diff options
| author | Renato Botelho <garga@FreeBSD.org> | 2013-03-01 10:44:01 -0300 |
|---|---|---|
| committer | Renato Botelho <garga@FreeBSD.org> | 2013-03-01 10:44:01 -0300 |
| commit | 6b23c19a15eb621208fa6d6fc5a8b97c3dd6ff97 (patch) | |
| tree | a44a1c770ef199764eeee2081a7315ea7f03cd13 /usr/local/www/firewall_virtual_ip_edit.php | |
| parent | 17ff2c46c266863b7c7b0af2ef5e39bf2894171a (diff) | |
| download | pfsense-6b23c19a15eb621208fa6d6fc5a8b97c3dd6ff97.zip pfsense-6b23c19a15eb621208fa6d6fc5a8b97c3dd6ff97.tar.gz | |
Don't allow adding IP Alias or CARP VIP on network or broadcast addresses. Fixes #2768
Diffstat (limited to 'usr/local/www/firewall_virtual_ip_edit.php')
| -rwxr-xr-x | usr/local/www/firewall_virtual_ip_edit.php | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/usr/local/www/firewall_virtual_ip_edit.php b/usr/local/www/firewall_virtual_ip_edit.php index a018ddf..4213380 100755 --- a/usr/local/www/firewall_virtual_ip_edit.php +++ b/usr/local/www/firewall_virtual_ip_edit.php @@ -132,6 +132,22 @@ if ($_POST) { $input_errors[] = gettext("The /127 and /128 subnet mask are invalid for CARP IPs."); } + /* ipalias and carp should not use network or broadcast address */ + if ($_POST['mode'] == "ipalias" || $_POST['mode'] == "carp") { + if (is_ipaddrv4($_POST['subnet']) && $_POST['subnet_bits'] != "32") { + $network_addr = gen_subnet($_POST['subnet'], $_POST['subnet_bits']); + $broadcast_addr = gen_subnet_max($_POST['subnet'], $_POST['subnet_bits']); + } else if (is_ipaddrv6($_POST['subnet']) && $_POST['subnet_bits'] != "128" ) { + $network_addr = gen_subnetv6($_POST['subnet'], $_POST['subnet_bits']); + $broadcast_addr = gen_subnetv6_max($_POST['subnet'], $_POST['subnet_bits']); + } + + if (isset($network_addr) && $_POST['subnet'] == $network_addr) + $input_errors[] = gettext("You cannot use the network address for this VIP"); + else if (isset($broadcast_addr) && $_POST['subnet'] == $broadcast_addr) + $input_errors[] = gettext("You cannot use the broadcast address for this VIP"); + } + /* make sure new ip is within the subnet of a valid ip * on one of our interfaces (wan, lan optX) */ |
