ovpnmain.cgi: Fix checking custom routes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/doc/language_issues.de b/doc/language_issues.de
index cb1e0584ac47a14cd8d43f89520d00036cab0acc..c9678af2dc1cc57d9df72c78d85b86de25cd2b3d 100644 (file)
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -603,6 +603,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn log
@@ -1013,6 +1015,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.en b/doc/language_issues.en
index 686f5f6e61a7e76e1c247702a23d57abceb3cb06..0277f0b00e1a7586d6bf76df9319c772c65f85a4 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -1437,8 +1437,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
-WARNING: untranslated string: ovpn errmsg green already pushed = Route for green network is always set
-WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-address or subnetmask
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.es b/doc/language_issues.es
index dd65458b212cd8b072af9d4f58c78ebeff764031..41f74e1bbda2a1da2e9d54f1d3db8630e577a952 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -658,6 +658,8 @@ WARNING: translation string unused: ovpn dh parameters
 WARNING: translation string unused: ovpn dh upload
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error dh
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
@@ -1074,6 +1076,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index c08f22a9d1e6053f8d24276ca8240af8805f9164..c9e062f612fb4af489415854a7e9b6da4647d1e2 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -633,6 +633,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn log
@@ -1020,6 +1022,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.it b/doc/language_issues.it
index 57c07da7b638fb87b4f085b5008b4a6dadbf177d..f769a2f4b084ed75d515fb3a2b2600051606c037 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -586,6 +586,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn hmac
 WARNING: translation string unused: ovpn log
@@ -1257,6 +1259,7 @@ WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index e3a3054e083de539c76237913b6e25fe6f322558..254617f79f8e670bedae6181258548038cfa17ab 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -587,6 +587,8 @@ WARNING: translation string unused: override mtu
 WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn log
 WARNING: translation string unused: ovpn mtu-disc
 WARNING: translation string unused: ovpn mtu-disc and mtu not 1500
@@ -1282,6 +1284,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index 5ba5a05e5f231bbab1f93fe06bf89dacdcdb2559..2a1233aa0d25155242f9fefa26edbb54d6e17e6b 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1437,8 +1437,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
-WARNING: untranslated string: ovpn errmsg green already pushed = Route for green network is always set
-WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-address or subnetmask
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 773ca692ce065af39710f2326eed8eebe1645d4b..cf54dacbc29d2c5f73704bb5e85ce7a74da3184d 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -512,6 +512,8 @@ WARNING: translation string unused: override mtu
 WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn log
 WARNING: translation string unused: ovpn on blue
 WARNING: translation string unused: ovpn on orange
@@ -1435,6 +1437,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index e9f598a031fc9ee8cd3cf856f976ffd1bb383974..7f409791c07f15259b2ee55c1ed9a17bf0267bc0 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -616,6 +616,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn hmac
 WARNING: translation string unused: ovpn log
@@ -1173,6 +1175,7 @@ WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_missings b/doc/language_missings
index 3a25710a33f9eefb9eeb25419f75a02fe4096f59..082f63afa1d752cd33544a8ff65a9dcde38c6032 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -89,6 +89,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -175,6 +176,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -232,6 +234,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -632,6 +635,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -1213,6 +1217,7 @@
 < ovpn dhcp settings
 < ovpn dynamic client subnet
 < ovpn engines
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -2114,6 +2119,7 @@
 < ovpn engines
 < ovpn errmsg green already pushed
 < ovpn errmsg invalid ip or mask
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -3148,6 +3154,7 @@
 < ovpn dhcp settings
 < ovpn dynamic client subnet
 < ovpn engines
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -3686,6 +3693,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index f792aafb65f3782f08335b2f68879f9a294c0777..3be6b0305a34d23e84417928202385e4958b41f9 100755 (executable)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -893,9 +893,7 @@ sub writecollectdconf {
 
 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
-    #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
-    #DAN this value has to leave.
-#new settings for daemon
+
     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
@@ -909,7 +907,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
     $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
     $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
-    my @temp=();
 
        # We must have at least one cipher selected
        if ($cgiparams{'DATACIPHERS'} eq '') {
@@ -975,54 +972,37 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
                goto ADV_ERROR;
        }
     }
+
+       # Validate pushed routes
     if ($cgiparams{'ROUTES_PUSH'} ne ''){
-       @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
-       undef $vpnsettings{'ROUTES_PUSH'};
+               my @temp = split(/\n/, $cgiparams{'ROUTES_PUSH'});
 
-       foreach my $tmpip (@temp)
-       {
-               s/^\s+//g; s/\s+$//g;
+               # Reset stored routes
+               $vpnsettings{'ROUTES_PUSH'} = "";
 
-               if ($tmpip)
-               {
-                       $tmpip=~s/\s*$//g;
-                       unless (&General::validipandmask($tmpip)) {
-                               $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
-                               goto ADV_ERROR;
-                       }
-                       my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
+               foreach my $route (@temp) {
+                       chomp($route);
 
-                       if ($ip eq $Network::ethernet{'GREEN_NETADDRESS'} && $cidr eq $Network::ethernet{'GREEN_NETMASK'}) {
-                               $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
-                               goto ADV_ERROR;
-                       }
+                       # Remove any excess whitespace
+                       $route =~ s/^\s+//g;
+                       $route =~ s/\s+$//g;
 
-                       my %ccdroutehash=();
-                       &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
-                       foreach my $key (keys %ccdroutehash) {
-                               foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
-                                       if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
-                                               $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
-                                               goto ADV_ERROR;
-                                       }
-                                       my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
-                                       if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
-                                               $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
-                                               goto ADV_ERROR;
-                                       }
-                               }
+                       # Skip empty lines
+                       next if ($route eq "");
+
+                       unless (&Network::check_subnet($route)) {
+                               $errormessage = "$Lang::tr{'ovpn errmsg invalid route'}: $route";
+                               goto ADV_ERROR;
                        }
 
-                       $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
+                       $vpnsettings{'ROUTES_PUSH'} .= $route . "\n";
                }
-       }
-    &write_routepushfile;
-       undef $vpnsettings{'ROUTES_PUSH'};
-    }
-       else {
-       undef $vpnsettings{'ROUTES_PUSH'};
-       &write_routepushfile;
+
+           &write_routepushfile();
+
+               undef $vpnsettings{'ROUTES_PUSH'};
     }
+
     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
         $errormessage = $Lang::tr{'invalid input for max clients'};
         goto ADV_ERROR;

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 229b9ddc1c13f5d826d171a4c4b1f1f29800dbfb..aea6740d7649b1666a0dc95000baad66cd2e8220 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2034,6 +2034,7 @@
 'ovpn engines' => 'Crypto engine',
 'ovpn errmsg green already pushed' => 'Route for green network is always set',
 'ovpn errmsg invalid ip or mask' => 'Invalid network-address or subnetmask',
+'ovpn errmsg invalid route' => 'Invalid route',
 'ovpn error md5' => 'You host certificate uses MD5 for the signature which is not accepted anymore. <br>Please update to the latest IPFire version and generate a new root and host certificate.</br><br>All OpenVPN clients needs then to be renewed!</br>',
 'ovpn fallback cipher' => 'Fallback Cipher',
 'ovpn fallback cipher help' => 'This cipher is being used by clients that do not support cipher negotiation.',