Allow ip range in the rule SOURCE

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1608 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Shorewall2/firewall

@@ -4043,7 +4043,8 @@ process_rule() # $1 = target
 	        # 16 ports are listed - use multiport match.
 	        #
 		multioption="-m multiport"
-		for client in $(separate_list ${clients:=-}); do
+		for clientrange in $(separate_list ${clients:=-}); do
+		    for client in $(ip_range $clientrange); do
 		        #
 		        # add_a_rule() modifies these so we must set their values each time
 		        #
@@ -4052,12 +4053,14 @@ process_rule() # $1 = target
 			cport=${cports:=-}
 			add_a_rule
 		    done
+		done
 	    else
 	        #
 	        # MULTIPORT is disabled or the rule isn't compatible with multiport match
 	        #
 		multioption=
-		for client in $(separate_list ${clients:=-}); do
+		for clientrange in $(separate_list ${clients:=-}); do
+		    for client in $(ip_range $clientrange); do
 			for port in $(separate_list ${ports:=-}); do
 			    for cport in $(separate_list ${cports:=-}); do
 				server=${servers:=-}
@@ -4065,6 +4068,7 @@ process_rule() # $1 = target
 			    done
 			done
 		    done
+		done
 	    fi
 	    ;;
 	*)
@@ -4081,7 +4085,8 @@ process_rule() # $1 = target
 	        # 16 ports are listed - use multiport match.
 	        #
 		multioption="-m multiport"
-		for client in $(separate_list ${clients:=-}); do
+		for clientrange in $(separate_list ${clients:=-}); do
+		    for client in $(ip_range $clientrange); do
 			for server in $(separate_list ${servers:=-}); do
 		            #
 		            # add_a_rule() modifies these so we must set their values each time
@@ -4091,12 +4096,14 @@ process_rule() # $1 = target
 			    add_a_rule
 			done
 		    done
+		done
 	    else
 	        #
 	        # MULTIPORT is disabled or the rule isn't compatible with multiport match
 	        #
 		multioption=
-		for client in $(separate_list ${clients:=-}); do
+		for clientrange in $(separate_list ${clients:=-}); do
+		    for client in $(ip_range $clientrange); do
 			for server in $(separate_list ${servers:=-}); do
 			    for port in $(separate_list ${ports:=-}); do
 				for cport in $(separate_list ${cports:=-}); do
@@ -4105,6 +4112,7 @@ process_rule() # $1 = target
 			    done
 			done
 		    done
+		done
 	    fi
 	    ;;
     esac

Shorewall2/functions

@@ -547,6 +547,13 @@ ip_range() {
     local first last l x y z vlsm
 
     case $1 in
+	!*)
+	    #
+	    # Let iptables complain if it's a range
+	    #
+	    echo $1
+	    return
+	    ;;
 	[0-9]*.*.*.*-*.*.*.*)
             ;;
 	*)

Shorewall2/releasenotes.txt

@@ -432,4 +432,10 @@ New Features:
 13) Shorewall now verifies that your kernel and iptables have physdev
     match support if BRIDGING=Yes in shorewall.conf.
 
+14) IP address ranges are now allowed in the SOURCE column of the
+    /etc/shorewall/rules file.
+    
+    Example:
+
+	ACCEPT	net:192.0.2.9-192.9.2.17	fw	tcp	25
 

Shorewall2/rules

@@ -118,6 +118,9 @@
 #			address; mac addresses must begin with "~" and must use
 #			"-" as a separator.
 #
+#			Hosts may be specified as an IP address range using the
+#			syntax <low address>-<high address>.
+#
 #			dmz:192.168.2.2		Host 192.168.2.2 in the DMZ
 #
 #			net:155.186.235.0/24	Subnet 155.186.235.0/24 on the
@@ -129,6 +132,10 @@
 #			loc:~00-A0-C9-15-39-78  Host in the local zone with
 #                                               MAC address 00:A0:C9:15:39:78.
 #
+#			net:192.0.2.11-192.0.2.17
+#						Hosts 192.0.2.11-192.0.2.17 in
+#						the net zone.
+#
 #			Alternatively, clients may be specified by interface
 #			by appending ":" to the zone name followed by the
 #			interface name. For example, loc:eth1 specifies a
@@ -159,7 +166,7 @@
 #				3. You may not specify both an interface and
 #				   an address.
 #
-#			Unlike in the SOURCE column, you may specify a range of
+#			Like in the SOURCE column, you may specify a range of
 #			up to 256 IP addresses using the syntax
 #			<first ip>-<last ip>. When the ACTION is DNAT or DNAT-,
 #			the connections will be assigned to addresses in the