Fix handling or ORIGINAL DEST when CONNTRACK_MATCH is not available

Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2011-08-10 07:12:13 -07:00
parent c923dfdade
commit 8eff66dcfd

View File

@ -4786,7 +4786,7 @@ sub expand_rule( $$$$$$$$$$;$ )
if ( $origdest ) { if ( $origdest ) {
if ( $origdest eq '-' || ! have_capability( 'CONNTRACK_MATCH' ) ) { if ( $origdest eq '-' || ! have_capability( 'CONNTRACK_MATCH' ) ) {
$origdest = ''; $onets = $oexcl = '';
} elsif ( $origdest =~ /^detect:(.*)$/ ) { } elsif ( $origdest =~ /^detect:(.*)$/ ) {
# #
# Either the filter part of a DNAT rule or 'detect' was given in the ORIG DEST column # Either the filter part of a DNAT rule or 'detect' was given in the ORIG DEST column
@ -4816,7 +4816,7 @@ sub expand_rule( $$$$$$$$$$;$ )
$rule .= "-m conntrack --ctorigdst $variable "; $rule .= "-m conntrack --ctorigdst $variable ";
} }
$origdest = ''; $onets = $oexcl = '';
} else { } else {
fatal_error "Invalid ORIGINAL DEST" if $origdest =~ /^([^!]+)?,!([^!]+)$/ || $origdest =~ /.*!.*!/; fatal_error "Invalid ORIGINAL DEST" if $origdest =~ /^([^!]+)?,!([^!]+)$/ || $origdest =~ /.*!.*!/;