Cherry-pick 98bf4991dc31f97fc7315a6b8aba433de9d39cea:

Fixes #4150. Move to tables to accomodate unlimited number of interfaces.

Cherry-pick 52fe0465b463dd8b8f4b2099d562254da320e704:

Fix the captive portal rules after 98bf4991dc31f97fc7315a6b8aba433de9d39cea.

The malformed rules breaks the parsing of initialisation rules.

Issue:          #4746

1 files changed, 14 insertions, 20 deletions

diff --git a/etc/inc/captiveportal.inc b/etc/inc/captiveportal.inc
index c533942..8e20ceb 100644
--- a/etc/inc/captiveportal.inc
+++ b/etc/inc/captiveportal.inc
@@ -520,10 +520,12 @@ function captiveportal_init_rules($reinit = false) {
 	if ($reinit == false)
 		$captiveportallck = lock("captiveportal{$cpzone}");
 
-	$cprules =	"add 65291 allow pfsync from any to any\n";
-	$cprules .= "add 65292 allow carp from any to any\n";
+	$cprules = <<<EOD
+
+flush
+add 65291 allow pfsync from any to any
+add 65292 allow carp from any to any
 
-	$cprules .= <<<EOD
 # layer 2: pass ARP
 add 65301 pass layer2 mac-type arp,rarp
 # pfsense requires for WPA
@@ -537,25 +539,18 @@ add 65307 deny layer2 not mac-type ip,ipv6
 EOD;
 
 	$rulenum = 65310;
-	$ipcount = 0;
-	$ips = "";
-	foreach ($cpips as $cpip) {
-		if($ipcount == 0) {
-			$ips = "{$cpip} ";
-		} else {
-			$ips .= "or {$cpip} ";
-		}
-		$ipcount++;
-	}
-	$ips = "{ 255.255.255.255 or {$ips} }";
-	$cprules .= "add {$rulenum} pass ip from any to {$ips} in\n";
+	/* These tables contain host ips */
+	$cprules .= "add {$rulenum} pass ip from any to table(100) in\n";
 	$rulenum++;
-	$cprules .= "add {$rulenum} pass ip from {$ips} to any out\n";
+	$cprules .= "add {$rulenum} pass ip from table(100) to any out\n";
 	$rulenum++;
-	$cprules .= "add {$rulenum} pass icmp from {$ips} to any out icmptype 0\n";
+	foreach ($cpips as $cpip)
+		$cprules .= "table 100 add {$cpip}\n";
+	$cprules .= "add {$rulenum} pass ip from any to 255.255.255.255 in\n";
 	$rulenum++;
-	$cprules .= "add {$rulenum} pass icmp from any to {$ips} in icmptype 8 \n";
+	$cprules .= "add {$rulenum} pass ip from 255.255.255.255 to any out\n";
 	$rulenum++;
+
 	/* Allowed ips */
 	$cprules .= "add {$rulenum} pipe tablearg ip from table(3) to any in\n";
 	$rulenum++;
@@ -609,11 +604,10 @@ EOD;
 	$cprules .= captiveportal_allowedhostname_configure();
 	
 	/* load rules */
-	$cprules = "flush\n{$cprules}";
 	file_put_contents("{$g['tmp_path']}/ipfw_{$cpzone}.cp.rules", $cprules);
 	mwexec("/sbin/ipfw -x {$cpzoneid} -q {$g['tmp_path']}/ipfw_{$cpzone}.cp.rules", true);
 	//@unlink("{$g['tmp_path']}/ipfw_{$cpzone}.cp.rules");
-	unset($cprules, $tmprules);
+	unset($cprules);
 
 	if ($reinit == false)
 		unlock($captiveportallck);