From 1891fd835cc3cd60d7c3a2ec8bf90b51ca261bf0 Mon Sep 17 00:00:00 2001 From: Karl 'vollmerk' Vollmer Date: Sat, 31 Jan 2009 23:48:46 +0000 Subject: [PATCH] ACL with IPv6 should be working / testing now --- admin/access.php | 68 ++++++++++++++++++++++- lib/class/access.class.php | 45 ++++++++++++++- templates/show_add_access.inc.php | 2 +- templates/show_add_access_current.inc.php | 2 +- templates/show_add_access_local.inc.php | 8 +-- templates/show_add_access_rpc.inc.php | 8 +-- templates/show_edit_access.inc.php | 48 ++++++++-------- 7 files changed, 142 insertions(+), 39 deletions(-) diff --git a/admin/access.php b/admin/access.php index 6ffaa167..0fa88a15 100644 --- a/admin/access.php +++ b/admin/access.php @@ -35,9 +35,70 @@ switch ($_REQUEST['action']) { show_confirmation(_('Deleted'),_('Your Access List Entry has been removed'),$url); break; case 'add_host': - Access::create($_POST); - $url = Config::get('web_path') . '/admin/access.php'; - show_confirmation(_('Added'),_('Your new Access List Entry has been created'),$url); + + // Make sure we've got a valid form submission + if (!Core::form_verify('add_acl','post')) { + access_denied(); + exit; + } + + // We need to pre-process this a little bit as stuff is coming in from all over + switch ($_GET['method']) { + case 'advanced': + Access::create($_POST); + break; + case 'local': + $_POST['type'] = 'network'; + Access::create($_POST); + + // Create Additional stuff based on the type + if ($_POST['addtype'] == 'streamnetwork' OR $_POST['addtype'] == 'allnetwork') { + $_POST['type'] = 'stream'; + Access::create($_POST); + } + if ($_POST['addtype'] == 'allnetwork') { + $_POST['type'] = 'interface'; + Access::create($_POST); + } + break; + case 'current': + $_POST['type'] = 'interface'; + Access::create($_POST); + $_POST['type'] = 'stream'; + Access::create($_POST); + break; + case 'rpc': + $_POST['type'] = 'rpc'; + Access::create($_POST); + + // Create Additional stuff based on the type + if ($_POST['addtype'] == 'streamrpc' OR $_POST['addtype'] == 'allrpc') { + $_POST['type'] = 'stream'; + Access::create($_POST); + } + if ($_POST['addtype'] == 'allrpc') { + $_POST['type'] = 'interface'; + Access::create($_POST); + } + break; + default: + // Do nothing they f'ed something up + break; + } // end switch on method + + if (!Error::occurred()) { + $url = Config::get('web_path') . '/admin/access.php'; + show_confirmation(_('Added'),_('Your new Access Control List(s) have been created'),$url); + } + else { + switch ($_GET['method']) { + case 'rpc': require_once Config::get('prefix') . '/templates/show_add_access_rpc.inc.php'; break; + case 'local': require_once Config::get('prefix') . '/templates/show_add_access_local.inc.php'; break; + case 'current': require_once Config::get('prefix') . '/templates/show_add_access_current.inc.php'; break; + case 'advanced': require_once Config::get('prefix') . '/templates/show_add_access.inc.php'; break; + default: require_once Config::get('prefix') . '/templates/show_access_list.inc.php'; break; + } + } break; case 'update_record': $access = new Access($_REQUEST['access_id']); @@ -58,6 +119,7 @@ switch ($_REQUEST['action']) { break; case 'show_edit_record': $access = new Access($_REQUEST['access_id']); + $access->format(); require_once Config::get('prefix') . '/templates/show_edit_access.inc.php'; break; default: diff --git a/lib/class/access.class.php b/lib/class/access.class.php index 9f8e6016..28a98073 100644 --- a/lib/class/access.class.php +++ b/lib/class/access.class.php @@ -120,9 +120,27 @@ class Access { public static function create($data) { /* We need to verify the incomming data a littlebit */ + $start = @inet_pton($data['start']); + $end = @inet_pton($data['end']); - $start = Dba::escape(inet_pton($data['start'])); - $end = Dba::escape(inet_pton($data['end'])); + if (!$start AND $data['start'] != '0.0.0.0' AND $data['start'] != '::') { + Error::add('start',_('Invalid IPv4 / IPv6 Address Entered')); + return false; + } + if (!$end) { + Error::add('end',_('Invalid IPv4 / IPv6 Address Entered')); + return false; + } + + // Check existing ACL's to make sure we're not duplicating values here + if (self::exists($data)) { + debug_event('ACL Create','Error did not create duplicate ACL entrie for ' . $data['start'] . ' - ' . $data['end'],'1'); + return false; + } + + + $start = Dba::escape($start); + $end = Dba::escape($end); $name = Dba::escape($data['name']); $key = Dba::escape($data['key']); $user = $data['user'] ? Dba::escape($data['user']) : '-1'; @@ -138,6 +156,29 @@ class Access { } // create + /** + * exists + * this sees if the ACL that we've specified already exists, prevent duplicates. This ignores the name + */ + public static function exists($data) { + + $start = Dba::escape(inet_pton($data['start'])); + $end = Dba::escape(inet_pton($data['end'])); + $type = self::validate_type($data['type']); + $user = $data['user'] ? Dba::escape($data['user']) : '-1'; + + $sql = "SELECT * FROM `access_list` WHERE `start`='$start' AND `end` = '$end' " . + "AND `type`='$type' AND `user`='$user'"; + $db_results = Dba::read($sql); + + if (Dba::fetch_assoc($db_results)) { + return true; + } + + return false; + + } // exists + /** * delete * deletes the specified access_list entry diff --git a/templates/show_add_access.inc.php b/templates/show_add_access.inc.php index 79d3de38..d2e537c5 100644 --- a/templates/show_add_access.inc.php +++ b/templates/show_add_access.inc.php @@ -20,7 +20,7 @@ */ ?> -
+ diff --git a/templates/show_add_access_current.inc.php b/templates/show_add_access_current.inc.php index e999ad57..64e9e5eb 100644 --- a/templates/show_add_access_current.inc.php +++ b/templates/show_add_access_current.inc.php @@ -20,7 +20,7 @@ */ ?> - +
:
diff --git a/templates/show_add_access_local.inc.php b/templates/show_add_access_local.inc.php index f7332f9d..cb6f4d43 100644 --- a/templates/show_add_access_local.inc.php +++ b/templates/show_add_access_local.inc.php @@ -20,7 +20,7 @@ */ ?> - +
:
@@ -47,9 +47,9 @@ diff --git a/templates/show_add_access_rpc.inc.php b/templates/show_add_access_rpc.inc.php index c23bfb36..c4600562 100644 --- a/templates/show_add_access_rpc.inc.php +++ b/templates/show_add_access_rpc.inc.php @@ -20,7 +20,7 @@ */ ?> - +
:
: -
- + +
- +
+
+ + +
+ +
@@ -47,9 +47,9 @@ diff --git a/templates/show_edit_access.inc.php b/templates/show_edit_access.inc.php index 9aa6c25e..72404892 100644 --- a/templates/show_edit_access.inc.php +++ b/templates/show_edit_access.inc.php @@ -1,7 +1,7 @@ - - + +
:
: -
- +
- + +
+ +
+ +
- + - - - + - + + + - - -
:
: +
: - - (0.0.0.0) -

+ (255.255.255.255) / (ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff) +
:: - - (0.0.0.0) + + : +
: + user); ?>
+
: - + + level; ${$name} = 'checked="checked"'; ?> + > + > + > + >
- + +