holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Remove sub-zone exclusion feature in preparation for implementing true exclude lists

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2492 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2005-08-15 16:04:39 +00:00
parent e075e8c3e2
commit 5df7bc0538
1 changed files with 1 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
Shorewall/firewall
View File

@ -4707,10 +4707,6 @@ add_nat_rule() {
target1="REDIRECT --to-port $servport" target1="REDIRECT --to-port $servport"
fi fi
if [ $source = $FW ]; then
[ -n "$excludezones" ] && fatal_error "Invalid Source in rule \"$rule\""
fi
# Generate nat table rules # Generate nat table rules
if [ $COMMAND != check ]; then if [ $COMMAND != check ]; then
@ -4738,20 +4734,13 @@ add_nat_rule() {
done done
fi fi
else else
if [ -n "${excludezones}${excludedests}" ]; then if [ -n "${excludedests}" ]; then
build_exclusion_chain chain nat "" $excludedests build_exclusion_chain chain nat "" $excludedests
for adr in $(separate_list $addr); do for adr in $(separate_list $addr); do
addnatrule $(dnat_chain $source) $cli $proto $multiport $sports $dports $(dest_ip_range $adr) -j $chain addnatrule $(dnat_chain $source) $cli $proto $multiport $sports $dports $(dest_ip_range $adr) -j $chain
done done
for z in $(separate_list $excludezones); do
eval hosts=\$${z}_hosts
for host in $hosts; do
addnatrule $chain $(match_source_hosts ${host#*:}) -j RETURN
done
done
if [ -n "$loglevel" ]; then if [ -n "$loglevel" ]; then
log_rule_limit $loglevel $chain $(dnat_chain $source) $logtarget "$ratelimit" "$logtag" -A -t nat log_rule_limit $loglevel $chain $(dnat_chain $source) $logtarget "$ratelimit" "$logtag" -A -t nat
fi fi
@ -5242,21 +5231,6 @@ process_rule() # $1 = target
fi fi
fi fi
if [ "$clientzone" = "${clientzone%!*}" ]; then
excludezones=
else
excludezones="${clientzone#*!}"
clientzone="${clientzone%!*}"
case $logtarget in
DNAT|REDIRECT|SAME)
;;
*)
fatal_error "Exclude list only allowed with DNAT, SAME or REDIRECT"
;;
esac
fi
validate_zone $clientzone || fatal_error "Undefined Client Zone in rule \"$rule\"" validate_zone $clientzone || fatal_error "Undefined Client Zone in rule \"$rule\""
# Parse and validate destination # Parse and validate destination