fw4.uc: allow use of cidr in ipsets

Sets of type ipv4_addr or ipv6_addr support entries in CIDR notation.
However, the parse_ipsetentry ignores them. Fix this by using
parse_subnet instead of iptoarr.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Reviewed-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/root/usr/share/ucode/fw4.uc b/root/usr/share/ucode/fw4.uc
index cfbd632cdd8b32753c4a5060593e17f2d2f0484b..bfc568ee540d1274449d38654c7dee1cc8dd956f 100644 (file)
--- a/root/usr/share/ucode/fw4.uc
+++ b/root/usr/share/ucode/fw4.uc
@@ -1268,21 +1268,28 @@ return {
                for (let i, t in set.types) {
                        switch (t) {
                        case 'ipv4_addr':
-                               ip = iptoarr(values[i]);
+                               ip = filter(this.parse_subnet(values[i]), a => (a.family == 4));
 
-                               if (length(ip) != 4)
-                                       return null;
+                               switch (length(ip)) {
+                               case 0: return null;
+                               case 1: break;
+                               default: this.warn("Set entry '%s' resolves to multiple addresses, using first one", values[i]);
+                               }
 
-                               rv[i] = arrtoip(ip);
+                               rv[i] = ("net" in set.fw4types) ? ip[0].addr + "/" + ip[0].bits : ip[0].addr;
                                break;
 
                        case 'ipv6_addr':
-                               ip = iptoarr(values[i]);
+                               ip = filter(this.parse_subnet(values[i]), a => (a.family == 6));
 
-                               if (length(ip) != 16)
-                                       return null;
+                               switch(length(ip)) {
+                               case 0: return null;
+                               case 1: break;
+                               case 2: this.warn("Set entry '%s' resolves to multiple addresses, using first one", values[i]);
+                               }
+
+                               rv[i] = ("net" in set.fw4types) ? ip[0].addr + "/" + ip[0].bits : ip[0].addr;
 
-                               rv[i] = arrtoip(ip);
                                break;
 
                        case 'ether_addr':
@@ -2774,6 +2781,8 @@ return {
                let s = {
                        ...ipset,
 
+                       fw4types: types,
+
                        types: map(types, (t) => {
                                switch (t) {
                                case 'ip':