From: Stefan Hrdlicka <s.hrdlicka@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH V3 firewall 1/2] allow non zero ip address host bits to be entered
Date: Tue, 13 Dec 2022 16:14:18 +0100 [thread overview]
Message-ID: <20221213151419.3658005-2-s.hrdlicka@proxmox.com> (raw)
In-Reply-To: <20221213151419.3658005-1-s.hrdlicka@proxmox.com>
They can already be set directly via the cluster.fw file. Net::IP is just a
bit more picky with what it allows:
For example:
error: 192.168.1.155/24
correct: 192.168.1.0/24
This cleans the entered IP and removes the non zero host bits.
Signed-off-by: Stefan Hrdlicka <s.hrdlicka@proxmox.com>
---
src/PVE/API2/Firewall/IPSet.pm | 2 +-
src/PVE/Firewall.pm | 19 ++++++++++++++++++-
2 files changed, 19 insertions(+), 2 deletions(-)
diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm
index a5f69e9..14bcfcb 100644
--- a/src/PVE/API2/Firewall/IPSet.pm
+++ b/src/PVE/API2/Firewall/IPSet.pm
@@ -199,7 +199,7 @@ sub register_create_ip {
my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
- my $cidr = $param->{cidr};
+ my $cidr = PVE::Firewall::clean_cidr($param->{cidr});
if ($cidr =~ m/^${PVE::Firewall::ip_alias_pattern}$/) {
# make sure alias exists (if $cidr is an alias)
PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $cidr);
diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index d40a9b1..ae5f221 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -69,8 +69,12 @@ sub pve_verify_ip_or_cidr {
my ($cidr, $noerr) = @_;
if ($cidr =~ m!^(?:$IPV6RE|$IPV4RE)(/(\d+))?$!) {
- return $cidr if Net::IP->new($cidr);
+ # Net::IP throws an error if the masked CIDR part isn't zero, e.g., `192.168.1.155/24`
+ # fails but `192.168.1.0/24` succeeds. clean_cidr removes the non zero bits from the CIDR.
+ my $clean_cidr = clean_cidr($cidr);
+ return $cidr if Net::IP->new($clean_cidr);
return undef if $noerr;
+
die Net::IP::Error() . "\n";
}
return undef if $noerr;
@@ -86,6 +90,19 @@ sub pve_verify_ip_or_cidr_or_alias {
return pve_verify_ip_or_cidr($cidr, $noerr);
}
+sub clean_cidr {
+ my ($cidr) = @_;
+ my ($ip, $len) = split('/', $cidr);
+ return $cidr if !$len;
+ my $ver = ($ip =~ m!^$IPV4RE$!) ? 4 : 6;
+
+ my $bin_ip = Net::IP::ip_iptobin( Net::IP::ip_expand_address($ip, $ver), $ver);
+ my $bin_mask = Net::IP::ip_get_mask($len, $ver);
+ my $clean_ip = Net::IP::ip_compress_address( Net::IP::ip_bintoip($bin_ip & $bin_mask, $ver), $ver);
+
+ return "${clean_ip}/$len";
+}
+
PVE::JSONSchema::register_standard_option('ipset-name', {
description => "IP set name.",
type => 'string',
--
2.30.2
next prev parent reply other threads:[~2022-12-13 15:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-13 15:14 [pve-devel] [PATCH V3 firewall 0/2] " Stefan Hrdlicka
2022-12-13 15:14 ` Stefan Hrdlicka [this message]
2022-12-13 15:14 ` [pve-devel] [PATCH V3 firewall 2/2] cleanup: don't capture "/xx" of CIDR Stefan Hrdlicka
2022-12-14 13:42 ` [pve-devel] applied-series: [PATCH V3 firewall 0/2] allow non zero ip address host bits to be entered Wolfgang Bumiller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221213151419.3658005-2-s.hrdlicka@proxmox.com \
--to=s.hrdlicka@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox