From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id D3309918B1 for ; Thu, 22 Dec 2022 11:42:29 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id BBD771A5F0 for ; Thu, 22 Dec 2022 11:42:29 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Thu, 22 Dec 2022 11:42:28 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 3E06944B8C for ; Thu, 22 Dec 2022 11:42:28 +0100 (CET) From: Christoph Heiss To: pmg-devel@lists.proxmox.com Date: Thu, 22 Dec 2022 11:19:40 +0100 Message-Id: <20221222101940.3610215-1-c.heiss@proxmox.com> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.100 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pmg-devel] [PATCH pmg-api] fix #4410: Remove non-null host-bits from CIDR when reading `mynetworks` X-BeenThere: pmg-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Dec 2022 10:42:29 -0000 This will simply drop non-null host bits when reading the config file, thus preserving backwards-compatibility. When creating new entries, invalid CIDRs are now rejected to prevent creation of such entries in the future. Signed-off-by: Christoph Heiss --- src/PMG/API2/MyNetworks.pm | 4 ++++ src/PMG/Config.pm | 21 +++++++++++---------- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/src/PMG/API2/MyNetworks.pm b/src/PMG/API2/MyNetworks.pm index 975ca2e..aff4041 100644 --- a/src/PMG/API2/MyNetworks.pm +++ b/src/PMG/API2/MyNetworks.pm @@ -3,6 +3,7 @@ package PMG::API2::MyNetworks; use strict; use warnings; use Data::Dumper; +use Net::IP; use PVE::SafeSyslog; use PVE::Tools qw(extract_param); @@ -83,6 +84,9 @@ __PACKAGE__->register_method ({ die "trusted network '$param->{cidr}' already exists\n" if $mynetworks->{$param->{cidr}}; + die "invalid network adress '$param->{cidr}', host-bits must be null\n" + if !Net::IP::ip_normalize($param->{cidr}); + $mynetworks->{$param->{cidr}} = { comment => $param->{comment} // '', }; diff --git a/src/PMG/Config.pm b/src/PMG/Config.pm index 9ba5c76..f03f102 100755 --- a/src/PMG/Config.pm +++ b/src/PMG/Config.pm @@ -730,6 +730,7 @@ use PVE::SafeSyslog; use PVE::Tools qw($IPV4RE $IPV6RE); use PVE::INotify; use PVE::JSONSchema; +use PVE::Network; use PMG::Cluster; use PMG::Utils; @@ -1008,13 +1009,13 @@ sub read_pmg_mynetworks { while (defined(my $line = <$fh>)) { chomp $line; next if $line =~ m/^\s*$/; - if ($line =~ m!^((?:$IPV4RE|$IPV6RE))/(\d+)\s*(?:#(.*)\s*)?$!) { - my ($network, $prefix_size, $comment) = ($1, $2, $3); - my $cidr = "$network/${prefix_size}"; - $mynetworks->{$cidr} = { - cidr => $cidr, - network_address => $network, - prefix_size => $prefix_size, + if ($line =~ m!^((?:$IPV4RE|$IPV6RE)/\d+)\s*(?:#(.*)\s*)?$!) { + my ($cidr, $comment) = ($1, $2); + my $ip = PVE::Network::IP_from_cidr($cidr); + $mynetworks->{$ip->prefix()} = { + cidr => $ip->prefix(), + network_address => $ip->ip(), + prefix_size => $ip->prefixlen(), comment => $comment // '', }; } else { @@ -1336,11 +1337,11 @@ sub get_template_vars { } my $netlist = PVE::INotify::read_file('mynetworks'); - foreach my $cidr (keys %$netlist) { - if ($cidr =~ m/^($IPV6RE)\/(\d+)$/) { + foreach my $ip (values %$netlist) { + if ($ip->{cidr} =~ m/^($IPV6RE)\/(\d+)$/) { $mynetworks->{"[$1]/$2"} = 1; } else { - $mynetworks->{$cidr} = 1; + $mynetworks->{$ip->{cidr}} = 1; } } -- 2.30.2