holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Correct intra-zone handling in policies

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2016-12-19 09:11:41 -08:00
parent e98abac706
commit e229849c5b
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -638,7 +638,8 @@ sub process_a_policy1($$$$$$$) {
my ( $client, $server, $originalpolicy, $loglevel, $synparams, $connlimit, $intrazone ) = @_;
my $clientwild = ( "\L$client" =~ /^all(\+)?$/ );
$intrazone = $clientwild && $1;
$intrazone ||= $clientwild && $1;
fatal_error "Undefined zone ($client)" unless $clientwild || defined_zone( $client );
@ -763,25 +764,28 @@ sub process_a_policy() {
$synparams = '' if $synparams eq '-';
$connlimit = '' if $connlimit eq '-';
my $intrazone;
my ( $intrazone, $clientlist, $serverlist );
if ( $intrazone = $clients =~ /.*,.*\+$/) {
$clients =~ s/\+$//;
if ( $clientlist = ( $clients =~ /,/ ) ) {
$intrazone = ( $clients =~ s/\+$// );
}
if ( $servers =~ /.*,.*\+$/ ) {
$servers =~ s/\+$//;
$intrazone = 1;
if ( $serverlist = ( $servers =~ /,/ ) ) {
$intrazone ||= ( $servers =~ s/\+$// );
}
fatal_error 'SOURCE must be specified' if $clients eq '-';
fatal_error 'DEST must be specified' if $servers eq '-';
fatal_error 'POLICY must be specified' if $policy eq '-';
for my $client ( split_list( $clients, 'zone' ) ) {
for my $server ( split_list( $servers, 'zone' ) ) {
process_a_policy1( $client, $server, $policy, $loglevel, $synparams, $connlimit, $intrazone );
if ( $clientlist || $serverlist ) {
for my $client ( split_list( $clients, 'zone' ) ) {
for my $server ( split_list( $servers, 'zone' ) ) {
process_a_policy1( $client, $server, $policy, $loglevel, $synparams, $connlimit, $intrazone ) if $intrazone || $client ne $server;
}
}
} else {
process_a_policy1( $clients, $servers, $policy, $loglevel, $synparams, $connlimit, 0 );
}
}