From c302e822337d804855c07f87abee514293d02dcc Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sun, 19 Dec 2010 10:46:35 -0800 Subject: [PATCH] Disallow wildcard interfaces in additional contexts --- Shorewall/Perl/Shorewall/Chains.pm | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm index 71361a3b4..f743e7a22 100644 --- a/Shorewall/Perl/Shorewall/Chains.pm +++ b/Shorewall/Perl/Shorewall/Chains.pm @@ -3534,6 +3534,7 @@ sub expand_rule( $$$$$$$$$$;$ ) # An interface in the SOURCE column of a masq file # fatal_error "Bridge ports may not appear in the SOURCE column of this file" if port_to_bridge( $iiface ); + fatal_error "A wildcard interface ( $iiface) is not allowed in this context" if $iiface =~ /\+$/; if ( $table eq 'nat' ) { warning_message qq(Using an interface as the masq SOURCE requires the interface to be up and configured when $Product starts/restarts) unless $idiotcount++; @@ -3625,6 +3626,7 @@ sub expand_rule( $$$$$$$$$$;$ ) # fatal_error "A DEST interface is not permitted in the PREROUTING chain" if $restriction & DESTIFACE_DISALLOW; fatal_error "Bridge port ($diface) not allowed" if port_to_bridge( $diface ); + fatal_error "A wildcard interface ($diface) is not allowed in this context" if $diface =~ /\+$/; push_command( $chainref , 'for dest in ' . get_interface_nets( $diface) . '; do', 'done' ); $rule .= '-d $dest '; } else {