fix for bug 3167: disallow multiport specification if both source and

destination ports are defined.

1 files changed, 6 insertions, 0 deletions

diff --git a/scripts/firewall/VyattaIpTablesRule.pm b/scripts/firewall/VyattaIpTablesRule.pm
index c2174c4..a4ec902 100644
--- a/scripts/firewall/VyattaIpTablesRule.pm
+++ b/scripts/firewall/VyattaIpTablesRule.pm
@@ -210,6 +210,12 @@ sub rule {
   return ($err_str, ) if (!defined($srcrule));
   ($dstrule, $err_str) = $dst->rule();
   return ($err_str, ) if (!defined($dstrule));
+  if ((grep /multiport/, $srcrule) || (grep /multiport/, $dstrule)) {
+    if ((grep /sport/, $srcrule) && (grep /dport/, $dstrule)) {
+      return ('Cannot specify multiple ports when both '
+              . 'source and destination ports are specified', );
+    }
+  }
   $rule .= " $srcrule $dstrule ";
 
   my $chain = $self->{_name};