Do not allow to add loopback/multicast/broadcast ips to split tunnel list

client/core/controllers/serverController.cpp

@@ -504,19 +504,6 @@ ErrorCode ServerController::startupContainerWorker(const ServerCredentials &cred
     if (e)
         return e;
 
-    if (container == DockerContainer::OpenVpn)
-    {
-        QFile file(":/server_scripts/openvpn/password_auth.sh");
-        file.open(QIODevice::ReadOnly);
-        QString scriptContent = QString(file.readAll());
-        const QString serverScriptPath = "/opt/amnezia/password_auth.sh";
-
-        uploadTextFileToContainer(container, credentials, scriptContent, serverScriptPath);
-        runScript(credentials,
-                  replaceVars(QStringLiteral("sudo docker exec -d $CONTAINER_NAME sh -c \"chmod +rx %1\"").arg(serverScriptPath),
-                              genVarsForScript(credentials, container, config)));
-    }
-
     return runScript(credentials,
                      replaceVars("sudo docker exec -d $CONTAINER_NAME sh -c \"chmod a+x /opt/amnezia/start.sh && "
                                  "/opt/amnezia/start.sh\"",

client/core/scripts_registry.cpp

@@ -47,7 +47,6 @@ QString amnezia::scriptName(ProtocolScriptType type)
     case ProtocolScriptType::configure_container: return QLatin1String("configure_container.sh");
     case ProtocolScriptType::container_startup: return QLatin1String("start.sh");
     case ProtocolScriptType::openvpn_template: return QLatin1String("template.ovpn");
-    case ProtocolScriptType::openvpn_password_auth: return QLatin1String("password_auth.sh");
     case ProtocolScriptType::wireguard_template: return QLatin1String("template.conf");
     case ProtocolScriptType::awg_template: return QLatin1String("template.conf");
     case ProtocolScriptType::xray_template: return QLatin1String("template.json");

client/core/scripts_registry.h

@@ -26,7 +26,6 @@ enum ProtocolScriptType {
     configure_container,
     container_startup,
     openvpn_template,
-    openvpn_password_auth,
     wireguard_template,
     awg_template,
     xray_template

client/resources.qrc

@@ -43,7 +43,6 @@
         <file>server_scripts/openvpn/template.ovpn</file>
         <file>server_scripts/openvpn/Dockerfile</file>
         <file>server_scripts/openvpn/start.sh</file>
-        <file>server_scripts/openvpn/password_auth.sh</file>
         <file>server_scripts/openvpn_shadowsocks/configure_container.sh</file>
         <file>server_scripts/openvpn_shadowsocks/Dockerfile</file>
         <file>server_scripts/openvpn_shadowsocks/run_container.sh</file>

client/server_scripts/openvpn/password_auth.sh

@@ -1,15 +0,0 @@
-#!/bin/bash
-
-readarray -t lines < $1
-current_login=${lines[0]}
-current_password=${lines[1]}
-
-credentials_file_path=/opt/amnezia/openvpn/auth_credentials.txt
-
-saved_login=$(awk 'NR==1' $credentials_file_path)
-saved_password=$(awk 'NR==2' $credentials_file_path)
-
-if [ "$current_login" == "$saved_login" ] && [ "$current_password" == "$saved_password" ]; then
-  exit 0
-fi
-exit 1

client/settings.cpp

@@ -9,6 +9,18 @@
 #include "containers/containers_defs.h"
 #include "logger.h"
 
+namespace {
+
+// true if invalid address or ip matches either of localhost/multicast/broadcast
+bool isIpAddressReserved(const QString &ipStr)
+{
+  QHostAddress ip(ipStr);
+
+  return ip.isLoopback() || ip.isMulticast() || ip.isBroadcast();
+}
+
+}
+
 const char Settings::cloudFlareNs1[] = "1.1.1.1";
 const char Settings::cloudFlareNs2[] = "1.0.0.1";
 
@@ -272,6 +284,11 @@ bool Settings::addVpnSite(RouteMode mode, const QString &site, const QString &ip
     if (sites.contains(site) && ip.isEmpty())
         return false;
 
+    if (isIpAddressReserved(site))
+    {
+        return false;
+    }
+
     sites.insert(site, ip);
     setVpnSites(mode, sites);
     return true;
@@ -284,6 +301,11 @@ void Settings::addVpnSites(RouteMode mode, const QMap<QString, QString> &sites)
         const QString &site = i.key();
         const QString &ip = i.value();
 
+        if (isIpAddressReserved(site))
+        {
+            continue;
+        }
+
         if (allSites.contains(site) && allSites.value(site) == ip)
             continue;
 

client/ui/controllers/sitesController.cpp

@@ -35,7 +35,12 @@ void SitesController::addSite(QString hostname)
     }
 
     const auto &processSite = [this](const QString &hostname, const QString &ip) {
-        m_sitesModel->addSite(hostname, ip);
+        bool isAdded = m_sitesModel->addSite(hostname, ip);
+
+        if (!isAdded)
+        {
+          return false;
+        }
 
         if (!ip.isEmpty()) {
             QMetaObject::invokeMethod(m_vpnConnection.get(), "addRoutes", Qt::QueuedConnection,
@@ -45,6 +50,8 @@ void SitesController::addSite(QString hostname)
                                       Q_ARG(QStringList, QStringList() << hostname));
         }
         QMetaObject::invokeMethod(m_vpnConnection.get(), "flushDns", Qt::QueuedConnection);
+
+        return true;
     };
 
     const auto &resolveCallback = [this, processSite](const QHostInfo &hostInfo) {
@@ -57,14 +64,20 @@ void SitesController::addSite(QString hostname)
         }
     };
 
+    bool isSiteAdded = false;
     if (NetworkUtilities::ipAddressWithSubnetRegExp().exactMatch(hostname)) {
-        processSite(hostname, "");
+        isSiteAdded = processSite(hostname, "");
     } else {
-        processSite(hostname, "");
+        isSiteAdded = processSite(hostname, "");
         QHostInfo::lookupHost(hostname, this, resolveCallback);
     }
 
-    emit finished(tr("New site added: %1").arg(hostname));
+    if (isSiteAdded) {
+        emit finished(tr("New site added: %1").arg(hostname));
+    } else
+    {
+        emit finished(tr("Invalid address or ip matches either of localhost/multicast/broadcast: %1").arg(hostname));
+    }
 }
 
 void SitesController::removeSite(int index)

client/ui/models/protocols/openvpnConfigModel.cpp

@@ -34,12 +34,6 @@ bool OpenVpnConfigModel::setData(const QModelIndex &index, const QVariant &value
         break;
     case Roles::AdditionalServerCommandsRole:
         m_protocolConfig.insert(config_key::additional_server_config, value.toString());
-        break;
-    case Roles::AuthLogin:
-
-        break;
-    case Roles::AuthPassword:
-
         break;
     }
 
@@ -78,8 +72,6 @@ QVariant OpenVpnConfigModel::data(const QModelIndex &index, int role) const
     case Roles::IsPortEditable: return m_container == DockerContainer::OpenVpn ? true : false;
     case Roles::IsTransportProtoEditable: return m_container == DockerContainer::OpenVpn ? true : false;
     case Roles::HasRemoveButton: return m_container == DockerContainer::OpenVpn ? true : false;
-    case Roles::AuthLogin:return {};
-    case Roles::AuthPassword: return {};
     }
     return QVariant();
 }
@@ -154,8 +146,6 @@ QHash<int, QByteArray> OpenVpnConfigModel::roleNames() const
     roles[IsTransportProtoEditable] = "isTransportProtoEditable";
 
     roles[HasRemoveButton] = "hasRemoveButton";
-    roles[AuthLogin] = "authLogin";
-    roles[AuthPassword] = "authPassword";
 
     return roles;
 }

client/ui/models/protocols/openvpnConfigModel.h

@@ -26,10 +26,7 @@ public:
         IsPortEditable,
         IsTransportProtoEditable,
 
-        HasRemoveButton,
-
-        AuthLogin,
-        AuthPassword,
+        HasRemoveButton
     };
 
     explicit OpenVpnConfigModel(QObject *parent = nullptr);

client/ui/qml/Pages2/PageProtocolOpenVpnSettings.qml

@@ -426,68 +426,6 @@ PageType {
                             }
                         }
 
-                        SwitcherType {
-                            id: authCredentialsSwitcher
-                            Layout.fillWidth: true
-                            Layout.topMargin: 24
-                            parentFlickable: fl
-
-                            checked: authLogin !== "" && authPassword !== ""
-
-                            text: qsTr("Authentication credentials")
-
-                            onCheckedChanged: {
-                                //if (!checked) {
-                                //    additionalServerCommands = ""
-                                //}
-                            }
-                        }
-
-                        TextFieldWithHeaderType {
-                            id: loginTextField
-
-                            Layout.fillWidth: true
-                            parentFlickable: fl
-
-                            //enabled: isPortEditable
-
-                            headerText: qsTr("Login")
-                            textFieldText: authLogin
-                            //textField.maximumLength: 5
-                            //textField.validator: IntValidator { bottom: 1; top: 65535 }
-
-                            textField.onEditingFinished: {
-                                if (textFieldText !== authLogin) {
-                                    authLogin = textFieldText
-                                }
-                            }
-
-                           // KeyNavigation.tab: autoNegotiateEncryprionSwitcher
-                        }
-
-                        TextFieldWithHeaderType {
-                            id: passwordTextField
-
-                            Layout.fillWidth: true
-                            Layout.topMargin: 20
-                            parentFlickable: fl
-
-                            //enabled: isPortEditable
-
-                            headerText: qsTr("Password")
-                             textFieldText: authPassword
-                            //textField.maximumLength: 5
-                            //textField.validator: IntValidator { bottom: 1; top: 65535 }
-
-                            textField.onEditingFinished: {
-                                  if (textFieldText !== authPassword) {
-                                      authPassword = textFieldText
-                                 }
-                            }
-
-                            // KeyNavigation.tab: autoNegotiateEncryprionSwitcher
-                        }
-
                         BasicButtonType {
                             id: saveRestartButton
 
@@ -511,7 +449,6 @@ PageType {
                                 InstallController.updateContainer(OpenVpnConfigModel.getConfig())
                             }
                         }
-
                     }
                 }
             }