code cleanup - introcduce new method resolve_alias

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 669c5d5fa34c288c74d8e143d95a817bec2beb4a..66f4b91a25aaf2f2b733dccf0a4edd9c143efb9d 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -2116,6 +2116,21 @@ sub parse_clusterfw_option {
     return ($opt, $value);
 }
 
+sub resolve_alias {
+    my ($clusterfw_conf, $fw_conf, $cidr) = @_;
+
+    if ($cidr !~ m/^\d/) {
+       my $alias = lc($cidr);
+       my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
+       $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf;
+       return $e->{cidr} if $e;
+       
+       die "no such alias '$cidr'\n";
+    }
+
+    return $cidr;
+}
+
 sub parse_alias {
     my ($line) = @_;
 
@@ -2137,7 +2152,7 @@ sub parse_alias {
     return undef;
 }
 
-sub generic_fw_rules_parser {
+sub generic_fw_config_parser {
     my ($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env) = @_;
 
     my $section;
@@ -2259,7 +2274,6 @@ sub generic_fw_rules_parser {
 
            if($cidr !~ m/^${ip_alias_pattern}$/) {
                $cidr =~ s|/32$||;
-
                eval { pve_verify_ipv4_or_cidr($cidr); };
                if (my $err = $@) {
                    warn "$prefix: $cidr - $err";
@@ -2281,15 +2295,15 @@ sub generic_fw_rules_parser {
     return $res;
 }
 
-sub parse_host_fw_rules {
+sub parse_hostfw_config {
     my ($filename, $fh, $cluster_conf, $verbose) = @_;
 
     my $empty_conf = { rules => [], options => {}};
 
-    return generic_fw_rules_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, 'host');
+    return generic_fw_config_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, 'host');
 }
 
-sub parse_vm_fw_rules {
+sub parse_vmfw_config {
     my ($filename, $fh, $cluster_conf, $rule_env, $verbose) = @_;
 
     my $empty_conf = {
@@ -2300,10 +2314,10 @@ sub parse_vm_fw_rules {
        ipset_comments => {},
     };
 
-    return generic_fw_rules_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env);
+    return generic_fw_config_parser($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env);
 }
 
-sub parse_cluster_fw_rules {
+sub parse_clusterfw_config {
     my ($filename, $fh, $verbose) = @_;
 
     my $section;
@@ -2319,7 +2333,7 @@ sub parse_cluster_fw_rules {
        ipset_comments => {},
     };
 
-    return generic_fw_rules_parser($filename, $fh, $verbose, $empty_conf, $empty_conf, 'cluster');
+    return generic_fw_config_parser($filename, $fh, $verbose, $empty_conf, $empty_conf, 'cluster');
 }
 
 sub run_locked {
@@ -2379,7 +2393,7 @@ sub load_vmfw_conf {
 
     my $filename = "$dir/$vmid.fw";
     if (my $fh = IO::File->new($filename, O_RDONLY)) {
-       $vmfw_conf = parse_vm_fw_rules($filename, $fh, $cluster_conf, $rule_env, $verbose);
+       $vmfw_conf = parse_vmfw_config($filename, $fh, $cluster_conf, $rule_env, $verbose);
        $vmfw_conf->{vmid} = $vmid;
     }
 
@@ -2608,20 +2622,11 @@ sub generate_ipset {
     # remove duplicates
     my $nethash = {};
     foreach my $entry (@$options) {
-       my $cidr = $entry->{cidr};
-       if ($cidr =~ m/^${ip_alias_pattern}$/) {
-           my $alias = lc($cidr);
-           my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
-           $e = $clusterfw_conf->{aliases}->{$alias} if !$e && $clusterfw_conf;
-           if ($e) {
-               $entry->{cidr} = $e->{cidr};
-               $nethash->{$entry->{cidr}} = $entry;
-           } else {
-               warn "no such alias '$cidr'\n";
-           }
-       } else {
-           $nethash->{$entry->{cidr}} = $entry;
-       }
+       eval {
+           my $cidr = resolve_alias($clusterfw_conf, $fw_conf, $entry->{cidr});
+           $nethash->{$cidr} = { cidr => $cidr, nomatch => $entry->{nomatch} };
+       };
+       warn $@ if $@;
     }
 
     foreach my $cidr (sort keys %$nethash) {
@@ -2655,7 +2660,7 @@ sub load_clusterfw_conf {
 
     my $cluster_conf = {};
     if (my $fh = IO::File->new($filename, O_RDONLY)) {
-       $cluster_conf = parse_cluster_fw_rules($filename, $fh, $verbose);
+       $cluster_conf = parse_clusterfw_config($filename, $fh, $verbose);
     }
 
     return $cluster_conf;
@@ -2704,7 +2709,7 @@ sub load_hostfw_conf {
 
     my $hostfw_conf = {};
     if (my $fh = IO::File->new($filename, O_RDONLY)) {
-       $hostfw_conf = parse_host_fw_rules($filename, $fh, $cluster_conf, $verbose);
+       $hostfw_conf = parse_hostfw_config($filename, $fh, $cluster_conf, $verbose);
     }
     return $hostfw_conf;
 }