proxy host rule API calls to correct node

[pve-firewall.git] / src / PVE / API2 / Firewall / Rules.pm

diff --git a/src/PVE/API2/Firewall/Rules.pm b/src/PVE/API2/Firewall/Rules.pm
index 56b53316a5dee50d2276686eb5063a78f92a561b..83190b4f3886e59d2564b4d65f2dfca275a98ae4 100644 (file)
--- a/src/PVE/API2/Firewall/Rules.pm
+++ b/src/PVE/API2/Firewall/Rules.pm
@@ -22,7 +22,7 @@ sub load_config {
 
     die "implement this in subclass";
 
-    #return ($fw_conf, $rules);
+    #return ($cluster_conf, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -67,6 +67,7 @@ sub register_get_rules {
            additionalProperties => 0,
            properties => $properties,
        },
+       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
        returns => {
            type => 'array',
            items => {
@@ -82,7 +83,7 @@ sub register_get_rules {
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 
@@ -111,6 +112,7 @@ sub register_get_rule {
            additionalProperties => 0,
            properties => $properties,
        },
+       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
        returns => {
            type => "object",
            properties => {
@@ -122,7 +124,7 @@ sub register_get_rule {
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
        
@@ -154,16 +156,17 @@ sub register_create_rule {
            additionalProperties => 0,
            properties => $create_rule_properties,
        },
+       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
        returns => { type => "null" },
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my $rule = {};
 
            PVE::Firewall::copy_rule_data($rule, $param);
-           PVE::Firewall::verify_rule($rule, $class->rule_env());
+           PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
 
            $rule->{enable} = 0 if !defined($param->{enable});
 
@@ -207,11 +210,12 @@ sub register_update_rule {
            additionalProperties => 0,
            properties => $update_rule_properties,
        },
+       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
        returns => { type => "null" },
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
            PVE::Tools::assert_if_modified($digest, $param->{digest});
@@ -237,7 +241,7 @@ sub register_update_rule {
                
                PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
 
-               PVE::Firewall::verify_rule($rule, $class->rule_env());
+               PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
            }
 
            $class->save_rules($param, $fw_conf, $rules);
@@ -265,11 +269,12 @@ sub register_delete_rule {
            additionalProperties => 0,
            properties => $properties,
        },
+       proxyto => $class->rule_env() eq 'host' ? 'node' : undef,
        returns => { type => "null" },
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
            PVE::Tools::assert_if_modified($digest, $param->{digest});
@@ -304,6 +309,7 @@ use base qw(PVE::API2::Firewall::RulesBase);
 
 __PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });
 
+
 sub rule_env {
     my ($class, $param) = @_;
     
@@ -317,16 +323,47 @@ sub load_config {
     my $rules = $fw_conf->{groups}->{$param->{group}};
     die "no such security group '$param->{group}'\n" if !defined($rules);
 
-    return ($fw_conf, $rules);
+    return (undef, $fw_conf, $rules);
 }
 
 sub save_rules {
     my ($class, $param, $fw_conf, $rules) = @_;
 
-    $fw_conf->{groups}->{$param->{group}} = $rules;
+    if (!defined($rules)) {
+       delete $fw_conf->{groups}->{$param->{group}};
+    } else {
+       $fw_conf->{groups}->{$param->{group}} = $rules;
+    }
+
     PVE::Firewall::save_clusterfw_conf($fw_conf);
 }
 
+__PACKAGE__->register_method({
+    name => 'delete_security_group',
+    path => '',
+    method => 'DELETE',
+    description => "Delete security group.",
+    protected => 1,
+    parameters => {
+       additionalProperties => 0,
+       properties => { 
+           group => get_standard_option('pve-security-group-name'),
+       },
+    },
+    returns => { type => 'null' },
+    code => sub {
+       my ($param) = @_;
+           
+       my (undef, $cluster_conf, $rules) = __PACKAGE__->load_config($param);
+
+       die "Security group '$param->{group}' is not empty\n" 
+           if scalar(@$rules);
+
+       __PACKAGE__->save_rules($param, $cluster_conf, undef);
+
+       return undef;
+    }});
+
 __PACKAGE__->register_handlers();
 
 package PVE::API2::Firewall::ClusterRules;
@@ -348,7 +385,7 @@ sub load_config {
     my $fw_conf = PVE::Firewall::load_clusterfw_conf();
     my $rules = $fw_conf->{rules};
 
-    return ($fw_conf, $rules);
+    return (undef, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -379,10 +416,11 @@ sub rule_env {
 sub load_config {
     my ($class, $param) = @_;
 
-    my $fw_conf = PVE::Firewall::load_hostfw_conf();
+    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+    my $fw_conf = PVE::Firewall::load_hostfw_conf($cluster_conf);
     my $rules = $fw_conf->{rules};
 
-    return ($fw_conf, $rules);
+    return ($cluster_conf, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -416,10 +454,11 @@ sub rule_env {
 sub load_config {
     my ($class, $param) = @_;
 
-    my $fw_conf = PVE::Firewall::load_vmfw_conf('vm', $param->{vmid});
+    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
     my $rules = $fw_conf->{rules};
 
-    return ($fw_conf, $rules);
+    return ($cluster_conf, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -453,10 +492,11 @@ sub rule_env {
 sub load_config {
     my ($class, $param) = @_;
 
-    my $fw_conf = PVE::Firewall::load_vmfw_conf('ct', $param->{vmid});
+    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
     my $rules = $fw_conf->{rules};
 
-    return ($fw_conf, $rules);
+    return ($cluster_conf, $fw_conf, $rules);
 }
 
 sub save_rules {