allow non zero ip address host bits to be entered

They can already be set directly via the cluster.fw file. Net::IP is just a
bit more picky with what it allows:
For example:
  error:   192.168.1.155/24
  correct: 192.168.1.0/24

This cleans the entered IP and removes the non zero host bits.

Signed-off-by: Stefan Hrdlicka <s.hrdlicka@proxmox.com>

diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm
index a5f69e9ac4042c51ff783fd3f1c5b264b8c33567..14bcfcb08e7456370dcfcd0df71b99c774f46be0 100644 (file)
--- a/src/PVE/API2/Firewall/IPSet.pm
+++ b/src/PVE/API2/Firewall/IPSet.pm
@@ -199,7 +199,7 @@ sub register_create_ip {
 
                my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param);
 
-               my $cidr = $param->{cidr};
+               my $cidr = PVE::Firewall::clean_cidr($param->{cidr});
                if ($cidr =~ m/^${PVE::Firewall::ip_alias_pattern}$/) {
                    # make sure alias exists (if $cidr is an alias)
                    PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $cidr);

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index d40a9b17328144fefd9c6ef308a460d9566a6664..ae5f22110e0b031555e33a2bc2d53e50894a6503 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -69,8 +69,12 @@ sub pve_verify_ip_or_cidr {
     my ($cidr, $noerr) = @_;
 
     if ($cidr =~ m!^(?:$IPV6RE|$IPV4RE)(/(\d+))?$!) {
-       return $cidr if Net::IP->new($cidr);
+        # Net::IP throws an error if the masked CIDR part isn't zero, e.g., `192.168.1.155/24`
+        # fails but `192.168.1.0/24` succeeds. clean_cidr removes the non zero bits from the CIDR.
+       my $clean_cidr = clean_cidr($cidr);
+       return $cidr if Net::IP->new($clean_cidr);
        return undef if $noerr;
+
        die Net::IP::Error() . "\n";
     }
     return undef if $noerr;
@@ -86,6 +90,19 @@ sub pve_verify_ip_or_cidr_or_alias {
     return pve_verify_ip_or_cidr($cidr, $noerr);
 }
 
+sub clean_cidr {
+    my ($cidr) = @_;
+    my ($ip, $len) = split('/', $cidr);
+    return $cidr if !$len;
+    my $ver = ($ip =~ m!^$IPV4RE$!) ? 4 : 6;
+
+    my $bin_ip = Net::IP::ip_iptobin( Net::IP::ip_expand_address($ip, $ver), $ver);
+    my $bin_mask = Net::IP::ip_get_mask($len, $ver);
+    my $clean_ip = Net::IP::ip_compress_address( Net::IP::ip_bintoip($bin_ip & $bin_mask, $ver), $ver);
+
+    return "${clean_ip}/$len";
+}
+
 PVE::JSONSchema::register_standard_option('ipset-name', {
     description => "IP set name.",
     type => 'string',