src/PVE/API2/Firewall/VM.pm

   1 package PVE::API2::Firewall::VMBase;
   2
   3 use strict;
   4 use warnings;
   5 use PVE::JSONSchema qw(get_standard_option);
   6 use PVE::Cluster;
   7 use PVE::Firewall;
   8 use PVE::API2::Firewall::Rules;
   9 use PVE::API2::Firewall::Aliases;
  10
  11 use Data::Dumper; # fixme: remove
  12
  13 use base qw(PVE::RESTHandler);
  14
  15 my $option_properties = {
  16     enable => {
  17         description => "Enable host firewall rules.",
  18         type => 'boolean',
  19         optional => 1,
  20     },
  21     macfilter => {
  22         description => "Enable/disable MAC address filter.",
  23         type => 'boolean',
  24         optional => 1,
  25     },
  26     dhcp => {
  27         description => "Enable DHCP.",
  28         type => 'boolean',
  29         optional => 1,
  30     },
  31     policy_in => {
  32         description => "Input policy.",
  33         type => 'string',
  34         optional => 1,
  35         enum => ['ACCEPT', 'REJECT', 'DROP'],
  36     },
  37     policy_out => {
  38         description => "Output policy.",
  39         type => 'string',
  40         optional => 1,
  41         enum => ['ACCEPT', 'REJECT', 'DROP'],
  42     },
  43     log_level_in =>  get_standard_option('pve-fw-loglevel', {
  44         description => "Log level for incoming traffic." }),
  45     log_level_out =>  get_standard_option('pve-fw-loglevel', {
  46         description => "Log level for outgoing traffic." }),
  47
  48 };
  49
  50 my $add_option_properties = sub {
  51     my ($properties) = @_;
  52
  53     foreach my $k (keys %$option_properties) {
  54         $properties->{$k} = $option_properties->{$k};
  55     }
  56
  57     return $properties;
  58 };
  59
  60 sub register_handlers {
  61     my ($class, $rule_env) = @_;
  62
  63     $class->register_method({
  64         name => 'index',
  65         path => '',
  66         method => 'GET',
  67         permissions => { user => 'all' },
  68         description => "Directory index.",
  69         parameters => {
  70             additionalProperties => 0,
  71             properties => {
  72                 node => get_standard_option('pve-node'),
  73                 vmid => get_standard_option('pve-vmid'),
  74             },
  75         },
  76         returns => {
  77             type => 'array',
  78             items => {
  79                 type => "object",
  80                 properties => {},
  81             },
  82             links => [ { rel => 'child', href => "{name}" } ],
  83         },
  84         code => sub {
  85             my ($param) = @_;
  86
  87             my $result = [
  88                 { name => 'rules' },
  89                 { name => 'aliases' },
  90                 { name => 'ipset' },
  91                 { name => 'refs' },
  92                 { name => 'options' },
  93                 ];
  94
  95             return $result;
  96         }});
  97
  98
  99     $class->register_method({
 100         name => 'get_options',
 101         path => 'options',
 102         method => 'GET',
 103         description => "Get VM firewall options.",
 104         proxyto => 'node',
 105         parameters => {
 106             additionalProperties => 0,
 107             properties => {
 108                 node => get_standard_option('pve-node'),
 109                 vmid => get_standard_option('pve-vmid'),
 110             },
 111         },
 112         returns => {
 113             type => "object",
 114             #additionalProperties => 1,
 115             properties => $option_properties,
 116         },
 117         code => sub {
 118             my ($param) = @_;
 119
 120             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 121             my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 122
 123             return PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
 124         }});
 125
 126     $class->register_method({
 127         name => 'set_options',
 128         path => 'options',
 129         method => 'PUT',
 130         description => "Set Firewall options.",
 131         protected => 1,
 132         proxyto => 'node',
 133         parameters => {
 134             additionalProperties => 0,
 135             properties => &$add_option_properties({
 136                 node => get_standard_option('pve-node'),
 137                 vmid => get_standard_option('pve-vmid'),
 138                 delete => {
 139                     type => 'string', format => 'pve-configid-list',
 140                     description => "A list of settings you want to delete.",
 141                     optional => 1,
 142                 },
 143                 digest => get_standard_option('pve-config-digest'),
 144             }),
 145         },
 146         returns => { type => "null" },
 147         code => sub {
 148             my ($param) = @_;
 149
 150
 151             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 152             my $vmfw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 153
 154             my (undef, $digest) = PVE::Firewall::copy_opject_with_digest($vmfw_conf->{options});
 155             PVE::Tools::assert_if_modified($digest, $param->{digest});
 156
 157             if ($param->{delete}) {
 158                 foreach my $opt (PVE::Tools::split_list($param->{delete})) {
 159                     raise_param_exc({ delete => "no such option '$opt'" })
 160                         if !$option_properties->{$opt};
 161                     delete $vmfw_conf->{options}->{$opt};
 162                 }
 163             }
 164
 165             if (defined($param->{enable})) {
 166                 $param->{enable} = $param->{enable} ? 1 : 0;
 167             }
 168
 169             foreach my $k (keys %$option_properties) {
 170                 next if !defined($param->{$k});
 171                 $vmfw_conf->{options}->{$k} = $param->{$k};
 172             }
 173
 174             PVE::Firewall::save_vmfw_conf($param->{vmid}, $vmfw_conf);
 175
 176             return undef;
 177         }});
 178
 179     $class->register_method({
 180         name => 'log',
 181         path => 'log',
 182         method => 'GET',
 183         description => "Read firewall log",
 184         proxyto => 'node',
 185         permissions => {
 186             check => ['perm', '/vms/{vmid}', [ 'VM.Console' ]],
 187         },
 188         protected => 1,
 189         parameters => {
 190             additionalProperties => 0,
 191             properties => {
 192                 node => get_standard_option('pve-node'),
 193                 vmid => get_standard_option('pve-vmid'),
 194                 start => {
 195                     type => 'integer',
 196                     minimum => 0,
 197                     optional => 1,
 198                 },
 199                 limit => {
 200                     type => 'integer',
 201                     minimum => 0,
 202                     optional => 1,
 203                 },
 204             },
 205         },
 206         returns => {
 207             type => 'array',
 208             items => {
 209                 type => "object",
 210                 properties => {
 211                     n => {
 212                         description=>  "Line number",
 213                         type=> 'integer',
 214                     },
 215                     t => {
 216                         description=>  "Line text",
 217                         type => 'string',
 218                     }
 219                 }
 220             }
 221         },
 222         code => sub {
 223             my ($param) = @_;
 224
 225             my $rpcenv = PVE::RPCEnvironment::get();
 226             my $user = $rpcenv->get_user();
 227             my $vmid = $param->{vmid};
 228
 229             my ($count, $lines) = PVE::Tools::dump_logfile("/var/log/pve-firewall.log",
 230                                                            $param->{start}, $param->{limit},
 231                                                            "^$vmid ");
 232
 233             $rpcenv->set_result_attrib('total', $count);
 234
 235             return $lines;
 236         }});
 237
 238
 239     $class->register_method({
 240         name => 'refs',
 241         path => 'refs',
 242         method => 'GET',
 243         description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
 244         parameters => {
 245             additionalProperties => 0,
 246             properties => {
 247                 node => get_standard_option('pve-node'),
 248                 vmid => get_standard_option('pve-vmid'),
 249                 type => {
 250                     description => "Only list references of specified type.",
 251                     type => 'string',
 252                     enum => ['alias', 'ipset'],
 253                     optional => 1,
 254                 },
 255             },
 256         },
 257         returns => {
 258             type => 'array',
 259             items => {
 260                 type => "object",
 261                 properties => {
 262                     type => {
 263                         type => 'string',
 264                         enum => ['alias', 'ipset'],
 265                     },
 266                     name => {
 267                         type => 'string',
 268                     },
 269                     comment => {
 270                         type => 'string',
 271                         optional => 1,
 272                     },
 273                 },
 274             },
 275         },
 276         code => sub {
 277             my ($param) = @_;
 278
 279             my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 280             my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 281
 282             my $ipsets = {};
 283             my $aliases = {};
 284
 285             foreach my $conf (($cluster_conf, $fw_conf)) {
 286                 next if !$conf;
 287                 if (!$param->{type} || $param->{type} eq 'ipset') {
 288                     foreach my $name (keys %{$conf->{ipset}}) {
 289                         my $data = {
 290                             type => 'ipset',
 291                             name => $name,
 292                             ref => "+$name",
 293                         };
 294                         if (my $comment = $conf->{ipset_comments}->{$name}) {
 295                             $data->{comment} = $comment;
 296                         }
 297                         $ipsets->{$name} = $data;
 298                     }
 299                 }
 300
 301                 if (!$param->{type} || $param->{type} eq 'alias') {
 302                     foreach my $name (keys %{$conf->{aliases}}) {
 303                         my $e = $conf->{aliases}->{$name};
 304                         my $data = {
 305                             type => 'alias',
 306                             name => $name,
 307                             ref => $name,
 308                         };
 309                         $data->{comment} = $e->{comment} if $e->{comment};
 310                         $aliases->{$name} = $data;
 311                     }
 312                 }
 313             }
 314
 315             my $res = [];
 316             foreach my $e (values %$ipsets) { push @$res, $e; };
 317             foreach my $e (values %$aliases) { push @$res, $e; };
 318
 319             return $res;
 320         }});
 321 }
 322
 323 package PVE::API2::Firewall::VM;
 324
 325 use strict;
 326 use warnings;
 327
 328 use base qw(PVE::API2::Firewall::VMBase);
 329
 330 __PACKAGE__->register_method ({
 331     subclass => "PVE::API2::Firewall::VMRules",
 332     path => 'rules',
 333 });
 334
 335 __PACKAGE__->register_method ({
 336     subclass => "PVE::API2::Firewall::VMAliases",
 337     path => 'aliases',
 338 });
 339
 340 __PACKAGE__->register_method ({
 341     subclass => "PVE::API2::Firewall::VMIPSetList",
 342     path => 'ipset',
 343 });
 344
 345 __PACKAGE__->register_handlers('vm');
 346
 347 package PVE::API2::Firewall::CT;
 348
 349 use strict;
 350 use warnings;
 351
 352 use base qw(PVE::API2::Firewall::VMBase);
 353
 354 __PACKAGE__->register_method ({
 355     subclass => "PVE::API2::Firewall::CTRules",
 356     path => 'rules',
 357 });
 358
 359 __PACKAGE__->register_method ({
 360     subclass => "PVE::API2::Firewall::CTAliases",
 361     path => 'aliases',
 362 });
 363
 364 __PACKAGE__->register_method ({
 365     subclass => "PVE::API2::Firewall::CTIPSetList",
 366     path => 'ipset',
 367 });
 368
 369 __PACKAGE__->register_handlers('vm');
 370
 371 1;