From patchwork Fri Mar 24 15:49:22 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Tremer X-Patchwork-Id: 6718 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4PjmqD68nfz3xCl for ; Fri, 24 Mar 2023 15:49:28 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4PjmqB6p9Cz9Q; Fri, 24 Mar 2023 15:49:26 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4PjmqB5Pqmz2yPS; Fri, 24 Mar 2023 15:49:26 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4Pjmq94cQ3z2xbl for ; Fri, 24 Mar 2023 15:49:25 +0000 (UTC) Received: from michael.haj.ipfire.org (michael.haj.ipfire.org [172.28.1.242]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "michael.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4Pjmq8568lz9Q; Fri, 24 Mar 2023 15:49:24 +0000 (UTC) Received: by michael.haj.ipfire.org (Postfix, from userid 0) id 4Pjmq839ByzTjVQ; Fri, 24 Mar 2023 15:49:24 +0000 (UTC) From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH] proxy: Skip VPNs that route everything for proxy.pac Date: Fri, 24 Mar 2023 15:49:22 +0000 Message-Id: <20230324154922.276520-1-michael.tremer@ipfire.org> X-Mailer: git-send-email 2.30.2 MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Michael Tremer Errors-To: development-bounces@lists.ipfire.org Sender: "Development" The function tries to figure out which networks are connected locally, but VPN tunnels that use 0.0.0.0 and GRE/VTI interfaces will be considered local and the proxy is being disabled for everyone. Signed-off-by: Michael Tremer --- html/cgi-bin/proxy.cgi | 3 +++ 1 file changed, 3 insertions(+) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index a718d5771..71be315f6 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -2986,6 +2986,7 @@ END foreach my $network (@networks) { my ($vpnip, $vpnsub) = split("/", $network); $vpnsub = &Network::convert_prefix2netmask($vpnsub) || $vpnsub; + next if ($vpnip eq "0.0.0.0" || $vpnsub eq "0.0.0.0"); print FILE " (isInNet(host, \"$vpnip\", \"$vpnsub\")) ||\n"; } } @@ -2996,6 +2997,8 @@ END my @networks = split(/\|/, $ovpnconfig{$key}[11]); foreach my $network (@networks) { my ($vpnip, $vpnsub) = split("/", $network); + $vpnsub = &Network::convert_prefix2netmask($vpnsub) || $vpnsub; + next if ($vpnip eq "0.0.0.0" || $vpnsub eq "0.0.0.0"); print FILE " (isInNet(host, \"$vpnip\", \"$vpnsub\")) ||\n"; } }