extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-30 17:39:33 +01:00
Code Issues Packages Projects Releases Wiki Activity

First stage of DETECT_DNAT_ADDRS

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@5643 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2007-03-23 01:37:23 +00:00
parent 81fca7f404
commit cb9a3650bd
1 changed files with 28 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
New/Shorewall/Rules.pm
View File

@ -885,7 +885,6 @@ sub process_rule1 ( $$$$$$$$$ ) {
# #
$rule = do_proto $proto, $ports, $sports . do_ratelimit( $ratelimit ) . ( do_user $user ); $rule = do_proto $proto, $ports, $sports . do_ratelimit( $ratelimit ) . ( do_user $user );
$origdest = ALLIPv4 unless $origdest and $origdest ne '-';
# #
# Generate NAT rule(s), if any # Generate NAT rule(s), if any
# #
@ -931,6 +930,13 @@ sub process_rule1 ( $$$$$$$$$ ) {
$target = '-j REDIRECT --to-port ' . ( $serverport ? $serverport : $ports ); $target = '-j REDIRECT --to-port ' . ( $serverport ? $serverport : $ports );
} }
unless ( $origdest and $origdest ne '-' ) {
if ( $config{DETECT_DNAT_ADDRS} ) {
$origdest = 'detect';
} else {
origdest = ALLIPv4;
}
}
# #
# And generate the nat table rule(s) # And generate the nat table rule(s)
# #
@ -952,23 +958,27 @@ sub process_rule1 ( $$$$$$$$$ ) {
$rule = do_proto $proto, $ports, $sports . do_ratelimit( $ratelimit ) . do_user $user; $rule = do_proto $proto, $ports, $sports . do_ratelimit( $ratelimit ) . do_user $user;
$loglevel = ''; $loglevel = '';
} }
} elsif ( $actiontype & NONAT ) { } else {
# $origdest = ALLIPv4 unless $origdest and $origdest ne '-';
# NONAT or ACCEPT+ -- May not specify a destination interface
#
fatal_error "Invalid DEST ($dest) in $action rule \"$line\"" if $dest =~ /:/;
expand_rule if ( $actiontype & NONAT ) {
ensure_chain ('nat' , $zones{$sourcezone}{type} eq 'firewall' ? 'OUTPUT' : dnat_chain $sourcezone) , #
PREROUTE_RESTRICT , # NONAT or ACCEPT+ -- May not specify a destination interface
$rule , #
$source , fatal_error "Invalid DEST ($dest) in $action rule \"$line\"" if $dest =~ /:/;
$dest ,
'' , expand_rule
'-j RETURN ' , ensure_chain ('nat' , $zones{$sourcezone}{type} eq 'firewall' ? 'OUTPUT' : dnat_chain $sourcezone) ,
$loglevel , PREROUTE_RESTRICT ,
$action , $rule ,
''; $source ,
$dest ,
'' ,
'-j RETURN ' ,
$loglevel ,
$action ,
'';
}
} }
# #
# Add filter table rule, unless this is a NATONLY rule type # Add filter table rule, unless this is a NATONLY rule type