From f917670fbdea90a47408efa9410fd05ee0cd8ae7 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Wed, 2 Nov 2016 19:30:18 -0700 Subject: [PATCH] Tighten editing of SNAT/MASQ port ranges. Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/IPAddrs.pm | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/Shorewall/Perl/Shorewall/IPAddrs.pm b/Shorewall/Perl/Shorewall/IPAddrs.pm index b358848fe..0b246411c 100644 --- a/Shorewall/Perl/Shorewall/IPAddrs.pm +++ b/Shorewall/Perl/Shorewall/IPAddrs.pm @@ -472,7 +472,7 @@ sub validate_portpair1( $$ ) { fatal_error "Invalid port range ($portpair)" if $portpair =~ tr/-/-/ > 1; - $portpair = "0$portpair" if substr( $portpair, 0, 1 ) eq ':'; + $portpair = "1$portpair" if substr( $portpair, 0, 1 ) eq ':'; $portpair = "${portpair}65535" if substr( $portpair, -1, 1 ) eq ':'; my @ports = split /-/, $portpair, 2; @@ -483,9 +483,10 @@ sub validate_portpair1( $$ ) { if ( @ports == 2 ) { $what = 'port range'; - fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1]; + fatal_error "Invalid port range ($portpair)" unless $ports[0] && $ports[0] < $ports[1]; } else { $what = 'port'; + fatal_error 'Invalid port number (0)' unless $portpair; } fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless