my $add_error = sub {
my ($param, $msg) = @_;
+ chomp $msg;
raise_param_exc({ $param => $msg }) if !$noerr;
$error_count++;
$errors->{$param} = $msg if !$errors->{$param};
}
sub parse_fw_rule {
- my ($line, $allow_iface, $allow_groups) = @_;
+ my ($prefix, $line, $allow_iface, $allow_groups, $verbose) = @_;
chomp $line;
+ my $orig_line = $line;
+
my $rule = {};
# we can add single line comments to the end of the rule
die "unable to parse rule parameters: $line\n" if length($line);
$rule = verify_rule($rule, $allow_groups, 1);
+ if ($verbose && $rule->{errors}) {
+ warn "$prefix - errors in rule parameters: $orig_line\n";
+ foreach my $p (keys %{$rule->{errors}}) {
+ warn " $p: $rule->{errors}->{$p}\n";
+ }
+ }
return $rule;
}
}
sub parse_vm_fw_rules {
- my ($filename, $fh) = @_;
+ my ($filename, $fh, $verbose) = @_;
my $res = {
rules => [],
}
my $rule;
- eval { $rule = parse_fw_rule($line, 1, 1); };
+ eval { $rule = parse_fw_rule($prefix, $line, 1, 1, $verbose); };
if (my $err = $@) {
warn "$prefix: $err";
next;
}
sub parse_host_fw_rules {
- my ($filename, $fh) = @_;
+ my ($filename, $fh, $verbose) = @_;
my $res = { rules => [], options => {}};
}
my $rule;
- eval { $rule = parse_fw_rule($line, 1, 1); };
+ eval { $rule = parse_fw_rule($prefix, $line, 1, 1, $verbose); };
if (my $err = $@) {
warn "$prefix: $err";
next;
}
sub parse_cluster_fw_rules {
- my ($filename, $fh) = @_;
+ my ($filename, $fh, $verbose) = @_;
my $section;
my $group;
warn "$prefix: $@" if $@;
} elsif ($section eq 'rules') {
my $rule;
- eval { $rule = parse_fw_rule($line, 1, 1); };
+ eval { $rule = parse_fw_rule($prefix, $line, 1, 1, $verbose); };
if (my $err = $@) {
warn "$prefix: $err";
next;
push @{$res->{$section}}, $rule;
} elsif ($section eq 'groups') {
my $rule;
- eval { $rule = parse_fw_rule($line, 0, 0); };
+ eval { $rule = parse_fw_rule($prefix, $line, 0, 0, $verbose); };
if (my $err = $@) {
warn "$prefix: $err";
next;
};
sub load_vmfw_conf {
- my ($vmid, $dir) = @_;
+ my ($vmid, $dir, $verbose) = @_;
my $vmfw_conf = {};
my $filename = "$dir/$vmid.fw";
if (my $fh = IO::File->new($filename, O_RDONLY)) {
- $vmfw_conf = parse_vm_fw_rules($filename, $fh);
+ $vmfw_conf = parse_vm_fw_rules($filename, $fh, $verbose);
}
return $vmfw_conf;
}
sub read_vm_firewall_configs {
- my ($vmdata, $dir) = @_;
+ my ($vmdata, $dir, $verbose) = @_;
my $vmfw_configs = {};
foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
- my $vmfw_conf = load_vmfw_conf($vmid, $dir);
+ my $vmfw_conf = load_vmfw_conf($vmid, $dir, $verbose);
next if !$vmfw_conf->{options}; # skip if file does not exists
$vmfw_configs->{$vmid} = $vmfw_conf;
}
}
sub load_clusterfw_conf {
- my ($filename) = @_;
+ my ($filename, $verbose) = @_;
$filename = $clusterfw_conf_filename if !defined($filename);
my $cluster_conf = {};
if (my $fh = IO::File->new($filename, O_RDONLY)) {
- $cluster_conf = parse_cluster_fw_rules($filename, $fh);
+ $cluster_conf = parse_cluster_fw_rules($filename, $fh, $verbose);
}
return $cluster_conf;
}
sub load_hostfw_conf {
- my ($filename) = @_;
+ my ($filename, $verbose) = @_;
$filename = $hostfw_conf_filename if !defined($filename);
my $hostfw_conf = {};
if (my $fh = IO::File->new($filename, O_RDONLY)) {
- $hostfw_conf = parse_host_fw_rules($filename, $fh);
+ $hostfw_conf = parse_host_fw_rules($filename, $fh, $verbose);
}
return $hostfw_conf;
}
}
sub compile {
- my ($cluster_conf, $hostfw_conf, $vmdata) = @_;
+ my ($cluster_conf, $hostfw_conf, $vmdata, $verbose) = @_;
my $vmfw_configs;
if ($vmdata) { # test mode
my $testdir = $vmdata->{testdir} || die "no test directory specified";
my $filename = "$testdir/cluster.fw";
- $cluster_conf = load_clusterfw_conf($filename);
+ $cluster_conf = load_clusterfw_conf($filename, $verbose);
$filename = "$testdir/host.fw";
- $hostfw_conf = load_hostfw_conf($filename);
+ $hostfw_conf = load_hostfw_conf($filename, $verbose);
- $vmfw_configs = read_vm_firewall_configs($vmdata, $testdir);
+ $vmfw_configs = read_vm_firewall_configs($vmdata, $testdir, $verbose);
} else { # normal operation
- $cluster_conf = load_clusterfw_conf() if !$cluster_conf;
+ $cluster_conf = load_clusterfw_conf(undef, $verbose) if !$cluster_conf;
- $hostfw_conf = load_hostfw_conf() if !$hostfw_conf;
+ $hostfw_conf = load_hostfw_conf(undef, $verbose) if !$hostfw_conf;
$vmdata = read_local_vm_config();
- $vmfw_configs = read_vm_firewall_configs($vmdata);
+ $vmfw_configs = read_vm_firewall_configs($vmdata, undef, $verbose);
}
}
sub update {
- my ($verbose) = @_;
-
my $code = sub {
my $cluster_conf = load_clusterfw_conf();
if (!$enable) {
PVE::Firewall::remove_pvefw_chains();
- print "Firewall disabled\n" if $verbose;
return;
}
my ($ruleset, $ipset_ruleset) = compile($cluster_conf, $hostfw_conf);
- apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset, $verbose);
+ apply_ruleset($ruleset, $hostfw_conf, $ipset_ruleset);
};
run_locked($code);
my $res = { status => $status };
if ($status eq 'active') {
- my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
+
+ my $verbose = 1; # show syntax errors
+ my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $verbose);
- my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset);
- my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset);
+ $verbose = 0; # do not show iptables details
+ my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);
+ my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);
$res->{changes} = ($ipset_changes || $ruleset_changes) ? 1 : 0;
}
local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
my $code = sub {
- my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
- my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, 1);
- my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, 1);
+ my $verbose = 1;
+
+ my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $verbose);
+
+ my (undef, undef, $ipset_changes) = PVE::Firewall::get_ipset_cmdlist($ipset_ruleset, $verbose);
+ my (undef, $ruleset_changes) = PVE::Firewall::get_ruleset_cmdlist($ruleset, $verbose);
if ($ipset_changes || $ruleset_changes) {
print "detected changes\n";
} else {
local $SIG{'__WARN__'} = 'DEFAULT'; # do not fill up syslog
- my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile();
+ my ($ruleset, $ipset_ruleset) = PVE::Firewall::compile(undef, undef, undef, $param->{verbose});
PVE::FirewallSimulator::debug($param->{verbose} || 0);