api: lock configs

[pve-firewall.git] / src / PVE / API2 / Firewall / Groups.pm

diff --git a/src/PVE/API2/Firewall/Groups.pm b/src/PVE/API2/Firewall/Groups.pm
index 99ea41877cc6196bb504e5945f13bbaff045b41a..558ba8ee893c5fd29e8595bea5a857478616a02e 100644 (file)
--- a/src/PVE/API2/Firewall/Groups.pm
+++ b/src/PVE/API2/Firewall/Groups.pm
@@ -8,7 +8,6 @@ use PVE::Exception qw(raise raise_param_exc);
 use PVE::Firewall;
 use PVE::API2::Firewall::Rules;
 
-use Data::Dumper; # fixme: remove
 
 use base qw(PVE::RESTHandler);
 
@@ -17,7 +16,7 @@ my $get_security_group_list = sub {
 
     my $res = [];
     foreach my $group (sort keys %{$cluster_conf->{groups}}) {
-       my $data = { 
+       my $data = {
            group => $group,
        };
        if (my $comment = $cluster_conf->{group_comments}->{$group}) {
@@ -45,10 +44,10 @@ __PACKAGE__->register_method({
        type => 'array',
        items => {
            type => "object",
-           properties => { 
+           properties => {
                group => get_standard_option('pve-security-group-name'),
                digest => get_standard_option('pve-config-digest', { optional => 0} ),
-               comment => { 
+               comment => {
                    type => 'string',
                    optional => 1,
                }
@@ -75,7 +74,7 @@ __PACKAGE__->register_method({
     },
     parameters => {
        additionalProperties => 0,
-       properties => { 
+       properties => {
            group => get_standard_option('pve-security-group-name'),
            comment => {
                type => 'string',
@@ -92,38 +91,45 @@ __PACKAGE__->register_method({
     code => sub {
        my ($param) = @_;
 
-       my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+       PVE::Firewall::lock_clusterfw_conf(10, sub {
+           my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 
-       if ($param->{rename}) {
-           my (undef, $digest) = &$get_security_group_list($cluster_conf);
-           PVE::Tools::assert_if_modified($digest, $param->{digest});
+           if ($param->{rename}) {
+               my (undef, $digest) = &$get_security_group_list($cluster_conf);
+               PVE::Tools::assert_if_modified($digest, $param->{digest});
 
-           raise_param_exc({ group => "Security group '$param->{rename}' does not exists" }) 
-               if !$cluster_conf->{groups}->{$param->{rename}};
+               raise_param_exc({ group => "Security group '$param->{rename}' does not exist" })
+                   if !$cluster_conf->{groups}->{$param->{rename}};
 
-           my $data = delete $cluster_conf->{groups}->{$param->{rename}};
-           $cluster_conf->{groups}->{$param->{group}} = $data;
-           if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {
-               $cluster_conf->{group_comments}->{$param->{group}} = $comment;
-           }
-           $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
-       } else {
-           foreach my $name (keys %{$cluster_conf->{groups}}) {
-               raise_param_exc({ group => "Security group '$name' already exists" }) 
-                   if $name eq $param->{group};
+               # prevent overwriting an existing group
+               raise_param_exc({ group => "Security group '$param->{group}' does already exist" })
+                   if $cluster_conf->{groups}->{$param->{group}} &&
+                   $param->{group} ne $param->{rename};
+
+               my $data = delete $cluster_conf->{groups}->{$param->{rename}};
+               $cluster_conf->{groups}->{$param->{group}} = $data;
+               if (my $comment = delete $cluster_conf->{group_comments}->{$param->{rename}}) {
+                   $cluster_conf->{group_comments}->{$param->{group}} = $comment;
+               }
+               $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
+           } else {
+               foreach my $name (keys %{$cluster_conf->{groups}}) {
+                   raise_param_exc({ group => "Security group '$name' already exists" })
+                       if $name eq $param->{group};
+               }
+
+               $cluster_conf->{groups}->{$param->{group}} = [];
+               $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
            }
 
-           $cluster_conf->{groups}->{$param->{group}} = [];
-           $cluster_conf->{group_comments}->{$param->{group}} = $param->{comment} if defined($param->{comment});
-       }
+           PVE::Firewall::save_clusterfw_conf($cluster_conf);
+       });
 
-       PVE::Firewall::save_clusterfw_conf($cluster_conf);
-       
        return undef;
     }});
 
 __PACKAGE__->register_method ({
-    subclass => "PVE::API2::Firewall::GroupRules",  
+    subclass => "PVE::API2::Firewall::GroupRules",
     path => '{group}',
 });