code cleanup

diff --git a/src/PVE/API2/Firewall/Aliases.pm b/src/PVE/API2/Firewall/Aliases.pm
index e25ae9cb3b4fd5f98ecbc59e0e8acf5b34318c0c..54af9150abb76c0cee8f16616658741c1f88a63b 100644 (file)
--- a/src/PVE/API2/Firewall/Aliases.pm
+++ b/src/PVE/API2/Firewall/Aliases.pm
@@ -12,7 +12,7 @@ use base qw(PVE::RESTHandler);
 my $api_properties = { 
     cidr => {
        description => "Network/IP specification in CIDR format.",
 my $api_properties = { 
     cidr => {
        description => "Network/IP specification in CIDR format.",

-       type => 'string', format => 'IPv4orCIDR',
+       type => 'string', format => 'IPorCIDR',

     },
     name => get_standard_option('pve-fw-alias'),
     rename => get_standard_option('pve-fw-alias', {
     },
     name => get_standard_option('pve-fw-alias'),
     rename => get_standard_option('pve-fw-alias', {

diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm
index 70acab4bdfb56f94cf277f3533a4d324d68e7752..60f710596f488911d5b50205853eb6d76b2c336d 100644 (file)
--- a/src/PVE/API2/Firewall/IPSet.pm
+++ b/src/PVE/API2/Firewall/IPSet.pm
@@ -12,7 +12,7 @@ use base qw(PVE::RESTHandler);
 my $api_properties = { 
     cidr => {
        description => "Network/IP specification in CIDR format.",
 my $api_properties = { 
     cidr => {
        description => "Network/IP specification in CIDR format.",

-       type => 'string', format => 'IPv4orCIDRorAlias',
+       type => 'string', format => 'IPorCIDRorAlias',

     },
     name => get_standard_option('ipset-name'),
     comment => {
     },
     name => get_standard_option('ipset-name'),
     comment => {

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index a908ef01ad27a4262f90c4cb581c491177d0c971..03e75f99538064e9836bfb898329c137c47b7f57 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -44,8 +44,8 @@ my $max_alias_name_length = 64;
 my $max_ipset_name_length = 64;
 my $max_group_name_length = 20;
 
 my $max_ipset_name_length = 64;
 my $max_group_name_length = 20;
 

-PVE::JSONSchema::register_format('IPv4orCIDR', \&pve_verify_ipv4_or_cidr);
-sub pve_verify_ipv4_or_cidr {
+PVE::JSONSchema::register_format('IPorCIDR', \&pve_verify_ip_or_cidr);
+sub pve_verify_ip_or_cidr {

     my ($cidr, $noerr) = @_;
 
     if ($cidr =~ m!^(?:$IPV6RE|$IPV4RE)(/(\d+))?$!) {
     my ($cidr, $noerr) = @_;
 
     if ($cidr =~ m!^(?:$IPV6RE|$IPV4RE)(/(\d+))?$!) {


@@ -57,19 +57,13 @@ sub pve_verify_ipv4_or_cidr {
     die "value does not look like a valid IP address or CIDR network\n";
 }
 
     die "value does not look like a valid IP address or CIDR network\n";
 }
 

-PVE::JSONSchema::register_format('IPv4orCIDRorAlias', \&pve_verify_ipv4_or_cidr_or_alias);
-sub pve_verify_ipv4_or_cidr_or_alias {
+PVE::JSONSchema::register_format('IPorCIDRorAlias', \&pve_verify_ip_or_cidr_or_alias);
+sub pve_verify_ip_or_cidr_or_alias {

     my ($cidr, $noerr) = @_;
 
     return if $cidr =~ m/^(?:$ip_alias_pattern)$/;
 
     my ($cidr, $noerr) = @_;
 
     return if $cidr =~ m/^(?:$ip_alias_pattern)$/;
 

-    if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) {
-       return $cidr if Net::IP->new($cidr);
-       return undef if $noerr;
-       die Net::IP::Error() . "\n";
-    }
-    return undef if $noerr;
-    die "value does not look like a valid IP address or CIDR network\n";
+    return pve_verify_ip_or_cidr($cidr, $noerr);

 }
 
 PVE::JSONSchema::register_standard_option('ipset-name', {
 }
 
 PVE::JSONSchema::register_standard_option('ipset-name', {


@@ -1100,7 +1094,7 @@ sub verify_rule {
     };
 
     my $check_ipset_or_alias_property = sub {
     };
 
     my $check_ipset_or_alias_property = sub {

-       my ($name) = @_;
+       my ($name, $expected_ipversion) = @_;

 
        if (my $value = $rule->{$name}) {
            if ($value =~ m/^\+/) {
 
        if (my $value = $rule->{$name}) {
            if ($value =~ m/^\+/) {


@@ -1119,7 +1113,8 @@ sub verify_rule {
                my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
                $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf;
 
                my $e = $fw_conf->{aliases}->{$alias} if $fw_conf;
                $e = $cluster_conf->{aliases}->{$alias} if !$e && $cluster_conf;
 

-               $ipversion = $e->{ipversion};
+               die "detected mixed ipv4/ipv6 adresses in rule\n"
+                   if $expected_ipversion && ($expected_ipversion != $e->{ipversion});

            }
        }
     };
            }
        }
     };


@@ -1190,18 +1185,18 @@ sub verify_rule {
     if ($rule->{source}) {
        eval { $ipversion = parse_address_list($rule->{source}); };
        &$add_error('source', $@) if $@;
     if ($rule->{source}) {
        eval { $ipversion = parse_address_list($rule->{source}); };
        &$add_error('source', $@) if $@;

-       &$check_ipset_or_alias_property('source');
+       &$check_ipset_or_alias_property('source', $ipversion);

     }
 
     if ($rule->{dest}) {
        eval { 
            my $dest_ipversion = parse_address_list($rule->{dest}); 
            die "detected mixed ipv4/ipv6 adresses in rule\n"
     }
 
     if ($rule->{dest}) {
        eval { 
            my $dest_ipversion = parse_address_list($rule->{dest}); 
            die "detected mixed ipv4/ipv6 adresses in rule\n"

-               if defined($ipversion) && ($dest_ipversion != $ipversion);
-           $ipversion = $dest_ipversion;
+               if $ipversion && $dest_ipversion && ($dest_ipversion != $ipversion);
+           $ipversion = $dest_ipversion if $dest_ipversion;

        };
        &$add_error('dest', $@) if $@;
        };
        &$add_error('dest', $@) if $@;

-       &$check_ipset_or_alias_property('dest');
+       &$check_ipset_or_alias_property('dest', $ipversion);

     }
 
     if ($rule->{macro} && !$error_count) {
     }
 
     if ($rule->{macro} && !$error_count) {


@@ -2219,6 +2214,24 @@ sub resolve_alias {
     return $cidr;
 }
 
     return $cidr;
 }
 

+sub parse_ip_or_cidr {
+    my ($cidr) = @_;
+
+    my $ipversion;
+    
+    if ($cidr =~ m!^(?:$IPV6RE)(/(\d+))?$!) {
+       $cidr =~ s|/128$||;
+       $ipversion = 6;
+    } elsif ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) {
+       $cidr =~ s|/32$||;
+       $ipversion = 4;
+    } else {
+       die "value does not look like a valid IP address or CIDR network\n";
+    }
+
+    return wantarray ? ($cidr, $ipversion) : $cidr;
+}
+

 sub parse_alias {
     my ($line) = @_;
 
 sub parse_alias {
     my ($line) = @_;
 


@@ -2227,10 +2240,10 @@ sub parse_alias {
 
     if ($line =~ m/^(\S+)\s(\S+)$/) {
        my ($name, $cidr) = ($1, $2);
 
     if ($line =~ m/^(\S+)\s(\S+)$/) {
        my ($name, $cidr) = ($1, $2);

-       $cidr =~ s|/32$||;
-       $cidr =~ s|/128$||;
-       pve_verify_ipv4_or_cidr($cidr);
-       my $ipversion = get_ip_version($cidr);
+       my $ipversion;
+
+       ($cidr, $ipversion) = parse_ip_or_cidr($cidr);
+

        my $data = {
            name => $name,
            cidr => $cidr,
        my $data = {
            name => $name,
            cidr => $cidr,


@@ -2243,20 +2256,6 @@ sub parse_alias {
     return undef;
 }
 
     return undef;
 }
 

-sub get_ip_version {
-    my ($cidr) = @_;
-
-    my $ipversion = undef;
-
-    if ($cidr =~ m!^(?:$IPV4RE)(/(\d+))?$!) {
-       $ipversion = '4';
-    }elsif ($cidr =~ m!^(?:$IPV6RE)(/(\d+))?$!) {
-       $ipversion = '6';
-    }
-
-    return $ipversion;
-}
-

 sub generic_fw_config_parser {
     my ($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env) = @_;
 
 sub generic_fw_config_parser {
     my ($filename, $fh, $verbose, $cluster_conf, $empty_conf, $rule_env) = @_;
 


@@ -2386,8 +2385,7 @@ sub generic_fw_config_parser {
                if ($cidr =~ m/^${ip_alias_pattern}$/) {
                    resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists
                } else {
                if ($cidr =~ m/^${ip_alias_pattern}$/) {
                    resolve_alias($cluster_conf, $res, $cidr); # make sure alias exists
                } else {

-                   $cidr =~ s|/32$||;
-                   pve_verify_ipv4_or_cidr_or_alias($cidr);
+                   $cidr = parse_ip_or_cidr($cidr);

                }
            };
            if (my $err = $@) {
                }
            };
            if (my $err = $@) {