extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-19 12:50:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Disallow destination interface in the OUTPUT chain.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2012-11-25 15:37:53 -08:00
parent dd0f42c462
commit 642f192b3d
3 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -6086,7 +6086,7 @@ sub verify_dest_interface( $$$$ ) {
if ( $chainref->{accounting} ) { if ( $chainref->{accounting} ) {
fatal_error "Destination Interface ($diface) not allowed in the $chainref->{name} chain"; fatal_error "Destination Interface ($diface) not allowed in the $chainref->{name} chain";
} else { } else {
fatal_error "Destination Interface ($diface) not allowed in the mangle OUTPUT chain"; fatal_error "Destination Interface ($diface) not allowed in the $chainref->{table} OUTPUT chain";
} }
} }

2
Shorewall/Perl/Shorewall/Raw.pm
View File

@ -55,7 +55,7 @@ sub process_conntrack_rule( $$$$$$$$$$ ) {
my $restriction = PREROUTE_RESTRICT; my $restriction = PREROUTE_RESTRICT;
if ( $chainref ) { if ( $chainref ) {
$restriction = OUTPUT_RESTRICT if $chainref->{name} eq 'OUTPUT'; $restriction = DESTIFACE_DISALLOW if $chainref->{name} eq 'OUTPUT';
} else { } else {
# #
# Entry in the conntrack file # Entry in the conntrack file

8
Shorewall/manpages/shorewall-conntrack.xml
View File

@ -272,7 +272,9 @@
<term>O</term> <term>O</term>
<listitem> <listitem>
<para>The rule is added to the raw table OUTPUT chain.</para> <para>The rule is added to the raw table OUTPUT chain. When
this <replaceable>chain-designator</replaceable> is used, an
interface may not be specified in the DEST column.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
@ -281,7 +283,9 @@
<listitem> <listitem>
<para>The rule is added to the raw table PREROUTING and OUTPUT <para>The rule is added to the raw table PREROUTING and OUTPUT
chains.</para> chains. When this <replaceable>chain-designator</replaceable>
is used, an interface may not be specified in the DEST
column.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
</variablelist> </variablelist>