ovpnmain.cgi: Fix checking custom routes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/doc/language_issues.de b/doc/language_issues.de
index 6656267925ed7be666c7f74306f1ec19b2e71910..2defaac954086d5e3d88080873859c81f53a6d75 100644 (file)
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -615,6 +615,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn log
@@ -1037,6 +1039,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.en b/doc/language_issues.en
index cd59942a31487d0e0b56c05e5f773b478dad9377..6febb11aa83e9b77b2779091bea83f85399bcbd3 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -1422,8 +1422,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
-WARNING: untranslated string: ovpn errmsg green already pushed = Route for green network is always set
-WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-address or subnetmask
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.es b/doc/language_issues.es
index adba792283159500e2aca4d4c8818f16799ffe1d..006ba8bcff028c2e024ceedd11d4c2c64d1f9133 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -669,6 +669,8 @@ WARNING: translation string unused: ovpn dh parameters
 WARNING: translation string unused: ovpn dh upload
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error dh
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
@@ -1100,6 +1102,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index ea3825a6278dcadd6116223132c5fd6ccad94dbc..36e4eeadc05a6c26f9ebb6e966e877fb3f647cd7 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -645,6 +645,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn log
@@ -1048,6 +1050,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.it b/doc/language_issues.it
index dd02424f6295fcf1365051a6cd666aa47c198041..defbc042255d7dc447d021ec9190b3ed96061c29 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -596,6 +596,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn hmac
 WARNING: translation string unused: ovpn log
@@ -1281,6 +1283,7 @@ WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index 2443fc8010a6a3b948e44b45a48d44d6b84b7416..ed1d88b08367bc684cbc4cf2d9316079c7beb51b 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -597,6 +597,8 @@ WARNING: translation string unused: override mtu
 WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn log
 WARNING: translation string unused: ovpn mtu-disc
 WARNING: translation string unused: ovpn mtu-disc and mtu not 1500
@@ -1306,6 +1308,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 33029370114cb2a38cbec4851d34e0396532a139..2363d7fc8344b4d428c902f0dd0360244491475c 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1461,8 +1461,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
-WARNING: untranslated string: ovpn errmsg green already pushed = Route for green network is always set
-WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-address or subnetmask
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index dfa56ba1c608836400d4fe40e0ffaafe548bb193..ebcef479bb69b14901bd8fff52ee446b23892f9e 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -522,6 +522,8 @@ WARNING: translation string unused: override mtu
 WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn log
 WARNING: translation string unused: ovpn on blue
 WARNING: translation string unused: ovpn on orange
@@ -1459,6 +1461,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 3dc5d722f1af12ac974b523e02313f2a648fd8a4..37798b355ff49c185c4e5a6850489ee8aad2a32e 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -626,6 +626,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn hmac
 WARNING: translation string unused: ovpn log
@@ -1197,6 +1199,7 @@ WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_missings b/doc/language_missings
index d21f83bebcee2a6207f5182f84dbda3779c527dd..43fd82bb8ad43e35c00b46aa6245df69e543f1f1 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -89,6 +89,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -180,6 +181,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -245,6 +247,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -653,6 +656,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -1242,6 +1246,7 @@
 < ovpn dhcp settings
 < ovpn dynamic client subnet
 < ovpn engines
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -2151,6 +2156,7 @@
 < ovpn engines
 < ovpn errmsg green already pushed
 < ovpn errmsg invalid ip or mask
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -3193,6 +3199,7 @@
 < ovpn dhcp settings
 < ovpn dynamic client subnet
 < ovpn engines
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -3739,6 +3746,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index f792aafb65f3782f08335b2f68879f9a294c0777..3be6b0305a34d23e84417928202385e4958b41f9 100755 (executable)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -893,9 +893,7 @@ sub writecollectdconf {
 
 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
-    #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
-    #DAN this value has to leave.
-#new settings for daemon
+
     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
@@ -909,7 +907,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
     $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
     $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
-    my @temp=();
 
        # We must have at least one cipher selected
        if ($cgiparams{'DATACIPHERS'} eq '') {
@@ -975,54 +972,37 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
                goto ADV_ERROR;
        }
     }
+
+       # Validate pushed routes
     if ($cgiparams{'ROUTES_PUSH'} ne ''){
-       @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
-       undef $vpnsettings{'ROUTES_PUSH'};
+               my @temp = split(/\n/, $cgiparams{'ROUTES_PUSH'});
 
-       foreach my $tmpip (@temp)
-       {
-               s/^\s+//g; s/\s+$//g;
+               # Reset stored routes
+               $vpnsettings{'ROUTES_PUSH'} = "";
 
-               if ($tmpip)
-               {
-                       $tmpip=~s/\s*$//g;
-                       unless (&General::validipandmask($tmpip)) {
-                               $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
-                               goto ADV_ERROR;
-                       }
-                       my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
+               foreach my $route (@temp) {
+                       chomp($route);
 
-                       if ($ip eq $Network::ethernet{'GREEN_NETADDRESS'} && $cidr eq $Network::ethernet{'GREEN_NETMASK'}) {
-                               $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
-                               goto ADV_ERROR;
-                       }
+                       # Remove any excess whitespace
+                       $route =~ s/^\s+//g;
+                       $route =~ s/\s+$//g;
 
-                       my %ccdroutehash=();
-                       &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
-                       foreach my $key (keys %ccdroutehash) {
-                               foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
-                                       if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
-                                               $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
-                                               goto ADV_ERROR;
-                                       }
-                                       my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
-                                       if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
-                                               $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
-                                               goto ADV_ERROR;
-                                       }
-                               }
+                       # Skip empty lines
+                       next if ($route eq "");
+
+                       unless (&Network::check_subnet($route)) {
+                               $errormessage = "$Lang::tr{'ovpn errmsg invalid route'}: $route";
+                               goto ADV_ERROR;
                        }
 
-                       $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
+                       $vpnsettings{'ROUTES_PUSH'} .= $route . "\n";
                }
-       }
-    &write_routepushfile;
-       undef $vpnsettings{'ROUTES_PUSH'};
-    }
-       else {
-       undef $vpnsettings{'ROUTES_PUSH'};
-       &write_routepushfile;
+
+           &write_routepushfile();
+
+               undef $vpnsettings{'ROUTES_PUSH'};
     }
+
     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
         $errormessage = $Lang::tr{'invalid input for max clients'};
         goto ADV_ERROR;

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index aef5cfcdf6fe70003cab588296da5d2da91743a0..1b73da7396fd2db42779d2c34e5f73c34158343c 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2031,6 +2031,7 @@
 'ovpn engines' => 'Crypto engine',
 'ovpn errmsg green already pushed' => 'Route for green network is always set',
 'ovpn errmsg invalid ip or mask' => 'Invalid network-address or subnetmask',
+'ovpn errmsg invalid route' => 'Invalid route',
 'ovpn error md5' => 'You host certificate uses MD5 for the signature which is not accepted anymore. <br>Please update to the latest IPFire version and generate a new root and host certificate.</br><br>All OpenVPN clients needs then to be renewed!</br>',
 'ovpn fallback cipher' => 'Fallback Cipher',
 'ovpn fallback cipher help' => 'This cipher is being used by clients that do not support cipher negotiation.',