src/PVE/APIServer/Utils.pm

   1 package PVE::APIServer::Utils;
   2
   3 use strict;
   4 use warnings;
   5
   6 use Net::IP;
   7
   8 # all settings are used for pveproxy and pmgproxy
   9 # the ALLOW/DENY/POLICY is also used by spiceproxy
  10 sub read_proxy_config {
  11     my ($proxy_name) = @_;
  12
  13     my $conffile = "/etc/default/$proxy_name";
  14
  15     # Note: evaluate with bash
  16     my $shcmd = ". $conffile;\n";
  17     $shcmd .= 'echo \"LISTEN_IP:\$LISTEN_IP\";';
  18     $shcmd .= 'echo \"ALLOW_FROM:\$ALLOW_FROM\";';
  19     $shcmd .= 'echo \"DENY_FROM:\$DENY_FROM\";';
  20     $shcmd .= 'echo \"POLICY:\$POLICY\";';
  21     $shcmd .= 'echo \"CIPHERS:\$CIPHERS\";';
  22     $shcmd .= 'echo \"CIPHERSUITES:\$CIPHERSUITES\";';
  23     $shcmd .= 'echo \"DHPARAMS:\$DHPARAMS\";';
  24     $shcmd .= 'echo \"HONOR_CIPHER_ORDER:\$HONOR_CIPHER_ORDER\";';
  25     $shcmd .= 'echo \"COMPRESSION:\$COMPRESSION\";';
  26
  27     my $data = -f $conffile ? `bash -c "$shcmd"` : '';
  28
  29     my $res = {};
  30
  31     while ($data =~ s/^(.*)\n//) {
  32         my ($key, $value) = split(/:/, $1, 2);
  33         next if !defined($value) || $value eq '';
  34         if ($key eq 'ALLOW_FROM' || $key eq 'DENY_FROM') {
  35             my $ips = [];
  36             foreach my $ip (split(/,/, $value)) {
  37                 if ($ip eq 'all') {
  38                     push @$ips, Net::IP->new('0/0') || die Net::IP::Error() . "\n";
  39                     push @$ips, Net::IP->new('::/0') || die Net::IP::Error() . "\n";
  40                     next;
  41                 }
  42                 push @$ips, Net::IP->new(normalize_v4_in_v6($ip)) || die Net::IP::Error() . "\n";
  43             }
  44             $res->{$key} = $ips;
  45         } elsif ($key eq 'LISTEN_IP') {
  46             $res->{$key} = $value;
  47         } elsif ($key eq 'POLICY') {
  48             die "unknown policy '$value'\n" if $value !~ m/^(allow|deny)$/;
  49             $res->{$key} = $value;
  50         } elsif ($key eq 'CIPHERS') {
  51             $res->{$key} = $value;
  52         } elsif ($key eq 'CIPHERSUITES') {
  53             $res->{$key} = $value;
  54         } elsif ($key eq 'DHPARAMS') {
  55             $res->{$key} = $value;
  56         } elsif ($key eq 'HONOR_CIPHER_ORDER' || $key eq 'COMPRESSION') {
  57             die "unknown value '$value' - use 0 or 1\n" if $value !~ m/^(0|1)$/;
  58             $res->{$key} = $value;
  59         } else {
  60             # silently skip everythin else?
  61         }
  62     }
  63
  64     return $res;
  65 }
  66
  67 sub normalize_v4_in_v6 {
  68     my ($ip_text) = @_;
  69
  70     my $ip = Net::IP->new($ip_text) || die Net::IP::Error() . "\n";
  71     my $v4_mapped_v6_prefix = Net::IP->new('::ffff:0:0/96');
  72     if ($v4_mapped_v6_prefix->overlaps($ip)) {
  73         return Net::IP::ip_get_embedded_ipv4($ip_text);
  74     }
  75     return $ip_text;
  76 }
  77
  78 1;