From patchwork Wed May 2 21:27:07 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Alexander Marx X-Patchwork-Id: 1745 Return-Path: Received: from mail01.ipfire.org (mail01.ipfire.org [IPv6:2001:470:7183:25::1]) by web02.i.ipfire.org (Postfix) with ESMTP id 6E9FF60366 for ; Wed, 2 May 2018 13:27:35 +0200 (CEST) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 2D26910F8DD8; Wed, 2 May 2018 12:27:35 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1525260455; h=from:from:sender:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:list-id:list-unsubscribe:list-subscribe:list-post; bh=kT17z9m7Hnhn9wqsUXszWzoo6HO5i3s84y4MsAq4jJ8=; b=emJiuy4XEB7vwaw2RNQNV7jl2CoabSHJXGrH5IpYS5m1aVLkx92QKp2F6b1LcbtkTy7ax7 0eBInwyK1UudAhJNaVErthx3dbd0PQwK5isIBVRIuWaFvpJ8EAhbO1hamBlyd/m1NMJWJQ K/pnbAptmT7ZgwHgIDoSAGfneFmVgMrU3Z0CLBr9HYc2WEXa8meAldusY671KhSG5FakJ8 +5MgyXdXdBGRx5mtSQknbzoYuqzVwRJz2dyD9zYrWA85rKoi435OXvskiZOXurbAEVVg+C gHuJJHmg18KNMA511ZZimGVDn7nATsOJzdezJ3k2HSGzfz7p5zO7eIS5R93Y2g== Authentication-Results: auth=pass smtp.auth=amarx smtp.mailfrom=alexander.marx@ipfire.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201801; t=1525260438; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references; bh=kT17z9m7Hnhn9wqsUXszWzoo6HO5i3s84y4MsAq4jJ8=; b=hR+C348ebtWHC7vDKhJt0WM3hj0cFMxb70qqb8OQ4NL3/Xf5UC1VA+osQIF6bipGqzgLom gYDWerCQIggy5/6b/sF0Jrl4jHY9efaMGzNp5Qt3RI6Y8rzhsqz/FqTVntd/HPN89svBvG cVaX32sG2drJlyAdFviz5GY5LM6m/nOCL/RXLN8gPcxYCesaZ/aERK2/TTN4bsJ2qO/ZtB Be1GB1jvHPa7IcQLIQ4pVxWo20QhrJfnGlNWilCIWubljMl4hdo7pgG+ir+q11u9BY3YUX HUQbl1XhvNcqTCUE6Ihg75DGVZkIGUzhljSfOcNm+TnQ6GN1mdIh8Hq/ieJH7g== Received: from EDV1.kappeln2011.lan (business-90-187-3-157.pool2.vodafone-ip.de [90.187.3.157]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id BC58110F8DD7; Wed, 2 May 2018 12:27:18 +0100 (BST) From: Alexander Marx To: development@lists.ipfire.org Subject: [PATCH 4/4] BUG11559: fwhosts Date: Wed, 2 May 2018 13:27:07 +0200 Message-Id: <1525260427-6695-4-git-send-email-alexander.marx@ipfire.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1525260427-6695-1-git-send-email-alexander.marx@ipfire.org> References: <1525260427-6695-1-git-send-email-alexander.marx@ipfire.org> X-Spamd-Result: default: False [-6.84 / 11.00]; MID_CONTAINS_FROM(1.00)[]; RCVD_COUNT_ZERO(0.00)[0]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; DKIM_SIGNED(0.00)[]; BAYES_HAM(-3.00)[100.00%]; REPLY(-2.00)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; MIME_GOOD(-0.10)[text/plain]; ARC_NA(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; ASN(0.00)[asn:31334, ipnet:90.187.0.0/16, country:DE]; NEURAL_HAM(-2.74)[-0.915,0]; RCVD_TLS_ALL(0.00)[] X-Spam-Status: No, score=-6.84 X-Rspamd-Server: mail01.i.ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" When creating firewallrules or using firewall groups, it should be possible to select a single IpSec subnet if there is more than one. This patch adds the changes to the firewall groups. Signed-off-by: Alexander Marx Tested-by: Peter Müller --- html/cgi-bin/fwhosts.cgi | 87 ++++++++++++++++++++++++++++++------------------ 1 file changed, 55 insertions(+), 32 deletions(-) diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi index a2ade8a..fb33ac6 100644 --- a/html/cgi-bin/fwhosts.cgi +++ b/html/cgi-bin/fwhosts.cgi @@ -54,6 +54,7 @@ my %fwinp=(); my %fwout=(); my %ovpnsettings=(); my %netsettings=(); +my %optionsfw=(); my $errormessage; my $hint; @@ -70,6 +71,7 @@ my $configgeoipgrp = "${General::swroot}/fwhosts/customgeoipgrp"; my $fwconfigfwd = "${General::swroot}/firewall/config"; my $fwconfiginp = "${General::swroot}/firewall/input"; my $fwconfigout = "${General::swroot}/firewall/outgoing"; +my $fwoptions = "${General::swroot}/optionsfw/settings"; my $configovpn = "${General::swroot}/ovpn/settings"; my $configipsecrw = "${General::swroot}/vpn/settings"; @@ -87,8 +89,9 @@ unless (-e $configgeoipgrp) { system("touch $configgeoipgrp"); } &General::readhasharray("$configipsec", \%ipsecconf); &General::readhash("$configipsecrw", \%ipsecsettings); &General::readhash("/var/ipfire/ethernet/settings", \%netsettings); -&Header::getcgihash(\%fwhostsettings); +&General::readhash($fwoptions, \%optionsfw); +&Header::getcgihash(\%fwhostsettings); &Header::showhttpheaders(); &Header::openpage($Lang::tr{'fwhost menu'}, 1, ''); &Header::openbigbox('100%', 'center'); @@ -1548,27 +1551,30 @@ END print""; } #IPsec networks - my @IPSEC_N2N=(); + foreach my $key (sort { ncmp($ipsecconf{$a}[0],$ipsecconf{$b}[0]) } keys %ipsecconf) { - if ($ipsecconf{$key}[3] eq 'net'){ - $show='1'; - push (@IPSEC_N2N,$ipsecconf{$key}[1]); - } - } - if ($show eq '1'){ - $show=''; - print< - - - - $Lang::tr{'fwhost ipsec net'}"; @@ -2116,14 +2122,15 @@ sub viewtablegrp print ""; if($customgrp{$key}[3] eq 'Standard Network'){ print &get_name($customgrp{$key}[2]).""; + }elsif($customgrp{$key}[3] eq "IpSec Network" && $customgrp{$key}[2] =~ /\|/){ + my ($a,$b) = split /\|/, $customgrp{$key}[2]; + print "$a"; }else{ print "$customgrp{$key}[2]"; } if ($ip eq '' && $customgrp{$key}[2] ne $Lang::tr{'fwhost err emptytable'}){ print "$Lang::tr{'fwhost deleted'}$Lang::tr{'fwhost '.$customgrp{$key}[3]}
"; }else{ - my ($colip,$colsub) = split("/",$ip); - $ip="$colip/".&General::iporsubtocidr($colsub) if ($colsub); print"".&getcolor($ip)."$Lang::tr{'fwhost '.$customgrp{$key}[3]}"; } if ($delflag > 0 && $ip ne ''){ @@ -2896,7 +2903,23 @@ sub getipforgroup if ($type eq 'IpSec Network'){ foreach my $key (keys %ipsecconf) { if ($ipsecconf{$key}[1] eq $name){ - return $ipsecconf{$key}[11]; + if ($ipsecconf{$key}[11] =~ /\|/) { + my $string; + my @parts = split /\|/ , $ipsecconf{$key}[11]; + foreach my $key1 (@parts){ + my ($val1,$val2) = split (/\//, $key1); + my $val3 = &Network::convert_netmask2prefix($val2) || $val2; + $string .= "$val1/$val3
"; + } + return $string; + }else{ + return $ipsecconf{$key}[11]; + } + }else{ + if ($name =~ /\|/) { + my ($a,$b) = split /\|/, $name; + return $b; + } } } &deletefromgrp($name,$configgrp); @@ -2917,7 +2940,7 @@ sub getipforgroup foreach my $key (keys %ccdhost) { if($ccdhost{$key}[1] eq $name){ my ($a,$b) = split ("/",$ccdhost{$key}[11]); - $b=&General::iporsubtodec($b); + $b=&Network::convert_netmask2prefix($b) || ($b); return "$a/$b"; } } @@ -2929,7 +2952,7 @@ sub getipforgroup foreach my $key (keys %ccdhost) { if($ccdhost{$key}[1] eq $name){ my ($a,$b) = split (/\//,$ccdhost{$key}[33]); - $b=&General::iporsubtodec($b); + $b=&Network::convert_netmask2prefix($b) || ($b) ; return "$a/$b"; } } @@ -2941,7 +2964,7 @@ sub getipforgroup foreach my $key (keys %ccdnet) { if ($ccdnet{$key}[0] eq $name){ my ($a,$b) = split (/\//,$ccdnet{$key}[1]); - $b=&General::iporsubtodec($b); + $b=&Network::convert_netmask2prefix($b) || ($b); return "$a/$b"; } } @@ -2961,7 +2984,7 @@ sub getipforgroup if ($type eq 'Custom Network'){ foreach my $key (keys %customnetwork) { if($customnetwork{$key}[0] eq $name){ - return $customnetwork{$key}[1]."/".$customnetwork{$key}[2]; + return $customnetwork{$key}[1]."/".&Network::convert_netmask2prefix($customnetwork{$key}[2]) || $customnetwork{$key}[2]; } } } @@ -2976,20 +2999,20 @@ sub getipforgroup if ($name eq 'GREEN'){ my %hash=(); &General::readhash("${General::swroot}/ethernet/settings",\%hash); - return $hash{'GREEN_NETADDRESS'}."/".$hash{'GREEN_NETMASK'}; + return $hash{'GREEN_NETADDRESS'}."/".&Network::convert_netmask2prefix($hash{'GREEN_NETMASK'}) || $hash{'GREEN_NETMASK'}; } if ($name eq 'BLUE'){ my %hash=(); &General::readhash("${General::swroot}/ethernet/settings",\%hash); - return $hash{'BLUE_NETADDRESS'}."/".$hash{'BLUE_NETMASK'}; + return $hash{'BLUE_NETADDRESS'}."/".&Network::convert_netmask2prefix($hash{'BLUE_NETMASK'}) || $hash{'BLUE_NETMASK'}; } if ($name eq 'ORANGE'){ my %hash=(); &General::readhash("${General::swroot}/ethernet/settings",\%hash); - return $hash{'ORANGE_NETADDRESS'}."/".$hash{'ORANGE_NETMASK'}; + return $hash{'ORANGE_NETADDRESS'}."/".&Network::convert_netmask2prefix($hash{'ORANGE_NETMASK'}) || $hash{'ORANGE_NETMASK'}; } if ($name eq 'ALL'){ - return "0.0.0.0/0.0.0.0"; + return "0.0.0.0/0"; } if ($name =~ /IPsec/i){ my %hash=();