return $copy;
}
+my $rules_modify_permissions = sub {
+ my ($rule_env) = @_;
+
+ if ($rule_env eq 'host') {
+ return {
+ check => ['perm', '/nodes/{node}', [ 'Sys.Modify' ]],
+ };
+ } elsif ($rule_env eq 'cluster' || $rule_env eq 'group') {
+ return {
+ check => ['perm', '/', [ 'Sys.Modify' ]],
+ };
+ } elsif ($rule_env eq 'vm' || $rule_env eq 'ct') {
+ return {
+ check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]],
+ }
+ }
+
+ return undef;
+};
+
+my $rules_audit_permissions = sub {
+ my ($rule_env) = @_;
+
+ if ($rule_env eq 'host') {
+ return {
+ check => ['perm', '/nodes/{node}', [ 'Sys.Audit' ]],
+ };
+ } elsif ($rule_env eq 'cluster' || $rule_env eq 'group') {
+ return {
+ check => ['perm', '/', [ 'Sys.Audit' ]],
+ };
+ } elsif ($rule_env eq 'vm' || $rule_env eq 'ct') {
+ return {
+ check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
+ }
+ }
+
+ return undef;
+};
+
sub register_get_rules {
my ($class) = @_;
my $properties = $class->additional_parameters();
+ my $rule_env = $class->rule_env();
+
$class->register_method({
name => 'get_rules',
path => '',
method => 'GET',
description => "List rules.",
+ permissions => &$rules_audit_permissions($rule_env),
parameters => {
additionalProperties => 0,
properties => $properties,
},
+ proxyto => $rule_env eq 'host' ? 'node' : undef,
returns => {
type => 'array',
items => {
$properties->{pos} = $api_properties->{pos};
+ my $rule_env = $class->rule_env();
+
$class->register_method({
name => 'get_rule',
path => '{pos}',
method => 'GET',
description => "Get single rule data.",
+ permissions => &$rules_audit_permissions($rule_env),
parameters => {
additionalProperties => 0,
properties => $properties,
},
+ proxyto => $rule_env eq 'host' ? 'node' : undef,
returns => {
type => "object",
properties => {
$create_rule_properties->{action}->{optional} = 0;
$create_rule_properties->{type}->{optional} = 0;
+ my $rule_env = $class->rule_env();
+
$class->register_method({
name => 'create_rule',
path => '',
method => 'POST',
description => "Create new rule.",
protected => 1,
+ permissions => &$rules_modify_permissions($rule_env),
parameters => {
additionalProperties => 0,
properties => $create_rule_properties,
},
+ proxyto => $rule_env eq 'host' ? 'node' : undef,
returns => { type => "null" },
code => sub {
my ($param) = @_;
$properties->{pos} = $api_properties->{pos};
+ my $rule_env = $class->rule_env();
+
$properties->{moveto} = {
description => "Move rule to new position <moveto>. Other arguments are ignored.",
type => 'integer',
method => 'PUT',
description => "Modify rule data.",
protected => 1,
+ permissions => &$rules_modify_permissions($rule_env),
parameters => {
additionalProperties => 0,
properties => $update_rule_properties,
},
+ proxyto => $rule_env eq 'host' ? 'node' : undef,
returns => { type => "null" },
code => sub {
my ($param) = @_;
$properties->{digest} = get_standard_option('pve-config-digest');
+ my $rule_env = $class->rule_env();
+
$class->register_method({
name => 'delete_rule',
path => '{pos}',
method => 'DELETE',
description => "Delete rule.",
protected => 1,
+ permissions => &$rules_modify_permissions($rule_env),
parameters => {
additionalProperties => 0,
properties => $properties,
},
+ proxyto => $rule_env eq 'host' ? 'node' : undef,
returns => { type => "null" },
code => sub {
my ($param) = @_;
__PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });
+
sub rule_env {
my ($class, $param) = @_;
sub save_rules {
my ($class, $param, $fw_conf, $rules) = @_;
- $fw_conf->{groups}->{$param->{group}} = $rules;
+ if (!defined($rules)) {
+ delete $fw_conf->{groups}->{$param->{group}};
+ } else {
+ $fw_conf->{groups}->{$param->{group}} = $rules;
+ }
+
PVE::Firewall::save_clusterfw_conf($fw_conf);
}
+__PACKAGE__->register_method({
+ name => 'delete_security_group',
+ path => '',
+ method => 'DELETE',
+ description => "Delete security group.",
+ protected => 1,
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ group => get_standard_option('pve-security-group-name'),
+ },
+ },
+ returns => { type => 'null' },
+ code => sub {
+ my ($param) = @_;
+
+ my (undef, $cluster_conf, $rules) = __PACKAGE__->load_config($param);
+
+ die "Security group '$param->{group}' is not empty\n"
+ if scalar(@$rules);
+
+ __PACKAGE__->save_rules($param, $cluster_conf, undef);
+
+ return undef;
+ }});
+
__PACKAGE__->register_handlers();
package PVE::API2::Firewall::ClusterRules;