extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-16 03:10:39 +01:00
Code Issues Packages Projects Releases Wiki Activity

Allow runtime address variables in the ADDRESS column of the masq file

Browse Source
This commit is contained in:
Tom Eastep 2011-01-28 16:32:53 -08:00
parent 156b04c380
commit f3aedcf805
4 changed files with 21 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -145,6 +145,7 @@ our %EXPORT_TAGS = (
do_helper do_helper
do_headers do_headers
have_ipset_rules have_ipset_rules
record_runtime_address
match_source_dev match_source_dev
match_dest_dev match_dest_dev
iprange_match iprange_match

12
Shorewall/Perl/Shorewall/Nat.pm
View File

@ -186,7 +186,10 @@ sub process_one_masq( )
} else { } else {
my $addrlist = ''; my $addrlist = '';
for my $addr ( split_list $addresses , 'address' ) { for my $addr ( split_list $addresses , 'address' ) {
if ( $addr =~ /^.*\..*\..*\./ ) { if ( $addr =~ /^&(.+)$/ ) {
$target = 'SNAT ';
$addrlist .= '--to-source ' . record_runtime_address $1;
} elsif ( $addr =~ /^.*\..*\..*\./ ) {
$target = 'SNAT '; $target = 'SNAT ';
my ($ipaddr, $rest) = split ':', $addr; my ($ipaddr, $rest) = split ':', $addr;
if ( $ipaddr =~ /^(.+)-(.+)$/ ) { if ( $ipaddr =~ /^(.+)-(.+)$/ ) {
@ -197,8 +200,11 @@ sub process_one_masq( )
$addrlist .= "--to-source $addr "; $addrlist .= "--to-source $addr ";
$exceptionrule = do_proto( $proto, '', '' ) if $addr =~ /:/; $exceptionrule = do_proto( $proto, '', '' ) if $addr =~ /:/;
} else { } else {
$addr =~ s/^://; my $ports = $addr;
$addrlist .= "--to-ports $addr "; $ports =~ s/^://;
$ports =~ s/:/-/;
validate_portpair( $proto, $ports );
$addrlist .= "--to-ports $ports ";
$exceptionrule = do_proto( $proto, '', '' ); $exceptionrule = do_proto( $proto, '', '' );
} }
} }

2
Shorewall/changelog.txt
View File

@ -10,7 +10,7 @@ Changes in Shorewall 4.4.17 Beta 1
5) Add 'USE_LOCAL_MODULES' option. 5) Add 'USE_LOCAL_MODULES' option.
6) Implement runtime address variables (&interface) 6) Implement run-time address variables (&interface)
Changes in Shorewall 4.4.17 Beta 1 Changes in Shorewall 4.4.17 Beta 1

16
Shorewall/releasenotes.txt
View File

@ -21,7 +21,7 @@ Beta 2
diagnostic. diagnostic.
2) Previously, the uninstall.sh scripts used insserv (if installed) on 2) Previously, the uninstall.sh scripts used insserv (if installed) on
Debian-based systems. These scripts now used the preferred tool Debian-based systems. These scripts now use the preferred tool
(updaterc.d). (updaterc.d).
3) Beginning with 4.4.16, compilation would fail if an empty shell 3) Beginning with 4.4.16, compilation would fail if an empty shell
@ -33,9 +33,9 @@ Beta 2
(unoptimized). Similarly, if OPTIMIZE=9 then the ruleset displayed (unoptimized). Similarly, if OPTIMIZE=9 then the ruleset displayed
was the same as when OPTIMIZE=1. was the same as when OPTIMIZE=1.
5) Startup could previously fail on a system where module autoloading 5) Startup could previously fail on a system where kernel module
was not available and where TC_ENABLED=Simple was specified in autoloading was not available and where TC_ENABLED=Simple was
shorewall.conf. specified in shorewall.conf.
Beta 1 Beta 1
@ -58,8 +58,9 @@ Beta 2
1) Traditionally, the -lite products have used the modules (or 1) Traditionally, the -lite products have used the modules (or
helpers) file on the firewall system unless there is a modules (or helpers) file on the firewall system unless there is a modules (or
helpers) file in the configuration directory. This release helpers) file in the configuration directory on the administrative
introduces the USE_LOCAL_MODULES option in shorewall[6].conf. system. This release introduces the USE_LOCAL_MODULES option in
shorewall[6].conf.
When USE_LOCAL_MODULES=Yes, the modules (helpers) file on the When USE_LOCAL_MODULES=Yes, the modules (helpers) file on the
administrative system will be used to determine the set of modules administrative system will be used to determine the set of modules
@ -96,6 +97,9 @@ Beta 2
macro files macro files
rules rules
They may also be used in the SOURCE and ADDRESS columns of the masq
file.
For optional interfaces, if the interface is not usable at the time For optional interfaces, if the interface is not usable at the time
that the firewall starts the all-zero address will be used (0.0.0.0 that the firewall starts the all-zero address will be used (0.0.0.0
in IPv4 and :: in IPv6), resulting in no packets matching the rule. in IPv4 and :: in IPv6), resulting in no packets matching the rule.