Restore ability to exclude a source sub-zone from DNAT, SAME and REDIRECT rules

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2504 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Shorewall/firewall

@@ -4708,6 +4708,10 @@ add_nat_rule() {
 	target1="REDIRECT --to-port $servport"
     fi
 
+    if [ $source = $FW ]; then
+	[ -n "$excludezones" ] && fatal_error "Invalid Source in rule \"$rule\""
+    fi
+
     # Generate nat table rules
 
     if [ $COMMAND != check ]; then
@@ -4735,13 +4739,20 @@ add_nat_rule() {
 		done
 	    fi
 	else
-	    if [ -n "${excludesource}${excludedests}" ]; then
+	    if [ -n "${excludesource}${excludedests}${excludezones}" ]; then
 		build_exclusion_chain chain nat "$excludesource" $excludedests
 
 		for adr in $(separate_list $addr); do
 		    addnatrule $(dnat_chain $source) $cli $proto $multiport $sports $dports $(dest_ip_range $adr) -j $chain
 		done
 
+ 		for z in $(separate_list $excludezones); do
+ 		    eval hosts=\$${z}_hosts
+ 		    for host in $hosts; do
+ 			addnatrule $chain $(match_source_hosts ${host#*:}) -j RETURN
+ 		    done
+ 		done
+ 
 		if [ -n "$loglevel" ]; then
 		    log_rule_limit $loglevel $chain $(dnat_chain $source) $logtarget "$ratelimit" "$logtag" -A -t nat
 		fi
@@ -5280,6 +5291,21 @@ process_rule() # $1 = target
 	    ;;
     esac
     
+    if [ "$clientzone" = "${clientzone%!*}" ]; then
+ 	excludezones=
+    else
+	excludezones="${clientzone#*!}"
+ 	clientzone="${clientzone%!*}"
+ 
+	case $logtarget in
+ 	    DNAT|REDIRECT|SAME)
+ 		;;
+ 	    *)
+ 		fatal_error "Exclude zone only allowed with DNAT, SAME or REDIRECT"
+ 		;;
+ 	esac
+    fi
+ 
     validate_zone $clientzone || fatal_error "Undefined Client Zone in rule \"$rule\""
 
     # Parse and validate destination