mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Bug #1560.IPsec GUI needs to reject duplicate subnets in phase 2s for a given phase 1 (improvement of previous patch)

Browse Source
This commit is contained in:
Evgeny Yurchenko 2011-06-01 18:28:15 -04:00
parent 538b6eb353
commit 3da5c50d5c
1 changed files with 24 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
usr/local/www/vpn_ipsec_phase2.php
View File

@ -140,33 +140,21 @@ if ($_POST) {
break;
}
}
/* Validate enabled phase2's are not duplicates */
if (isset($pconfig['mobile'])){
/* User is adding phase 2 for mobile phase1 */
foreach($a_phase2 as $name){
if (isset($name['mobile'])){
/* check duplicate localids only for mobile clents */
if ($name['localid']['type'] == $pconfig['localid_type']){
/* Types match, check further */
switch($pconfig['localid_type']){
case "none":
case "lan":
case "wan":
$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
break;
case "address":
if ($name['localid']['address'] == $pconfig['localid_address'])
$input_errors[] = gettext("Phase2 with this Local Address is already defined for mobile clients.");
break;
case "network":
if ($name['localid']['address'] == $pconfig['localid_address'] &&
$name['localid']['netbits'] == $pconfig['localid_netbits'])
$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
break;
}
if (count($input_errors) > 0)
break; /* there is an error, stop checking other phase2 definitions */
$localid_data = ipsec_idinfo_to_cidr($name['localid']);
$entered = array();
$entered['type'] = $pconfig['localid_type'];
if (isset($pconfig['localid_address'])) $entered['address'] = $pconfig['localid_address'];
if (isset($pconfig['localid_netbits'])) $entered['netbits'] = $pconfig['localid_netbits'];
$entered_localid_data = ipsec_idinfo_to_cidr($entered);
if ($localid_data == $entered_localid_data){
$input_errors[] = gettext("Phase2 with this Local Network is already defined for mobile clients.");
break;
}
}
}
@ -176,34 +164,21 @@ if ($_POST) {
foreach($a_phase2 as $name){
if (!isset($name['mobile']) && $pconfig['ikeid'] == $name['ikeid']){
/* check duplicate subnets only for given phase1 */
if ($name['localid']['type'] == $pconfig['localid_type'] &&
$name['remoteid']['type'] == $pconfig['remoteid_type']){
/* Types match, check further */
$configured_remote_string = $name['remoteid']['address'] . $name['remoteid']['netbits'];
$eneterd_remote_string = $pconfig['remoteid_address'] . $pconfig['remoteid_netbits'];
switch($pconfig['localid_type']){
case "none":
case "lan":
case "wan":
if ($configured_remote_string == $eneterd_remote_string)
$input_error = 1;
break;
case "address":
if ($name['localid']['address'] == $pconfig['localid_address'] &&
$configured_remote_string == $eneterd_remote_string)
$input_error = 1;
break;
case "network":
if ($name['localid']['address'] == $pconfig['localid_address'] &&
$name['localid']['netbits'] == $pconfig['localid_netbits'] &&
$configured_remote_string == $eneterd_remote_string)
$input_error = 1;
break;
}
if ($input_error){
$input_errors[] = gettext("Phase2 with this Local/Remote Networks combination is already defined for this Phase1.");
break; /* there is an error, stop checking other phase2 definitions */
}
$localid_data = ipsec_idinfo_to_cidr($name['localid']);
$remoteid_data = ipsec_idinfo_to_cidr($name['remoteid']);
$entered_local = array();
$entered_local['type'] = $pconfig['localid_type'];
if (isset($pconfig['localid_address'])) $entered_local['address'] = $pconfig['localid_address'];
if (isset($pconfig['localid_netbits'])) $entered_local['netbits'] = $pconfig['localid_netbits'];
$entered_localid_data = ipsec_idinfo_to_cidr($entered_local);
$entered_remote = array();
$entered_remote['type'] = $pconfig['remoteid_type'];
if (isset($pconfig['remoteid_address'])) $entered_remote['address'] = $pconfig['remoteid_address'];
if (isset($pconfig['remoteid_netbits'])) $entered_remote['netbits'] = $pconfig['remoteid_netbits'];
$entered_remoteid_data = ipsec_idinfo_to_cidr($entered_remote);
if ($localid_data == $entered_localid_data && $remoteid_data == $entered_remoteid_data) {
$input_errors[] = gettext("Phase2 with this Local/Remote networks combination is already defined for this Phase1.");
break;
}
}
}