X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=zones.c;h=514d20310dfb93312e6cfb2d0c0355633a335f16;hp=520d00cf1e2775b9e3ab0b022b6fe3aace4db824;hb=503db4a2e50519802ca6380495d4ecf32894f905;hpb=37cb4cb437fd685f31926a4c326ba8afe329e4a6

diff --git a/zones.c b/zones.c
index 520d00c..514d203 100644
--- a/zones.c
+++ b/zones.c
@@ -66,6 +66,7 @@ const struct fw3_option fw3_zone_opts[] = {
 	FW3_OPT("output",              target,   zone,     policy_output),
 
 	FW3_OPT("masq",                bool,     zone,     masq),
+	FW3_OPT("masq_allow_invalid",  bool,     zone,     masq_allow_invalid),
 	FW3_LIST("masq_src",           network,  zone,     masq_src),
 	FW3_LIST("masq_dest",          network,  zone,     masq_dest),
 
@@ -104,6 +105,26 @@ check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
 	}
 }
 
+static bool
+check_masq_addrs(struct list_head *head)
+{
+	struct fw3_address *addr;
+	int n_addr = 0, n_failed = 0;
+
+	list_for_each_entry(addr, head, list)
+	{
+		if (addr->invert)
+			continue;
+
+		n_addr++;
+
+		if (!addr->set && addr->resolved)
+			n_failed++;
+	}
+
+	return (n_addr == 0 || n_failed < n_addr);
+}
+
 static void
 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
 {
@@ -170,7 +191,8 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 		if (!zone)
 			continue;
 
-		fw3_parse_options(zone, fw3_zone_opts, s);
+		if (!fw3_parse_options(zone, fw3_zone_opts, s))
+			warn_elem(e, "has invalid options");
 
 		if (!zone->enabled)
 		{
@@ -207,6 +229,18 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 			warn_elem(e, "has no device, network, subnet or extra options");
 		}
 
+		if (!check_masq_addrs(&zone->masq_src))
+		{
+			warn_elem(e, "has unresolved masq_src, disabling masq");
+			zone->masq = false;
+		}
+
+		if (!check_masq_addrs(&zone->masq_dest))
+		{
+			warn_elem(e, "has unresolved masq_dest, disabling masq");
+			zone->masq = false;
+		}
+
 		check_policy(e, &zone->policy_input, defs->policy_input, "input");
 		check_policy(e, &zone->policy_output, defs->policy_output, "output");
 		check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
@@ -354,6 +388,17 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 
 			if (has(zone->flags, handle->family, t))
 			{
+				if (t == FW3_FLAG_ACCEPT &&
+				    zone->masq && !zone->masq_allow_invalid)
+				{
+					r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
+					fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
+					fw3_ipt_rule_comment(r, "Prevent NAT leakage");
+					fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_DROP]);
+					fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
+					                     fw3_flag_names[t]);
+				}
+
 				r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
 				fw3_ipt_rule_target(r, jump_target(t));
 				fw3_ipt_rule_extra(r, zone->extra_dest);
@@ -467,7 +512,7 @@ next_addr(struct fw3_address *addr, struct list_head *list,
 	{
 		rv = list_entry(p, struct fw3_address, list);
 
-		if (fw3_is_family(rv, family) && rv->invert == invert)
+		if (fw3_is_family(rv, family) && rv->set && rv->invert == invert)
 			return rv;
 	}