+sub enable_group_rules {
+ my ($group) = @_;
+
+ generate_group_rules($group);
+ iptables_restore();
+}
+
+sub generate_group_rules {
+ my ($group) = @_;
+
+ my $filename = "/etc/pve/firewall/groups.fw";
+ my $fh = IO::File->new($filename, O_RDONLY);
+ return if !$fh;
+
+ my $rules = parse_fw_rules($filename, $fh, $group);
+ my $inrules = $rules->{in};
+ my $outrules = $rules->{out};
+
+ my $chain = "GROUP-".$group."-IN";
+
+ iptables_addrule(":$chain - [0:0]");
+
+ if (scalar(@$inrules)) {
+ foreach my $rule (@$inrules) {
+ iptables_generate_rule($chain, $rule);
+ }
+ }
+
+ $chain = "GROUP-".$group."-OUT";
+
+ iptables_addrule(":$chain - [0:0]");
+
+ if(!iptables_chain_exist("BRIDGEFW-OUT")){
+ iptables_addrule(":BRIDGEFW-OUT - [0:0]");
+ }
+
+ if(!iptables_chain_exist("BRIDGEFW-IN")){
+ iptables_addrule(":BRIDGEFW-IN - [0:0]");
+ }
+
+ if (scalar(@$outrules)) {
+ foreach my $rule (@$outrules) {
+ #we go the BRIDGEFW-IN because we need to check also other tap rules
+ #(and group rules can be set on any bridge, so we can't go to VMBRXX-IN)
+ $rule->{action} = 'BRIDGEFW-IN' if $rule->{action} eq 'ACCEPT';
+ iptables_generate_rule($chain, $rule);
+ }
+ }
+
+}
+
+sub disable_group_rules {
+ my ($group) = @_;
+
+ my $chain = "GROUP-".$group."-IN";
+
+ if(iptables_chain_exist($chain)){
+ iptables_addrule("-F $chain");
+ iptables_addrule("-X $chain");
+ }
+
+ $chain = "GROUP-".$group."-OUT";
+
+ if(iptables_chain_exist($chain)){
+ iptables_addrule("-F $chain");
+ iptables_addrule("-X $chain");
+ }
+
+ #iptables_restore will die if security group is linked in a tap chain
+ #maybe can we improve that, parsing each vm config, or parsing iptables -S
+ #to see if the security group is linked or not
+ iptables_restore();
+}
+