holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Refine source/dest network parsing in expand_rule()

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2010-10-04 18:57:11 -07:00
parent e74f48410f
commit 8fd221ef30
1 changed files with 54 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -3581,19 +3581,34 @@ sub expand_rule( $$$$$$$$$$;$ )
$iexcl = ''; $iexcl = '';
} }
} else { } else {
my $originets = $inets;
my @inets = mysplit $inets; my @inets = mysplit $inets;
shift @inets; $inets= $iexcl = '';
for ( @inets ) { for ( @inets ) {
fatal_error "Invalid SOURCE ($inets)" if /^!/; my $bangs = tr/!/!/;
}
if ( $inets =~ /^([^!]+)?!([^!]+)$/ ) { if ( $bangs ) {
$inets = $1; if ( /^!(.*)$/ ) {
$iexcl = $2; fatal_error "Invalid SOURCE ($originets)" if ( $inets || $iexcl );
} else { $iexcl = $1;
$iexcl = ''; } elsif ( /^\+/ ) {
if ( $iexcl ) {
$iexcl = join(',', $iexcl, $_ );
} else {
$inets = join(',', $inets, $_ );
}
} else {
fatal_error "Invalid SOURCE ($originets)" if $bangs > 1;
( my $temp, $iexcl ) = split /!/;
$inets = $inets ? join(',', $inets, $temp ) : $temp;
}
} elsif ( $iexcl ) {
$iexcl = join(',', $iexcl, $_ );
} else {
$inets = $inets ? join(',', $inets, $_ ) : $_;
}
} }
unless ( $inets || ( $iiface && $restriction & POSTROUTE_RESTRICT ) ) { unless ( $inets || ( $iiface && $restriction & POSTROUTE_RESTRICT ) ) {
@ -3604,7 +3619,6 @@ sub expand_rule( $$$$$$$$$$;$ )
$trivialiexcl = 1; $trivialiexcl = 1;
} }
} }
} }
} else { } else {
$iexcl = ''; $iexcl = '';
@ -3615,7 +3629,13 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
if ( $dnets ) { if ( $dnets ) {
if ( $dnets =~ /^(!?)(\+\[(.+)\])$/ ) { if ( $dnets =~ /^(!?)(\+\[(.+)\])$/ ) {
#
# set list
#
if ( $1 ) { if ( $1 ) {
#
# Exclusion
#
$dnets = ''; $dnets = '';
my @dexcl = mysplit $3; my @dexcl = mysplit $3;
@ -3631,24 +3651,37 @@ sub expand_rule( $$$$$$$$$$;$ )
$dexcl = ''; $dexcl = '';
} }
} else { } else {
my $origdnets = $dnets;
my @dnets = mysplit $dnets; my @dnets = mysplit $dnets;
shift @dnets; $dnets= $dexcl = '';
for ( @dnets ) { for ( @dnets ) {
fatal_error "Invalid DEST ($dnets)" if /^!/; my $bangs = tr/!/!/;
if ( $bangs ) {
if ( /^!(.*)$/ ) {
fatal_error "Invalid DEST ($origdnets)" if ( $dnets || $dexcl );
$dexcl = $1;
} elsif ( /^\+/ ) {
if ( $dexcl ) {
$dexcl = join(',', $dexcl, $_ );
} else {
$dnets = join(',', $dnets, $_ );
}
} else {
fatal_error "Invalid DEST ($origdnets)" if $bangs > 1;
( my $temp, $dexcl ) = split /!/;
$dnets = $dnets ? join(',', $dnets, $temp ) : $temp;
}
} elsif ( $dexcl ) {
$dexcl = join(',', $dexcl, $_ );
} else {
$dnets = $dnets ? join(',', $dnets, $_ ) : $_;
}
} }
fatal_error "Invalid DEST" if $dnets =~ /^([^!]+)?,!([^!]+)$/ || $dnets =~ /.*!.*!/; unless ( $dnets ) {
if ( $dnets =~ /^([^!]+)?!([^!]+)$/ ) {
$dnets = $1;
$dexcl = $2;
} else {
$dexcl = '';
}
unless ( $dnets || $dexcl =~ /!/ ) {
my @dexcl = mysplit $dexcl; my @dexcl = mysplit $dexcl;
if ( @dexcl == 1 ) { if ( @dexcl == 1 ) {
$rule .= match_dest_net "!$dexcl"; $rule .= match_dest_net "!$dexcl";