From 0588bf2aa6d0b80bf8bb36e4c80966d384471acb Mon Sep 17 00:00:00 2001 From: Thomas Lamprecht Date: Mon, 4 May 2020 14:13:23 +0200 Subject: [PATCH] add dport: factor out ICMP-type validity checking Signed-off-by: Thomas Lamprecht --- src/PVE/Firewall.pm | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index a6157e3..eadfc6b 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -812,6 +812,17 @@ my $icmpv6_type_names = { 'redirect' => 1, }; +my $is_valid_icmp_type = sub { + my ($type, $valid_types) = @_; + + if ($type =~ m/^\d+$/) { + # values for icmp-type range between 0 and 255 (8 bit field) + die "invalid icmp-type '$type'\n" if $type > 255; + } else { + die "unknown icmp-type '$type'\n" if !defined($valid_types->{$type}); + } +}; + sub init_firewall_macros { $pve_fw_parsed_macros = {}; @@ -2041,21 +2052,12 @@ sub ipt_rule_to_cmds { my $add_dport = sub { return if !defined($rule->{dport}); + # NOTE: we re-use dport to store --icmp-type for icmp* protocol if ($proto eq 'icmp') { - # Note: we use dport to store --icmp-type - die "unknown icmp-type '$rule->{dport}'\n" - if $rule->{dport} !~ /^\d+$/ && !defined($icmp_type_names->{$rule->{dport}}); - # values for icmp-type range between 0 and 255 - # higher values and iptables-restore fails - die "invalid icmp-type '$rule->{dport}'\n" if ($rule->{dport} =~ m/^(\d+)$/) && ($1 > 255); + $is_valid_icmp_type->($rule->{dport}, $icmp_type_names); push @match, "-m icmp --icmp-type $rule->{dport}"; } elsif ($proto eq 'icmpv6') { - # Note: we use dport to store --icmpv6-type - die "unknown icmpv6-type '$rule->{dport}'\n" - if $rule->{dport} !~ /^\d+$/ && !defined($icmpv6_type_names->{$rule->{dport}}); - # values for icmpv6-type range between 0 and 255 - # higher values and iptables-restore fails - die "invalid icmpv6-type '$rule->{dport}'\n" if ($rule->{dport} =~ m/^(\d+)$/) && ($1 > 255); + $is_valid_icmp_type->($rule->{dport}, $icmpv6_type_names); push @match, "-m icmpv6 --icmpv6-type $rule->{dport}"; } elsif (!$PROTOCOLS_WITH_PORTS->{$proto}) { die "protocol $proto does not have ports\n"; -- 2.39.2