holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Correct additional issues with 'update'

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2016-06-18 10:24:52 -07:00
parent 93ee4432de
commit 47557aa4f7
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
1 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -4749,10 +4749,6 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
}
}
unless ( ( $chain || $default_chain ) == OUTPUT ) {
fatal_error 'A USER/GROUP may only be specified when the SOURCE is $FW' unless $user eq '-';
}
if ( $dest ne '-' ) {
if ( $dest eq $fw ) {
fatal_error 'Rules with DEST $FW must use the INPUT chain' if $designator && $designator ne INPUT;
@ -4795,6 +4791,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
fatal_error "Duplicate STATE ($_)" if $state{$_}++;
}
}
#
# Call the command's processing function
#
@ -4805,12 +4802,23 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
if ( $chain == ACTIONCHAIN ) {
fatal_error "$cmd rules are not allowed in the $chainlabels{$chain} chain" unless $commandref->{allowedchains} & $chainref->{allowedchains};
$chainref->{allowedchains} &= $commandref->{allowedchains};
$chainref->{allowedchains} &= (OUTPUT | POSTROUTING ) if $user ne '-';
} else {
#
# Inline within one of the standard chains
#
fatal_error "$cmd rules are not allowed in the $chainlabels{$chain} chain" unless $commandref->{allowedchains} & $chain;
unless ( $chain == OUTPUT || $chain == POSTROUTING ) {
fatal_error 'A USER/GROUP may only be specified when the SOURCE is $FW' unless $user eq '-';
}
}
} else {
$resolve_chain->();
fatal_error "$cmd rules are not allowed in the $chainlabels{$chain} chain" unless $commandref->{allowedchains} & $chain;
unless ( $chain == OUTPUT || $chain == POSTROUTING ) {
fatal_error 'A USER/GROUP may only be specified when the SOURCE is $FW' unless $user eq '-';
}
$chainref = ensure_chain( 'mangle', $chainnames{$chain} );
}
@ -4976,6 +4984,13 @@ sub process_tc_rule1( $$$$$$$$$$$$$$$$ ) {
$mark = $rest;
} elsif ( supplied $2 ) {
$mark = $2;
if ( supplied $mark && $command eq 'IPMARK' ) {
my @params = split ',', $mark;
$params[1] = '0xff' unless supplied $params[1];
$params[2] = '0x00' unless supplied $params[2];
$params[3] = '0' unless supplied $params[3];
$mark = join ',', @params;
}
} else {
$mark = '';
}
@ -4986,7 +5001,7 @@ sub process_tc_rule1( $$$$$$$$$$$$$$$$ ) {
}
}
$command = ( $command ? "$command($mark)" : $mark ) . $designator;
$command = ( $command ? supplied $mark ? "$command($mark)" : $command : $mark ) . $designator;
my $line = ( $family == F_IPV6 ?
"$command\t$source\t$dest\t$proto\t$ports\t$sports\t$user\t$testval\t$length\t$tos\t$connbytes\t$helper\t$headers\t$probability\t$dscp\t$state" :
"$command\t$source\t$dest\t$proto\t$ports\t$sports\t$user\t$testval\t$length\t$tos\t$connbytes\t$helper\t$probability\t$dscp\t$state" );