From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id E035F9EC1D for ; Wed, 7 Jun 2023 12:18:30 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id C1BF43F7EC for ; Wed, 7 Jun 2023 12:18:00 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 7 Jun 2023 12:17:59 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id AD78041E30 for ; Wed, 7 Jun 2023 12:17:59 +0200 (CEST) From: Leo Nunner To: pve-devel@lists.proxmox.com Date: Wed, 7 Jun 2023 12:17:49 +0200 Message-Id: <20230607101751.87616-3-l.nunner@proxmox.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20230607101751.87616-1-l.nunner@proxmox.com> References: <20230607101751.87616-1-l.nunner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.104 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pve-devel] [PATCH firewall 2/3] fix #4556: introduce 'dc' and 'vm' prefix for aliases X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Jun 2023 10:18:30 -0000 since they had the same issue as IPSets, detailed in #4556. The format works the same as for IPSets: dc/alias Looks for the alias on the Datacenter level. vm/alias Looks for the alias on the VM level. alias Uses the previous method of scoping, where it first looks at the VM level and then at the Datacenter level. Signed-off-by: Leo Nunner --- src/PVE/API2/Firewall/IPSet.pm | 9 ++++-- src/PVE/Firewall.pm | 58 +++++++++++++++++++++++----------- 2 files changed, 46 insertions(+), 21 deletions(-) diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm index 14bcfcb..515f2d3 100644 --- a/src/PVE/API2/Firewall/IPSet.pm +++ b/src/PVE/API2/Firewall/IPSet.pm @@ -199,11 +199,14 @@ sub register_create_ip { my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param); - my $cidr = PVE::Firewall::clean_cidr($param->{cidr}); - if ($cidr =~ m/^${PVE::Firewall::ip_alias_pattern}$/) { + my $cidr = $param->{cidr}; + if ($cidr =~ m@^(dc/|vm/)?(${PVE::Firewall::ip_alias_pattern})$@) { + my $scope = $1 // ""; + my $alias = $2; # make sure alias exists (if $cidr is an alias) - PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $cidr); + PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $alias, $scope); } else { + $cidr = PVE::Firewall::clean_cidr($cidr); # normalize like config parser, otherwise duplicates might slip through $cidr = PVE::Firewall::parse_ip_or_cidr($cidr); } diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index ff18de0..ecde176 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -85,7 +85,7 @@ PVE::JSONSchema::register_format('IPorCIDRorAlias', \&pve_verify_ip_or_cidr_or_a sub pve_verify_ip_or_cidr_or_alias { my ($cidr, $noerr) = @_; - return if $cidr =~ m/^(?:$ip_alias_pattern)$/; + return if $cidr =~ m@^(dc/|vm/)?(?:$ip_alias_pattern)$@; return pve_verify_ip_or_cidr($cidr, $noerr); } @@ -1067,7 +1067,7 @@ sub parse_address_list { return; } - if ($str =~ m/^${ip_alias_pattern}$/) { + if ($str =~ m@^(dc/|vm/)?${ip_alias_pattern}$@) { die "alias name too long\n" if length($str) > $max_alias_name_length; return; } @@ -1690,12 +1690,19 @@ sub verify_rule { } else { &$add_error($name, "invalid ipset name '$value'"); } - } elsif ($value =~ m/^${ip_alias_pattern}$/){ - my $alias = lc($value); + } elsif ($value =~ m@^(vm/|dc/)?(${ip_alias_pattern})$@){ + my $scope = $1 // ""; + my $alias = lc($2); &$add_error($name, "no such alias '$value'") if !($cluster_conf->{aliases}->{$alias} || ($fw_conf && $fw_conf->{aliases}->{$alias})); - my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; - $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; + + my $e; + if ($scope ne 'dc/' && $fw_conf) { + $e = $fw_conf->{aliases}->{$alias}; + } + if ($scope ne 'vm/' && !$e && $cluster_conf) { + $e = $cluster_conf->{aliases}->{$alias}; + } &$set_ip_version($e->{ipversion}); } @@ -2096,7 +2103,7 @@ sub ipt_gen_src_or_dst_match { my $match; if ($adr =~ m/^\+/) { if ($adr =~ m@^\+(vm/|dc/)?(${ipset_name_pattern})$@) { - my $scope = $1; + my $scope = $1 // ""; my $name = $2; my $ipset_chain; if ($scope ne 'dc/' && $fw_conf && $fw_conf->{ipset}->{$name}) { @@ -2110,10 +2117,16 @@ sub ipt_gen_src_or_dst_match { } else { die "invalid security group name '$adr'\n"; } - } elsif ($adr =~ m/^${ip_alias_pattern}$/){ - my $alias = lc($adr); - my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; - $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf; + } elsif ($adr =~ m@^(dc/|vm/)?(${ip_alias_pattern})$@){ + my $scope = $1 // ""; + my $alias = lc($2); + my $e; + if ($scope ne 'dc/' && $fw_conf) { + $e = $fw_conf->{aliases}->{$alias}; + } + if ($scope ne 'vm/' && !$e && $cluster_conf) { + $e = $cluster_conf->{aliases}->{$alias}; + } die "no such alias '$adr'\n" if !$e; $match = "-${dir} $e->{cidr}"; } elsif ($adr =~ m/\-/){ @@ -2964,11 +2977,16 @@ sub parse_clusterfw_option { } sub resolve_alias { - my ($clusterfw_conf, $fw_conf, $cidr) = @_; + my ($clusterfw_conf, $fw_conf, $cidr, $scope) = @_; my $alias = lc($cidr); - my $e = $fw_conf ? $fw_conf->{aliases}->{$alias} : undef; - $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf; + my $e; + if ($scope ne 'dc/' && $fw_conf) { + $e = $fw_conf->{aliases}->{$alias}; + } + if ($scope ne 'vm/' && !$e && $clusterfw_conf) { + $e = $clusterfw_conf->{aliases}->{$alias}; + } die "no such alias '$cidr'\n" if !$e;; @@ -3156,8 +3174,10 @@ sub generic_fw_config_parser { } eval { - if ($cidr =~ m/^${ip_alias_pattern}$/) { - resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists + if ($cidr =~ m@^(dc/|vm/)?(${ip_alias_pattern}$)@) { + my $scope = $1 // ""; + my $alias = $2; + resolve_alias($cluster_conf, $res, $alias, $scope); # make sure alias exists } else { $cidr = parse_ip_or_cidr($cidr); } @@ -3508,8 +3528,10 @@ sub generate_ipset_chains { next if $entry->{errors}; # skip entries with errors eval { my ($cidr, $ver); - if ($entry->{cidr} =~ m/^${ip_alias_pattern}$/) { - ($cidr, $ver) = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr}); + if ($entry->{cidr} =~ m@^(dc/|vm/)?(${ip_alias_pattern})$@) { + my $scope = $1 // ""; + my $alias = $2; + ($cidr, $ver) = resolve_alias($clusterfw_conf, $fw_conf, $alias, $scope); } else { ($cidr, $ver) = parse_ip_or_cidr($entry->{cidr}); } -- 2.30.2