On Thu, 2011-12-29 at 13:18 -0800, Tom Eastep wrote:
> On Thu, 2011-12-29 at 20:12 +0000, Steven Jan Springl wrote:
> > The patch fixes the above issues.
> > 
> > However, if DEST contains fw and an IP address e.g.
> > 
> > 1:130:F  10.1.1.0/24  fw:1.1.1.1
> > 
> > the iptables error still occurs.
> > 
> > My testing indicated that specifying a source of fw is valid for :F.
> > Should Shorewall not allow this?
> 
> Steven,
> 
> No. Traffic that originates on the firewall does not traverse the
> FORWARD chain. The reason that it was previously working for you is that
> the compiler was silently substituting OUTPUT for FORWARD. Now it is
> generating an error.

I believe that this patch catches all cases that should not be
supported.

Thanks, Steven

-Tom
-- 
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________


diff --git a/Shorewall/Perl/Shorewall/Tc.pm b/Shorewall/Perl/Shorewall/Tc.pm
index 359bdc0..44672be 100644
--- a/Shorewall/Perl/Shorewall/Tc.pm
+++ b/Shorewall/Perl/Shorewall/Tc.pm
@@ -240,10 +240,10 @@ sub process_tc_rule( ) {
 	    } else {
 		$chain = 'tcout';
 	    }
-
 	    $source = '';
-	} else {
-	    $chain = 'tcout' if $source =~ s/^($fw)://;
+	} elsif ( $source =~ s/^($fw):// ) {
+	    fatal_error ":F is not allowed when the SOURCE is the firewall" if $chain eq 'tcfor';
+	    $chain = 'tcout';
 	}
     }
 
@@ -252,8 +252,9 @@ sub process_tc_rule( ) {
 	    fatal_error 'A CLASSIFY rule may not have $FW as the DEST' if $classid;
 	    $chain = 'tcin';
 	    $dest  = '';
-	} else {
-	    $chain = 'tcin' if $dest =~ s/^($fw)://;
+	} elsif ( $dest =~ s/^($fw):// ) {
+	    fatal_error 'A CLASSIFY rule may not have $FW as the DEST' if $classid;
+	    $chain = 'tcin';
 	}
     }
 

Attachment: signature.asc
Description: This is a digitally signed message part

------------------------------------------------------------------------------
Ridiculously easy VDI. With Citrix VDI-in-a-Box, you don't need a complex
infrastructure or vast IT resources to deliver seamless, secure access to
virtual desktops. With this all-in-one solution, easily deploy virtual 
desktops for less than the cost of PCs and save 60% on VDI infrastructure 
costs. Try it free! http://p.sf.net/sfu/Citrix-VDIinabox
_______________________________________________
Shorewall-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/shorewall-devel

Reply via email to