X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=da1784cf66cbbf7c4f72771724f8193691b9cd41;hp=e349ee7769a6d529a3414075bf04520085e31d06;hb=be99c6a0e95108bd9fe84b3c238e216ed2b31e64;hpb=644b5fc95ad95e370893f902e3296b948f182f9a

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index e349ee7..da1784c 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1623,6 +1623,8 @@ sub verify_rule {
 		if !$allow_groups;
 	    &$add_error('action', "invalid characters in security group name")
 		if $action && ($action !~ m/^${security_group_name_pattern}$/);
+	    &$add_error('action', "security group '$action' does not exist")
+		if $action && !defined($cluster_conf->{groups}->{$action});
 	} else {
 	    &$add_error('type', "unknown rule type '$type'");
 	}
@@ -2041,11 +2043,17 @@ sub ipt_rule_to_cmds {
 		    # Note: we use dport to store --icmp-type
 		    die "unknown icmp-type '$rule->{dport}'\n"
 			if $rule->{dport} !~ /^\d+$/ && !defined($icmp_type_names->{$rule->{dport}});
+		    # values for icmp-type range between 0 and 255
+		    # higher values and iptables-restore fails
+		    die "invalid icmp-type '$rule->{dport}'\n" if ($rule->{dport} =~ m/^(\d+)$/) && ($1 > 255);
 		    push @match, "-m icmp --icmp-type $rule->{dport}";
 		} elsif ($proto eq 'icmpv6') {
 		    # Note: we use dport to store --icmpv6-type
 		    die "unknown icmpv6-type '$rule->{dport}'\n"
 			if $rule->{dport} !~ /^\d+$/ && !defined($icmpv6_type_names->{$rule->{dport}});
+		    # values for icmpv6-type range between 0 and 255
+		    # higher values and iptables-restore fails
+		    die "invalid icmpv6-type '$rule->{dport}'\n" if ($rule->{dport} =~ m/^(\d+)$/) && ($1 > 255);
 		    push @match, "-m icmpv6 --icmpv6-type $rule->{dport}";
 		} elsif (!$PROTOCOLS_WITH_PORTS->{$proto}) {
 		    die "protocol $proto does not have ports\n";