ovpnmain.cgi: Fix checking custom routes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/doc/language_issues.de b/doc/language_issues.de
index 1c92b2d3867844e3d12c5ecc7e516cd8a7f93d38..61ab6f05c6d37753ae4ba569b25ef7a3cbb7d387 100644 (file)
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -595,6 +595,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn log
@@ -991,6 +993,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.en b/doc/language_issues.en
index 3d3c3a7a1c0abb55ce15d325ffc33f88b449ad05..136b4b46059c7b13aa4b689b851968baf92cdb77 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -1441,8 +1441,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
-WARNING: untranslated string: ovpn errmsg green already pushed = Route for green network is always set
-WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-address or subnetmask
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.es b/doc/language_issues.es
index 0fea87bf3cfcb3da377648742a4f22234935dded..5a38bbe0028a93a4270954726ef540435081679f 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -652,6 +652,8 @@ WARNING: translation string unused: ovpn dh parameters
 WARNING: translation string unused: ovpn dh upload
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error dh
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
@@ -1053,6 +1055,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index e3ca5de4b197e12323dac38138b6f740dd9f2068..e98af2a75a3ff523d3fef55a880efdb7f8f62ae7 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -626,6 +626,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn error md5
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn log
@@ -997,6 +999,7 @@ WARNING: untranslated string: ovpn ciphers = Ciphers
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.it b/doc/language_issues.it
index ffe5c6ee2288a0f8b28507f282bcdd0016340d10..8e16c0f0441d1cb9e34cd19cbaec47b85df495aa 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -581,6 +581,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn hmac
 WARNING: translation string unused: ovpn log
@@ -1239,6 +1241,7 @@ WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index 9e664823d307d0d5a87f219da354215b17edc8c6..804e19175cc6c1ec77c1f7b5fd9c8f34cc46722c 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -581,6 +581,8 @@ WARNING: translation string unused: override mtu
 WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn log
 WARNING: translation string unused: ovpn mtu-disc
 WARNING: translation string unused: ovpn mtu-disc and mtu not 1500
@@ -1262,6 +1264,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index c542aa13fd30a8e1c220bc0bc0fd21566f5936b0..9833159c3a1f10d05c1d687c49178de2f96d9ce2 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1419,8 +1419,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
-WARNING: untranslated string: ovpn errmsg green already pushed = Route for green network is always set
-WARNING: untranslated string: ovpn errmsg invalid ip or mask = Invalid network-address or subnetmask
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 7005aba33d70f2745bec7b7f8bc3c59701fe1f55..77c1f66cfbf8c2d18a951675efb7162baecc564d 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -507,6 +507,8 @@ WARNING: translation string unused: override mtu
 WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn log
 WARNING: translation string unused: ovpn on blue
 WARNING: translation string unused: ovpn on orange
@@ -1417,6 +1419,7 @@ WARNING: untranslated string: ovpn crypt options = unknown string
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index 336d2db9ce5db6f09eeb8e8331c14db59b082b63..c2b3e19d11fef457454f7eaaf5c73d1c9419f8de 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -611,6 +611,8 @@ WARNING: translation string unused: ovpn config
 WARNING: translation string unused: ovpn device
 WARNING: translation string unused: ovpn dl
 WARNING: translation string unused: ovpn engines
+WARNING: translation string unused: ovpn errmsg green already pushed
+WARNING: translation string unused: ovpn errmsg invalid ip or mask
 WARNING: translation string unused: ovpn generating the root and host certificates
 WARNING: translation string unused: ovpn hmac
 WARNING: translation string unused: ovpn log
@@ -1155,6 +1157,7 @@ WARNING: untranslated string: ovpn connection name = Connection Name
 WARNING: untranslated string: ovpn crypto settings = Cryptographic Settings
 WARNING: untranslated string: ovpn dhcp settings = DHCP Settings
 WARNING: untranslated string: ovpn dynamic client subnet = Dynamic Client Subnet
+WARNING: untranslated string: ovpn errmsg invalid route = Invalid route
 WARNING: untranslated string: ovpn fallback cipher = Fallback Cipher
 WARNING: untranslated string: ovpn fallback cipher help = This cipher is being used by clients that do not support cipher negotiation.
 WARNING: untranslated string: ovpn fqdn = FQDN

diff --git a/doc/language_missings b/doc/language_missings
index ea00255584c773a3650d09e0d26de7ab9529071a..c9b3ce789075e8a35f1c2c25b56bcf5707c295f9 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -85,6 +85,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -160,6 +161,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -203,6 +205,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn fallback cipher
 < ovpn fallback cipher help
 < ovpn fqdn
@@ -589,6 +592,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -1157,6 +1161,7 @@
 < ovpn dhcp settings
 < ovpn dynamic client subnet
 < ovpn engines
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -2045,6 +2050,7 @@
 < ovpn engines
 < ovpn errmsg green already pushed
 < ovpn errmsg invalid ip or mask
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -3066,6 +3072,7 @@
 < ovpn dhcp settings
 < ovpn dynamic client subnet
 < ovpn engines
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help
@@ -3591,6 +3598,7 @@
 < ovpn crypto settings
 < ovpn dhcp settings
 < ovpn dynamic client subnet
+< ovpn errmsg invalid route
 < ovpn error md5
 < ovpn fallback cipher
 < ovpn fallback cipher help

diff --git a/html/cgi-bin/ovpnmain.cgi b/html/cgi-bin/ovpnmain.cgi
index af160dd2ee7aedf4db303501ef881a1cad9f5a77..611a360edd3797f9705e660ab8739081600ad340 100755 (executable)
--- a/html/cgi-bin/ovpnmain.cgi
+++ b/html/cgi-bin/ovpnmain.cgi
@@ -893,9 +893,7 @@ sub writecollectdconf {
 
 if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     &General::readhash("${General::swroot}/ovpn/settings", \%vpnsettings);
-    #DAN do we really need (to to check) this value? Besides if we listen on blue and orange too,
-    #DAN this value has to leave.
-#new settings for daemon
+
     $vpnsettings{'DPROTOCOL'} = $cgiparams{'DPROTOCOL'};
     $vpnsettings{'DDEST_PORT'} = $cgiparams{'DDEST_PORT'};
     $vpnsettings{'DMTU'} = $cgiparams{'DMTU'};
@@ -909,7 +907,6 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
     $vpnsettings{'DCIPHER'} = $cgiparams{'DCIPHER'};
     $vpnsettings{'DAUTH'} = $cgiparams{'DAUTH'};
     $vpnsettings{'TLSAUTH'} = $cgiparams{'TLSAUTH'};
-    my @temp=();
 
        # We must have at least one cipher selected
        if ($cgiparams{'DATACIPHERS'} eq '') {
@@ -975,54 +972,37 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'save-adv-options'}) {
                goto ADV_ERROR;
        }
     }
+
+       # Validate pushed routes
     if ($cgiparams{'ROUTES_PUSH'} ne ''){
-       @temp = split(/\n/,$cgiparams{'ROUTES_PUSH'});
-       undef $vpnsettings{'ROUTES_PUSH'};
+               my @temp = split(/\n/, $cgiparams{'ROUTES_PUSH'});
 
-       foreach my $tmpip (@temp)
-       {
-               s/^\s+//g; s/\s+$//g;
+               # Reset stored routes
+               $vpnsettings{'ROUTES_PUSH'} = "";
 
-               if ($tmpip)
-               {
-                       $tmpip=~s/\s*$//g;
-                       unless (&General::validipandmask($tmpip)) {
-                               $errormessage = "$tmpip ".$Lang::tr{'ovpn errmsg invalid ip or mask'};
-                               goto ADV_ERROR;
-                       }
-                       my ($ip, $cidr) = split("\/",&General::ipcidr2msk($tmpip));
+               foreach my $route (@temp) {
+                       chomp($route);
 
-                       if ($ip eq $Network::ethernet{'GREEN_NETADDRESS'} && $cidr eq $Network::ethernet{'GREEN_NETMASK'}) {
-                               $errormessage = $Lang::tr{'ovpn errmsg green already pushed'};
-                               goto ADV_ERROR;
-                       }
+                       # Remove any excess whitespace
+                       $route =~ s/^\s+//g;
+                       $route =~ s/\s+$//g;
 
-                       my %ccdroutehash=();
-                       &General::readhasharray("${General::swroot}/ovpn/ccdroute", \%ccdroutehash);
-                       foreach my $key (keys %ccdroutehash) {
-                               foreach my $i (1 .. $#{$ccdroutehash{$key}}) {
-                                       if ( $ip."/".$cidr eq $ccdroutehash{$key}[$i] ){
-                                               $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
-                                               goto ADV_ERROR;
-                                       }
-                                       my ($ip2,$cidr2) = split(/\//,$ccdroutehash{$key}[$i]);
-                                       if (&General::IpInSubnet ($ip,$ip2,$cidr2)){
-                                               $errormessage="Route $ip\/$cidr ".$Lang::tr{'ccd err inuse'}." $ccdroutehash{$key}[0]" ;
-                                               goto ADV_ERROR;
-                                       }
-                               }
+                       # Skip empty lines
+                       next if ($route eq "");
+
+                       unless (&Network::check_subnet($route)) {
+                               $errormessage = "$Lang::tr{'ovpn errmsg invalid route'}: $route";
+                               goto ADV_ERROR;
                        }
 
-                       $vpnsettings{'ROUTES_PUSH'} .= $tmpip."\n";
+                       $vpnsettings{'ROUTES_PUSH'} .= $route . "\n";
                }
-       }
-    &write_routepushfile;
-       undef $vpnsettings{'ROUTES_PUSH'};
-    }
-       else {
-       undef $vpnsettings{'ROUTES_PUSH'};
-       &write_routepushfile;
+
+           &write_routepushfile();
+
+               undef $vpnsettings{'ROUTES_PUSH'};
     }
+
     if ((length($cgiparams{'MAX_CLIENTS'}) == 0) || (($cgiparams{'MAX_CLIENTS'}) < 1 ) || (($cgiparams{'MAX_CLIENTS'}) > 1024 )) {
         $errormessage = $Lang::tr{'invalid input for max clients'};
         goto ADV_ERROR;

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index dc3509f40eeffea2ccfee0163a6e5495c015f35d..f93e70e9012a08a3f0d0097f5f95adc4c6b1d88d 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2028,6 +2028,7 @@
 'ovpn engines' => 'Crypto engine',
 'ovpn errmsg green already pushed' => 'Route for green network is always set',
 'ovpn errmsg invalid ip or mask' => 'Invalid network-address or subnetmask',
+'ovpn errmsg invalid route' => 'Invalid route',
 'ovpn error md5' => 'You host certificate uses MD5 for the signature which is not accepted anymore. <br>Please update to the latest IPFire version and generate a new root and host certificate.</br><br>All OpenVPN clients needs then to be renewed!</br>',
 'ovpn fallback cipher' => 'Fallback Cipher',
 'ovpn fallback cipher help' => 'This cipher is being used by clients that do not support cipher negotiation.',