holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Allow runtime address variables as the server IP in DNAT rules

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2017-08-12 12:18:16 -07:00
parent 72293883dd
commit 1a2647618e
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -6324,7 +6324,7 @@ sub match_dest_net( $;$ ) {
return '-d ' . record_runtime_address $1, $2; return '-d ' . record_runtime_address $1, $2;
} }
$net = validate_net $net, 1; $net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
$net eq ALLIP ? '' : "-d $net "; $net eq ALLIP ? '' : "-d $net ";
} }
@ -6405,7 +6405,7 @@ sub imatch_dest_net( $;$ ) {
return ( d => record_runtime_address( $1, $2, 1 ) ); return ( d => record_runtime_address( $1, $2, 1 ) );
} }
$net = validate_net $net, 1; $net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
$net eq ALLIP ? () : ( d => $net ); $net eq ALLIP ? () : ( d => $net );
} }
@ -7528,6 +7528,11 @@ sub isolate_dest_interface( $$$$ ) {
$rule .= "-d $variable "; $rule .= "-d $variable ";
} }
} elsif ( $dest =~ /^\$/ ) {
#
# Runtime address variable
#
$dnets = $dest;
} elsif ( $family == F_IPV4 ) { } elsif ( $family == F_IPV4 ) {
if ( $dest =~ /^(.+?):(.+)$/ ) { if ( $dest =~ /^(.+?):(.+)$/ ) {
$diface = $1; $diface = $1;

10
Shorewall/Perl/Shorewall/Nat.pm
View File

@ -941,7 +941,15 @@ sub handle_nat_rule( $$$$$$$$$$$$$ ) {
} else { } else {
$server = $1 if $family == F_IPV6 && $server =~ /^\[(.+)\]$/; $server = $1 if $family == F_IPV6 && $server =~ /^\[(.+)\]$/;
fatal_error "Invalid server IP address ($server)" if $server eq ALLIP || $server eq NILIP; fatal_error "Invalid server IP address ($server)" if $server eq ALLIP || $server eq NILIP;
my @servers = validate_address $server, 1;
my @servers;
if ( ( $server =~ /^([&%])(.+)/ ) ) {
@servers = ( record_runtime_address( $1, $2 ) );
} else {
@servers = validate_address $server, 1;
}
$server = join ',', @servers; $server = join ',', @servers;
} }