src/PVE/API2/Firewall/VM.pm

   1 package PVE::API2::Firewall::VMBase;
   2
   3 use strict;
   4 use warnings;
   5
   6 use PVE::Exception qw(raise_param_exc);
   7 use PVE::JSONSchema qw(get_standard_option);
   8 use PVE::Cluster;
   9 use PVE::Firewall;
  10 use PVE::API2::Firewall::Rules;
  11 use PVE::API2::Firewall::Aliases;
  12
  13
  14 use base qw(PVE::RESTHandler);
  15
  16 my $option_properties = $PVE::Firewall::vm_option_properties;
  17
  18 my $add_option_properties = sub {
  19     my ($properties) = @_;
  20
  21     foreach my $k (keys %$option_properties) {
  22         $properties->{$k} = $option_properties->{$k};
  23     }
  24
  25     return $properties;
  26 };
  27
  28 sub register_handlers {
  29     my ($class, $rule_env) = @_;
  30
  31     $class->register_method({
  32         name => 'index',
  33         path => '',
  34         method => 'GET',
  35         permissions => { user => 'all' },
  36         description => "Directory index.",
  37         parameters => {
  38             additionalProperties => 0,
  39             properties => {
  40                 node => get_standard_option('pve-node'),
  41                 vmid => get_standard_option('pve-vmid'),
  42             },
  43         },
  44         returns => {
  45             type => 'array',
  46             items => {
  47                 type => "object",
  48                 properties => {},
  49             },
  50             links => [ { rel => 'child', href => "{name}" } ],
  51         },
  52         code => sub {
  53             my ($param) = @_;
  54
  55             my $result = [
  56                 { name => 'rules' },
  57                 { name => 'aliases' },
  58                 { name => 'ipset' },
  59                 { name => 'refs' },
  60                 { name => 'options' },
  61                 ];
  62
  63             return $result;
  64         }});
  65
  66
  67     $class->register_method({
  68         name => 'get_options',
  69         path => 'options',
  70         method => 'GET',
  71         description => "Get VM firewall options.",
  72         proxyto => 'node',
  73         permissions => {
  74             check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
  75         },
  76         parameters => {
  77             additionalProperties => 0,
  78             properties => {
  79                 node => get_standard_option('pve-node'),
  80                 vmid => get_standard_option('pve-vmid'),
  81             },
  82         },
  83         returns => {
  84             type => "object",
  85             #additionalProperties => 1,
  86             properties => $option_properties,
  87         },
  88         code => sub {
  89             my ($param) = @_;
  90
  91             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
  92             my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
  93
  94             return PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
  95         }});
  96
  97     $class->register_method({
  98         name => 'set_options',
  99         path => 'options',
 100         method => 'PUT',
 101         description => "Set Firewall options.",
 102         protected => 1,
 103         proxyto => 'node',
 104         permissions => {
 105             check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]],
 106         },
 107         parameters => {
 108             additionalProperties => 0,
 109             properties => &$add_option_properties({
 110                 node => get_standard_option('pve-node'),
 111                 vmid => get_standard_option('pve-vmid'),
 112                 delete => {
 113                     type => 'string', format => 'pve-configid-list',
 114                     description => "A list of settings you want to delete.",
 115                     optional => 1,
 116                 },
 117                 digest => get_standard_option('pve-config-digest'),
 118             }),
 119         },
 120         returns => { type => "null" },
 121         code => sub {
 122             my ($param) = @_;
 123
 124             PVE::Firewall::lock_vmfw_conf($param->{vmid}, 10, sub {
 125                 my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 126                 my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 127
 128                 my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
 129                 PVE::Tools::assert_if_modified($digest, $param->{digest});
 130
 131                 if ($param->{delete}) {
 132                     foreach my $opt (PVE::Tools::split_list($param->{delete})) {
 133                         raise_param_exc({ delete => "no such option '$opt'" })
 134                             if !$option_properties->{$opt};
 135                         delete $vmfw_conf->{options}->{$opt};
 136                     }
 137                 }
 138
 139                 if (defined($param->{enable})) {
 140                     $param->{enable} = $param->{enable} ? 1 : 0;
 141                 }
 142
 143                 foreach my $k (keys %$option_properties) {
 144                     next if !defined($param->{$k});
 145                     $vmfw_conf->{options}->{$k} = $param->{$k};
 146                 }
 147
 148                 PVE::Firewall::save_vmfw_conf($param->{vmid}, $vmfw_conf);
 149             });
 150
 151             return undef;
 152         }});
 153
 154     $class->register_method({
 155         name => 'log',
 156         path => 'log',
 157         method => 'GET',
 158         description => "Read firewall log",
 159         proxyto => 'node',
 160         permissions => {
 161             check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 162         },
 163         protected => 1,
 164         parameters => {
 165             additionalProperties => 0,
 166             properties => {
 167                 node => get_standard_option('pve-node'),
 168                 vmid => get_standard_option('pve-vmid'),
 169                 start => {
 170                     type => 'integer',
 171                     minimum => 0,
 172                     optional => 1,
 173                 },
 174                 limit => {
 175                     type => 'integer',
 176                     minimum => 0,
 177                     optional => 1,
 178                 },
 179             },
 180         },
 181         returns => {
 182             type => 'array',
 183             items => {
 184                 type => "object",
 185                 properties => {
 186                     n => {
 187                         description=>  "Line number",
 188                         type=> 'integer',
 189                     },
 190                     t => {
 191                         description=>  "Line text",
 192                         type => 'string',
 193                     }
 194                 }
 195             }
 196         },
 197         code => sub {
 198             my ($param) = @_;
 199
 200             my $rpcenv = PVE::RPCEnvironment::get();
 201             my $user = $rpcenv->get_user();
 202             my $vmid = $param->{vmid};
 203
 204             my ($count, $lines) = PVE::Tools::dump_logfile("/var/log/pve-firewall.log",
 205                                                            $param->{start}, $param->{limit},
 206                                                            "^$vmid ");
 207
 208             $rpcenv->set_result_attrib('total', $count);
 209
 210             return $lines;
 211         }});
 212
 213
 214     $class->register_method({
 215         name => 'refs',
 216         path => 'refs',
 217         method => 'GET',
 218         description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
 219         permissions => {
 220             check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
 221         },
 222         parameters => {
 223             additionalProperties => 0,
 224             properties => {
 225                 node => get_standard_option('pve-node'),
 226                 vmid => get_standard_option('pve-vmid'),
 227                 type => {
 228                     description => "Only list references of specified type.",
 229                     type => 'string',
 230                     enum => ['alias', 'ipset'],
 231                     optional => 1,
 232                 },
 233             },
 234         },
 235         returns => {
 236             type => 'array',
 237             items => {
 238                 type => "object",
 239                 properties => {
 240                     type => {
 241                         type => 'string',
 242                         enum => ['alias', 'ipset'],
 243                     },
 244                     name => {
 245                         type => 'string',
 246                     },
 247                     comment => {
 248                         type => 'string',
 249                         optional => 1,
 250                     },
 251                 },
 252             },
 253         },
 254         code => sub {
 255             my ($param) = @_;
 256
 257             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 258             my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 259
 260             my $ipsets = {};
 261             my $aliases = {};
 262
 263             foreach my $conf (($cluster_conf, $fw_conf)) {
 264                 next if !$conf;
 265                 if (!$param->{type} || $param->{type} eq 'ipset') {
 266                     foreach my $name (keys %{$conf->{ipset}}) {
 267                         my $data = {
 268                             type => 'ipset',
 269                             name => $name,
 270                             ref => "+$name",
 271                         };
 272                         if (my $comment = $conf->{ipset_comments}->{$name}) {
 273                             $data->{comment} = $comment;
 274                         }
 275                         $ipsets->{$name} = $data;
 276                     }
 277                 }
 278
 279                 if (!$param->{type} || $param->{type} eq 'alias') {
 280                     foreach my $name (keys %{$conf->{aliases}}) {
 281                         my $e = $conf->{aliases}->{$name};
 282                         my $data = {
 283                             type => 'alias',
 284                             name => $name,
 285                             ref => $name,
 286                         };
 287                         $data->{comment} = $e->{comment} if $e->{comment};
 288                         $aliases->{$name} = $data;
 289                     }
 290                 }
 291             }
 292
 293             my $res = [];
 294             foreach my $e (values %$ipsets) { push @$res, $e; };
 295             foreach my $e (values %$aliases) { push @$res, $e; };
 296
 297             return $res;
 298         }});
 299 }
 300
 301 package PVE::API2::Firewall::VM;
 302
 303 use strict;
 304 use warnings;
 305
 306 use base qw(PVE::API2::Firewall::VMBase);
 307
 308 __PACKAGE__->register_method ({
 309     subclass => "PVE::API2::Firewall::VMRules",
 310     path => 'rules',
 311 });
 312
 313 __PACKAGE__->register_method ({
 314     subclass => "PVE::API2::Firewall::VMAliases",
 315     path => 'aliases',
 316 });
 317
 318 __PACKAGE__->register_method ({
 319     subclass => "PVE::API2::Firewall::VMIPSetList",
 320     path => 'ipset',
 321 });
 322
 323 __PACKAGE__->register_handlers('vm');
 324
 325 package PVE::API2::Firewall::CT;
 326
 327 use strict;
 328 use warnings;
 329
 330 use base qw(PVE::API2::Firewall::VMBase);
 331
 332 __PACKAGE__->register_method ({
 333     subclass => "PVE::API2::Firewall::CTRules",
 334     path => 'rules',
 335 });
 336
 337 __PACKAGE__->register_method ({
 338     subclass => "PVE::API2::Firewall::CTAliases",
 339     path => 'aliases',
 340 });
 341
 342 __PACKAGE__->register_method ({
 343     subclass => "PVE::API2::Firewall::CTIPSetList",
 344     path => 'ipset',
 345 });
 346
 347 __PACKAGE__->register_handlers('vm');
 348
 349 1;