public inbox for pmg-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Christoph Heiss <c.heiss@proxmox.com>
To: pmg-devel@lists.proxmox.com
Subject: [pmg-devel] [PATCH pmg-api] fix #4410: Remove non-null host-bits from CIDR when reading `mynetworks`
Date: Thu, 22 Dec 2022 11:19:40 +0100	[thread overview]
Message-ID: <20221222101940.3610215-1-c.heiss@proxmox.com> (raw)

This will simply drop non-null host bits when reading the config file,
thus preserving backwards-compatibility.
When creating new entries, invalid CIDRs are now rejected to prevent
creation of such entries in the future.

Signed-off-by: Christoph Heiss <c.heiss@proxmox.com>
---
 src/PMG/API2/MyNetworks.pm |  4 ++++
 src/PMG/Config.pm          | 21 +++++++++++----------
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/PMG/API2/MyNetworks.pm b/src/PMG/API2/MyNetworks.pm
index 975ca2e..aff4041 100644
--- a/src/PMG/API2/MyNetworks.pm
+++ b/src/PMG/API2/MyNetworks.pm
@@ -3,6 +3,7 @@ package PMG::API2::MyNetworks;
 use strict;
 use warnings;
 use Data::Dumper;
+use Net::IP;

 use PVE::SafeSyslog;
 use PVE::Tools qw(extract_param);
@@ -83,6 +84,9 @@ __PACKAGE__->register_method ({
 	    die "trusted network '$param->{cidr}' already exists\n"
 		if $mynetworks->{$param->{cidr}};

+	    die "invalid network adress '$param->{cidr}', host-bits must be null\n"
+		if !Net::IP::ip_normalize($param->{cidr});
+
 	    $mynetworks->{$param->{cidr}} = {
 		comment => $param->{comment} // '',
 	    };
diff --git a/src/PMG/Config.pm b/src/PMG/Config.pm
index 9ba5c76..f03f102 100755
--- a/src/PMG/Config.pm
+++ b/src/PMG/Config.pm
@@ -730,6 +730,7 @@ use PVE::SafeSyslog;
 use PVE::Tools qw($IPV4RE $IPV6RE);
 use PVE::INotify;
 use PVE::JSONSchema;
+use PVE::Network;

 use PMG::Cluster;
 use PMG::Utils;
@@ -1008,13 +1009,13 @@ sub read_pmg_mynetworks {
 	while (defined(my $line = <$fh>)) {
 	    chomp $line;
 	    next if $line =~ m/^\s*$/;
-	    if ($line =~ m!^((?:$IPV4RE|$IPV6RE))/(\d+)\s*(?:#(.*)\s*)?$!) {
-		my ($network, $prefix_size, $comment) = ($1, $2, $3);
-		my $cidr = "$network/${prefix_size}";
-		$mynetworks->{$cidr} = {
-		    cidr => $cidr,
-		    network_address => $network,
-		    prefix_size => $prefix_size,
+	    if ($line =~ m!^((?:$IPV4RE|$IPV6RE)/\d+)\s*(?:#(.*)\s*)?$!) {
+		my ($cidr, $comment) = ($1, $2);
+		my $ip = PVE::Network::IP_from_cidr($cidr);
+		$mynetworks->{$ip->prefix()} = {
+		    cidr => $ip->prefix(),
+		    network_address => $ip->ip(),
+		    prefix_size => $ip->prefixlen(),
 		    comment => $comment // '',
 		};
 	    } else {
@@ -1336,11 +1337,11 @@ sub get_template_vars {
     }

     my $netlist = PVE::INotify::read_file('mynetworks');
-    foreach my $cidr (keys %$netlist) {
-	if ($cidr =~ m/^($IPV6RE)\/(\d+)$/) {
+    foreach my $ip (values %$netlist) {
+	if ($ip->{cidr} =~ m/^($IPV6RE)\/(\d+)$/) {
 	    $mynetworks->{"[$1]/$2"} = 1;
 	} else {
-	    $mynetworks->{$cidr} = 1;
+	    $mynetworks->{$ip->{cidr}} = 1;
 	}
     }

--
2.30.2





             reply	other threads:[~2022-12-22 10:42 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-22 10:19 Christoph Heiss [this message]
2022-12-22 15:25 ` Stoiko Ivanov
2022-12-27  9:27   ` Christoph Heiss

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221222101940.3610215-1-c.heiss@proxmox.com \
    --to=c.heiss@proxmox.com \
    --cc=pmg-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal