From cbcb628bff669049d544eebbb595b90fc3a8dad6 Mon Sep 17 00:00:00 2001
From: ssongliu <sloooop1x@gmail.com>
Date: Fri, 3 Jul 2026 16:37:03 +0800
Subject: [PATCH] fix: normalize firewall import addresses (#13196)

---
 agent/app/service/firewall.go                 | 23 ++++++++++++++++++-
 .../views/host/firewall/port/import/index.vue | 22 ++++++++++++------
 2 files changed, 37 insertions(+), 8 deletions(-)

diff --git a/agent/app/service/firewall.go b/agent/app/service/firewall.go
index 53d2148b2..ed94de238 100644
--- a/agent/app/service/firewall.go
+++ b/agent/app/service/firewall.go
@@ -222,7 +222,7 @@ func (u *FirewallService) OperatePortRule(req dto.PortRuleOperate, reload bool)
 		req.Chain = iptables.Chain1PanelBasic
 	}
 	protos := strings.Split(req.Protocol, "/")
-	itemAddress := strings.Split(strings.TrimSuffix(req.Address, ","), ",")
+	itemAddress := splitFirewallRuleAddresses(req.Address)
 
 	if client.Name() == "ufw" {
 		if strings.Contains(req.Port, ",") || strings.Contains(req.Port, "-") {
@@ -515,6 +515,7 @@ func (u *FirewallService) operatePort(client firewall.FirewallClient, req dto.Po
 	if err := copier.Copy(&fireInfo, &req); err != nil {
 		return err
 	}
+	fireInfo.Address = normalizeFirewallRuleAddress(fireInfo.Address)
 
 	if client.Name() == "ufw" {
 		if len(fireInfo.Address) != 0 && !strings.EqualFold(fireInfo.Address, "Anywhere") {
@@ -529,6 +530,26 @@ func (u *FirewallService) operatePort(client firewall.FirewallClient, req dto.Po
 	return client.Port(fireInfo, req.Operation)
 }
 
+func splitFirewallRuleAddresses(address string) []string {
+	parts := strings.Split(strings.TrimSuffix(address, ","), ",")
+	addresses := make([]string, 0, len(parts))
+	for _, part := range parts {
+		addresses = append(addresses, normalizeFirewallRuleAddress(part))
+	}
+	if len(addresses) == 0 {
+		return []string{""}
+	}
+	return addresses
+}
+
+func normalizeFirewallRuleAddress(address string) string {
+	address = strings.TrimSpace(address)
+	if strings.EqualFold(address, "Anywhere") {
+		return ""
+	}
+	return address
+}
+
 type portOfApp struct {
 	AppName   string
 	HttpPort  string
diff --git a/frontend/src/views/host/firewall/port/import/index.vue b/frontend/src/views/host/firewall/port/import/index.vue
index 5294ba75b..a020c3d20 100644
--- a/frontend/src/views/host/firewall/port/import/index.vue
+++ b/frontend/src/views/host/firewall/port/import/index.vue
@@ -74,7 +74,7 @@
 </template>
 
 <script lang="ts" setup>
-import { ref } from 'vue';
+import { reactive, ref } from 'vue';
 import { genFileId, UploadFile, UploadFiles, UploadProps, UploadRawFile } from 'element-plus';
 import { MsgError, MsgSuccess } from '@/utils/message';
 import i18n from '@/lang';
@@ -178,29 +178,37 @@ const checkDataFormat = (item: any): boolean => {
     return true;
 };
 
+const normalizeRuleAddress = (address?: string): string => {
+    const normalized = (address || '').trim();
+    return normalized.toLowerCase() === 'anywhere' ? '' : normalized;
+};
+
 const compareRules = (importedRules: any[]) => {
     const newRules: any[] = [];
     const conflictRules: any[] = [];
     const duplicateRules: any[] = [];
 
     for (const importedRule of importedRules) {
-        const key = `${importedRule.address || 'Anywhere'}:${importedRule.port}:${importedRule.protocol}`;
+        const normalizedAddress = normalizeRuleAddress(importedRule.address);
+        const normalizedRule = { ...importedRule, address: normalizedAddress };
+        const key = `${normalizedAddress || 'Anywhere'}:${importedRule.port}:${importedRule.protocol}`;
 
         const existingRule = currentRules.value.find((rule) => {
-            const existingKey = `${rule.address || 'Anywhere'}:${rule.port}:${rule.protocol}`;
+            const existingAddress = normalizeRuleAddress(rule.address);
+            const existingKey = `${existingAddress || 'Anywhere'}:${rule.port}:${rule.protocol}`;
             return existingKey === key;
         });
 
         if (!existingRule) {
-            newRules.push({ ...importedRule, status: 'new' });
+            newRules.push({ ...normalizedRule, status: 'new' });
         } else if (existingRule.strategy !== importedRule.strategy) {
             conflictRules.push({
-                ...importedRule,
+                ...normalizedRule,
                 status: 'conflict',
                 existingStrategy: existingRule.strategy,
             });
         } else {
-            duplicateRules.push({ ...importedRule, status: 'duplicate' });
+            duplicateRules.push({ ...normalizedRule, status: 'duplicate' });
         }
     }
 
@@ -222,7 +230,7 @@ const onImport = async (rules = selects.value) => {
         try {
             const params: Host.RulePort = {
                 operation: 'add',
-                address: rule.address || 'Anywhere',
+                address: normalizeRuleAddress(rule.address),
                 port: rule.port,
                 source: '',
                 protocol: rule.protocol,