From 198bb44993ff5a8d639522e325cc96cec0df96a2 Mon Sep 17 00:00:00 2001 From: jim-p Date: Tue, 4 Dec 2012 13:12:24 -0500 Subject: Add input validation to reject invalid combinations of IPv4/IPv6 openvpn protocols and interface/VIPs. --- usr/local/www/vpn_openvpn_client.php | 11 +++++++++++ usr/local/www/vpn_openvpn_server.php | 11 +++++++++++ 2 files changed, 22 insertions(+) (limited to 'usr') diff --git a/usr/local/www/vpn_openvpn_client.php b/usr/local/www/vpn_openvpn_client.php index 8b269f5..44facb2 100644 --- a/usr/local/www/vpn_openvpn_client.php +++ b/usr/local/www/vpn_openvpn_client.php @@ -155,6 +155,17 @@ if ($_POST) { else $vpnid = 0; + list($iv_iface, $iv_ip) = explode ("|",$pconfig['interface']); + if (is_ipaddrv4($iv_ip) && (stristr($pconfig['protocol'], "6") !== false)) { + $input_errors[] = gettext("Protocol and IP address families do not match. You cannot select an IPv6 protocol and an IPv4 IP address."); + } elseif (is_ipaddrv6($iv_ip) && (stristr($pconfig['protocol'], "6") === false)) { + $input_errors[] = gettext("Protocol and IP address families do not match. You cannot select an IPv4 protocol and an IPv6 IP address."); + } elseif ((stristr($pconfig['protocol'], "6") === false) && !get_interface_ip($iv_iface)) { + $input_errors[] = gettext("An IPv4 protocol was selected, but the selected interface has no IPv4 address."); + } elseif ((stristr($pconfig['protocol'], "6") !== false) && !get_interface_ipv6($iv_iface)) { + $input_errors[] = gettext("An IPv6 protocol was selected, but the selected interface has no IPv6 address."); + } + if ($pconfig['mode'] != "p2p_shared_key") $tls_mode = true; else diff --git a/usr/local/www/vpn_openvpn_server.php b/usr/local/www/vpn_openvpn_server.php index 004ce56..dafcabc 100644 --- a/usr/local/www/vpn_openvpn_server.php +++ b/usr/local/www/vpn_openvpn_server.php @@ -207,6 +207,17 @@ if ($_POST) { else $vpnid = 0; + list($iv_iface, $iv_ip) = explode ("|",$pconfig['interface']); + if (is_ipaddrv4($iv_ip) && (stristr($pconfig['protocol'], "6") !== false)) { + $input_errors[] = gettext("Protocol and IP address families do not match. You cannot select an IPv6 protocol and an IPv4 IP address."); + } elseif (is_ipaddrv6($iv_ip) && (stristr($pconfig['protocol'], "6") === false)) { + $input_errors[] = gettext("Protocol and IP address families do not match. You cannot select an IPv4 protocol and an IPv6 IP address."); + } elseif ((stristr($pconfig['protocol'], "6") === false) && !get_interface_ip($iv_iface)) { + $input_errors[] = gettext("An IPv4 protocol was selected, but the selected interface has no IPv4 address."); + } elseif ((stristr($pconfig['protocol'], "6") !== false) && !get_interface_ipv6($iv_iface)) { + $input_errors[] = gettext("An IPv6 protocol was selected, but the selected interface has no IPv6 address."); + } + if ($pconfig['mode'] != "p2p_shared_key") $tls_mode = true; else -- cgit v1.1