improve rule verification

[pve-firewall.git] / src / PVE / API2 / Firewall / Rules.pm

diff --git a/src/PVE/API2/Firewall/Rules.pm b/src/PVE/API2/Firewall/Rules.pm
index 65fe8a65e2be48d56beaaa379d09409951553f7b..fba5c1037be5a46ceadaab1f118f61468de9096e 100644 (file)
--- a/src/PVE/API2/Firewall/Rules.pm
+++ b/src/PVE/API2/Firewall/Rules.pm
@@ -22,7 +22,7 @@ sub load_config {
 
     die "implement this in subclass";
 
-    #return ($fw_conf, $rules);
+    #return ($cluster_conf, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -33,8 +33,10 @@ sub save_rules {
 
 my $additional_param_hash = {};
 
-sub allow_groups {
-    return 1;
+sub rule_env {
+    my ($class, $param) = @_;
+    
+    die "implement this in subclass";
 }
 
 sub additional_parameters {
@@ -80,7 +82,7 @@ sub register_get_rules {
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
 
@@ -120,7 +122,7 @@ sub register_get_rule {
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my ($list, $digest) = PVE::Firewall::copy_list_with_digest($rules);
        
@@ -156,12 +158,12 @@ sub register_create_rule {
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my $rule = {};
 
            PVE::Firewall::copy_rule_data($rule, $param);
-           PVE::Firewall::verify_rule($rule, $class->allow_groups());
+           PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
 
            $rule->{enable} = 0 if !defined($param->{enable});
 
@@ -209,7 +211,7 @@ sub register_update_rule {
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
            PVE::Tools::assert_if_modified($digest, $param->{digest});
@@ -231,16 +233,11 @@ sub register_update_rule {
                push @$newrules, $rule if $moveto >= scalar(@$rules);
                $rules = $newrules;
            } else {
-               raise_param_exc({ type => "property is missing"})
-                   if !defined($param->{type});
-               raise_param_exc({ action => "property is missing"})
-                   if !defined($param->{action});
-
                PVE::Firewall::copy_rule_data($rule, $param);
                
                PVE::Firewall::delete_rule_properties($rule, $param->{'delete'}) if $param->{'delete'};
 
-               PVE::Firewall::verify_rule($rule, $class->allow_groups());
+               PVE::Firewall::verify_rule($rule, $cluster_conf, $fw_conf, $class->rule_env());
            }
 
            $class->save_rules($param, $fw_conf, $rules);
@@ -272,7 +269,7 @@ sub register_delete_rule {
        code => sub {
            my ($param) = @_;
 
-           my ($fw_conf, $rules) = $class->load_config($param);
+           my ($cluster_conf, $fw_conf, $rules) = $class->load_config($param);
 
            my (undef, $digest) = PVE::Firewall::copy_list_with_digest($rules);
            PVE::Tools::assert_if_modified($digest, $param->{digest});
@@ -307,8 +304,10 @@ use base qw(PVE::API2::Firewall::RulesBase);
 
 __PACKAGE__->additional_parameters({ group => get_standard_option('pve-security-group-name') });
 
-sub allow_groups {
-    return 0;
+sub rule_env {
+    my ($class, $param) = @_;
+    
+    return 'group';
 }
 
 sub load_config {
@@ -318,7 +317,7 @@ sub load_config {
     my $rules = $fw_conf->{groups}->{$param->{group}};
     die "no such security group '$param->{group}'\n" if !defined($rules);
 
-    return ($fw_conf, $rules);
+    return (undef, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -337,13 +336,19 @@ use warnings;
 
 use base qw(PVE::API2::Firewall::RulesBase);
 
+sub rule_env {
+    my ($class, $param) = @_;
+    
+    return 'cluster';
+}
+
 sub load_config {
     my ($class, $param) = @_;
 
     my $fw_conf = PVE::Firewall::load_clusterfw_conf();
     my $rules = $fw_conf->{rules};
 
-    return ($fw_conf, $rules);
+    return (undef, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -365,13 +370,20 @@ use base qw(PVE::API2::Firewall::RulesBase);
 
 __PACKAGE__->additional_parameters({ node => get_standard_option('pve-node')});
 
+sub rule_env {
+    my ($class, $param) = @_;
+    
+    return 'host';
+}
+
 sub load_config {
     my ($class, $param) = @_;
 
-    my $fw_conf = PVE::Firewall::load_hostfw_conf();
+    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+    my $fw_conf = PVE::Firewall::load_hostfw_conf($cluster_conf);
     my $rules = $fw_conf->{rules};
 
-    return ($fw_conf, $rules);
+    return ($cluster_conf, $fw_conf, $rules);
 }
 
 sub save_rules {
@@ -396,13 +408,58 @@ __PACKAGE__->additional_parameters({
     vmid => get_standard_option('pve-vmid'),                              
 });
 
+sub rule_env {
+    my ($class, $param) = @_;
+    
+    return 'vm';
+}
+
+sub load_config {
+    my ($class, $param) = @_;
+
+    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'vm', $param->{vmid});
+    my $rules = $fw_conf->{rules};
+
+    return ($cluster_conf, $fw_conf, $rules);
+}
+
+sub save_rules {
+    my ($class, $param, $fw_conf, $rules) = @_;
+
+    $fw_conf->{rules} = $rules;
+    PVE::Firewall::save_vmfw_conf($param->{vmid}, $fw_conf);
+}
+
+__PACKAGE__->register_handlers();
+
+package PVE::API2::Firewall::CTRules;
+
+use strict;
+use warnings;
+use PVE::JSONSchema qw(get_standard_option);
+
+use base qw(PVE::API2::Firewall::RulesBase);
+
+__PACKAGE__->additional_parameters({ 
+    node => get_standard_option('pve-node'),
+    vmid => get_standard_option('pve-vmid'),                              
+});
+
+sub rule_env {
+    my ($class, $param) = @_;
+    
+    return 'ct';
+}
+
 sub load_config {
     my ($class, $param) = @_;
 
-    my $fw_conf = PVE::Firewall::load_vmfw_conf($param->{vmid});
+    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
+    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, 'ct', $param->{vmid});
     my $rules = $fw_conf->{rules};
 
-    return ($fw_conf, $rules);
+    return ($cluster_conf, $fw_conf, $rules);
 }
 
 sub save_rules {