verify_rule: detected mixed ipv4/ipv6 addresses

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 37dbcb0acf57c11e6a739762abd7a144b1286da8..b98dbdfbed8341574e567a796e8672c35b608a51 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -806,13 +806,14 @@ sub parse_address_list {
 
     foreach my $elem (split(/,/, $str)) {
        $count++;
-       if (!Net::IP->new($elem)) {
+       my $ip = Net::IP->new($elem);
+       if (!$ip) {
            my $err = Net::IP::Error();
            die "invalid IP address: $err\n";
        }
        $iprange = 1 if $elem =~ m/-/;
 
-       my $new_ipversion = Net::IP::ip_get_version($elem); #fixme : don't work with range
+       my $new_ipversion = Net::IP::ip_is_ipv6($ip->ip()) ? 6 : 4;
 
        die "detected mixed ipv4/ipv6 addresses in address list '$str'\n"
            if defined($ipversion) && ($new_ipversion != $ipversion);
@@ -1082,7 +1083,6 @@ sub verify_rule {
     my ($rule, $cluster_conf, $fw_conf, $rule_env, $noerr) = @_;
 
     my $allow_groups = $rule_env eq 'group' ? 0 : 1;
-    my $ipversion = undef;
 
     my $allow_iface = $rule_env_iface_lookup->{$rule_env};
     die "unknown rule_env '$rule_env'\n" if !defined($allow_iface); # should not happen
@@ -1180,6 +1180,8 @@ sub verify_rule {
            if !$rule->{proto};
     }
 
+    my $ipversion;
+
     if ($rule->{source}) {
        eval { $ipversion = parse_address_list($rule->{source}); };
        &$add_error('source', $@) if $@;
@@ -1187,7 +1189,12 @@ sub verify_rule {
     }
 
     if ($rule->{dest}) {
-       eval { $ipversion = parse_address_list($rule->{dest}); };
+       eval { 
+           my $dest_ipversion = parse_address_list($rule->{dest}); 
+           die "detected mixed ipv4/ipv6 adresses in rule\n"
+               if defined($ipversion) && ($dest_ipversion != $ipversion);
+           $ipversion = $dest_ipversion;
+       };
        &$add_error('dest', $@) if $@;
        &$check_ipset_or_alias_property('dest');
     }