@@ -29,20 +29,12 @@ def validate(record)
2929
3030 add_rule_error ( "protocol must be 'tcp', 'udp', 'icmp', 'icmpv6' or 'all'" , record , index ) unless valid_protocol ( rule [ :protocol ] )
3131
32- if rule [ :protocol ] == 'icmp'
33- allowed_ip_version = NetAddr ::IPv4Net
34- elsif rule [ :protocol ] == 'icmpv6'
35- allowed_ip_version = NetAddr ::IPv6Net
36- else
37- allowed_ip_version = nil
38- end
39-
4032 if valid_destination_type ( rule [ :destination ] , record , index )
4133 destinations = rule [ :destination ] . split ( ',' , -1 )
4234 add_rule_error ( "maximum destinations per rule exceeded - must be under #{ MAX_DESTINATIONS_PER_RULE } " , record , index ) unless destinations . length <= MAX_DESTINATIONS_PER_RULE
4335
4436 destinations . each do |d |
45- validate_destination ( d , rule [ :protocol ] , allowed_ip_version , record , index )
37+ validate_destination ( d , rule [ :protocol ] , get_allowed_ip_version ( rule ) , record , index )
4638 end
4739 end
4840
@@ -55,14 +47,22 @@ def validate(record)
5547 when 'icmp'
5648 validate_icmp_protocol ( rule , record , index )
5749 when 'icmpv6'
58- add_rule_error ( " icmpv6 cannot be used if enable_ipv6 is false" , record , index ) unless CloudController ::RuleValidator . ipv6_enabled?
50+ add_rule_error ( ' icmpv6 cannot be used if enable_ipv6 is false' , record , index ) unless CloudController ::RuleValidator . ipv6_enabled?
5951 validate_icmp_protocol ( rule , record , index )
6052 when 'all'
6153 add_rule_error ( 'ports are not allowed for protocols of type all' , record , index ) if rule [ :ports ]
6254 end
6355 end
6456 end
6557
58+ def get_allowed_ip_version ( rule )
59+ if rule [ :protocol ] == 'icmp'
60+ NetAddr ::IPv4Net
61+ elsif rule [ :protocol ] == 'icmpv6'
62+ NetAddr ::IPv6Net
63+ end
64+ end
65+
6666 def boolean? ( value )
6767 [ true , false ] . include? value
6868 end
@@ -148,11 +148,11 @@ def validate_destination(destination, protocol, allowed_ip_version, record, inde
148148
149149 zeros_error_message = 'destination octets cannot contain leading zeros'
150150 add_rule_error ( zeros_error_message , record , index ) unless CloudController ::RuleValidator . no_leading_zeros ( address_list )
151-
152151 if address_list . length == 1
153152 parsed_ip = CloudController ::RuleValidator . parse_ip ( address_list . first )
154153 add_rule_error ( error_message , record , index ) unless parsed_ip
155- add_rule_error ( "for protocol \" #{ protocol } \" you cannot use IPv#{ parsed_ip . version } addresses" , record , index ) unless parsed_ip . nil? || allowed_ip_version . nil? || parsed_ip . is_a? ( allowed_ip_version )
154+ add_rule_error ( "for protocol \" #{ protocol } \" you cannot use IPv#{ parsed_ip . version } addresses" , record , index ) \
155+ unless valid_ip_version? ( allowed_ip_version , parsed_ip )
156156 elsif address_list . length == 2
157157 ips = CloudController ::RuleValidator . parse_ip ( address_list )
158158 return add_rule_error ( 'destination IP address range is invalid' , record , index ) unless ips
@@ -165,8 +165,8 @@ def validate_destination(destination, protocol, allowed_ip_version, record, inde
165165
166166 reversed_range_error = 'beginning of IP address range is numerically greater than the end of its range (range endpoints are inverted)'
167167 add_rule_error ( reversed_range_error , record , index ) unless ips . first == sorted_ips . first
168- add_rule_error ( "for protocol \" #{ protocol } \" you cannot use IPv#{ ips . first . version } addresses" , record , index ) unless ips . first . nil? || allowed_ip_version . nil? || ips . first . is_a? ( allowed_ip_version )
169-
168+ add_rule_error ( "for protocol \" #{ protocol } \" you cannot use IPv#{ ips . first . version } addresses" , record , index ) \
169+ unless valid_ip_version? ( allowed_ip_version , ips . first )
170170 else
171171 add_rule_error ( error_message , record , index )
172172 end
@@ -175,4 +175,10 @@ def validate_destination(destination, protocol, allowed_ip_version, record, inde
175175 def add_rule_error ( message , record , index )
176176 record . errors . add ( "Rules[#{ index } ]:" , message )
177177 end
178+
179+ private
180+
181+ def valid_ip_version? ( allowed_ip_version , parsed_ip )
182+ parsed_ip . nil? || allowed_ip_version . nil? || parsed_ip . is_a? ( allowed_ip_version )
183+ end
178184end
0 commit comments