holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Fix dynamic zone fiasco

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@6352 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2007-05-14 23:14:30 +00:00
parent 37a5edb43a
commit 89d8afe45c
3 changed files with 20 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Shorewall-common/lib.dynamiczones
View File

@ -187,6 +187,7 @@ add_to_zone() # $1...${n-1} = <interface>[:<hosts>] $n = zone
for h in $dest_hosts; do
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
@ -206,6 +207,7 @@ add_to_zone() # $1...${n-1} = <interface>[:<hosts>] $n = zone
for h in $source_hosts; do
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
@ -374,6 +376,7 @@ delete_from_zone() # $1 = <interface>[:<hosts>] $2 = zone
for h in $dest_hosts; do
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
@ -390,6 +393,7 @@ delete_from_zone() # $1 = <interface>[:<hosts>] $2 = zone
for h in $source_hosts; do
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then

30
Shorewall-perl/Shorewall/Rules.pm
View File

@ -1420,25 +1420,25 @@ sub generate_matrix() {
add_rule $in_ref , "-i $interface -s $net -j RETURN";
add_rule $out_ref , "-i $interface -s $net -j RETURN";
}
}
if ( $capabilities{POLICY_MATCH} ) {
my $type = $zoneref->{type};
my $source_ref = ( $zoneref->{hosts}{ipsec} ) || {};
if ( $capabilities{POLICY_MATCH} ) {
my $type = $zoneref->{type};
my $source_ref = ( $zoneref->{hosts}{ipsec} ) || {};
if ( $config{DYNAMIC_ZONES} ) {
no warnings;
create_zone_dyn_chain $zone, $frwd_ref if (%$source_ref || $type ne 'ipsec4' );
}
if ( $config{DYNAMIC_ZONES} ) {
no warnings;
create_zone_dyn_chain $zone, $frwd_ref if (%$source_ref || $type eq 'ipsec4' );
}
for my $interface ( keys %$source_ref ) {
my $arrayref = $source_ref->{$interface};
for my $hostref ( @{$arrayref} ) {
my $ipsec_match = match_ipsec_in $zone , $hostref;
for my $net ( @{$hostref->{hosts}} ) {
add_rule
$filter_table->{forward_chain $interface} ,
for my $interface ( keys %$source_ref ) {
my $arrayref = $source_ref->{$interface};
for my $hostref ( @{$arrayref} ) {
my $ipsec_match = match_ipsec_in $zone , $hostref;
for my $net ( @{$hostref->{hosts}} ) {
add_rule
$filter_table->{forward_chain $interface} ,
join( '', match_source_net( $net ), $ipsec_match, "-j $frwd_ref->{name}" );
}
}
}
}

2
Shorewall-perl/Shorewall/Zones.pm
View File

@ -248,7 +248,7 @@ sub determine_zones()
$in_options = '' if $in_options eq '-';
$out_options = '' if $out_options eq '-';
$zone_hash{in_out} = parse_zone_option_list( $options || '',$zoneref->{type} );
$zone_hash{in_out} = parse_zone_option_list( $options || '', $zoneref->{type} );
$zone_hash{in} = parse_zone_option_list( $in_options || '', $zoneref->{type} );
$zone_hash{out} = parse_zone_option_list( $out_options || '', $zoneref->{type} );
$zone_hash{complex} = ($zoneref->{type} eq 'ipsec4' || $options || $in_options || $out_options ? 1 : 0);