
 205                     }
 206                 }
 207             }
 208         },
 209         code => sub {
 210             my ($param) = @_;
 211
 212             my $rpcenv = PVE::RPCEnvironment::get();
 213             my $user = $rpcenv->get_user();
 214             my $filename = "/var/log/pve-firewall.log";
 215             my $vmid = $param->{'vmid'};
 216
 217             my $callback = sub {
 218                 my ($line) = @_;
 219                 my $reg = "^$vmid ";
 220                 return $line =~ m/$reg/;
 221             };
 222
 223             my ($count, $lines) = PVE::Firewall::Helpers::dump_fw_logfile(
 224                 $filename, $param, $callback);
 225
 226             $rpcenv->set_result_attrib('total', $count);
 227
 228             return $lines;
 229         }});
 230
 231
 232     $class->register_method({
 233         name => 'refs',
 234         path => 'refs',
 235         method => 'GET',
 236         description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
 237         permissions => {
 238             check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 239         },
 240         parameters => {
 241             additionalProperties => 0,
 242             properties => {
 243                 node => get_standard_option('pve-node'),
 244                 vmid => get_standard_option('pve-vmid'),
 245                 type => {
 246                     description => "Only list references of specified type.",
 247                     type => 'string',
 248                     enum => ['alias', 'ipset'],
 249                     optional => 1,
 250                 },
 251             },
 252         },
 253         returns => {
 254             type => 'array',
 255             items => {
 256                 type => "object",
 257                 properties => {
 258                     type => {
 259                         type => 'string',
 260                         enum => ['alias', 'ipset'],
 261                     },
 262                     name => {
 263                         type => 'string',
 264                     },
 265                     ref => {
 266                         type => 'string',
 267                     },
 268                     scope => {
 269                         type => 'string',
 270                     },
 271                     comment => {
 272                         type => 'string',
 273                         optional => 1,
 274                     },
 275                 },
 276             },
 277         },
 278         code => sub {
 279             my ($param) = @_;
 280
 281             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 282             my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 283
 284             my $dc_refs = PVE::Firewall::Helpers::collect_refs($cluster_conf, $param->{type}, 'dc');
 285             my $vm_refs = PVE::Firewall::Helpers::collect_refs($fw_conf, $param->{type}, 'guest');
 286
 287             return [@$dc_refs, @$vm_refs];
 288         }});
 289 }
 290
 291 package PVE::API2::Firewall::VM;
 292
 293 use strict;
 294 use warnings;
 295
 296 use base qw(PVE::API2::Firewall::VMBase);
 297
 298 __PACKAGE__->register_method ({
 299     subclass => "PVE::API2::Firewall::VMRules",
 300     path => 'rules',
 301 });
 302
 303 __PACKAGE__->register_method ({
 304     subclass => "PVE::API2::Firewall::VMAliases",
 305     path => 'aliases',
 306 });
 307
 308 __PACKAGE__->register_method ({
 309     subclass => "PVE::API2::Firewall::VMIPSetList",
 310     path => 'ipset',
 311 });
 312
 313 __PACKAGE__->register_handlers('vm');
 314
 315 package PVE::API2::Firewall::CT;
 316
 317 use strict;
 318 use warnings;
 319
 320 use base qw(PVE::API2::Firewall::VMBase);
 321
 322 __PACKAGE__->register_method ({
 323     subclass => "PVE::API2::Firewall::CTRules",
 324     path => 'rules',
 325 });
 326
 327 __PACKAGE__->register_method ({
 328     subclass => "PVE::API2::Firewall::CTAliases",
 329     path => 'aliases',
 330 });
 331
 332 __PACKAGE__->register_method ({
 333     subclass => "PVE::API2::Firewall::CTIPSetList",
 334     path => 'ipset',
 335 });
 336
 337 __PACKAGE__->register_handlers('vm');
 338
 339 1;