X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=src%2FPVE%2FFirewall.pm;h=ef74ca2fae597a882ea30e778c49cee8cfc5ff77;hp=22bf61dd7315a166f898bd0a79a4e514f186449f;hb=15c800003e921cfd627ef0b6213b9ff09fe3d8c8;hpb=e50429af2cab704c2c1d55009a29e3054d075627

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 22bf61d..ef74ca2 100644
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -52,6 +52,14 @@ my $max_alias_name_length = 64;
 my $max_ipset_name_length = 64;
 my $max_group_name_length = 18;
 
+my $PROTOCOLS_WITH_PORTS = {
+    udp => 1,     17 => 1,
+    udplite => 1, 136 => 1,
+    tcp => 1,     6 => 1,
+    dccp => 1,    33 => 1,
+    sctp => 1,    132 => 1,
+};
+
 PVE::JSONSchema::register_format('IPorCIDR', \&pve_verify_ip_or_cidr);
 sub pve_verify_ip_or_cidr {
     my ($cidr, $noerr) = @_;
@@ -322,6 +330,10 @@ my $pve_fw_macros = {
 	{ action => 'PARAM', proto => 'tcp', dport => '465' },
 	{ action => 'PARAM', proto => 'tcp', dport => '587' },
     ],
+    'MDNS' => [
+	"Multicast DNS",
+	{ action => 'PARAM', proto => 'udp', dport => '5353' },
+    ],
     'Munin' => [
 	"Munin networked resource monitoring traffic",
 	{ action => 'PARAM', proto => 'tcp', dport => '4949' },
@@ -899,13 +911,17 @@ sub local_network {
 	    my $mask;
 	    if ($isv6) {
 		$mask = $entry->{prefix};
+		next if !$mask; # skip the default route...
 	    } else {
 		$mask = $PVE::Network::ipv4_mask_hash_localnet->{$entry->{mask}};
 		next if !defined($mask);
 	    }
 	    my $cidr = "$entry->{dest}/$mask";
 	    my $testnet = Net::IP->new($cidr);
-	    if ($testnet->overlaps($testip) == $Net::IP::IP_B_IN_A_OVERLAP) {
+	    my $overlap = $testnet->overlaps($testip);
+	    if ($overlap == $Net::IP::IP_B_IN_A_OVERLAP ||
+	        $overlap == $Net::IP::IP_IDENTICAL)
+	    {
 		$__local_network = $cidr;
 		return;
 	    }
@@ -1498,15 +1514,22 @@ sub verify_rule {
     if ($rule->{dport}) {
 	eval { parse_port_name_number_or_range($rule->{dport}, 1); };
 	&$add_error('dport', $@) if $@;
+	my $proto = $rule->{proto};
 	&$add_error('proto', "missing property - 'dport' requires this property")
-	    if !$rule->{proto};
+	    if !$proto;
+	&$add_error('dport', "protocol '$proto' does not support ports")
+	    if !$PROTOCOLS_WITH_PORTS->{$proto} &&
+		$proto ne 'icmp' && $proto ne 'icmpv6'; # special cases
     }
 
     if ($rule->{sport}) {
 	eval { parse_port_name_number_or_range($rule->{sport}, 0); };
 	&$add_error('sport', $@) if $@;
+	my $proto = $rule->{proto};
 	&$add_error('proto', "missing property - 'sport' requires this property")
-	    if !$rule->{proto};
+	    if !$proto;
+	&$add_error('sport', "protocol '$proto' does not support ports")
+	    if !$PROTOCOLS_WITH_PORTS->{$proto};
     }
 
     if ($rule->{source}) {
@@ -1827,8 +1850,8 @@ sub ruleset_generate_cmdstr {
         }
     }
 
-    if ($rule->{proto}) {
-	push @cmd, "-p $rule->{proto}";
+    if (my $proto = $rule->{proto}) {
+	push @cmd, "-p $proto";
 
 	my $multiport = 0;
 	$multiport++ if $nbdport > 1;
@@ -1840,16 +1863,18 @@ sub ruleset_generate_cmdstr {
 	    if ($multiport == 2) && ($rule->{dport} ne $rule->{sport});
 
 	if ($rule->{dport}) {
-	    if ($rule->{proto} && $rule->{proto} eq 'icmp') {
+	    if ($proto eq 'icmp') {
 		# Note: we use dport to store --icmp-type
 		die "unknown icmp-type '$rule->{dport}'\n"
 		    if $rule->{dport} !~ /^\d+$/ && !defined($icmp_type_names->{$rule->{dport}});
 		push @cmd, "-m icmp --icmp-type $rule->{dport}";
-	    } elsif ($rule->{proto} && $rule->{proto} eq 'icmpv6') {
+	    } elsif ($proto eq 'icmpv6') {
 		# Note: we use dport to store --icmpv6-type
 		die "unknown icmpv6-type '$rule->{dport}'\n"
 		    if $rule->{dport} !~ /^\d+$/ && !defined($icmpv6_type_names->{$rule->{dport}});
 		push @cmd, "-m icmpv6 --icmpv6-type $rule->{dport}";
+	    } elsif (!$PROTOCOLS_WITH_PORTS->{$proto}) {
+		die "protocol $proto does not have ports\n";
 	    } else {
 		if ($nbdport > 1) {
 		    if ($multiport == 2) {
@@ -1864,6 +1889,8 @@ sub ruleset_generate_cmdstr {
 	}
 
 	if ($rule->{sport}) {
+	    die "protocol $proto does not have ports\n"
+		 if !$PROTOCOLS_WITH_PORTS->{$proto};
 	    if ($nbsport > 1) {
 		push @cmd, "--sports $rule->{sport}" if $multiport != 2;
 	    } else {