check chain name length (max 28 chars)

[pve-firewall.git] / pvefw

diff --git a/pvefw b/pvefw
index 25c4f8a8b0b8e80a65d759673343414877296de0..1c346b555e7e4e6019452593844508b0145cfefd 100755 (executable)
--- a/pvefw
+++ b/pvefw
@@ -29,117 +29,33 @@ $rpcenv->init_request();
 $rpcenv->set_language($ENV{LANG});
 $rpcenv->set_user('root@pam');
 
-__PACKAGE__->register_method({
-    name => 'enabletaprules',
-    path => 'enabletaprules',
-    method => 'POST',
-    parameters => {
-        additionalProperties => 0,
-        properties => {
-            vmid => get_standard_option('pve-vmid'),
-            netid => {
-                type => 'string',
-            },
-
-        },
-    },
-    returns => { type => 'null' },
-    code => sub {
-        my ($param) = @_;
-
-        # test if VM exists
-        my $vmid = $param->{vmid};
-        my $netid = $param->{netid};
-
-       my $conf = PVE::QemuServer::load_config($vmid);
-       my $net = PVE::QemuServer::parse_net($conf->{$netid});
-
-       PVE::Firewall::generate_tap_rules($net, $netid, $vmid);
-
-        return undef;
-    }});
-
-__PACKAGE__->register_method({
-    name => 'disabletaprules',
-    path => 'disabletaprules',
-    method => 'POST',
-    parameters => {
-        additionalProperties => 0,
-        properties => {
-            vmid => get_standard_option('pve-vmid'),
-            netid => {
-                type => 'string',
-            },
-
-        },
-    },
-    returns => { type => 'null' },
-    code => sub {
-        my ($param) = @_;
-
-        # test if VM exists
-        my $vmid = $param->{vmid};
-        my $netid = $param->{netid};
-
-       my $conf = PVE::QemuServer::load_config($vmid);
-       my $net = PVE::QemuServer::parse_net($conf->{$netid});
-
-       PVE::Firewall::flush_tap_rules($net, $netid, $vmid);
-
-        return undef;
-    }});
-
-__PACKAGE__->register_method({
-    name => 'enablehostfw',
-    path => 'enablehostfw',
-    method => 'POST',
-    parameters => {
-       additionalProperties => 0,
-       properties => {},
-    },
-    returns => { type => 'null' },
-
-    code => sub {
-       my ($param) = @_;
-
-       PVE::Firewall::enablehostfw();
-
-       return undef;
-    }});
-
-__PACKAGE__->register_method({
-    name => 'disablehostfw',
-    path => 'disablehostfw',
-    method => 'POST',
-    parameters => {
-       additionalProperties => 0,
-       properties => {},
-    },
-    returns => { type => 'null' },
-
-    code => sub {
-       my ($param) = @_;
-
-       PVE::Firewall::disablehostfw();
-
-       return undef;
-    }});
-
 __PACKAGE__->register_method ({
     name => 'compile',
     path => 'compile',
     method => 'POST',
-    description => "Compile firewall rules.",
+    description => "Compile amd print firewall rules. This is only for testing.",
     parameters => {
        additionalProperties => 0,
-       properties => {},
+       properties => {
+           verbose => {
+               description => "Verbose output.",
+               type => "boolean",
+               optional => 1,
+               default => 0,
+           },
+       },
     },
     returns => { type => 'null' },
 
     code => sub {
        my ($param) = @_;
 
-       PVE::Firewall::compile();
+       my $code = sub {
+           my $ruleset = PVE::Firewall::compile();
+           PVE::Firewall::get_ruleset_status($ruleset, 1) if $param->{verbose};
+       };
+
+       PVE::Firewall::run_locked($code);
 
        return undef;
     }});
@@ -148,36 +64,29 @@ __PACKAGE__->register_method ({
     name => 'start',
     path => 'start',
     method => 'POST',
-    description => "Start firewall.",
+    description => "Start (or restart if already active) firewall.",
     parameters => {
        additionalProperties => 0,
-       properties => {},
+       properties => {
+           verbose => {
+               description => "Verbose output.",
+               type => "boolean",
+               optional => 1,
+               default => 0,
+           },
+       },
     },
     returns => { type => 'null' },
 
     code => sub {
        my ($param) = @_;
 
-       PVE::Firewall::compile_and_start();
+       my $code = sub {
+           my $ruleset = PVE::Firewall::compile();
+           PVE::Firewall::apply_ruleset($ruleset, $param->{verbose});
+       };
 
-       return undef;
-    }});
-
-__PACKAGE__->register_method ({
-    name => 'restart',
-    path => 'restart',
-    method => 'POST',
-    description => "Restart firewall.",
-    parameters => {
-       additionalProperties => 0,
-       properties => {},
-    },
-    returns => { type => 'null' },
-
-    code => sub {
-       my ($param) = @_;
-
-       PVE::Firewall::compile_and_start(1);
+       PVE::Firewall::run_locked($code);
 
        return undef;
     }});
@@ -186,26 +95,7 @@ __PACKAGE__->register_method ({
     name => 'stop',
     path => 'stop',
     method => 'POST',
-    description => "Stop firewall.",
-    parameters => {
-       additionalProperties => 0,
-       properties => {},
-    },
-    returns => { type => 'null' },
-
-    code => sub {
-       my ($param) = @_;
-
-       PVE::Tools::run_command(['shorewall', 'stop']);
-
-       return undef;
-    }});
-
-__PACKAGE__->register_method ({
-    name => 'clear',
-    path => 'clear',
-    method => 'POST',
-    description => "Clear will remove all rules installed by this script. The host is then unprotected.",
+    description => "Stop firewall. This will remove all rules installed by this script. The host is then unprotected.",
     parameters => {
        additionalProperties => 0,
        properties => {},
@@ -215,7 +105,35 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
-       PVE::Tools::run_command(['shorewall', 'clear']);
+       my $code = sub {
+           my $chash = PVE::Firewall::iptables_get_chains();
+           my $cmdlist = "*filter\n";
+           my $rule = "INPUT -j PVEFW-INPUT";
+           if (PVE::Firewall::iptables_rule_exist($rule)) {
+               $cmdlist .= "-D $rule\n";
+           }
+           $rule = "OUTPUT -j PVEFW-OUTPUT";
+           if (PVE::Firewall::iptables_rule_exist($rule)) {
+               $cmdlist .= "-D $rule\n";
+           }
+
+           $rule = "FORWARD -j PVEFW-FORWARD";
+           if (PVE::Firewall::iptables_rule_exist($rule)) {
+               $cmdlist .= "-D $rule\n";
+           }
+
+           foreach my $chain (keys %$chash) {
+               $cmdlist .= "-F $chain\n";
+           }
+           foreach my $chain (keys %$chash) {
+               $cmdlist .= "-X $chain\n";
+           }
+           $cmdlist .= "COMMIT\n";
+
+           PVE::Firewall::iptables_restore_cmdlist($cmdlist);
+       };
+
+       PVE::Firewall::run_locked($code);
 
        return undef;
     }});
@@ -225,13 +143,7 @@ my $nodename = PVE::INotify::nodename();
 my $cmddef = {
     compile => [ __PACKAGE__, 'compile', []],
     start => [ __PACKAGE__, 'start', []],
-    restart => [ __PACKAGE__, 'restart', []],
     stop => [ __PACKAGE__, 'stop', []],
-    clear => [ __PACKAGE__, 'clear', []],
-    enabletaprules => [ __PACKAGE__, 'enabletaprules', []],
-    disabletaprules => [ __PACKAGE__, 'disabletaprules', []],
-    enablehostfw => [ __PACKAGE__, 'enablehostfw', []],
-    disablehostfw => [ __PACKAGE__, 'disablehostfw', []],
 };
 
 my $cmd = shift;