check multiport limit in port ranges

[pve-firewall.git] / src / PVE / Firewall.pm

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index c858b853bff4dca88e15f2ee7d3dff3e042c53e7..bc3d9fe083b4d2c28ba7871dabddb4db1a810ef8 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1035,12 +1035,13 @@ sub parse_port_name_number_or_range {
     my @elements = split(/,/, $str);
     die "extraneous commas in list\n" if $str ne join(',', @elements);
     foreach my $item (@elements) {
-       $count++;
        if ($item =~ m/^(\d+):(\d+)$/) {
+           $count += 2;
            my ($port1, $port2) = ($1, $2);
            die "invalid port '$port1'\n" if $port1 > 65535;
            die "invalid port '$port2'\n" if $port2 > 65535;
        } elsif ($item =~ m/^(\d+)$/) {
+           $count += 1;
            my $port = $1;
            die "invalid port '$port'\n" if $port > 65535;
        } else {
@@ -1054,7 +1055,13 @@ sub parse_port_name_number_or_range {
        }
     }
 
-    die "ICPM ports not allowed in port range\n" if $icmp_port && $count > 1;
+    die "ICPM ports not allowed in port range\n" if $icmp_port && $count > 0;
+
+    # I really don't like to use the word number here, but it's the only thing
+    # that makes sense in a literal way. The range 1:100 counts as 2, not as
+    # one and not as 100...
+    die "too many entries in port list (> 15 numbers)\n"
+       if $count > 15;
 
     return $count;
 }
@@ -2417,6 +2424,7 @@ sub generate_group_rules {
 
     foreach my $rule (@$rules) {
        next if $rule->{type} ne 'in';
+       next if !$rule->{enable} || $rule->{errors};
        next if $rule->{ipversion} && $rule->{ipversion} ne $ipversion;
        rule_substitude_action($rule, { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" });
        ruleset_generate_rule($ruleset, $chain, $ipversion, $rule, $cluster_conf);
@@ -2429,6 +2437,7 @@ sub generate_group_rules {
 
     foreach my $rule (@$rules) {
        next if $rule->{type} ne 'out';
+       next if !$rule->{enable} || $rule->{errors};
        next if $rule->{ipversion} && $rule->{ipversion} ne $ipversion;
        # we use PVEFW-SET-ACCEPT-MARK (Instead of ACCEPT) because we need to
        # check also other tap rules later