bump version to 5.0.4

[pve-firewall.git] / src / PVE / API2 / Firewall / Groups.pm

diff --git a/src/PVE/API2/Firewall/Groups.pm b/src/PVE/API2/Firewall/Groups.pm
index 8f94b6df72f58bc41bffb9da4e2ea9068cee22fb..ffdc45c1889e3d2af1906e412bca2601601c595f 100644 (file)
--- a/src/PVE/API2/Firewall/Groups.pm
+++ b/src/PVE/API2/Firewall/Groups.pm
@@ -16,7 +16,7 @@ my $get_security_group_list = sub {
 
     my $res = [];
     foreach my $group (sort keys %{$cluster_conf->{groups}}) {
-       my $data = { 
+       my $data = {
            group => $group,
        };
        if (my $comment = $cluster_conf->{group_comments}->{$group}) {
@@ -30,6 +30,15 @@ my $get_security_group_list = sub {
     return wantarray ? ($list, $digest) : $list;
 };
 
+my $rename_fw_rules = sub {
+    my ($old, $new, $rules) = @_;
+
+    for my $rule (@{$rules}) {
+       next if ($rule->{type} ne "group" || $rule->{action} ne $old);
+       $rule->{action} = $new;
+    }
+};
+
 __PACKAGE__->register_method({
     name => 'list_security_groups',
     path => '',
@@ -44,10 +53,10 @@ __PACKAGE__->register_method({
        type => 'array',
        items => {
            type => "object",
-           properties => { 
+           properties => {
                group => get_standard_option('pve-security-group-name'),
                digest => get_standard_option('pve-config-digest', { optional => 0} ),
-               comment => { 
+               comment => {
                    type => 'string',
                    optional => 1,
                }
@@ -74,7 +83,7 @@ __PACKAGE__->register_method({
     },
     parameters => {
        additionalProperties => 0,
-       properties => { 
+       properties => {
            group => get_standard_option('pve-security-group-name'),
            comment => {
                type => 'string',
@@ -91,43 +100,100 @@ __PACKAGE__->register_method({
     code => sub {
        my ($param) = @_;
 
-       my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+       my $group = $param->{group};
+       my $rename = $param->{rename};
+       my $comment = $param->{comment};
 
-       if ($param->{rename}) {
-           my (undef, $digest) = &$get_security_group_list($cluster_conf);
-           PVE::Tools::assert_if_modified($digest, $param->{digest});
+       PVE::Firewall::lock_clusterfw_conf(10, sub {
+           my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 
-           raise_param_exc({ group => "Security group '$param->{rename}' does not exists" }) 
-               if !$cluster_conf->{groups}->{$param->{rename}};
+           if ($rename) {
+               my (undef, $digest) = &$get_security_group_list($cluster_conf);
+               PVE::Tools::assert_if_modified($digest, $param->{digest});
 
-           # prevent overwriting an existing group
-           raise_param_exc({ group => "Security group '$param->{group}' does already exist" })
-               if $cluster_conf->{groups}->{$param->{group}} &&
-               $param->{group} ne $param->{rename};
+               raise_param_exc({ group => "Security group '$rename' does not exist" })
+                   if !$cluster_conf->{groups}->{$rename};
 
-           my $data = delete $cluster_conf->{groups}->{$param->{rename}};
-           $cluster_conf->{groups}->{$param->{group}} = $data;
-           if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {
-               $cluster_conf->{group_comments}->{$param->{group}} = $comment;
-           }
-           $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
-       } else {
-           foreach my $name (keys %{$cluster_conf->{groups}}) {
-               raise_param_exc({ group => "Security group '$name' already exists" }) 
-                   if $name eq $param->{group};
+               # prevent overwriting an existing group
+               raise_param_exc({ group => "Security group '$group' does already exist" })
+                   if $cluster_conf->{groups}->{$group} &&
+                   $group ne $rename;
+
+               if ($rename eq $group) {
+                   $cluster_conf->{group_comments}->{$rename} = $comment if defined($comment);
+                   PVE::Firewall::save_clusterfw_conf($cluster_conf);
+                   return;
+               }
+
+               # Create an exact copy of the old security group
+               $cluster_conf->{groups}->{$group} = $cluster_conf->{groups}->{$rename};
+               $cluster_conf->{group_comments}->{$group} = $cluster_conf->{group_comments}->{$rename};
+
+               # Update comment if provided
+               $cluster_conf->{group_comments}->{$group} = $comment if defined($comment);
+
+               # Write the copy to the cluster config, so that if something fails inbetween, the new firewall
+               # rules won't be broken when the new name is referenced
+               PVE::Firewall::save_clusterfw_conf($cluster_conf);
+
+               # Update all the host configs to the new copy
+               my $hosts = PVE::Cluster::get_nodelist();
+               foreach my $host (@$hosts) {
+                   PVE::Firewall::lock_hostfw_conf($host, 10, sub {
+                       my $host_conf_path = "/etc/pve/nodes/$host/host.fw";
+                       my $host_conf = PVE::Firewall::load_hostfw_conf($cluster_conf, $host_conf_path);
+
+                       if (defined($host_conf)) {
+                           &$rename_fw_rules($rename,
+                               $group,
+                               $host_conf->{rules});
+                           PVE::Firewall::save_hostfw_conf($host_conf, $host_conf_path);
+                       }
+                   });
+               }
+
+               # Update all the VM configs
+               my $vms = PVE::Cluster::get_vmlist();
+               foreach my $vm (keys %{$vms->{ids}}) {
+                   PVE::Firewall::lock_vmfw_conf($vm, 10, sub {
+                       my $vm_type = $vms->{ids}->{$vm}->{type} eq "lxc" ? "ct" : "vm";
+                       my $vm_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $vm_type, $vm, "/etc/pve/firewall");
+
+                       if (defined($vm_conf)) {
+                           &$rename_fw_rules($rename,
+                               $group,
+                               $vm_conf->{rules});
+                           PVE::Firewall::save_vmfw_conf($vm, $vm_conf);
+                       }
+                   });
+               }
+
+               # And also update the cluster itself
+               &$rename_fw_rules($rename,
+                   $group,
+                   $cluster_conf->{rules});
+
+               # Now that everything has been updated, the old rule can be deleted
+               delete $cluster_conf->{groups}->{$rename};
+               delete $cluster_conf->{group_comments}->{$rename};
+           } else {
+               foreach my $name (keys %{$cluster_conf->{groups}}) {
+                   raise_param_exc({ group => "Security group '$name' already exists" })
+                       if $name eq $group;
+               }
+
+               $cluster_conf->{groups}->{$group} = [];
+               $cluster_conf->{group_comments}->{$group} = $comment if defined($comment);
            }
 
-           $cluster_conf->{groups}->{$param->{group}} = [];
-           $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
-       }
+           PVE::Firewall::save_clusterfw_conf($cluster_conf);
+       });
 
-       PVE::Firewall::save_clusterfw_conf($cluster_conf);
-       
        return undef;
     }});
 
 __PACKAGE__->register_method ({
-    subclass => "PVE::API2::Firewall::GroupRules",  
+    subclass => "PVE::API2::Firewall::GroupRules",
     path => '{group}',
 });