make verbose a global state

[pve-firewall.git] / src / PVE / FirewallSimulator.pm

diff --git a/src/PVE/FirewallSimulator.pm b/src/PVE/FirewallSimulator.pm
index c924b41c3e9377fb99668ea6b00fff19cc4d74ad..188c38fa52325e79f9a3d5cf40a887eddf83d9f1 100644 (file)
--- a/src/PVE/FirewallSimulator.pm
+++ b/src/PVE/FirewallSimulator.pm
@@ -6,10 +6,22 @@ use Data::Dumper;
 use PVE::Firewall;
 use File::Basename;
 use Net::IP;
-use PVE::LXC;
-use PVE::QemuServer;
 
-my $mark;
+# dynamically include PVE::QemuServer and PVE::LXC
+# to avoid dependency problems
+my $have_qemu_server;
+eval {
+    require PVE::QemuServer;
+    $have_qemu_server = 1;
+};
+
+my $have_lxc;
+eval {
+    require PVE::LXC;
+    $have_lxc = 1;
+};
+
+my $mark = 0;
 my $trace;
 my $debug = 0;
 
@@ -99,7 +111,7 @@ sub ipset_match {
 sub rule_match {
     my ($ipset_ruleset, $chain, $rule, $pkg) = @_;
 
-    $rule =~ s/^-A $chain // || die "got strange rule: $rule";
+    $rule =~ s/^-A $chain +// || die "got strange rule: $rule";
 
     while (length($rule)) {
 
@@ -215,7 +227,7 @@ sub rule_match {
 
        if ($rule =~ s@^-m mark --mark ($NUMBER_RE)(?:/($NUMBER_RE))?\s*@@) {
            my ($value, $mask) = PVE::Firewall::get_mark_values($1, $2);
-           return undef if !defined($mark) || ($mark & $mask) != $value;
+           return undef if ($mark & $mask) != $value;
            next;
        }
 
@@ -530,11 +542,13 @@ sub simulate_firewall {
        $from_info->{iface} = 'tapXYZ';
        $start_state = 'from-bport';
     } elsif ($from =~ m/^ct(\d+)$/) {
+       return 'SKIPPED' if !$have_lxc;
        my $vmid = $1;
        $from_info = extract_ct_info($vmdata, $vmid, 0);
        $start_state = 'fwbr-out'; 
        $pkg->{mac_source} = $from_info->{macaddr};
     } elsif ($from =~ m/^vm(\d+)(i(\d))?$/) {
+       return 'SKIPPED' if !$have_qemu_server;
        my $vmid = $1;
        my $netnum = $3 || 0;
        $from_info = extract_vm_info($vmdata, $vmid, $netnum);
@@ -563,10 +577,12 @@ sub simulate_firewall {
        $target->{bridge} = 'vmbr0';
        $target->{iface} = 'tapXYZ';
     } elsif ($to =~ m/^ct(\d+)$/) {
+       return 'SKIPPED' if !$have_lxc;
        my $vmid = $1;
        $target = extract_ct_info($vmdata, $vmid, 0);
        $target->{iface} = $target->{tapdev};
    } elsif ($to =~ m/^vm(\d+)$/) {
+       return 'SKIPPED' if !$have_qemu_server;
        my $vmid = $1;
        $target = extract_vm_info($vmdata, $vmid, 0);
        $target->{iface} = $target->{tapdev};