They can already be set directly via the cluster.fw file. Net::IP is just a bit more picky with what it allows: For example: error: 192.168.1.155/24 correct: 192.168.1.0/24
This cleans the entered IP and removes the non zero host bits. Signed-off-by: Stefan Hrdlicka <[email protected]> --- src/PVE/API2/Firewall/IPSet.pm | 2 +- src/PVE/Firewall.pm | 19 ++++++++++++++++++- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/src/PVE/API2/Firewall/IPSet.pm b/src/PVE/API2/Firewall/IPSet.pm index a5f69e9..14bcfcb 100644 --- a/src/PVE/API2/Firewall/IPSet.pm +++ b/src/PVE/API2/Firewall/IPSet.pm @@ -199,7 +199,7 @@ sub register_create_ip { my ($cluster_conf, $fw_conf, $ipset) = $class->load_config($param); - my $cidr = $param->{cidr}; + my $cidr = PVE::Firewall::clean_cidr($param->{cidr}); if ($cidr =~ m/^${PVE::Firewall::ip_alias_pattern}$/) { # make sure alias exists (if $cidr is an alias) PVE::Firewall::resolve_alias($cluster_conf, $fw_conf, $cidr); diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm index d40a9b1..ae5f221 100644 --- a/src/PVE/Firewall.pm +++ b/src/PVE/Firewall.pm @@ -69,8 +69,12 @@ sub pve_verify_ip_or_cidr { my ($cidr, $noerr) = @_; if ($cidr =~ m!^(?:$IPV6RE|$IPV4RE)(/(\d+))?$!) { - return $cidr if Net::IP->new($cidr); + # Net::IP throws an error if the masked CIDR part isn't zero, e.g., `192.168.1.155/24` + # fails but `192.168.1.0/24` succeeds. clean_cidr removes the non zero bits from the CIDR. + my $clean_cidr = clean_cidr($cidr); + return $cidr if Net::IP->new($clean_cidr); return undef if $noerr; + die Net::IP::Error() . "\n"; } return undef if $noerr; @@ -86,6 +90,19 @@ sub pve_verify_ip_or_cidr_or_alias { return pve_verify_ip_or_cidr($cidr, $noerr); } +sub clean_cidr { + my ($cidr) = @_; + my ($ip, $len) = split('/', $cidr); + return $cidr if !$len; + my $ver = ($ip =~ m!^$IPV4RE$!) ? 4 : 6; + + my $bin_ip = Net::IP::ip_iptobin( Net::IP::ip_expand_address($ip, $ver), $ver); + my $bin_mask = Net::IP::ip_get_mask($len, $ver); + my $clean_ip = Net::IP::ip_compress_address( Net::IP::ip_bintoip($bin_ip & $bin_mask, $ver), $ver); + + return "${clean_ip}/$len"; +} + PVE::JSONSchema::register_standard_option('ipset-name', { description => "IP set name.", type => 'string', -- 2.30.2 _______________________________________________ pve-devel mailing list [email protected] https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
