From c8301d6308c3edef3fa0d4a4ea83526b0d404ed1 Mon Sep 17 00:00:00 2001
From: Dietmar Maurer <dietmar@proxmox.com>
Date: Wed, 5 Mar 2014 10:43:32 +0100
Subject: [PATCH] start openvz support

Seems we can reuse generate_tap_rules_direction for bridged devices.
---
 src/PVE/Firewall.pm | 69 +++++++++++++++++++++++++++++++++++++--------
 1 file changed, 58 insertions(+), 11 deletions(-)

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 7a68642..7e577c2 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -4,9 +4,12 @@ use warnings;
 use strict;
 use Data::Dumper;
 use Digest::SHA;
+use PVE::INotify;
+use PVE::Cluster;
 use PVE::ProcFSTools;
 use PVE::Tools;
 use PVE::QemuServer;
+use PVE::OpenVZ; # dependeny problem?!
 use File::Basename;
 use File::Path;
 use IO::File;
@@ -15,6 +18,8 @@ use PVE::Tools qw(run_command lock_file);
 
 use Data::Dumper;
 
+my $nodename = PVE::INotify::nodename();
+
 my $pve_fw_lock_filename = "/var/lock/pvefw.lck";
 my $pve_fw_status_filename = "/var/lib/pve-firewall/pvefw.status";
 
@@ -1399,26 +1404,39 @@ sub run_locked {
 sub read_local_vm_config {
 
     my $openvz = {};
-
     my $qemu = {};
 
-    my $list = PVE::QemuServer::config_list();
+    my $vmdata = { openvz => $openvz, qemu => $qemu };
 
-    foreach my $vmid (keys %$list) {
-	my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
-	if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
-	    $qemu->{$vmid} = $conf;
+    my $vmlist = PVE::Cluster::get_vmlist();
+    return $vmdata if !$vmlist || !$vmlist->{ids};
+    my $ids = $vmlist->{ids};
+
+    foreach my $vmid (keys %$ids) {
+	next if !$vmid; # skip VE0
+	my $d = $ids->{$vmid};
+	next if !$d->{node} || $d->{node} ne $nodename;
+	next if !$d->{type};
+	if ($d->{type} eq 'openvz') {
+	    my $cfspath = PVE::OpenVZ::cfs_config_path($vmid);
+	    if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
+		$openvz->{$vmid} = $conf;
+	    }
+	} elsif ($d->{type} eq 'qemu') {
+	    my $cfspath = PVE::QemuServer::cfs_config_path($vmid);
+	    if (my $conf = PVE::Cluster::cfs_read_file($cfspath)) {
+		$qemu->{$vmid} = $conf;
+	    }
 	}
     }
-
-    my $vmdata = { openvz => $openvz, qemu => $qemu };
-
+ 
     return $vmdata;
 };
 
 sub read_vm_firewall_configs {
     my ($vmdata) = @_;
     my $vmfw_configs = {};
+
     foreach my $vmid (keys %{$vmdata->{qemu}}, keys %{$vmdata->{openvz}}) {
 	my $filename = "/etc/pve/firewall/$vmid.fw";
 	my $fh = IO::File->new($filename, O_RDONLY);
@@ -1519,8 +1537,6 @@ sub compile {
 	$groups_conf = parse_group_fw_rules($filename, $fh);
     }
 
-    #print Dumper($rules);
-
     my $ruleset = {};
 
     ruleset_create_chain($ruleset, "PVEFW-INPUT");
@@ -1570,6 +1586,37 @@ sub compile {
 	}
     }
 
+    # generate firewall rules for OpenVZ containers
+    foreach my $vmid (keys %{$vmdata->{openvz}}) {
+	my $conf = $vmdata->{openvz}->{$vmid};
+
+	my $vmfw_conf = $vmfw_configs->{$vmid};
+	next if !$vmfw_conf;
+	next if defined($vmfw_conf->{options}->{enable}) && ($vmfw_conf->{options}->{enable} == 0);
+
+	if ($conf->{ip_address} && $conf->{ip_address}->{value}) {
+	    my $ip = $conf->{ip_address}->{value};
+	    die "implement me";
+	}
+
+	if ($conf->{netif} && $conf->{netif}->{value}) {
+	    my $netif = PVE::OpenVZ::parse_netif($conf->{netif}->{value});
+	    print Dumper($netif);
+	    foreach my $netid (keys %$netif) {
+		my $d = $netif->{$netid};
+		my $bridge = $d->{bridge};
+		if (!$bridge) {
+		    warn "no bridge device for CT $vmid iface '$netid'\n";
+		    next; # fixme?
+		}
+		my $macaddr = $d->{host_mac};
+		my $iface = $d->{host_ifname};
+		generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'IN');
+		generate_tap_rules_direction($ruleset, $groups_conf, $iface, $netid, $macaddr, $vmfw_conf, $bridge, 'OUT');
+	    }
+	}
+    }
+
     return wantarray ? ($ruleset, $hostfw_conf) : $ruleset;
 }
 
-- 
2.39.2