holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Simplify the fix for double exclusion in ipset lists

Browse Source
This commit is contained in:
Tom Eastep 2011-05-06 14:28:22 -07:00
parent 0c59e0231d
commit afed909e52
1 changed files with 16 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -2867,7 +2867,7 @@ sub conditional_rule_end( $ ) {
add_commands( $chainref , "fi\n" ); add_commands( $chainref , "fi\n" );
} }
sub mysplit( $$ ); sub mysplit( $;$ );
# #
# Match a Source. # Match a Source.
@ -3226,7 +3226,7 @@ sub addnatjump( $$$ ) {
# Split a comma-separated source or destination host list but keep [...] together. Used for spliting address lists # Split a comma-separated source or destination host list but keep [...] together. Used for spliting address lists
# where an element of the list might be +ipset[flag,...] or +[ipset[flag,...],...] # where an element of the list might be +ipset[flag,...] or +[ipset[flag,...],...]
# #
sub mysplit( $$ ) { sub mysplit( $;$ ) {
my ( $input, $loose ) = @_; my ( $input, $loose ) = @_;
my @input = split_list $input, 'host'; my @input = split_list $input, 'host';
@ -3635,7 +3635,7 @@ sub handle_network_list( $$ ) {
my $nets = ''; my $nets = '';
my $excl = ''; my $excl = '';
my @nets = mysplit $list, 0; my @nets = mysplit $list;
for ( @nets ) { for ( @nets ) {
if ( /!/ ) { if ( /!/ ) {
@ -3951,7 +3951,7 @@ sub expand_rule( $$$$$$$$$$;$ )
} }
unless ( $onets ) { unless ( $onets ) {
my @oexcl = mysplit $oexcl, 0; my @oexcl = mysplit $oexcl;
if ( @oexcl == 1 ) { if ( @oexcl == 1 ) {
$rule .= match_orig_dest( "!$oexcl" ); $rule .= match_orig_dest( "!$oexcl" );
$oexcl = ''; $oexcl = '';
@ -4026,19 +4026,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
my $exclude = '-j MARK --or-mark ' . in_hex( $globals{EXCLUSION_MASK} ); my $exclude = '-j MARK --or-mark ' . in_hex( $globals{EXCLUSION_MASK} );
for ( mysplit $iexcl, 0 ) { for ( mysplit $iexcl ) {
my $cond = conditional_rule( $chainref, $_ ); my $cond = conditional_rule( $chainref, $_ );
add_rule $chainref, ( match_source_net $_ , $restriction, $mac ) . $exclude; add_rule $chainref, ( match_source_net $_ , $restriction, $mac ) . $exclude;
conditional_rule_end( $chainref ) if $cond; conditional_rule_end( $chainref ) if $cond;
} }
for ( mysplit $dexcl, 0 ) { for ( mysplit $dexcl ) {
my $cond = conditional_rule( $chainref, $_ ); my $cond = conditional_rule( $chainref, $_ );
add_rule $chainref, ( match_dest_net $_ ) . $exclude; add_rule $chainref, ( match_dest_net $_ ) . $exclude;
conditional_rule_end( $chainref ) if $cond; conditional_rule_end( $chainref ) if $cond;
} }
for ( mysplit $oexcl, 0 ) { for ( mysplit $oexcl ) {
my $cond = conditional_rule( $chainref, $_ ); my $cond = conditional_rule( $chainref, $_ );
add_rule $chainref, ( match_orig_dest $_ ) . $exclude; add_rule $chainref, ( match_orig_dest $_ ) . $exclude;
conditional_rule_end( $chainref ) if $cond; conditional_rule_end( $chainref ) if $cond;
@ -4057,19 +4057,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
# Use the current rule and send all possible matches to the exclusion chain # Use the current rule and send all possible matches to the exclusion chain
# #
for my $onet ( mysplit $onets , 0 ) { for my $onet ( mysplit $onets ) {
my $cond = conditional_rule( $chainref, $onet ); my $cond = conditional_rule( $chainref, $onet );
$onet = match_orig_dest $onet; $onet = match_orig_dest $onet;
for my $inet ( mysplit $inets , 0 ) { for my $inet ( mysplit $inets ) {
my $cond = conditional_rule( $chainref, $inet ); my $cond = conditional_rule( $chainref, $inet );
my $source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' ); my $source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' );
for my $dnet ( mysplit $dnets , 0 ) { for my $dnet ( mysplit $dnets ) {
$source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' ); $source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' );
add_jump( $chainref, $echainref, 0, join( '', $rule, $source_match, match_dest_net( $dnet ), $onet ), 1 ); add_jump( $chainref, $echainref, 0, join( '', $rule, $source_match, match_dest_net( $dnet ), $onet ), 1 );
} }
@ -4082,19 +4082,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
# Generate RETURNs for each exclusion # Generate RETURNs for each exclusion
# #
for ( mysplit $iexcl , 0 ) { for ( mysplit $iexcl ) {
my $cond = conditional_rule( $echainref, $_ ); my $cond = conditional_rule( $echainref, $_ );
add_rule $echainref, ( match_source_net $_ , $restriction, $mac ) . '-j RETURN'; add_rule $echainref, ( match_source_net $_ , $restriction, $mac ) . '-j RETURN';
conditional_rule_end( $echainref ) if $cond; conditional_rule_end( $echainref ) if $cond;
} }
for ( mysplit $dexcl , 0 ) { for ( mysplit $dexcl ) {
my $cond = conditional_rule( $echainref, $_ ); my $cond = conditional_rule( $echainref, $_ );
add_rule $echainref, ( match_dest_net $_ ) . '-j RETURN'; add_rule $echainref, ( match_dest_net $_ ) . '-j RETURN';
conditional_rule_end( $echainref ) if $cond; conditional_rule_end( $echainref ) if $cond;
} }
for ( mysplit $oexcl , 0 ) { for ( mysplit $oexcl ) {
my $cond = conditional_rule( $echainref, $_ ); my $cond = conditional_rule( $echainref, $_ );
add_rule $echainref, ( match_orig_dest $_ ) . '-j RETURN'; add_rule $echainref, ( match_orig_dest $_ ) . '-j RETURN';
conditional_rule_end( $echainref ) if $cond; conditional_rule_end( $echainref ) if $cond;
@ -4124,19 +4124,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
# No non-trivial exclusions or we're using marks to handle them # No non-trivial exclusions or we're using marks to handle them
# #
for my $onet ( mysplit $onets , 0 ) { for my $onet ( mysplit $onets ) {
my $cond = conditional_rule( $chainref, $onet ); my $cond = conditional_rule( $chainref, $onet );
$onet = match_orig_dest $onet; $onet = match_orig_dest $onet;
for my $inet ( mysplit $inets , 0 ) { for my $inet ( mysplit $inets ) {
my $source_match; my $source_match;
my $cond = conditional_rule( $chainref, $inet ); my $cond = conditional_rule( $chainref, $inet );
$source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' ); $source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' );
for my $dnet ( mysplit $dnets , 0 ) { for my $dnet ( mysplit $dnets ) {
$source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' ); $source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' );
my $dest_match = match_dest_net( $dnet ); my $dest_match = match_dest_net( $dnet );
my $matches = join( '', $rule, $source_match, $dest_match, $onet ); my $matches = join( '', $rule, $source_match, $dest_match, $onet );