On 10/4/10 11:36 AM, Mr Dash Four wrote: > >> 1) Multiple source or destination ipset matches can be generated by >> enclosing the ipset list in [...]. >> >> Example (/etc/shorewall/rules): >> >> ACCEPT $FW net:+[dest-ip-map,dest-port-map] >> > Converting the 'old' format from "$FW:!+dest-port[dst] net:+dest-net" to > "$FW net:+[dest-net,!dest-port]" gives me ERROR: Invalid DEST > Converting the 'old' format from "$FW:+dest-port[dst] net:!+dest-net" to > "$FW net:+[!dest-net,dest-port]" gives me ERROR: Missing ']' (+[) > Converting the 'old' format from "$FW:!+dest-port[dst] net:!+dest-net" > to "$FW net:!+[dest-net,dest-port]" gives me ERROR: An ipset name > (+[dest-net,dest-port]) is not allowed in this context
Short description: Exclusion in setlists doesn't work. Attached is a patch against /usr/share/shorewall/Shorewall/Chains.pm. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
diff --git a/Shorewall/Perl/Shorewall/Chains.pm
b/Shorewall/Perl/Shorewall/Chains.pm
index 308b645..7af1ce2 100644
--- a/Shorewall/Perl/Shorewall/Chains.pm
+++ b/Shorewall/Perl/Shorewall/Chains.pm
@@ -3564,21 +3564,46 @@ sub expand_rule( $$$$$$$$$$;$ )
# Determine if there is Source Exclusion
#
if ( $inets ) {
- fatal_error "Invalid SOURCE" if $inets =~ /^([^!]+)?,!([^!]+)$/ ||
$inets =~ /.*!.*!/;
+ if ( $inets =~ /^(!?)(\+\[(.*)\])$/ ) {
+ if ( $1 ) {
+ $inets = '';
+ $iexcl = $3;
- if ( $inets =~ /^([^!]+)?!([^!]+)$/ ) {
- $inets = $1;
- $iexcl = $2;
+ my @iexcl = mysplit $iexcl;
+
+ for ( @iexcl ) {
+ fatal_error "Expected ipset name ($_)" unless
/^(!?)(\+?)[a-zA-Z][-\w]*(\[.*\])?/;
+ /^\+/ || s/^/+/;
+ }
+
+ $iexcl = join ',', @iexcl;
+ } else {
+ $inets = $2;
+ $iexcl = '';
+ }
} else {
- $iexcl = '';
- }
+ my @inets = mysplit $inets;
- unless ( $inets || ( $iiface && $restriction & POSTROUTE_RESTRICT ) ) {
- my @iexcl = mysplit $iexcl;
- if ( @iexcl == 1 ) {
- $rule .= match_source_net "!$iexcl" , $restriction;
+ shift @inets;
+
+ for ( @inets ) {
+ fatal_error "Invalid SOURCE ($inets)" if /^!/;
+ }
+
+ if ( $inets =~ /^([^!]+)?!([^!]+)$/ ) {
+ $inets = $1;
+ $iexcl = $2;
+ } else {
$iexcl = '';
- $trivialiexcl = 1;
+ }
+
+ unless ( $inets || ( $iiface && $restriction & POSTROUTE_RESTRICT )
) {
+ my @iexcl = mysplit $iexcl;
+ if ( @iexcl == 1 ) {
+ $rule .= match_source_net "!$iexcl" , $restriction;
+ $iexcl = '';
+ $trivialiexcl = 1;
+ }
}
}
@@ -3590,21 +3615,48 @@ sub expand_rule( $$$$$$$$$$;$ )
# Determine if there is Destination Exclusion
#
if ( $dnets ) {
- fatal_error "Invalid DEST" if $dnets =~ /^([^!]+)?,!([^!]+)$/ ||
$dnets =~ /.*!.*!/;
+ if ( $dnets =~ /^(!?)(\+\[(.*)\])$/ ) {
+ if ( $1 ) {
+ $dnets = '';
+ $dexcl = $3;
+
+ my @dexcl = mysplit $dexcl;
- if ( $dnets =~ /^([^!]+)?!([^!]+)$/ ) {
- $dnets = $1;
- $dexcl = $2;
+ for ( @dexcl ) {
+ fatal_error "Expected ipset name ($_)" unless
/^(!?)(\+?)[a-zA-Z][-\w]*(\[.*\])?/;
+ /^\+/ || s/^/+/;
+ }
+
+ $dexcl = join ',', @dexcl;
+ } else {
+ $dnets = $2;
+ $dexcl = '';
+ }
} else {
- $dexcl = '';
- }
+ my @dnets = mysplit $dnets;
- unless ( $dnets ) {
- my @dexcl = mysplit $dexcl;
- if ( @dexcl == 1 ) {
- $rule .= match_dest_net "!$dexcl";
+ shift @dnets;
+
+ for ( @dnets ) {
+ fatal_error "Invalid DEST ($dnets)" if /^!/;
+ }
+
+ fatal_error "Invalid DEST" if $dnets =~ /^([^!]+)?,!([^!]+)$/ ||
$dnets =~ /.*!.*!/;
+
+ if ( $dnets =~ /^([^!]+)?!([^!]+)$/ ) {
+ $dnets = $1;
+ $dexcl = $2;
+ } else {
$dexcl = '';
- $trivialdexcl = 1;
+ }
+
+ unless ( $dnets || $dexcl =~ /!/ ) {
+ my @dexcl = mysplit $dexcl;
+ if ( @dexcl == 1 ) {
+ $rule .= match_dest_net "!$dexcl";
+ $dexcl = '';
+ $trivialdexcl = 1;
+ }
}
}
} else {
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Virtualization is moving to the mainstream and overtaking non-virtualized environment for deploying applications. Does it make network security easier or more difficult to achieve? Read this whitepaper to separate the two and get a better understanding. http://p.sf.net/sfu/hp-phase2-d2d
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
