Port forward: UI allows targeting of an object with ip range, leading to incorrect rule application

[gsanchietti]

Description
The UI currently allows the creation or modification of port forward rules that target an object containing an IP range. This behavior results in the firewall rule incorrectly handling the dest_ip parameter, where only the IP range is considered. While the system does not crash, the rule is applied improperly, leading to unexpected behavior.

Steps to reproduce

1. Create an object (obj1) with a single IP:

   config host 'ns_ee2225de'
       option name 'obj1'
       option family 'ipv4'
       list ipaddr '192.168.100.45'
   

2. Create a port forward rule (pf1) that uses the object as the destination:

   config redirect 'ns_b2fd9097'
       option src 'wan'
       option target 'DNAT'
       option enabled '1'
       option log '0'
       option name 'pf1'
       option ns_dst 'objects/ns_ee2225de'
       list proto 'tcp'
       list proto 'udp'
       option reflection '0'
       option src_dport '4455'
       option dest_ip '192.168.100.45'
   

3. Modify the obj1 file to include both an IP and an IP range:

   config host 'ns_ee2225de'
       option name 'obj1'
       option family 'ipv4'
       list ipaddr '192.168.100.45'
       list ipaddr '192.168.100.46-192.168.100.50'
   

4. Observe the updated firewall and nftables configurations:

   • Firewall:

     config redirect 'ns_b2fd9097'
         option src 'wan'
         option target 'DNAT'
         option enabled '1'
         option log '0'
         option name 'pf1'
         option ns_dst 'objects/ns_ee2225de'
         list proto 'tcp'
         list proto 'udp'
         option reflection '0'
         option src_dport '4455'
         option dest_ip '192.168.100.46-192.168.100.50'
     

   • Nftables:

     chain dstnat_wan {
             meta nfproto ipv4 tcp dport 4455 counter packets 0 bytes 0 dnat ip to 192.168.100.46-192.168.100.50:4455 comment "!fw4: pf1"
             meta nfproto ipv4 udp dport 4455 counter packets 0 bytes 0 dnat ip to 192.168.100.46-192.168.100.50:4455 comment "!fw4: pf1"
     }
     

UI:

Expected behavior

• The UI should prevent creating or modifying port forward rules that target an object containing an IP range, as this results in incorrect rule application.
• The UI should prevent adding an IP range to an object used inside a port forward rule

Actual behavior

• The UI allows targeting of an object containing an IP range for port forward rules.
• Only the IP range is considered for the dest_ip configuration in the rules, leading to improper handling and potentially unintended behavior. This may cause issues in the application of the port forward rule.

Components
NethSecurity version: 8-23.05.5-ns.1.3.0

[stephdl]

this issue should close #898

[stephdl]

QA

Use this image

Create hosts objects with

• range
• IP
• object nested to object

case 1
create port forward using this object, only objects with IP are available for destination and advanced/restricted access

case 2
once objects are set to portforward,

try to add a range to an object used by a portforward, it must be refused
try to add an object to an object used by a portforward, it must be refused

[gsanchietti]

Both test cases have been verified.