extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-20 01:37:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Interface lists in masq and nat files

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8068 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2008-01-15 02:39:21 +00:00
parent 3eb254c0b6
commit 545dd7dbc3
1 changed files with 157 additions and 148 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
Shorewall-perl/Shorewall/Nat.pm
View File

@ -115,56 +115,45 @@ sub do_ipsec_options($)
# #
sub setup_one_masq($$$$$$$) sub setup_one_masq($$$$$$$)
{ {
my ($fullinterface, $networks, $addresses, $proto, $ports, $ipsec, $mark) = @_; my ($interfacelist, $networks, $addresses, $proto, $ports, $ipsec, $mark) = @_;
my $rule = '';
my $pre_nat; my $pre_nat;
my $add_snat_aliases = $config{ADD_SNAT_ALIASES}; my $add_snat_aliases = $config{ADD_SNAT_ALIASES};
my $destnets = ''; my $destnets = '';
my $target = '-j MASQUERADE ';
#
# Handle IPSEC options, if any
#
if ( $ipsec ne '-' ) {
fatal_error "Non-empty IPSEC column requires policy match support in your kernel and iptables" unless $globals{ORIGINAL_POLICY_MATCH};
if ( $ipsec =~ /^yes$/i ) {
$rule .= '-m policy --pol ipsec --dir out ';
} elsif ( $ipsec =~ /^no$/i ) {
$rule .= '-m policy --pol none --dir out ';
} else {
$rule .= do_ipsec_options $ipsec;
}
} elsif ( $capabilities{POLICY_MATCH} ) {
$rule .= '-m policy --pol none --dir out ';
}
# #
# Leading '+' # Leading '+'
# #
$pre_nat = 1 if $fullinterface =~ s/^\+//; $pre_nat = 1 if $interfacelist =~ s/^\+//;
# #
# Parse the remaining part of the INTERFACE column # Parse the remaining part of the INTERFACE column
# #
if ( $fullinterface =~ /^([^:]+)::([^:]*)$/ ) { if ( $interfacelist =~ /^([^:]+)::([^:]*)$/ ) {
$add_snat_aliases = 0; $add_snat_aliases = 0;
$destnets = $2; $destnets = $2;
$fullinterface = $1; $interfacelist = $1;
} elsif ( $fullinterface =~ /^([^:]+:[^:]+):([^:]+)$/ ) { } elsif ( $interfacelist =~ /^([^:]+:[^:]+):([^:]+)$/ ) {
$destnets = $2; $destnets = $2;
$fullinterface = $1; $interfacelist = $1;
} elsif ( $fullinterface =~ /^([^:]+):$/ ) { } elsif ( $interfacelist =~ /^([^:]+):$/ ) {
$add_snat_aliases = 0; $add_snat_aliases = 0;
$fullinterface = $1; $interfacelist = $1;
} elsif ( $fullinterface =~ /^([^:]+):([^:]*)$/ ) { } elsif ( $interfacelist =~ /^([^:]+):([^:]*)$/ ) {
my ( $one, $two ) = ( $1, $2 ); my ( $one, $two ) = ( $1, $2 );
if ( $2 =~ /\./ ) { if ( $2 =~ /\./ ) {
$fullinterface = $one; $interfacelist = $one;
$destnets = $two; $destnets = $two;
} }
} }
#
# If there is no source or destination then allow all addresses
#
$networks = ALLIPv4 if $networks eq '-';
$destnets = ALLIPv4 if $destnets eq '-';
for my $fullinterface (split /,/, $interfacelist ) {
my $rule = '';
my $target = '-j MASQUERADE ';
# #
# Isolate and verify the interface part # Isolate and verify the interface part
# #
@ -183,10 +172,22 @@ sub setup_one_masq($$$$$$$)
my $chainref = ensure_chain('nat', $pre_nat ? snat_chain $interface : masq_chain $interface); my $chainref = ensure_chain('nat', $pre_nat ? snat_chain $interface : masq_chain $interface);
# #
# If there is no source or destination then allow all addresses # Handle IPSEC options, if any
# #
$networks = ALLIPv4 if $networks eq '-'; if ( $ipsec ne '-' ) {
$destnets = ALLIPv4 if $destnets eq '-'; fatal_error "Non-empty IPSEC column requires policy match support in your kernel and iptables" unless $globals{ORIGINAL_POLICY_MATCH};
if ( $ipsec =~ /^yes$/i ) {
$rule .= '-m policy --pol ipsec --dir out ';
} elsif ( $ipsec =~ /^no$/i ) {
$rule .= '-m policy --pol none --dir out ';
} else {
$rule .= do_ipsec_options $ipsec;
}
} elsif ( $capabilities{POLICY_MATCH} ) {
$rule .= '-m policy --pol none --dir out ';
}
# #
# Handle Protocol and Ports # Handle Protocol and Ports
# #
@ -295,6 +296,7 @@ sub setup_one_masq($$$$$$$)
} }
} }
} }
}
progress_message " Masq record \"$currentline\" $done"; progress_message " Masq record \"$currentline\" $done";
@ -399,7 +401,6 @@ sub do_one_nat( $$$$$ )
} }
} }
progress_message " NAT entry \"$currentline\" $done";
} }
# #
@ -413,12 +414,20 @@ sub setup_nat() {
while ( read_a_line ) { while ( read_a_line ) {
my ( $external, $interface, $internal, $allints, $localnat ) = split_line1 3, 5, 'nat file'; my ( $external, $interfacelist, $internal, $allints, $localnat ) = split_line1 3, 5, 'nat file';
if ( $external eq 'COMMENT' ) { if ( $external eq 'COMMENT' ) {
process_comment; process_comment;
} else { } else {
do_one_nat $external, $interface, $internal, $allints, $localnat; ( $interfacelist, my $digit ) = split /:/, $interfacelist;
$digit = defined $digit ? ":$digit" : '';
for my $interface ( split /,/, $interfacelist ) {
do_one_nat $external, "${interface}${digit}", $internal, $allints, $localnat;
}
progress_message " NAT entry \"$currentline\" $done";
} }
} }