summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorStig Thormodsrud <stig@io.vyatta.com>2009-02-27 11:31:19 -0800
committerStig Thormodsrud <stig@io.vyatta.com>2009-02-27 11:31:19 -0800
commit09b937160c8aadf443ce9788af93b3e4a225645a (patch)
tree18060cc988c4b6877e6b6afd596c11bfbcb2c66d /lib
parent250a07e2a816fdf7d295d743fcc892faae8e9c9a (diff)
downloadvyatta-cfg-firewall-09b937160c8aadf443ce9788af93b3e4a225645a.tar.gz
vyatta-cfg-firewall-09b937160c8aadf443ce9788af93b3e4a225645a.zip
Limit address range to a /24, but make easy to change if it's deam too restrictive.
Diffstat (limited to 'lib')
-rwxr-xr-xlib/Vyatta/IpTables/IpSet.pm15
1 files changed, 13 insertions, 2 deletions
diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm
index 01486dd..60ec2f2 100755
--- a/lib/Vyatta/IpTables/IpSet.pm
+++ b/lib/Vyatta/IpTables/IpSet.pm
@@ -48,6 +48,12 @@ my %grouptype_hash = (
my $logger = 'logger -t IpSet.pm -p local0.warn --';
+# Currently we restrict an address range to a /24 even
+# though ipset would support a /16. The main reason is
+# due to the long time it takes to make that many calls
+# to add each individual member to the set.
+my $addr_range_mask = 24;
+
sub new {
my ($that, $name, $type) = @_;
@@ -242,6 +248,11 @@ sub check_member {
if ($stop_ip <= $start_ip) {
return "Error: $1 must be less than $2\n";
}
+ my $start_net = new NetAddr::IP("$1/$addr_range_mask");
+ if (! $start_net->contains($stop_ip)) {
+ return "Error: address range must be within /$addr_range_mask\n";
+ }
+
} else {
my $rc = check_member_address($member);
return $rc if defined $rc;
@@ -294,7 +305,7 @@ sub add_member_range {
} elsif ($self->{_type} eq 'address') {
# $start_ip++ won't work if it doesn't know the
# prefix, so we'll make a big range.
- my $start_ip = new NetAddr::IP("$start/16");
+ my $start_ip = new NetAddr::IP("$start/$addr_range_mask");
my $stop_ip = new NetAddr::IP($stop);
for (; $start_ip <= $stop_ip; $start_ip++) {
my $rc = $self->add_member($start_ip->addr());
@@ -332,7 +343,7 @@ sub delete_member_range {
return $rc if defined $rc;
}
} elsif ($self->{_type} eq 'address') {
- my $start_ip = new NetAddr::IP("$start/16");
+ my $start_ip = new NetAddr::IP("$start/$addr_range_mask");
my $stop_ip = new NetAddr::IP($stop);
for (; $start_ip <= $stop_ip; $start_ip++) {
my $rc = $self->delete_member($start_ip->addr());