Formatting fixes (trailing whitespace and indentation)

[pve-firewall.git] / src / PVE / Service / pve_firewall.pm

diff --git a/src/PVE/Service/pve_firewall.pm b/src/PVE/Service/pve_firewall.pm
index d8e42ec6cf3f9d1f341a6604f7f6e6434f19c1b1..39ceb3935e9b457677f68658744ca0e46ea38f06 100755 (executable)
--- a/src/PVE/Service/pve_firewall.pm
+++ b/src/PVE/Service/pve_firewall.pm
@@ -10,6 +10,7 @@ use PVE::Tools qw(dir_glob_foreach file_read_firstline);
 use PVE::ProcFSTools;
 use PVE::INotify;
 use PVE::Cluster qw(cfs_read_file);
+use PVE::Corosync;
 use PVE::RPCEnvironment;
 use PVE::CLIHandler;
 use PVE::Firewall;
@@ -29,14 +30,14 @@ my $nodename = PVE::INotify::nodename();
 sub init {
 
     PVE::Cluster::cfs_update();
-    
+
     PVE::Firewall::init();
 }
 
 my $restart_request = 0;
 my $next_update = 0;
 
-my $cycle = 0; 
+my $cycle = 0;
 my $updatetime = 10;
 
 my $initial_memory_usage;
@@ -48,7 +49,7 @@ sub shutdown {
 
     # wait for children
     1 while (waitpid(-1, POSIX::WNOHANG()) > 0);
-       
+
     syslog('info' , "clear firewall rules");
 
     eval { PVE::Firewall::remove_pvefw_chains(); };
@@ -78,7 +79,7 @@ sub run {
            PVE::Firewall::update();
        };
        my $err = $@;
-       
+
        if ($err) {
            syslog('err', "status update error: $err");
        }
@@ -92,7 +93,7 @@ sub run {
        $cycle++;
 
        my $mem = PVE::ProcFSTools::read_memory_usage();
-       
+
        if (!defined($initial_memory_usage) || ($cycle < 10)) {
            $initial_memory_usage = $mem->{resident};
        } else {
@@ -105,10 +106,10 @@ sub run {
        }
 
        my $wcount = 0;
-       while ((time() < $next_update) && 
+       while ((time() < $next_update) &&
               ($wcount < $updatetime) && # protect against time wrap
               !$restart_request) { $wcount++; sleep (1); };
-       
+
        $self->restart_daemon() if $restart_request;
     }
 }
@@ -125,10 +126,10 @@ __PACKAGE__->register_method ({
     method => 'GET',
     description => "Get firewall status.",
     parameters => {
-       additionalProperties => 0,
+       additionalProperties => 0,
        properties => {},
     },
-    returns => { 
+    returns => {
        type => 'object',
        additionalProperties => 0,
        properties => {
@@ -164,7 +165,7 @@ __PACKAGE__->register_method ({
            $res->{enable} = $cluster_conf->{options}->{enable} ? 1 : 0;
 
            if ($status eq 'running') {
-               
+
                my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile($cluster_conf, undef, undef);
 
                PVE::Firewall::set_verbose(0); # do not show iptables details
@@ -188,7 +189,7 @@ __PACKAGE__->register_method ({
     method => 'GET',
     description => "Compile and print firewall rules. This is useful for testing.",
     parameters => {
-       additionalProperties => 0,
+       additionalProperties => 0,
        properties => {},
     },
     returns => { type => 'null' },
@@ -239,7 +240,7 @@ __PACKAGE__->register_method ({
     method => 'GET',
     description => "Print information about local network.",
     parameters => {
-       additionalProperties => 0,
+       additionalProperties => 0,
        properties => {},
     },
     returns => { type => 'null' },
@@ -255,7 +256,7 @@ __PACKAGE__->register_method ({
        print "local IP address: $ip\n";
 
        my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
-       
+
        my $localnet = PVE::Firewall::local_network() || '127.0.0.0/8';
        print "network auto detect: $localnet\n";
        if ($cluster_conf->{aliases}->{local_network}) {
@@ -264,6 +265,28 @@ __PACKAGE__->register_method ({
            print "using detected local_network: $localnet\n";
        }
 
+       if (PVE::Corosync::check_conf_exists(1)) {
+           my $corosync_conf = PVE::Cluster::cfs_read_file("corosync.conf");
+           my $corosync_node_found = 0;
+
+           print "\naccepting corosync traffic from/to:\n";
+
+           PVE::Corosync::for_all_corosync_addresses($corosync_conf, undef, sub {
+               my ($node_name, $node_ip, $node_ipversion, $key) = @_;
+
+               if (!$corosync_node_found) {
+                   $corosync_node_found = 1;
+               }
+
+               $key =~ m/(?:ring|link)(\d+)_addr/;
+               print " - $node_name: $node_ip (link: $1)\n";
+           });
+
+           if (!$corosync_node_found) {
+               print " - no nodes found\n";
+           }
+       }
+
        return undef;
     }});
 
@@ -273,7 +296,7 @@ __PACKAGE__->register_method ({
     method => 'GET',
     description => "Simulate firewall rules. This does not simulate kernel 'routing' table. Instead, this simply assumes that routing from source zone to destination zone is possible.",
     parameters => {
-       additionalProperties => 0,
+       additionalProperties => 0,
        properties => {
            verbose => {
                description => "Verbose output.",
@@ -339,7 +362,7 @@ __PACKAGE__->register_method ({
        my ($ruleset, $ipset_ruleset, $rulesetv6, $ebtables_ruleset) = PVE::Firewall::compile();
 
        PVE::FirewallSimulator::debug();
-       
+
        my $host_ip = PVE::Cluster::remote_node_ip($nodename);
 
        PVE::FirewallSimulator::reset_trace();
@@ -357,11 +380,11 @@ __PACKAGE__->register_method ({
 
        if (!defined($test->{to})) {
            $test->{to} = 'host';
-           PVE::FirewallSimulator::add_trace("Set Zone: to => '$test->{to}'\n"); 
-       } 
+           PVE::FirewallSimulator::add_trace("Set Zone: to => '$test->{to}'\n");
+       }
        if (!defined($test->{from})) {
            $test->{from} = 'outside',
-           PVE::FirewallSimulator::add_trace("Set Zone: from => '$test->{from}'\n"); 
+           PVE::FirewallSimulator::add_trace("Set Zone: from => '$test->{from}'\n");
        }
 
        my $vmdata = PVE::Firewall::read_local_vm_config();
@@ -374,9 +397,9 @@ __PACKAGE__->register_method ({
 
        $test->{action} = 'QUERY';
 
-       my $res = PVE::FirewallSimulator::simulate_firewall($ruleset, $ipset_ruleset, 
+       my $res = PVE::FirewallSimulator::simulate_firewall($ruleset, $ipset_ruleset,
                                                            $host_ip, $vmdata, $test);
-       
+
        print "ACTION: $res\n";
 
        return undef;
@@ -392,7 +415,7 @@ our $cmddef = {
     status => [ __PACKAGE__, 'status', [], undef, sub {
        my $res = shift;
        my $status = ($res->{enable} ? "enabled" : "disabled") . '/' . $res->{status};
-       
+
        if ($res->{changes}) {
            print "Status: $status (pending changes)\n";
        } else {