Merge pull request #6201 from Security-Onion-Solutions/fix/cidr-ip-validation

Improve cidr validation in setup and match ip validation to similar method

salt/common/tools/sbin/so-common

@@ -390,20 +390,30 @@ has_uppercase() {
 }
 
 valid_cidr() {
-	# Verify there is a backslash in the string
-	echo "$1" | grep -qP "^[^/]+/[^/]+$" || return 1
-	
-	local cidr
-	local ip
+	local cidr=$1
 
-	cidr=$(echo "$1" | sed 's/.*\///')
-	ip=$(echo "$1" | sed 's/\/.*//' )
-	
-	if valid_ip4 "$ip"; then
-		[[ $cidr =~ ([0-9]|[1-2][0-9]|3[0-2]) ]] && return 0 || return 1
-	else
-		return 1
-	fi
+	read -r -d '' cidr_python <<- EOM
+	import ipaddress
+	import sys
+
+	def validate_cidr(cidr: str) -> bool:
+	  # We want the string to be a cidr block and not a single ip
+	  if '/' not in cidr:
+	  	return False
+	  try:
+	    ipaddress.ip_network(cidr)
+	  except ValueError:
+	    return False
+	  return True
+
+	if validate_cidr('$cidr'):
+	  sys.exit(0)
+	else:
+	  sys.exit(1)
+	EOM
+
+	python3 -c "$cidr_python"
+	return $?
 }
 
 valid_cidr_list() {
@@ -447,7 +457,26 @@ valid_hostname() {
 valid_ip4() {
 	local ip=$1
 
-	echo "$ip" | grep -qP '^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$' && return 0 || return 1
+	local ip_python
+	read -r -d '' ip_python <<- EOM
+	import ipaddress
+	import sys
+
+	def validate_ip(ip: str) -> bool:
+	  try:
+	    ipaddress.ip_address(ip)
+	  except ValueError:
+	    return False
+	  return True
+
+	if validate_ip('$ip'):
+	  sys.exit(0)
+	else:
+	  sys.exit(1)
+	EOM
+
+	python3 -c "$ip_python"
+	return $?
 }
 
 valid_int() {

setup/so-whiptail

@@ -721,7 +721,7 @@ whiptail_install_type() {
 
 	# What kind of install are we doing?
 	install_type=$(whiptail --title "$whiptail_title" --radiolist \
-	"Choose install type. See https://docs.securityonion.net/architecture for details." 12 65 5 \
+	"Choose install type. \nSee https://docs.securityonion.net/architecture for details." 13 65 5 \
 		"EVAL" "Evaluation mode (not for production) " ON \
 		"STANDALONE" "Standalone production install " OFF \
 		"DISTRIBUTED" "Distributed install submenu " OFF \

tests/validation.sh

@@ -46,7 +46,7 @@ test_fun 1 valid_fqdn "rwwiv."
 
 test_fun 1 valid_fqdn ""
 
-sleep 0.15s
+sleep 0.15
 
 header "ip4"
 
@@ -62,13 +62,13 @@ test_fun 1 valid_ip4 "192.168.1.1."
 
 test_fun 1 valid_ip4 ""
 
-sleep 0.15s
+sleep 0.15
 
 header "CIDR (ipv4)"
 
 test_fun 0 valid_cidr "192.168.1.0/24"
 
-test_fun 0 valid_cidr "192.168.1.0/12"
+test_fun 0 valid_cidr "192.160.0.0/12"
 
 test_fun 1 valid_cidr "192.168.1.0"
 
@@ -78,7 +78,7 @@ test_fun 1 valid_ip4 "/24"
 
 test_fun 1 valid_cidr ""
 
-sleep 0.15s
+sleep 0.15
 
 header "CIDR list"
 
@@ -90,7 +90,7 @@ test_fun 1 valid_cidr_list "10.0.0.0/8,192.168.0.0/16172.16.0.0/12"
 
 test_fun 1 valid_cidr_list "10.0.0.0"
 
-sleep 0.15s
+sleep 0.15
 
 header "DNS"
 
@@ -104,7 +104,7 @@ test_fun 1 valid_dns_list "8.8.8.,8.8.4.4"
 
 test_fun 1 valid_dns_list "192.168.9."
 
-sleep 0.15s
+sleep 0.15
 
 header "int (default min: 1, default max: 1000000000)"
 
@@ -130,7 +130,7 @@ test_fun 1 valid_int "not_a_num"
 
 test_fun 1 valid_int ""
 
-sleep 0.15s
+sleep 0.15
 
 header "hostname"
 
@@ -146,7 +146,7 @@ test_fun 1 valid_hostname "localhost"
 
 test_fun 1 valid_hostname ""
 
-sleep 0.15s
+sleep 0.15
 
 header "string (default min_length: 1, default max_length: 64)"
 
@@ -168,7 +168,7 @@ test_fun 1 valid_string "too_long" "" "4"
 
 test_fun 1 valid_string ""
 
-sleep 0.15s
+sleep 0.15
 
 header "Linux user"