From patchwork Fri Jul 16 18:20:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Schantl X-Patchwork-Id: 4543 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4GRKKr14KQz3xGY for ; Fri, 16 Jul 2021 18:20:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail02.haj.ipfire.org", Issuer "R3" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4GRKKq0SLSzs2; Fri, 16 Jul 2021 18:20:31 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [127.0.0.1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4GRKKp5crHz2xjs; Fri, 16 Jul 2021 18:20:30 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384 client-signature ECDSA (P-384) client-digest SHA384) (Client CN "mail01.haj.ipfire.org", Issuer "R3" (verified OK)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4GRKKn3HRDz2xJj for ; Fri, 16 Jul 2021 18:20:29 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384) server-digest SHA384) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4GRKKm3XDkzs2; Fri, 16 Jul 2021 18:20:28 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1626459628; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=++PVv20I9vsQmBcY4EAKWuCI9g5ATHrzCV7D7EyMvmQ=; b=W62ZXLLfgWNrXUyVH2Ggw9Kq6xZyoEUzA5CXBB/twXo7d8f6n8EP6J/NwxTwApEZo+Z1M5 aCHDxwkXG2F0xGDw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1626459628; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=++PVv20I9vsQmBcY4EAKWuCI9g5ATHrzCV7D7EyMvmQ=; b=h7dFDu5xEQcAvwo4LysiEAfpEDVBpwiLEc16PEtUQ2VZnE/R51dZSAtiTMI96JKGSRLRmF g4TXdj6W2Xz04G/I9J4yANyhD6vaXZ6J1REaH15nzFTh3EdOFs9C3feD1YNTM+lVIVDtKh Gd191j+tUk6MziVO9Na9OMFNJr+/qQ5l4q5BsleOQ1JEkzz3otsVM4BfBVPydFF0aBsYvq uL2cgKi9Hoa+hVOJ6AQtgTOhdVZr+WyuSz4Npfv3aPhHEs+B+hBzK4zBMgauDIKrZ6KvBZ w/1e7Fxa+e9yKipmdq1qYr2fSIYnkrBFAdb0hN+YbwVQ05n0vrI5J2lO42vazQ== From: Stefan Schantl To: development@lists.ipfire.org Subject: [PATCH] firewall.cgi: Bring back check for single IP when using DNAT. Date: Fri, 16 Jul 2021 20:20:22 +0200 Message-Id: <20210716182022.3016-1-stefan.schantl@ipfire.org> MIME-Version: 1.0 X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" This check has been removed by commit: bbe8e009b824aef745c9ab9718dce9a1b557f5fc So it was able to create DNAT rules with a network as target. Signed-off-by: Stefan Schantl Reviewed-by: Michael Tremer --- html/cgi-bin/firewall.cgi | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi index e168788eb..b328b426c 100644 --- a/html/cgi-bin/firewall.cgi +++ b/html/cgi-bin/firewall.cgi @@ -569,6 +569,24 @@ sub checktarget #check DNAT settings (has to be single Host and single Port or portrange) if ($fwdfwsettings{'USE_NAT'} eq 'ON' && $fwdfwsettings{'nat'} eq 'dnat'){ if($fwdfwsettings{'grp2'} eq 'tgt_addr' || $fwdfwsettings{'grp2'} eq 'cust_host_tgt' || $fwdfwsettings{'grp2'} eq 'ovpn_host_tgt'){ + # Check if a manual entered IP is a single Host (if set) + if ($fwdfwsettings{'grp2'} eq 'tgt_addr') { + # Split input into address and prefix (if provided). + my ($address, $subnet) = split ('/', $fwdfwsettings{$fwdfwsettings{'grp2'}}); + + # Check if a subnet is given. + if ($subnet) { + # Check if the prefix or subnetmask is for a single host. + unless ($subnet eq "32" || $subnet eq "255.255.255.255") { + # Set error message. + $errormessage=$Lang::tr{'fwdfw dnat error'}."
"; + + # Return the error. + return $errormessage; + } + } + } + #check if Port is a single Port or portrange if ($fwdfwsettings{'nat'} eq 'dnat' && $fwdfwsettings{'grp3'} eq 'TGT_PORT'){ if(($fwdfwsettings{'PROT'} ne 'TCP'|| $fwdfwsettings{'PROT'} ne 'UDP') && $fwdfwsettings{'TGT_PORT'} eq ''){