extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-15 12:14:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Finish 'detectnets'

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@6054 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2007-04-21 23:57:30 +00:00
parent 82eaf6fe1a
commit e4c8d85fb9
1 changed files with 41 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
Shorewall-perl/Shorewall/Interfaces.pm
View File

@ -115,6 +115,36 @@ sub add_group_to_zone($$$$$)
push @{$arrayref}, \%h; push @{$arrayref}, \%h;
} }
sub get_routed_networks ( $$ ) {
my ( $interface , $error_message ) = @_;
my @networks;
if ( open IP , '-|' , "ip route show dev $interface 2> /dev/null" ) {
while ( my $route = <IP> ) {
$route =~ s/^\s+//;
my $network = ( split /\s+/, $route )[0];
if ( $network eq 'default' ) {
if ( $error_message ) {
fatal_error $error_message;
} else {
warning_message "default route ignored on interface $interface";
}
} else {
my ( $address, $vlsm ) = split '/', $network;
$vlsm = 32 unless defined $vlsm;
push @networks, "$address/$vlsm";
}
}
close IP
} else {
fatal_error "Cannot get routes through interface $interface";
}
fatal_error "detectnets: There are no routes through interface $interface" unless @networks;
@networks;
}
# #
# Parse the interfaces file. # Parse the interfaces file.
# #
@ -186,12 +216,10 @@ sub validate_interfaces_file()
my $optionsref = {}; my $optionsref = {};
if ( $options ) my %options;
{
my %options; if ( $options ) {
for my $option (split ',', $options ) {
for my $option (split ',', $options )
{
next if $option eq '-'; next if $option eq '-';
( $option, my $value ) = split /=/, $option; ( $option, my $value ) = split /=/, $option;
@ -219,19 +247,22 @@ sub validate_interfaces_file()
$options{arp_ignore} = 1; $options{arp_ignore} = 1;
} }
} else { } else {
fatal_error "Internal Error in validate_interfaces_file" fatal_error "Internal Error in validate_interfaces_file";
} }
} }
} }
$zoneref->{options}{in_out}{routeback} = 1 if $options{routeback}; $zoneref->{options}{in_out}{routeback} = 1 if $options{routeback};
$interfaces{$interface}{options} = $optionsref = \%options;
} }
$interfaces{$interface}{options} = $optionsref = \%options;
push @interfaces, $interface; push @interfaces, $interface;
add_group_to_zone( $zone, $zoneref->{type}, $interface, \@allipv4, $optionsref ) if $zone; my @networks = $options{detectnets} ? get_routed_networks( $interface , "detectnets not allowed on interface with default route - $interface" ) : @allipv4;
add_group_to_zone( $zone, $zoneref->{type}, $interface, \@networks, $optionsref ) if $zone;
$interfaces{$interface}{zone} = $zone; #Must follow the call to add_group_to_zone() $interfaces{$interface}{zone} = $zone; #Must follow the call to add_group_to_zone()