experimental code to read existing chains and compute SHA1 checksum

[pve-firewall.git] / pvefw

diff --git a/pvefw b/pvefw
index 70a2beecd954f867174c45fe7758d4812b22d65b..e33518de64c13db1e7463a8382505bd47a8afab6 100755 (executable)
--- a/pvefw
+++ b/pvefw
@@ -51,17 +51,21 @@ __PACKAGE__->register_method({
         my $vmid = $param->{vmid};
         my $netid = $param->{netid};
 
         my $vmid = $param->{vmid};
         my $netid = $param->{netid};
 

-       my $conf = PVE::QemuServer::load_config($vmid);
-
-       foreach my $opt (keys %$conf) {
-            next if $opt !~ m/^net(\d+)$/;
-            my $net = PVE::QemuServer::parse_net($conf->{$opt});
-            next if !$net;
-           next if $netid && $opt != $netid;
-           PVE::Firewall::generate_tap_rules($net, $opt, $vmid);
-       }
-
-        return undef;
+       my $code = sub {
+           my $conf = PVE::QemuServer::load_config($vmid);
+
+           foreach my $opt (keys %$conf) {
+               next if $opt !~ m/^net(\d+)$/;
+               my $net = PVE::QemuServer::parse_net($conf->{$opt});
+               next if !$net;
+               next if $netid && $opt != $netid;
+               PVE::Firewall::generate_tap_rules($net, $opt, $vmid);
+           }
+       };
+
+       PVE::Firewall::run_locked($code);
+        
+       return undef;

     }});
 
 __PACKAGE__->register_method({
     }});
 
 __PACKAGE__->register_method({


@@ -87,15 +91,20 @@ __PACKAGE__->register_method({
         my $vmid = $param->{vmid};
         my $netid = $param->{netid};
 
         my $vmid = $param->{vmid};
         my $netid = $param->{netid};
 

-       my $conf = PVE::QemuServer::load_config($vmid);

 
 

-       foreach my $opt (keys %$conf) {
-            next if $opt !~ m/^net(\d+)$/;
-            my $net = PVE::QemuServer::parse_net($conf->{$opt});
-            next if !$net;
-           next if $netid && $opt != $netid;
-           PVE::Firewall::flush_tap_rules($net, $opt, $vmid);
-       }
+       my $code = sub {
+           my $conf = PVE::QemuServer::load_config($vmid);
+
+           foreach my $opt (keys %$conf) {
+               next if $opt !~ m/^net(\d+)$/;
+               my $net = PVE::QemuServer::parse_net($conf->{$opt});
+               next if !$net;
+               next if $netid && $opt != $netid;
+               PVE::Firewall::flush_tap_rules($net, $opt, $vmid);
+           }
+       };
+
+       PVE::Firewall::run_locked($code);

 
         return undef;
     }});
 
         return undef;
     }});


@@ -116,9 +125,13 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
     code => sub {
         my ($param) = @_;
 

-       my $group = $param->{securitygroup};
-       PVE::Firewall::enable_group_rules($group);
+       my $code = sub {
+           my $group = $param->{securitygroup};
+           PVE::Firewall::enable_group_rules($group);
+       };

 
 

+       PVE::Firewall::run_locked($code);
+       

         return undef;
     }});
 
         return undef;
     }});
 


@@ -139,8 +152,12 @@ __PACKAGE__->register_method({
     code => sub {
         my ($param) = @_;
 
     code => sub {
         my ($param) = @_;
 

-       my $group = $param->{securitygroup};
-       PVE::Firewall::disable_group_rules($group);
+       my $code = sub {
+           my $group = $param->{securitygroup};
+           PVE::Firewall::disable_group_rules($group);
+       };
+
+       PVE::Firewall::run_locked($code);

 
         return undef;
     }});
 
         return undef;
     }});


@@ -158,7 +175,11 @@ __PACKAGE__->register_method({
     code => sub {
        my ($param) = @_;
 
     code => sub {
        my ($param) = @_;
 

-       PVE::Firewall::enablehostfw();
+       my $code = sub {
+           PVE::Firewall::enablehostfw();
+       };
+
+       PVE::Firewall::run_locked($code);

 
        return undef;
     }});
 
        return undef;
     }});


@@ -176,7 +197,11 @@ __PACKAGE__->register_method({
     code => sub {
        my ($param) = @_;
 
     code => sub {
        my ($param) = @_;
 

-       PVE::Firewall::disablehostfw();
+       my $code = sub {
+           PVE::Firewall::disablehostfw();
+       };
+
+       PVE::Firewall::run_locked($code);

 
        return undef;
     }});
 
        return undef;
     }});


@@ -195,7 +220,11 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
     code => sub {
        my ($param) = @_;
 

-       PVE::Firewall::compile();
+       my $code = sub {
+           PVE::Firewall::compile();
+       };
+
+       PVE::Firewall::run_locked($code);

 
        return undef;
     }});
 
        return undef;
     }});


@@ -204,7 +233,7 @@ __PACKAGE__->register_method ({
     name => 'start',
     path => 'start',
     method => 'POST',
     name => 'start',
     path => 'start',
     method => 'POST',

-    description => "Start firewall.",
+    description => "Start (or restart if already active) firewall.",

     parameters => {
        additionalProperties => 0,
        properties => {},
     parameters => {
        additionalProperties => 0,
        properties => {},


@@ -214,26 +243,11 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
     code => sub {
        my ($param) = @_;
 

-       PVE::Firewall::compile_and_start();
-
-       return undef;
-    }});
-
-__PACKAGE__->register_method ({
-    name => 'restart',
-    path => 'restart',
-    method => 'POST',
-    description => "Restart firewall.",
-    parameters => {
-       additionalProperties => 0,
-       properties => {},
-    },
-    returns => { type => 'null' },
-
-    code => sub {
-       my ($param) = @_;
+       my $code = sub {
+           PVE::Firewall::compile_and_start();
+       };

 
 

-       PVE::Firewall::compile_and_start(1);
+       PVE::Firewall::run_locked($code);

 
        return undef;
     }});
 
        return undef;
     }});


@@ -242,7 +256,7 @@ __PACKAGE__->register_method ({
     name => 'stop',
     path => 'stop',
     method => 'POST',
     name => 'stop',
     path => 'stop',
     method => 'POST',

-    description => "Stop firewall.",
+    description => "Stop firewall. This will remove all rules installed by this script. The host is then unprotected.",

     parameters => {
        additionalProperties => 0,
        properties => {},
     parameters => {
        additionalProperties => 0,
        properties => {},


@@ -252,26 +266,11 @@ __PACKAGE__->register_method ({
     code => sub {
        my ($param) = @_;
 
     code => sub {
        my ($param) = @_;
 

-       PVE::Tools::run_command(['shorewall', 'stop']);
-
-       return undef;
-    }});
-
-__PACKAGE__->register_method ({
-    name => 'clear',
-    path => 'clear',
-    method => 'POST',
-    description => "Clear will remove all rules installed by this script. The host is then unprotected.",
-    parameters => {
-       additionalProperties => 0,
-       properties => {},
-    },
-    returns => { type => 'null' },
-
-    code => sub {
-       my ($param) = @_;
+       my $code = sub {
+           die "implement me";
+       };

 
 

-       PVE::Tools::run_command(['shorewall', 'clear']);
+       PVE::Firewall::run_locked($code);

 
        return undef;
     }});
 
        return undef;
     }});


@@ -283,7 +282,6 @@ my $cmddef = {
     start => [ __PACKAGE__, 'start', []],
     restart => [ __PACKAGE__, 'restart', []],
     stop => [ __PACKAGE__, 'stop', []],
     start => [ __PACKAGE__, 'start', []],
     restart => [ __PACKAGE__, 'restart', []],
     stop => [ __PACKAGE__, 'stop', []],

-    clear => [ __PACKAGE__, 'clear', []],

     enablevmfw => [ __PACKAGE__, 'enablevmfw', []],
     disablevmfw => [ __PACKAGE__, 'disablevmfw', []],
     enablehostfw => [ __PACKAGE__, 'enablehostfw', []],
     enablevmfw => [ __PACKAGE__, 'enablevmfw', []],
     disablevmfw => [ __PACKAGE__, 'disablevmfw', []],
     enablehostfw => [ __PACKAGE__, 'enablehostfw', []],