improve search for local-network
authorWolfgang Bumiller <w.bumiller@proxmox.com>
Wed, 23 Nov 2016 09:23:36 +0000 (10:23 +0100)
committerDietmar Maurer <dietmar@proxmox.com>
Tue, 29 Nov 2016 05:33:48 +0000 (06:33 +0100)
Skip zero-prefix routes as they make no sense to be
considered (and ipset doesn't allow ::/0 to be added
anyway).

Support /128 local addresses by also checking for identical
addresses beside b-in-a overlapping.

src/PVE/Firewall.pm

index cf96564..ef74ca2 100644 (file)
@@ -911,13 +911,17 @@ sub local_network {
            my $mask;
            if ($isv6) {
                $mask = $entry->{prefix};
+               next if !$mask; # skip the default route...
            } else {
                $mask = $PVE::Network::ipv4_mask_hash_localnet->{$entry->{mask}};
                next if !defined($mask);
            }
            my $cidr = "$entry->{dest}/$mask";
            my $testnet = Net::IP->new($cidr);
-           if ($testnet->overlaps($testip) == $Net::IP::IP_B_IN_A_OVERLAP) {
+           my $overlap = $testnet->overlaps($testip);
+           if ($overlap == $Net::IP::IP_B_IN_A_OVERLAP ||
+               $overlap == $Net::IP::IP_IDENTICAL)
+           {
                $__local_network = $cidr;
                return;
            }