Firewall: appended check of maximum ports per protocol. portranges 100:200 count...

[people/teissler/ipfire-2.x.git] / html / cgi-bin / fwhosts.cgi

diff --git a/html/cgi-bin/fwhosts.cgi b/html/cgi-bin/fwhosts.cgi
index fd66a494145a4e9cb0c51d77829ee87529248a08..bc9ca85d4cf9487094ca5ada912652e9755faea4 100755 (executable)
--- a/html/cgi-bin/fwhosts.cgi
+++ b/html/cgi-bin/fwhosts.cgi
@@ -741,6 +741,7 @@ if ($fwhostsettings{'ACTION'} eq 'saveservice')
                }
        }
        if($ICMP eq ''){$ICMP=$fwhostsettings{'ICMP_TYPES'};}
+       if ($fwhostsettings{'PROT'} ne 'ICMP'){$ICMP='';}
        if (!$errormessage){
                my $key = &General::findhasharraykey (\%customservice);
                foreach my $i (0 .. 4) { $customservice{$key}[$i] = "";}
@@ -763,12 +764,34 @@ if ($fwhostsettings{'ACTION'} eq 'saveservicegrp')
        my $prot;
        my $port;
        my $count=0;
+       my $tcpcounter=0;
+       my $udpcounter=0;
        &General::readhasharray("$configsrvgrp", \%customservicegrp );
        &General::readhasharray("$configsrv", \%customservice );
        $errormessage=&checkservicegroup;
+       #Check if we have more than 13 services from one Protocol in the group
+       #iptables can only handle 13 ports/portranges via multiport
+       foreach my $key (keys %customservicegrp){
+               if($customservicegrp{$key}[0] eq $fwhostsettings{'SRVGRP_NAME'}){
+                       foreach my $key1 (keys %customservice){
+                               $tcpcounter++ if $customservice{$key1}[2] eq 'TCP' && $customservicegrp{$key}[2] eq $customservice{$key1}[0];
+                               $tcpcounter++ if $customservice{$key1}[2] eq 'TCP' && $customservicegrp{$key}[2] eq $customservice{$key1}[0] && $customservice{$key1}[1] =~m/:/i;
+                               $udpcounter++ if $customservice{$key1}[2] eq 'UDP' && $customservicegrp{$key}[2] eq $customservice{$key1}[0];
+                               $udpcounter++ if $customservice{$key1}[2] eq 'UDP' && $customservicegrp{$key}[2] eq $customservice{$key1}[0] && $customservice{$key1}[1] =~m/:/i;
+                       }
+               }
+       }
+       if ($tcpcounter > 15){
+               $errormessage=$Lang::tr{'fwhost err maxservicetcp'};
+       }
+       if ($udpcounter > 15){
+               $errormessage=$Lang::tr{'fwhost err maxserviceudp'};
+       }
+       $tcpcounter=0;
+       $udpcounter=0;
        #check remark
        if ($fwhostsettings{'SRVGRP_REMARK'} ne '' && !&validremark($fwhostsettings{'SRVGRP_REMARK'})){
-               $errormessage=$Lang::tr{'fwhost err remark'};
+               $errormessage .= $Lang::tr{'fwhost err remark'};
        }
        if (!$errormessage){
                #on first save, we have to enter a dummy value