remove useless unused Data::Dumper uses

[pve-firewall.git] / src / PVE / API2 / Firewall / VM.pm

diff --git a/src/PVE/API2/Firewall/VM.pm b/src/PVE/API2/Firewall/VM.pm
index 3e49e8887c93aa6838ee6ec296d41ca31114fac2..2341b91a6b6104e828bea914b53483c46012633c 100644 (file)
--- a/src/PVE/API2/Firewall/VM.pm
+++ b/src/PVE/API2/Firewall/VM.pm
@@ -2,50 +2,18 @@ package PVE::API2::Firewall::VMBase;
 
 use strict;
 use warnings;
+
+use PVE::Exception qw(raise_param_exc);
 use PVE::JSONSchema qw(get_standard_option);
 use PVE::Cluster;
 use PVE::Firewall;
 use PVE::API2::Firewall::Rules;
 use PVE::API2::Firewall::Aliases;
 
-use Data::Dumper; # fixme: remove
 
 use base qw(PVE::RESTHandler);
 
-my $option_properties = {
-    enable => {
-       description => "Enable host firewall rules.",
-       type => 'boolean',
-       optional => 1,
-    },
-    macfilter => {
-       description => "Enable/disable MAC address filter.",
-       type => 'boolean',
-       optional => 1,
-    },
-    dhcp => {
-       description => "Enable DHCP.",
-       type => 'boolean',
-       optional => 1,
-    },
-    policy_in => {
-       description => "Input policy.",
-       type => 'string',
-       optional => 1,
-       enum => ['ACCEPT', 'REJECT', 'DROP'],
-    },
-    policy_out => { 
-       description => "Output policy.",
-       type => 'string',
-       optional => 1,
-       enum => ['ACCEPT', 'REJECT', 'DROP'],
-    },
-    log_level_in =>  get_standard_option('pve-fw-loglevel', {
-       description => "Log level for incoming traffic." }),
-    log_level_out =>  get_standard_option('pve-fw-loglevel', {
-       description => "Log level for outgoing traffic." }),
-
-};
+my $option_properties = $PVE::Firewall::vm_option_properties;
 
 my $add_option_properties = sub {
     my ($properties) = @_;
@@ -102,6 +70,9 @@ sub register_handlers {
        method => 'GET',
        description => "Get VM firewall options.",
        proxyto => 'node',
+       permissions => {
+           check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
+       },
        parameters => {
            additionalProperties => 0,
            properties => {
@@ -130,6 +101,9 @@ sub register_handlers {
        description => "Set Firewall options.",
        protected => 1,
        proxyto => 'node',
+       permissions => {
+           check => ['perm', '/vms/{vmid}', [ 'VM.Config.Network' ]],
+       },
        parameters => {
            additionalProperties => 0,
            properties => &$add_option_properties({
@@ -241,11 +215,20 @@ sub register_handlers {
        path => 'refs',
        method => 'GET',
        description => "Lists possible IPSet/Alias reference which are allowed in source/dest properties.",
+       permissions => {
+           check => ['perm', '/vms/{vmid}', [ 'VM.Audit' ]],
+       },
        parameters => {
            additionalProperties => 0,
            properties => {
                node => get_standard_option('pve-node'),
                vmid => get_standard_option('pve-vmid'),
+               type => {
+                   description => "Only list references of specified type.",
+                   type => 'string',
+                   enum => ['alias', 'ipset'],
+                   optional => 1,
+               },
            },
        },
        returns => {
@@ -278,27 +261,31 @@ sub register_handlers {
 
            foreach my $conf (($cluster_conf, $fw_conf)) {
                next if !$conf;
-               foreach my $name (keys %{$conf->{ipset}}) {
-                   my $data = { 
-                       type => 'ipset',
-                       name => $name,
-                       ref => "+$name",
-                   };
-                   if (my $comment = $conf->{ipset_comments}->{$name}) {
-                       $data->{comment} = $comment;
+               if (!$param->{type} || $param->{type} eq 'ipset') {
+                   foreach my $name (keys %{$conf->{ipset}}) {
+                       my $data = { 
+                           type => 'ipset',
+                           name => $name,
+                           ref => "+$name",
+                       };
+                       if (my $comment = $conf->{ipset_comments}->{$name}) {
+                           $data->{comment} = $comment;
+                       }
+                       $ipsets->{$name} = $data;
                    }
-                   $ipsets->{$name} = $data;
                }
 
-               foreach my $name (keys %{$conf->{aliases}}) {
-                   my $e = $conf->{aliases}->{$name};
-                   my $data = { 
-                       type => 'alias',
-                       name => $name,
-                       ref => $name,
-                   };
-                   $data->{comment} = $e->{comment} if $e->{comment};
-                   $aliases->{$name} = $data;
+               if (!$param->{type} || $param->{type} eq 'alias') {
+                   foreach my $name (keys %{$conf->{aliases}}) {
+                       my $e = $conf->{aliases}->{$name};
+                       my $data = { 
+                           type => 'alias',
+                           name => $name,
+                           ref => $name,
+                       };
+                       $data->{comment} = $e->{comment} if $e->{comment};
+                       $aliases->{$name} = $data;
+                   }
                }
            }