mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Do not allow duplicate subnet entries on left|rightsubnet specification since it will blackhole all traffic to that subnet when connection is setup as route

Browse Source
This commit is contained in:
Ermal 2014-08-18 10:25:45 +00:00
parent 5d37d51581
commit ae170e96df
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
etc/inc/vpn.inc
View File

@ -660,12 +660,16 @@ EOD;
}
}
$leftsubnet_spec[] = $leftsubnet_data;
if (empty($leftsubnet_spec[$leftsubnet_data]))
$leftsubnet_spec[$leftsubnet_data] = $leftsubnet_data;
if (!isset($ph2ent['mobile'])) {
$rightsubnet_spec[] = ipsec_idinfo_to_cidr($ph2ent['remoteid'], false, $ph2ent['mode']);
$tmpsubnet = ipsec_idinfo_to_cidr($ph2ent['remoteid'], false, $ph2ent['mode']);
if (empty($rightsubnet_spec[$tmpsubnet]))
$rightsubnet_spec[$tmpsubnet] = $tmpsubnet;
} else if (!empty($a_client['pool_address'])) {
$rightsubnet_spec[] = "{$a_client['pool_address']}/{$a_client['pool_netbits']}";
if (empty($rightsubnet_spec["{$a_client['pool_address']}/{$a_client['pool_netbits']}"]))
$rightsubnet_spec["{$a_client['pool_address']}/{$a_client['pool_netbits']}"] = "{$a_client['pool_address']}/{$a_client['pool_netbits']}";
}
} else {
$tunneltype = "type = transport";
@ -674,11 +678,15 @@ EOD;
($ph1ent['authentication_method'] == "pre_shared_key")) && isset($ph1ent['mobile'])) {
$left_spec = "%any";
} else {
$leftsubnet_spec[] = ipsec_get_phase1_src($ph1ent);
$tmpsubnet = ipsec_get_phase1_src($ph1ent);
if ($leftsubnet_spec[$tmpsubnet])
$leftsubnet_spec[$tmpsubnet] = $tmpsubnet;
}
if (!isset($ph2ent['mobile']))
$rightsubnet_spec[] = $right_spec;
if (!isset($ph2ent['mobile'])) {
if (empty($rightsubnet_spec[$right_spec]))
$rightsubnet_spec[$right_spec] = $right_spec;
}
}
if (isset($a_client['pfs_group']))