From 47557aa4f744ffbb37dbcdff7a0166dd4a767440 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sat, 18 Jun 2016 10:24:52 -0700 Subject: [PATCH] Correct additional issues with 'update' Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Rules.pm | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/Shorewall/Perl/Shorewall/Rules.pm b/Shorewall/Perl/Shorewall/Rules.pm index 25f862233..5a441795b 100644 --- a/Shorewall/Perl/Shorewall/Rules.pm +++ b/Shorewall/Perl/Shorewall/Rules.pm @@ -4749,10 +4749,6 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) { } } - unless ( ( $chain || $default_chain ) == OUTPUT ) { - fatal_error 'A USER/GROUP may only be specified when the SOURCE is $FW' unless $user eq '-'; - } - if ( $dest ne '-' ) { if ( $dest eq $fw ) { fatal_error 'Rules with DEST $FW must use the INPUT chain' if $designator && $designator ne INPUT; @@ -4795,6 +4791,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) { fatal_error "Duplicate STATE ($_)" if $state{$_}++; } } + # # Call the command's processing function # @@ -4805,12 +4802,23 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) { if ( $chain == ACTIONCHAIN ) { fatal_error "$cmd rules are not allowed in the $chainlabels{$chain} chain" unless $commandref->{allowedchains} & $chainref->{allowedchains}; $chainref->{allowedchains} &= $commandref->{allowedchains}; + $chainref->{allowedchains} &= (OUTPUT | POSTROUTING ) if $user ne '-'; } else { + # + # Inline within one of the standard chains + # fatal_error "$cmd rules are not allowed in the $chainlabels{$chain} chain" unless $commandref->{allowedchains} & $chain; + unless ( $chain == OUTPUT || $chain == POSTROUTING ) { + fatal_error 'A USER/GROUP may only be specified when the SOURCE is $FW' unless $user eq '-'; + } } } else { $resolve_chain->(); fatal_error "$cmd rules are not allowed in the $chainlabels{$chain} chain" unless $commandref->{allowedchains} & $chain; + unless ( $chain == OUTPUT || $chain == POSTROUTING ) { + fatal_error 'A USER/GROUP may only be specified when the SOURCE is $FW' unless $user eq '-'; + } + $chainref = ensure_chain( 'mangle', $chainnames{$chain} ); } @@ -4976,6 +4984,13 @@ sub process_tc_rule1( $$$$$$$$$$$$$$$$ ) { $mark = $rest; } elsif ( supplied $2 ) { $mark = $2; + if ( supplied $mark && $command eq 'IPMARK' ) { + my @params = split ',', $mark; + $params[1] = '0xff' unless supplied $params[1]; + $params[2] = '0x00' unless supplied $params[2]; + $params[3] = '0' unless supplied $params[3]; + $mark = join ',', @params; + } } else { $mark = ''; } @@ -4986,7 +5001,7 @@ sub process_tc_rule1( $$$$$$$$$$$$$$$$ ) { } } - $command = ( $command ? "$command($mark)" : $mark ) . $designator; + $command = ( $command ? supplied $mark ? "$command($mark)" : $command : $mark ) . $designator; my $line = ( $family == F_IPV6 ? "$command\t$source\t$dest\t$proto\t$ports\t$sports\t$user\t$testval\t$length\t$tos\t$connbytes\t$helper\t$headers\t$probability\t$dscp\t$state" : "$command\t$source\t$dest\t$proto\t$ports\t$sports\t$user\t$testval\t$length\t$tos\t$connbytes\t$helper\t$probability\t$dscp\t$state" );