From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id C46421FF385 for ; Wed, 26 Jun 2024 14:16:34 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id D13E91F9A5; Wed, 26 Jun 2024 14:16:05 +0200 (CEST) From: Stefan Hanreich To: pve-devel@lists.proxmox.com Date: Wed, 26 Jun 2024 14:15:48 +0200 Message-Id: <20240626121550.292290-20-s.hanreich@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240626121550.292290-1-s.hanreich@proxmox.com> References: <20240626121550.292290-1-s.hanreich@proxmox.com> MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.259 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Subject: [pve-devel] [PATCH pve-firewall 19/21] add support for loading sdn firewall configuration X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Signed-off-by: Stefan Hanreich --- src/PVE/Firewall.pm | 43 +++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 41 insertions(+), 2 deletions(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index 09544ba..95325a0 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -25,6 +25,7 @@ use PVE::Tools qw($IPV4RE $IPV6RE); use PVE::Tools qw(run_command lock_file dir_glob_foreach); use PVE::Firewall::Helpers; +use PVE::RS::Firewall::SDN; my $pvefw_conf_dir = "/etc/pve/firewall"; my $clusterfw_conf_filename = "$pvefw_conf_dir/cluster.fw"; @@ -3644,7 +3645,7 @@ sub lock_clusterfw_conf { } sub load_clusterfw_conf { - my ($filename) = @_; + my ($filename, $load_sdn_config) = @_; $filename = $clusterfw_conf_filename if !defined($filename); my $empty_conf = { @@ -3657,12 +3658,50 @@ sub load_clusterfw_conf { ipset_comments => {}, }; + if ($load_sdn_config) { + my $sdn_conf = load_sdn_conf(); + $empty_conf = { %$empty_conf, %$sdn_conf }; + } + my $cluster_conf = generic_fw_config_parser($filename, $empty_conf, $empty_conf, 'cluster'); $set_global_log_ratelimit->($cluster_conf->{options}); return $cluster_conf; } +sub load_sdn_conf { + my $rpcenv = PVE::RPCEnvironment::get(); + my $authuser = $rpcenv->get_user(); + + my $guests = PVE::Cluster::get_vmlist(); + my $allowed_vms = []; + foreach my $vmid (sort keys %{$guests->{ids}}) { + next if !$rpcenv->check($authuser, "/vms/$vmid", [ 'VM.Audit' ], 1); + push @$allowed_vms, $vmid; + } + + my $vnets = PVE::Network::SDN::Vnets::config(1); + my $privs = [ 'SDN.Audit', 'SDN.Allocate' ]; + my $allowed_vnets = []; + foreach my $vnet (sort keys %{$vnets->{ids}}) { + my $zone = $vnets->{ids}->{$vnet}->{zone}; + next if !$rpcenv->check_any($authuser, "/sdn/zones/$zone/$vnet", $privs, 1); + push @$allowed_vnets, $vnet; + } + + my $sdn_config = { + ipset => {} , + ipset_comments => {}, + }; + + eval { + $sdn_config = PVE::RS::Firewall::SDN::config($allowed_vnets, $allowed_vms); + }; + warn $@ if $@; + + return $sdn_config; +} + sub save_clusterfw_conf { my ($cluster_conf) = @_; @@ -4731,7 +4770,7 @@ sub init { sub update { my $code = sub { - my $cluster_conf = load_clusterfw_conf(); + my $cluster_conf = load_clusterfw_conf(undef, 1); my $hostfw_conf = load_hostfw_conf($cluster_conf); if (!is_enabled_and_not_nftables($cluster_conf, $hostfw_conf)) { -- 2.39.2 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel