extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-24 00:23:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Tweak NONAT/ACCEPT+ action implementation

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1311 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-05-07 16:49:37 +00:00
parent 65a4fe1d1b
commit 71fa76ce74
1 changed files with 24 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

68
Shorewall2/firewall
View File

@ -3124,7 +3124,10 @@ add_a_rule()
fatal_error "Rule \"$rule\" - Destination may not be specified by MAC Address" fatal_error "Rule \"$rule\" - Destination may not be specified by MAC Address"
;; ;;
*) *)
[ -n "$server" ] && dest_interface="$(match_dest_dev $server)" if [ -n "$server" ]; then
[ -n "$nonat" ] && fatal_error "Destination interface not allowe with $logtarget"
dest_interface="$(match_dest_dev $server)"
fi
;; ;;
esac esac
@ -3168,7 +3171,6 @@ add_a_rule()
case "$logtarget" in case "$logtarget" in
ACCEPT|DROP|REJECT|CONTINUE) ACCEPT|DROP|REJECT|CONTINUE)
[ "$logtarget" = REJECT -a -n "$servport" ] && \ [ "$logtarget" = REJECT -a -n "$servport" ] && \
fatal_error "Server port may not be specified in a REJECT rule; rule: \"$rule\"" fatal_error "Server port may not be specified in a REJECT rule; rule: \"$rule\""
if [ -z "$proto" -a -z "$cli" -a -z "$serv" -a -z "$servport" -a -z "$userspec" ] ; then if [ -z "$proto" -a -z "$cli" -a -z "$serv" -a -z "$servport" -a -z "$userspec" ] ; then
@ -3223,21 +3225,13 @@ add_a_rule()
$(fix_bang $proto $sports $multiport $cli -d $srv $dports) $(fix_bang $proto $sports $multiport $cli -d $srv $dports)
fi fi
case $logtarget in [ -n "$nonat" ] && \
NONAT|ACCEPT+) addnatrule $(dnat_chain $source) $proto $multiport \
addnatrule $(dnat_chain $source) $proto $multiport \ $cli $sports -d $srv $dports $ratelimit $userandgroup -j RETURN
$cli $sports -d $srv $dports $ratelimit $userandgroup -j RETURN
;;
esac
case $logtarget in [ "$logtarget" != NONAT ] && \
NONAT) run_iptables2 -A $chain $proto $multiport $cli $sports \
;; -d $srv $dports $ratelimit $userandgroup -j $target
*)
run_iptables2 -A $chain $proto $multiport $cli $sports \
-d $srv $dports $ratelimit $userandgroup -j $target
;;
esac
fi fi
done done
done done
@ -3247,21 +3241,13 @@ add_a_rule()
$(fix_bang $proto $sports $multiport $cli $dports) $(fix_bang $proto $sports $multiport $cli $dports)
fi fi
case $logtarget in [ -n "$nonat" ] && \
NONAT|ACCEPT+) addnatrule $(dnat_chain $source) $proto $multiport \
addnatrule $(dnat_chain $source) $proto $multiport \ $cli $sports $dports $ratelimit $userandgroup -j RETURN
$cli $sports $dports $ratelimit $userandgroup -j RETURN
;;
esac
case $logtarget in [ "$logtarget" != NONAT ] && \
NONAT) run_iptables2 -A $chain $proto $multiport $cli $sports \
;; $dports $ratelimit $userandgroup -j $target
*)
run_iptables2 -A $chain $proto $multiport $cli $sports \
$dports $ratelimit $userandgroup -j $target
;;
esac
fi fi
fi fi
fi fi
@ -3279,23 +3265,15 @@ add_a_rule()
$(fix_bang $proto $multiport $dest_interface $cli $sports $dports) $(fix_bang $proto $multiport $dest_interface $cli $sports $dports)
fi fi
case $logtarget in if [ "$logtarget" != LOG ]; then
LOG) [ -n "$nonat" ] && \
;;
NONAT|ACCEPT+)
addnatrule $(dnat_chain $source) $proto $multiport \ addnatrule $(dnat_chain $source) $proto $multiport \
$cli $sports $dports $ratelimit $userandgroup -j RETURN $cli $sports $dports $ratelimit $userandgroup -j RETURN
;;
esac
case $logtarget in [ "$logtarget" != NONAT ] && \
LOG|NONAT)
;;
*)
run_iptables2 -A $chain $proto $multiport $dest_interface \ run_iptables2 -A $chain $proto $multiport $dest_interface \
$cli $sports $dports $ratelimit $userandgroup -j $target $cli $sports $dports $ratelimit $userandgroup -j $target
;; fi
esac
fi fi
fi fi
} }
@ -3325,6 +3303,7 @@ process_rule() # $1 = target
local userandgroup= local userandgroup=
local rule="$(echo $target $clients $servers $protocol $ports $cports $address $ratelimit $userspec)" local rule="$(echo $target $clients $servers $protocol $ports $cports $address $ratelimit $userspec)"
local logtag= local logtag=
local nonat=
# Function Body - isolate rate limit # Function Body - isolate rate limit
@ -3407,10 +3386,11 @@ process_rule() # $1 = target
fi fi
case $target in case $target in
ACCEPT+) ACCEPT+|NONAT)
nonat=Yes
target=ACCEPT target=ACCEPT
;; ;;
ACCEPT|LOG|NONAT) ACCEPT|LOG)
;; ;;
DROP) DROP)
[ -n "$ratelimit" ] && fatal_error "Rate Limiting not available with DROP" [ -n "$ratelimit" ] && fatal_error "Rate Limiting not available with DROP"