implement ipsets for VM/CT

[pve-firewall.git] / src / pve-firewall

diff --git a/src/pve-firewall b/src/pve-firewall
index 91fc531cf9181d7137a6eff5dc6ff285e11e4005..d401b993ea5dd2d6b0d637cc339efa2f6650e8a2 100755 (executable)
--- a/src/pve-firewall
+++ b/src/pve-firewall
@@ -58,6 +58,8 @@ sub restart_server {
 
     sleep($waittime) if $waittime; # avoid high server load due to restarts
 
+    PVE::INotify::inotify_close();
+
     exec (@$commandline);
     exit (-1); # never reached?
 }
@@ -332,10 +334,13 @@ __PACKAGE__->register_method ({
 
            my $res = { status => $status };
            if ($status eq 'active') {
-               my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
+               
+               my $verbose = 1; # show syntax errors 
+               my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $verbose);
 
-               my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
-               my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset);
+               $verbose = 0; # do not show iptables details
+               my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);
+               my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);
              
                $res->{changes} = ($ipset_changes || $ruleset_changes) ? 1 : 0;
            }
@@ -349,7 +354,7 @@ __PACKAGE__->register_method ({
 __PACKAGE__->register_method ({
     name => 'compile',
     path => 'compile',
-    method => 'POST',
+    method => 'GET',
     description => "Compile and print firewall rules. This is useful for testing.",
     parameters => {
        additionalProperties => 0,
@@ -363,10 +368,13 @@ __PACKAGE__->register_method ({
        local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 
        my $code = sub {
-           my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
 
-           my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, 1);
-           my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, 1);
+           my $verbose = 1;
+
+           my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $verbose);
+
+           my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);
+           my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);
            if ($ipset_changes || $ruleset_changes) {
                print "detected changes\n";
            } else {
@@ -416,7 +424,7 @@ __PACKAGE__->register_method ({
 __PACKAGE__->register_method ({
     name => 'simulate',
     path => 'simulate',
-    method => 'POST',
+    method => 'GET',
     description => "Simulate firewall rules. This does not simulate kernel 'routing' table. Instead, this simply assumes that routing from source zone to destination zone is possible.",
     parameters => {
        additionalProperties => 0,
@@ -480,7 +488,7 @@ __PACKAGE__->register_method ({
 
        local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
 
-       my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
+       my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $param->{verbose});
 
        PVE::FirewallSimulator::debug($param->{verbose} || 0);