[pve-devel] [PATCH pve-firewall v7 2/4] ipsets: return sdn ipsets from api

[Stefan Hanreich]

In order for the new SDN ipsets to show up we need to adapt the
existing API endpoints so they read the SDN configuration. We reload
the SDN configuration explicitly, in order to return only the IPSets
the user is allowed to see.

Signed-off-by: Stefan Hanreich <s.hanreich at proxmox.com>
---
 src/PVE/API2/Firewall/Cluster.pm | 12 +++++++++++-
 src/PVE/API2/Firewall/VM.pm      | 10 +++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/PVE/API2/Firewall/Cluster.pm b/src/PVE/API2/Firewall/Cluster.pm
index 48ad90d..4d51b34 100644
--- a/src/PVE/API2/Firewall/Cluster.pm
+++ b/src/PVE/API2/Firewall/Cluster.pm
@@ -9,6 +9,7 @@ use PVE::Firewall;
 use PVE::API2::Firewall::Aliases;
 use PVE::API2::Firewall::Rules;
 use PVE::API2::Firewall::Groups;
+use PVE::API2::Firewall::Helpers;
 use PVE::API2::Firewall::IPSet;
 
 #fixme: locking?
@@ -255,7 +256,16 @@ __PACKAGE__->register_method({
 
 	my $conf = PVE::Firewall::load_clusterfw_conf();
 
-	return PVE::Firewall::Helpers::collect_refs($conf, $param->{type}, "dc");
+	# we are explicitly loading the SDN config here with the scope of the current
+	# API user, so we only return the IPSets that the user can actually use
+	my $allowed_vms = PVE::API2::Firewall::Helpers::get_allowed_vms();
+	my $allowed_vnets = PVE::API2::Firewall::Helpers::get_allowed_vnets();
+	my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
+
+	my $cluster_refs = PVE::Firewall::Helpers::collect_refs($conf, $param->{type}, "dc");
+	my $sdn_refs = PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn");
+
+	return [@$sdn_refs, @$cluster_refs];
     }});
 
 1;
diff --git a/src/PVE/API2/Firewall/VM.pm b/src/PVE/API2/Firewall/VM.pm
index 4222103..2d25735 100644
--- a/src/PVE/API2/Firewall/VM.pm
+++ b/src/PVE/API2/Firewall/VM.pm
@@ -8,6 +8,7 @@ use PVE::JSONSchema qw(get_standard_option);
 use PVE::Cluster;
 use PVE::Firewall;
 use PVE::API2::Firewall::Rules;
+use PVE::API2::Firewall::Helpers;
 use PVE::API2::Firewall::Aliases;
 
 
@@ -281,10 +282,17 @@ sub register_handlers {
 	    my $cluster_conf = PVE::Firewall::load_clusterfw_conf();
 	    my $fw_conf = PVE::Firewall::load_vmfw_conf($cluster_conf, $rule_env, $param->{vmid});
 
+	    # we are explicitly loading the SDN config here with the scope of the current
+	    # API user, so we only return the IPSets that the user can actually use
+	    my $allowed_vms = PVE::API2::Firewall::Helpers::get_allowed_vms();
+	    my $allowed_vnets = PVE::API2::Firewall::Helpers::get_allowed_vnets();
+	    my $sdn_conf = PVE::Firewall::load_sdn_conf($allowed_vms, $allowed_vnets);
+
 	    my $dc_refs = PVE::Firewall::Helpers::collect_refs($cluster_conf, $param->{type}, 'dc');
+	    my $sdn_refs = PVE::Firewall::Helpers::collect_refs($sdn_conf, $param->{type}, "sdn");
 	    my $vm_refs = PVE::Firewall::Helpers::collect_refs($fw_conf, $param->{type}, 'guest');
 
-	    return [@$dc_refs, @$vm_refs];
+	    return [@$dc_refs, @$sdn_refs, @$vm_refs];
 	}});
 }
 
-- 
2.39.5