pass ipset errors to GUI

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 6adf487b0c168a50f709fc971e008ed0064c3b84..b2bcc32e5ca685cfafd84cc05019094c3ee6a925 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2116,6 +2116,21 @@ sub parse_clusterfw_option {
     return ($opt, $value);
 }
 
+sub resolve_alias {
+    my ($clusterfw_conf, $fw_conf, $cidr) = @_;
+
+    if ($cidr !~ m/^\d/) {
+       my $alias = lc($cidr);
+       my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
+       $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf;
+       return $e->{cidr} if $e;
+       
+       die "no such alias '$cidr'\n";
+    }
+
+    return $cidr;
+}
+
 sub parse_alias {
     my ($line) = @_;
 
@@ -2145,8 +2160,6 @@ sub generic_fw_config_parser {
 
     my $res = $empty_conf;
 
-    my $ipset_option = get_standard_option('ipset-name');
-
     while (defined(my $line = <$fh>)) {
        next if $line =~ m/^#/;
        next if $line =~ m/^\s*$/;
@@ -2256,20 +2269,28 @@ sub generic_fw_config_parser {
            $line =~ m/^(\!)?\s*(\S+)\s*$/;
            my $nomatch = $1;
            my $cidr = $2;
+           my $errors;
 
-           if($cidr !~ m/^${ip_alias_pattern}$/) {
-               $cidr =~ s|/32$||;
+           if ($nomatch && !$feature_ipset_nomatch) {
+               $errors->{nomatch} = "nomatch not supported by kernel";
+           }
 
-               eval { pve_verify_ipv4_or_cidr($cidr); };
-               if (my $err = $@) {
-                   warn "$prefix: $cidr - $err";
-                   next;
+           eval { 
+               if ($cidr =~ m/^${ip_alias_pattern}$/) {
+                   resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists
+               } else {
+                   $cidr =~ s|/32$||;
+                   pve_verify_ipv4_or_cidr_or_alias($cidr);
                }
+           };
+           if (my $err = $@) {
+               $errors->{cidr} = $err;
            }
 
            my $entry = { cidr => $cidr };
            $entry->{nomatch} = 1 if $nomatch;
            $entry->{comment} = $comment if $comment;
+           $entry->{errors} =  $errors if $errors;
 
            push @{$res->{$section}->{$group}}, $entry;
        } else {
@@ -2608,20 +2629,11 @@ sub generate_ipset {
     # remove duplicates
     my $nethash = {};
     foreach my $entry (@$options) {
-       my $cidr = $entry->{cidr};
-       if ($cidr =~ m/^${ip_alias_pattern}$/) {
-           my $alias = lc($cidr);
-           my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
-           $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf;
-           if ($e) {
-               $entry->{cidr} = $e->{cidr};
-               $nethash->{$entry->{cidr}} = $entry;
-           } else {
-               warn "no such alias '$cidr'\n";
-           }
-       } else {
-           $nethash->{$entry->{cidr}} = $entry;
-       }
+       eval {
+           my $cidr = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr});
+           $nethash->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} };
+       };
+       warn $@ if $@;
     }
 
     foreach my $cidr (sort keys %$nethash) {