fix #967: source: dest: limit length
[pve-firewall.git] / src / PVE / API2 / Firewall / VM.pm
1 package PVE::API2::Firewall::VMBase;
2
3 use strict;
4 use warnings;
5
6 use PVE::Exception qw(raise_param_exc);
7 use PVE::JSONSchema qw(get_standard_option);
8 use PVE::Cluster;
9 use PVE::Firewall;
10 use PVE::API2::Firewall::Rules;
11 use PVE::API2::Firewall::Aliases;
12
13
14 use base qw(PVE::RESTHandler);
15
16 my $option_properties = $PVE::Firewall::vm_option_properties;
17
18 my $add_option_properties = sub {
19 my ($properties) = @_;
20
21 foreach my $k (keys %$option_properties) {
22 $properties->{$k} = $option_properties->{$k};
23 }
24
25 return $properties;
26 };
27
28 sub register_handlers {
29 my ($class, $rule_env) = @_;
30
31 $class->register_method({
32 name => 'index',
33 path => '',
34 method => 'GET',
35 permissions => { user => 'all' },
36 description => "Directory index.",
37 parameters => {
38 additionalProperties => 0,
39 properties => {
40 node => get_standard_option('pve-node'),
41 vmid => get_standard_option('pve-vmid'),
42 },
43 },
44 returns => {
45 type => 'array',
46 items => {
47 type => "object",
48 properties => {},
49 },
50 links => [ { rel => 'child', href => "{name}" } ],
51 },
52 code => sub {
53 my ($param) = @_;
54
55 my $result = [
56 { name => 'rules' },
57 { name => 'aliases' },
58 { name => 'ipset' },
59 { name => 'refs' },
60 { name => 'options' },
61 ];
62
63 return $result;
64 }});
65
66
67 $class->register_method({
68 name => 'get_options',
69 path => 'options',
70 method => 'GET',
71 description => "Get VM firewall options.",
72 proxyto => 'node',
73 permissions => {
74 check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
75 },
76 parameters => {
77 additionalProperties => 0,
78 properties => {
79 node => get_standard_option('pve-node'),
80 vmid => get_standard_option('pve-vmid'),
81 },
82 },
83 returns => {
84 type => "object",
85 #additionalProperties => 1,
86 properties => $option_properties,
87 },
88 code => sub {
89 my ($param) = @_;
90
91 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
92 my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
93
94 return PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
95 }});
96
97 $class->register_method({
98 name => 'set_options',
99 path => 'options',
100 method => 'PUT',
101 description => "Set Firewall options.",
102 protected => 1,
103 proxyto => 'node',
104 permissions => {
105 check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]],
106 },
107 parameters => {
108 additionalProperties => 0,
109 properties => &$add_option_properties({
110 node => get_standard_option('pve-node'),
111 vmid => get_standard_option('pve-vmid'),
112 delete => {
113 type => 'string', format => 'pve-configid-list',
114 description => "A list of settings you want to delete.",
115 optional => 1,
116 },
117 digest => get_standard_option('pve-config-digest'),
118 }),
119 },
120 returns => { type => "null" },
121 code => sub {
122 my ($param) = @_;
123
124 PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, sub {
125 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
126 my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
127
128 my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
129 PVE::Tools::assert_if_modified($digest, $param->{digest});
130
131 if ($param->{delete}) {
132 foreach my $opt (PVE::Tools::split_list($param->{delete})) {
133 raise_param_exc({ delete => "no such option '$opt'" })
134 if !$option_properties->{$opt};
135 delete $vmfw_conf->{options}->{$opt};
136 }
137 }
138
139 if (defined($param->{enable})) {
140 $param->{enable} = $param->{enable} ? 1 : 0;
141 }
142
143 foreach my $k (keys %$option_properties) {
144 next if !defined($param->{$k});
145 $vmfw_conf->{options}->{$k} = $param->{$k};
146 }
147
148 PVE::Firewall::save_vmfw_conf($param->{vmid}, $vmfw_conf);
149 });
150
151 return undef;
152 }});
153
154 $class->register_method({
155 name => 'log',
156 path => 'log',
157 method => 'GET',
158 description => "Read firewall log",
159 proxyto => 'node',
160 permissions => {
161 check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
162 },
163 protected => 1,
164 parameters => {
165 additionalProperties => 0,
166 properties => {
167 node => get_standard_option('pve-node'),
168 vmid => get_standard_option('pve-vmid'),
169 start => {
170 type => 'integer',
171 minimum => 0,
172 optional => 1,
173 },
174 limit => {
175 type => 'integer',
176 minimum => 0,
177 optional => 1,
178 },
179 },
180 },
181 returns => {
182 type => 'array',
183 items => {
184 type => "object",
185 properties => {
186 n => {
187 description=> "Line number",
188 type=> 'integer',
189 },
190 t => {
191 description=> "Line text",
192 type => 'string',
193 }
194 }
195 }
196 },
197 code => sub {
198 my ($param) = @_;
199
200 my $rpcenv = PVE::RPCEnvironment::get();
201 my $user = $rpcenv->get_user();
202 my $vmid = $param->{vmid};
203
204 my ($count, $lines) = PVE::Tools::dump_logfile("/var/log/pve-firewall.log",
205 $param->{start}, $param->{limit},
206 "^$vmid ");
207
208 $rpcenv->set_result_attrib('total', $count);
209
210 return $lines;
211 }});
212
213
214 $class->register_method({
215 name => 'refs',
216 path => 'refs',
217 method => 'GET',
218 description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
219 permissions => {
220 check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
221 },
222 parameters => {
223 additionalProperties => 0,
224 properties => {
225 node => get_standard_option('pve-node'),
226 vmid => get_standard_option('pve-vmid'),
227 type => {
228 description => "Only list references of specified type.",
229 type => 'string',
230 enum => ['alias', 'ipset'],
231 optional => 1,
232 },
233 },
234 },
235 returns => {
236 type => 'array',
237 items => {
238 type => "object",
239 properties => {
240 type => {
241 type => 'string',
242 enum => ['alias', 'ipset'],
243 },
244 name => {
245 type => 'string',
246 },
247 comment => {
248 type => 'string',
249 optional => 1,
250 },
251 },
252 },
253 },
254 code => sub {
255 my ($param) = @_;
256
257 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
258 my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
259
260 my $ipsets = {};
261 my $aliases = {};
262
263 foreach my $conf (($cluster_conf, $fw_conf)) {
264 next if !$conf;
265 if (!$param->{type} || $param->{type} eq 'ipset') {
266 foreach my $name (keys %{$conf->{ipset}}) {
267 my $data = {
268 type => 'ipset',
269 name => $name,
270 ref => "+$name",
271 };
272 if (my $comment = $conf->{ipset_comments}->{$name}) {
273 $data->{comment} = $comment;
274 }
275 $ipsets->{$name} = $data;
276 }
277 }
278
279 if (!$param->{type} || $param->{type} eq 'alias') {
280 foreach my $name (keys %{$conf->{aliases}}) {
281 my $e = $conf->{aliases}->{$name};
282 my $data = {
283 type => 'alias',
284 name => $name,
285 ref => $name,
286 };
287 $data->{comment} = $e->{comment} if $e->{comment};
288 $aliases->{$name} = $data;
289 }
290 }
291 }
292
293 my $res = [];
294 foreach my $e (values %$ipsets) { push @$res, $e; };
295 foreach my $e (values %$aliases) { push @$res, $e; };
296
297 return $res;
298 }});
299 }
300
301 package PVE::API2::Firewall::VM;
302
303 use strict;
304 use warnings;
305
306 use base qw(PVE::API2::Firewall::VMBase);
307
308 __PACKAGE__->register_method ({
309 subclass => "PVE::API2::Firewall::VMRules",
310 path => 'rules',
311 });
312
313 __PACKAGE__->register_method ({
314 subclass => "PVE::API2::Firewall::VMAliases",
315 path => 'aliases',
316 });
317
318 __PACKAGE__->register_method ({
319 subclass => "PVE::API2::Firewall::VMIPSetList",
320 path => 'ipset',
321 });
322
323 __PACKAGE__->register_handlers('vm');
324
325 package PVE::API2::Firewall::CT;
326
327 use strict;
328 use warnings;
329
330 use base qw(PVE::API2::Firewall::VMBase);
331
332 __PACKAGE__->register_method ({
333 subclass => "PVE::API2::Firewall::CTRules",
334 path => 'rules',
335 });
336
337 __PACKAGE__->register_method ({
338 subclass => "PVE::API2::Firewall::CTAliases",
339 path => 'aliases',
340 });
341
342 __PACKAGE__->register_method ({
343 subclass => "PVE::API2::Firewall::CTIPSetList",
344 path => 'ipset',
345 });
346
347 __PACKAGE__->register_handlers('vm');
348
349 1;