extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-20 01:37:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

Verify that parent and child zones have a common interface

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2017-08-12 09:24:05 -07:00
parent d0861e813b
commit c31397532c
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
1 changed files with 46 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
Shorewall/Perl/Shorewall/Zones.pm
View File

@ -701,6 +701,40 @@ sub haveipseczones() {
0;
}
#
# Returns 1 if the two interfaces passed are related
#
sub interface_match( $$ ) {
my ( $piface, $ciface ) = @_;
return 1 if $piface eq $ciface;
my ( $pifaceref, $cifaceref ) = @interfaces{$piface, $ciface};
return 1 if $piface eq $cifaceref->{bridge};
return 1 if $ciface eq $pifaceref->{bridge};
if ( $minroot ) {
if ( $piface =~ /\+$/ ) {
my $root = $pifaceref->{root};
my $rlength = length( $root );
while ( length( $ciface ) >= $rlength ) {
return 1 if $ciface eq $root;
chop $ciface;
}
} elsif ( $ciface =~ /\+$/ ) {
my $root = $cifaceref->{root};
my $rlength = length( $root );
while ( length( $piface ) >= $rlength ) {
return 1 if $piface eq $root;
chop $piface;
}
}
}
0;
}
#
# Report about zones.
#
@ -738,7 +772,7 @@ sub zone_report()
if ( $family == F_IPV4 ) {
progress_message_nocompress " $iref->{physical}:$grouplist";
} else {
progress_message_nocompress " $iref->{physical}:<$grouplist>";
progress_message_nocompress " $iref->{physical}:[$grouplist]";
}
$printed = 1;
}
@ -747,6 +781,17 @@ sub zone_report()
}
}
PARENT:
for my $p ( @{$zoneref->{parents}} ) {
for my $pi ( keys ( %{$zones{$p}{interfaces}} ) ) {
for my $ci ( keys( %{$zoneref->{interfaces}} ) ) {
next PARENT if interface_match( $pi, $ci );
}
}
warning_message "Zone $zone is defined as a sub-zone of $p, yet the two zones have no interface in common";
}
unless ( $printed ) {
fatal_error "No bridge has been associated with zone $zone" if $type & BPORT && ! $zoneref->{bridge};
warning_message "*** $zone is an EMPTY ZONE ***" unless $type == FIREWALL;