From: Michael Tremer <michael.tremer@ipfire.org>
Date: Wed, 5 Dec 2018 17:10:16 +0000 (+0000)
Subject: IPsec: Do not allow 0.0.0.0/0 as remote subnet
X-Git-Tag: v2.23-core131~197^2~27
X-Git-Url: http://git.ipfire.org/?p=ipfire-2.x.git;a=commitdiff_plain;h=f2d45a45ab78d6b2a557d515d84785a8daaa182f

IPsec: Do not allow 0.0.0.0/0 as remote subnet

This renders the whole machine inaccessible

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---

diff --git a/html/cgi-bin/vpnmain.cgi b/html/cgi-bin/vpnmain.cgi
index b65838d92e..f6791c70b2 100644
--- a/html/cgi-bin/vpnmain.cgi
+++ b/html/cgi-bin/vpnmain.cgi
@@ -305,7 +305,7 @@ sub writeipsecfiles {
 		} elsif ($interface_mode eq "vti") {
 			print CONF "\tleftsubnet=0.0.0.0/0\n";
 		} else {
-			print CONF "\tleftsubnet=" . &make_subnets($lconfighash{$key}[8]) . "\n";
+			print CONF "\tleftsubnet=" . &make_subnets("left", $lconfighash{$key}[8]) . "\n";
 		}
 
 		print CONF "\tleftfirewall=yes\n";
@@ -318,7 +318,7 @@ sub writeipsecfiles {
 			} elsif ($interface_mode eq "vti") {
 				print CONF "\trightsubnet=0.0.0.0/0\n";
 			} else {
-				print CONF "\trightsubnet=" . &make_subnets($lconfighash{$key}[11]) . "\n";
+				print CONF "\trightsubnet=" . &make_subnets("right", $lconfighash{$key}[11]) . "\n";
 			}
 		}
 
@@ -3345,13 +3345,19 @@ sub make_algos($$$$$) {
 	return &array_unique(\@algos);
 }
 
-sub make_subnets($) {
+sub make_subnets($$) {
+	my $direction = shift;
 	my $subnets = shift;
 
 	my @nets = split(/\|/, $subnets);
 	my @cidr_nets = ();
 	foreach my $net (@nets) {
 		my $cidr_net = &General::ipcidr($net);
+
+		# Skip 0.0.0.0/0 for remote because this renders the
+		# while system inaccessible
+		next if (($direction eq "right") && ($cidr_net eq "0.0.0.0/0"));
+
 		push(@cidr_nets, $cidr_net);
 	}