Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Failures handling address ranges in windows firewall that don't align on a single netmask or cidr #64

Open
TimesliceTechnologies opened this issue May 20, 2024 · 0 comments

Comments

@TimesliceTechnologies
Copy link

Given the following remote addresses and address ranges configured in a firewall rule:
13.110.220.0 - 13.110.222.200
13.110.234.124
13.110.234.126
13.110.224.0/20
13.110.230.0/24

Problem 1: Rule.RemoteAddresses only returns 2 IAddresses instead of 5:
13.110.224.0/255.255.240.0
13.110.220.0-13.110.222.200

Problem 2: NetworkAddress.TryParse() FAILS when trying to parse range 13.110.220.0 - 13.110.222.200
NetworkAddress.TryParse() FAILS when trying to parse range 13.110.220.0 - 13.110.222.200
The range 13.110.220.0 - 13.110.222.200 can't be converted to a single netmask which is somewhat understandable however not getting the full list of RemoteAddresses when such a range is in the rule's scope is definitely NOT ok.

This screenshot shows the address range from Iaddress, however NetworkAddress.TryParse fails:
NetworkAddress-TryParseFail

Both issues are probably related to a range that doesn't align on a strict CIDR boundary

This is fundamentally problematic - FIrewall Helper is not returning the full scope of the rule - This is critical if there are many addresses in the rule's scope, especially if you update the rule with only a few addresses / ranges you think exist where there were previously many addresses / ranges

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant