From mboxrd@z Thu Jan  1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@link38.eu>
To: development@lists.ipfire.org
Subject: Re: [PATCH 2/4] BUG11559: firewall.cgi
Date: Mon, 07 May 2018 18:23:37 +0200
Message-ID: <60bc4f21-0549-3efd-fdaf-be83e1d9922c@link38.eu>
In-Reply-To: <1525260427-6695-2-git-send-email-alexander.marx@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6889965385468278071=="
List-Id: <development.lists.ipfire.org>

--===============6889965385468278071==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

When creating firewallrules or using firewall groups,
it should be possible to select a single IpSec subnet if there is more than o=
ne.

This patch has the changes for firewall.cgi
Signed-off-by: Alexander Marx <alexander.marx(a)ipfire.org>
Tested-by: Peter M=C3=BCller <peter.mueller(a)link38.eu>
---
 html/cgi-bin/firewall.cgi | 36 +++++++++++++++++++++++++++++++++---
 1 file changed, 33 insertions(+), 3 deletions(-)

diff --git a/html/cgi-bin/firewall.cgi b/html/cgi-bin/firewall.cgi
index face0f4..499f279 100644
--- a/html/cgi-bin/firewall.cgi
+++ b/html/cgi-bin/firewall.cgi
@@ -1161,11 +1161,31 @@ END
 	#IPsec netze
 	foreach my $key (sort { ncmp($ipsecconf{$a}[1],$ipsecconf{$b}[1]) } keys %i=
psecconf) {
 		if ($ipsecconf{$key}[3] eq 'net' || ($optionsfw{'SHOWDROPDOWN'} eq 'on' &&=
 $ipsecconf{$key}[3] ne 'host')){
-			print"<tr><td valign=3D'top'><input type=3D'radio' name=3D'$grp' value=3D=
'ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$srctgt}></td><td >$Lang::tr{=
'fwhost ipsec net'}</td><td align=3D'right'><select name=3D'ipsec_net_$srctgt=
' style=3D'width:200px;'>" if ($show eq '');
+			print"<tr><td valign=3D'top'><input type=3D'radio' name=3D'$grp' id=3D'ip=
sec_net_$srctgt' value=3D'ipsec_net_$srctgt' $checked{$grp}{'ipsec_net_'.$src=
tgt}></td><td >$Lang::tr{'fwhost ipsec net'}</td><td align=3D'right'><select =
name=3D'ipsec_net_$srctgt' style=3D'width:200px;'>" if ($show eq '');
 			$show=3D'1';
+
+			#Check if we have more than one REMOTE subnet in config
+			my @arr1 =3D split /\|/, $ipsecconf{$key}[11];
+			my $cnt1 +=3D @arr1;
+
 			print "<option ";
-			print "selected=3D'selected'" if ($fwdfwsettings{$fwdfwsettings{$grp}} eq=
 $ipsecconf{$key}[1]);
-			print ">$ipsecconf{$key}[1]</option>";
+			print "value=3D$ipsecconf{$key}[1]";
+			print " selected " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipseccon=
f{$key}[1]");
+			print ">$ipsecconf{$key}[1] ";
+			print "($Lang::tr{'fwdfw all subnets'})" if $cnt1 > 1; #If this Conenctio=
n has more than one subnet, print one option for all subnets
+			print "</option>";
+
+			if ($cnt1 > 1){
+				foreach my $val (@arr1){
+					#normalize subnet to cidr notation
+					my ($val1,$val2) =3D split /\//, $val;
+					my $val3 =3D &General::iporsubtocidr($val2);
+					print "<option ";
+					print "value=3D'$ipsecconf{$key}[1]|$val1/$val3'";
+					print "selected " if ($fwdfwsettings{$fwdfwsettings{$grp}} eq "$ipsecco=
nf{$key}[1]|$val1/$val3");
+					print ">$ipsecconf{$key}[1] ($val1/$val3)</option>";
+				}
+			}
 		}
 	}
 	if($optionsfw{'SHOWDROPDOWN'} eq 'on' && $show eq ''){
@@ -2575,6 +2595,11 @@ END
 			#SOURCE
 			my $ipfireiface;
 			&getcolor($$hash{$key}[3],$$hash{$key}[4],\%customhost);
+			# Check SRC Host and replace "|" with space
+			if ($$hash{$key}[4] =3D~ /\|/){
+				$$hash{$key}[4] =3D~ s/\|/ (/g;
+				$$hash{$key}[4] =3D $$hash{$key}[4].")";
+			}
 			print"<td align=3D'center' width=3D'30%' $tdcolor>";
 			if ($$hash{$key}[3] eq 'ipfire_src'){
 				$ipfireiface=3D$Lang::tr{'fwdfw iface'};
@@ -2640,6 +2665,11 @@ END
 			print<<END;
 					<td align=3D'center' $tdcolor>
 END
+			# Check TGT Host and replace "|" with space
+			if ($$hash{$key}[6] =3D~ /\|/){
+				$$hash{$key}[6] =3D~ s/\|/ (/g;
+				$$hash{$key}[6] =3D $$hash{$key}[6].")";
+			}
 			#Is this a DNAT rule?
 			my $natstring;
 			if ($$hash{$key}[31] eq 'dnat' && $$hash{$key}[28] eq 'ON'){
--=20
2.7.4



--===============6889965385468278071==
Content-Type: application/pgp-signature
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="signature.asc"
MIME-Version: 1.0

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251UEcgdjIKCmlRSWNCQUVC
Q2dBR0JRSmE4SDJKQUFvSkVObEk4Zzk5ZTU5b0J1c1ArUUVtK3BpRWVkWWFVWlBvdGcxTXFiOXkK
K0JsMmQxUVRmVmFmWnpPWEttclpPenhMUzZmdjY5U1lFQXVnUEF0MzRBd05XcjRjWkwvaUdaUDU3
VUhZL3ozYgo0bmtjanVmbnJ3eUFmUms1elQzcTBRNWFOSVdsZjdoOEYxUDFkRGd1clBZOFFMUFMz
UFhlRkFRS0tpdjVjZWFuCktYWCtNQm9XNHl2OWw2WTlDRFQybEV4TXF6NUhqemJPanJGOXBIbnAy
d05FeEZ6UzM2K1VFWjZCdXFCQTFURGgKMFYrWDJuZmMyNENic25FclBGdFd2MWdpZGl3MnYrUm5H
MHZOZmpPUU1MSWVVSFdHSHBLS1o3c0o2N0wzOUIzUwo5eHhQbUdOYlZJUmk0K0h4am9PWTlIRmxW
UHpHaitZQVFFcWw4SnNiN2E3bmVNVlRuMzFqeXdKdE5VWWlvNTV4Cm5rUUJUREk2YnErMlFpSWV3
b0hhRDRVWGdDWUpnZVR4MCsyL2J6bU1QRFFlcTNZZ2NLVzVHVWNPT1lMMTJ5bjYKL3RIeE1ELzc0
WU5lU1M1cTNYc3hCR1pKd0ZQZ1RTcEZiUGpFL3lKb2ticHlyMXZyeklOSzhCRXpMNTJ5dnFacwpM
QkREV2xSYndJZy9KaVQ3cE11dUpRdE1Td0w2aU5lSC82MFVPZnM1ZXdnR1l2SCtJaW1KNVBHUmFN
OTZYMnVICkFTREJ3dzN3OGhyTDZMVmk4all1TExpeGFHRTdwSmdxNS9LN0Niam9GaTc4NmlwM000
c0dwdVpJTHZGeXNMNDQKVFNjaXJRazU3M1ZleG55a1FmZUNSUG5URE53NWViSHJsei9wNm5pa09S
UG9rdzc5bTJMbTlFU3VIemhZNDVXaApRV1VQMVFPYzAxajV0NmtOMi9vWgo9T25xbQotLS0tLUVO
RCBQR1AgU0lHTkFUVVJFLS0tLS0K

--===============6889965385468278071==--