Disallow rules on virtual interfaces

diff --git a/firewall/CHANGELOG b/firewall/CHANGELOG
index 984d8bb..9f3e693 100644 (file)
--- a/firewall/CHANGELOG
+++ b/firewall/CHANGELOG
@@ -26,3 +26,5 @@ When initializing the firewall, the actual ports for Webmin, Usermin and SSHd ar
 Added an option for the UNTRACKED state in rules.
 ---- Changes since 1.450 ----
 Fixed 'Does not equal' option for multiple ports.
+---- Changes since 1.470 ----
+Disallow rules on virtual interfaces, as they don't work.

diff --git a/firewall/firewall-lib.pl b/firewall/firewall-lib.pl
index 613b045..3361cf5 100644 (file)
--- a/firewall/firewall-lib.pl
+++ b/firewall/firewall-lib.pl
@@ -250,7 +250,7 @@ sub interface_choice
 local @ifaces;
 if (&foreign_check("net")) {
        &foreign_require("net", "net-lib.pl");
-       return &net::interface_choice($_[0], $_[1]);
+       return &net::interface_choice($_[0], $_[1], undef, 0, 1);
        }
 else {
        return "<input name=$_[0] size=6 value='$_[1]'>";

diff --git a/firewall/setup.cgi b/firewall/setup.cgi
index a4007e0..e3d3398 100755 (executable)
--- a/firewall/setup.cgi
+++ b/firewall/setup.cgi
@@ -51,7 +51,8 @@ if ($in{'auto'}) {
        @tables = &get_iptables_save();
        if ($in{'auto'} == 1) {
                # Add a single rule to the nat table for masquerading
-               $iface = $in{'iface1'} || $in{'iface1_other'};
+               $iface = $in{'iface1'} eq 'other' ? $in{'iface1_other'}
+                                                 : $in{'iface1'};
                $iface || &error($text{'setup_eiface'});
                ($table) = grep { $_->{'name'} eq 'nat' } @tables;
                push(@{$table->{'rules'}},
@@ -64,8 +65,9 @@ if ($in{'auto'}) {
                # connections, DNS replies and safe ICMP types
                # In mode 3 allow ssh and ident too
                # In mode 4 allow ftp, echo-request and high ports too
-               $iface = $in{'iface'.$in{'auto'}} ||
-                        $in{'iface'.$in{'auto'}.'_other'};
+               $iface = $in{'iface'.$in{'auto'}} eq 'other' ?
+                                $in{'iface'.$in{'auto'}.'_other'} :
+                                $in{'iface'.$in{'auto'}};
                $iface || &error($text{'setup_eiface'});
                ($table) = grep { $_->{'name'} eq 'filter' } @tables;
                $table->{'defaults'}->{'INPUT'} = 'DROP';

diff --git a/net/net-lib.pl b/net/net-lib.pl
index 6f0d68a..fd50744 100644 (file)
--- a/net/net-lib.pl
+++ b/net/net-lib.pl
@@ -269,31 +269,32 @@ sub can_create_iface
 return $access{'ifcs'} == 2;
 }
 
-# interface_choice(name, value, blankmode-text, [disabled?])
+# interface_choice(name, value, blankmode-text, [disabled?], [non-virt-only])
 # Returns HTML for an interface chooser menu
 sub interface_choice
 {
-local @ifaces = map { $_->{'fullname'} } (&net::active_interfaces(), &net::boot_interfaces());
+my ($name, $value, $blanktext, $disabled, $nonvirt) = @_;
+my @ifacestrs = grep { $_->{'fullname'} }
+                    ( &active_interfaces(), &boot_interfaces() );
+if ($nonvirt) {
+       @ifacestrs = grep { $_->{'virtual'} eq '' } @ifacestrs;
+       }
+my @ifaces = map { $_->{'fullname'} } @ifacestrs;
 @ifaces = sort { $a cmp $b } &unique(@ifaces);
-local $rv = "<select name=$_[0] ".($_[3] ? " disabled=true" : "").">\n";
-local ($i, $found);
-if ($_[2]) {
-       $rv .= sprintf "<option value='' %s> %s\n",
-                       $_[1] eq "" ? "checked" : "", $_[2];
+my @opts;
+my $found;
+if ($blanktext) {
+       push(@opts, [ '', $blanktext ]);
        }
-$found++ if ($_[1] eq "");
-foreach $i (@ifaces) {
-       $rv .= sprintf "<option value=%s %s>%s\n",
-               $i, $_[1] eq $i ? "selected" : "", $i;
-       $found++ if ($_[1] eq $i);
+$found++ if ($value eq "");
+foreach my $i (@ifaces) {
+       push(@opts, [ $i, $i ]);
+       $found++ if ($value eq $i);
        }
-#$rv .= "<option value=$_[1] selected>$_[1]\n" if (!$found && $_[1]);
-$rv .= sprintf "<option value=other %s> %s\n",
-               !$found && $_[1] ? "selected" : "", $text{'chooser_other'};
-$rv .= "</select>";
-$rv .= sprintf "<input name=$_[0]_other size=6 value='%s' %s>\n",
-               !$found ? $_[1] : "", $_[3] ? " disabled=true" : "";
-return $rv;
+push(@opts, [ 'other', $text{'chooser_other'} ]);
+return &ui_select($name, !$found && $value ? 'other' : $value,
+                 \@opts, 1, 0, 0, $disabled)." ".
+       &ui_textbox($name."_other", $found ? "" : $value, $disabled);
 }
 
 # compute_broadcast(ip, netmask)