pass $rule_env (cluster/host/vm/ct) to rule parser.

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 4d3f6a6931b39cb2d279fb19cd9138a7f6a94555..deef1aed30049bde1ad845ad414ca228ea3e21e8 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1004,14 +1004,28 @@ my $apply_macro = sub {
     return $rules;
 };
 
+my $rule_env_iface_lookup = {
+    'ct' => 1,
+    'vm' => 1,
+    'group' => 0,
+    'cluster' => 1,
+    'host' => 1,
+};
+
 sub verify_rule {
-    my ($rule, $allow_groups, $noerr) = @_;
+    my ($rule, $rule_env, $noerr) = @_;
+
+    my $allow_groups = $rule_env eq 'group' ? 0 : 1;
+    
+    my $allow_iface = $rule_env_iface_lookup->{$rule_env};
+    die "unknown rule_env '$rule_env'\n" if !defined($allow_iface); # should not happen
 
     my $errors = {};
     my $error_count = 0;
 
     my $add_error = sub {
        my ($param, $msg)  = @_;
+       chomp $msg;
        raise_param_exc({ $param => $msg }) if !$noerr;
        $error_count++;
        $errors->{$param} = $msg if !$errors->{$param};
@@ -1038,9 +1052,18 @@ sub verify_rule {
     }
 
     if ($rule->{iface}) {
+       &$add_error('type', "parameter -i not allowed for this rule type") 
+           if !$allow_iface;
        eval { PVE::JSONSchema::pve_verify_iface($rule->{iface}); };
        &$add_error('iface', $@) if $@;
-    }  
+       if ($rule_env eq 'vm') {
+           &$add_error('iface', "value does not match the regex pattern 'net\\d+'")
+               if $rule->{iface} !~  m/^net(\d+)$/;
+       } elsif ($rule_env eq 'ct') {
+           &$add_error('iface', "value does not match the regex pattern '(venet|eth\\d+)'")
+               if $rule->{iface} !~  m/^(venet|eth(\d+))$/;
+       }
+    }
 
     if ($rule->{macro}) {
        if (my $preferred_name = $pve_fw_preferred_macro_names->{lc($rule->{macro})}) {
@@ -1852,10 +1875,12 @@ for (my $i = 0; $i < $MAX_NETS; $i++)  {
 }
 
 sub parse_fw_rule {
-    my ($line, $allow_iface, $allow_groups) = @_;
+    my ($prefix, $line, $rule_env, $verbose) = @_;
 
     chomp $line;
 
+    my $orig_line = $line;
+
     my $rule = {};
 
     # we can add single line comments to the end of the rule
@@ -1882,7 +1907,6 @@ sub parse_fw_rule {
 
     while (length($line)) {
        if ($line =~ s/^-i (\S+)\s*//) {
-           die "parameter -i not allowed\n" if !$allow_iface;
            $rule->{iface} = $1;
            next;
        }
@@ -1917,7 +1941,13 @@ sub parse_fw_rule {
 
     die "unable to parse rule parameters: $line\n" if length($line);
 
-    $rule = verify_rule($rule, $allow_groups, 1);
+    $rule = verify_rule($rule, $rule_env, 1);
+    if ($verbose && $rule->{errors}) {
+       warn "$prefix - errors in rule parameters: $orig_line\n";
+       foreach my $p (keys %{$rule->{errors}}) {
+           warn "  $p: $rule->{errors}->{$p}\n";
+       }
+    }
 
     return $rule;
 }
@@ -2014,7 +2044,7 @@ sub parse_alias {
 }
 
 sub parse_vm_fw_rules {
-    my ($filename, $fh) = @_;
+    my ($filename, $fh, $rule_env, $verbose) = @_;
 
     my $res = { 
        rules => [], 
@@ -2062,7 +2092,7 @@ sub parse_vm_fw_rules {
        }
 
        my $rule;
-       eval { $rule = parse_fw_rule($line, 1, 1); };
+       eval { $rule = parse_fw_rule($prefix, $line, $rule_env, $verbose); };
        if (my $err = $@) {
            warn "$prefix: $err";
            next;
@@ -2075,7 +2105,7 @@ sub parse_vm_fw_rules {
 }
 
 sub parse_host_fw_rules {
-    my ($filename, $fh) = @_;
+    my ($filename, $fh, $verbose) = @_;
 
     my $res = { rules => [], options => {}};
 
@@ -2110,7 +2140,7 @@ sub parse_host_fw_rules {
        }
 
        my $rule;
-       eval { $rule = parse_fw_rule($line, 1, 1); };
+       eval { $rule = parse_fw_rule($prefix, $line, 'host', $verbose); };
        if (my $err = $@) {
            warn "$prefix: $err";
            next;
@@ -2123,7 +2153,7 @@ sub parse_host_fw_rules {
 }
 
 sub parse_cluster_fw_rules {
-    my ($filename, $fh) = @_;
+    my ($filename, $fh, $verbose) = @_;
 
     my $section;
     my $group;
@@ -2199,7 +2229,7 @@ sub parse_cluster_fw_rules {
            warn "$prefix: $@" if $@;
        } elsif ($section eq 'rules') {
            my $rule;
-           eval { $rule = parse_fw_rule($line, 1, 1); };
+           eval { $rule = parse_fw_rule($prefix, $line, 'cluster', $verbose); };
            if (my $err = $@) {
                warn "$prefix: $err";
                next;
@@ -2207,7 +2237,7 @@ sub parse_cluster_fw_rules {
            push @{$res->{$section}}, $rule;
        } elsif ($section eq 'groups') {
            my $rule;
-           eval { $rule = parse_fw_rule($line, 0, 0); };
+           eval { $rule = parse_fw_rule($prefix, $line, 'group', $verbose); };
            if (my $err = $@) {
                warn "$prefix: $err";
                next;
@@ -2291,7 +2321,7 @@ sub read_local_vm_config {
 };
 
 sub load_vmfw_conf {
-    my ($vmid, $dir) = @_;
+    my ($rule_env, $vmid, $dir, $verbose) = @_;
 
     my $vmfw_conf = {};
 
@@ -2299,7 +2329,7 @@ sub load_vmfw_conf {
 
     my $filename = "$dir/$vmid.fw";
     if (my $fh = IO::File->new($filename, O_RDONLY)) {
-       $vmfw_conf = parse_vm_fw_rules($filename, $fh);
+       $vmfw_conf = parse_vm_fw_rules($filename, $fh, $rule_env, $verbose);
     }
 
     return $vmfw_conf;
@@ -2419,12 +2449,17 @@ sub save_vmfw_conf {
 }
 
 sub read_vm_firewall_configs {
-    my ($vmdata, $dir) = @_;
+    my ($vmdata, $dir, $verbose) = @_;
 
     my $vmfw_configs = {};
 
-    foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
-       my $vmfw_conf = load_vmfw_conf($vmid, $dir);
+    foreach my $vmid (keys %{$vmdata->{qemu}}) {
+       my $vmfw_conf = load_vmfw_conf('vm', $vmid, $dir, $verbose);
+       next if !$vmfw_conf->{options}; # skip if file does not exists
+       $vmfw_configs->{$vmid} = $vmfw_conf;
+    }
+    foreach my $vmid (keys %{$vmdata->{openvz}}) {
+       my $vmfw_conf = load_vmfw_conf('ct', $vmid, $dir, $verbose);
        next if !$vmfw_conf->{options}; # skip if file does not exists
        $vmfw_configs->{$vmid} = $vmfw_conf;
     }
@@ -2544,13 +2579,13 @@ sub round_powerof2 {
 }
 
 sub load_clusterfw_conf {
-    my ($filename) = @_;
+    my ($filename, $verbose) = @_;
 
     $filename = $clusterfw_conf_filename if !defined($filename);
 
     my $cluster_conf = {};
     if (my $fh = IO::File->new($filename, O_RDONLY)) {
-       $cluster_conf = parse_cluster_fw_rules($filename, $fh);
+       $cluster_conf = parse_cluster_fw_rules($filename, $fh, $verbose);
     }
 
     return $cluster_conf;
@@ -2603,13 +2638,13 @@ sub save_clusterfw_conf {
 }
 
 sub load_hostfw_conf {
-    my ($filename) = @_;
+    my ($filename, $verbose) = @_;
 
     $filename = $hostfw_conf_filename if !defined($filename);
 
     my $hostfw_conf = {};
     if (my $fh = IO::File->new($filename, O_RDONLY)) {
-       $hostfw_conf = parse_host_fw_rules($filename, $fh);
+       $hostfw_conf = parse_host_fw_rules($filename, $fh, $verbose);
     }
     return $hostfw_conf;
 }
@@ -2633,26 +2668,26 @@ sub save_hostfw_conf {
 }
 
 sub compile {
-    my ($cluster_conf, $hostfw_conf, $vmdata) = @_;
+    my ($cluster_conf, $hostfw_conf, $vmdata, $verbose) = @_;
 
     my $vmfw_configs;
 
     if ($vmdata) { # test mode
        my $testdir = $vmdata->{testdir} || die "no test directory specified";
        my $filename = "$testdir/cluster.fw";
-       $cluster_conf = load_clusterfw_conf($filename);
+       $cluster_conf = load_clusterfw_conf($filename, $verbose);
 
        $filename = "$testdir/host.fw";
-       $hostfw_conf = load_hostfw_conf($filename);
+       $hostfw_conf = load_hostfw_conf($filename, $verbose);
 
-       $vmfw_configs = read_vm_firewall_configs($vmdata, $testdir);
+       $vmfw_configs = read_vm_firewall_configs($vmdata, $testdir, $verbose);
     } else { # normal operation
-       $cluster_conf = load_clusterfw_conf() if !$cluster_conf;
+       $cluster_conf = load_clusterfw_conf(undef, $verbose) if !$cluster_conf;
 
-       $hostfw_conf = load_hostfw_conf() if !$hostfw_conf;
+       $hostfw_conf = load_hostfw_conf(undef, $verbose) if !$hostfw_conf;
 
        $vmdata = read_local_vm_config();
-       $vmfw_configs = read_vm_firewall_configs($vmdata);
+       $vmfw_configs = read_vm_firewall_configs($vmdata, undef, $verbose);
     }
 
 
@@ -3064,8 +3099,6 @@ sub init {
 }
 
 sub update {
-    my ($verbose) = @_;
-
     my $code = sub {
 
        my $cluster_conf = load_clusterfw_conf();
@@ -3077,7 +3110,6 @@ sub update {
 
        if (!$enable) {
            PVE::Firewall::remove_pvefw_chains();
-           print "Firewall disabled\n" if $verbose;
            return;
        }
 
@@ -3085,7 +3117,7 @@ sub update {
 
        my ($ruleset, $ipset_ruleset) = compile($cluster_conf, $hostfw_conf);
 
-       apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $verbose);
+       apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset);
     };
 
     run_locked($code);