Merge branch 'glendale' into hollywood

3 files changed, 49 insertions, 12 deletions

diff --git a/debian/changelog b/debian/changelog
index 32c601d..c06f47c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,31 @@
+vyatta-cfg-firewall (0.6) unstable; urgency=low
+
+  VC4.0.2
+  [ Mark O'Brien ]
+
+
+  [ An-Cheng Huang ]
+  * fix for bug 3167: get the actual return status from iptables.
+  * fix for bug 3167: disallow multiport specification if both source
+    and
+
+  [ Mark O'Brien ]
+
+ -- Mark O'Brien <mobrien@vyatta.com>  Sat, 19 Apr 2008 11:55:56 -0700
+
+vyatta-cfg-firewall (0.5) unstable; urgency=low
+
+  VC4.0.2 release candidate
+  [ Mark O'Brien ]
+
+
+  [ An-Cheng Huang ]
+  * fix for bug 3127: look for an exact match to replace/delete.
+
+  [ Mark O'Brien ]
+
+ -- Mark O'Brien <mobrien@vyatta.com>  Wed, 16 Apr 2008 09:49:51 -0700
+
 vyatta-cfg-firewall (0.4) unstable; urgency=low
 
   3.0.2
diff --git a/scripts/firewall/VyattaIpTablesRule.pm b/scripts/firewall/VyattaIpTablesRule.pm
index c2174c4..a4ec902 100644
--- a/scripts/firewall/VyattaIpTablesRule.pm
+++ b/scripts/firewall/VyattaIpTablesRule.pm
@@ -210,6 +210,12 @@ sub rule {
   return ($err_str, ) if (!defined($srcrule));
   ($dstrule, $err_str) = $dst->rule();
   return ($err_str, ) if (!defined($dstrule));
+  if ((grep /multiport/, $srcrule) || (grep /multiport/, $dstrule)) {
+    if ((grep /sport/, $srcrule) && (grep /dport/, $dstrule)) {
+      return ('Cannot specify multiple ports when both '
+              . 'source and destination ports are specified', );
+    }
+  }
   $rule .= " $srcrule $dstrule ";
 
   my $chain = $self->{_name};
diff --git a/scripts/firewall/vyatta-firewall.pl b/scripts/firewall/vyatta-firewall.pl
index 299a1e1..e01f30c 100755
--- a/scripts/firewall/vyatta-firewall.pl
+++ b/scripts/firewall/vyatta-firewall.pl
@@ -141,8 +141,8 @@ sub update_rules() {
             last;
           }
 	  system ("$logger Running: iptables --insert $name $iptablesrule $_");
-          system ("iptables --insert $name $iptablesrule $_ 2>&1 | $logger") == 0
-            || die "iptables error: $? - $_\n";
+          system ("iptables --insert $name $iptablesrule $_");
+          die "iptables error: $! - $_" if ($? >> 8);
           $iptablesrule++;
         }
       } elsif ("$rulehash{$rule}" eq "changed") {
@@ -164,8 +164,8 @@ sub update_rules() {
         my $ipt_rules = $oldnode->get_num_ipt_rules();
         for (1 .. $ipt_rules) {
 	  system ("$logger Running: iptables --delete $name $iptablesrule");
-          system ("iptables --delete $name $iptablesrule 2>&1 | $logger") == 0
-            || die "iptables error: $? - $rule\n";
+          system ("iptables --delete $name $iptablesrule");
+          die "iptables error: $! - $rule" if ($? >> 8);
         }
        
         foreach (@rule_strs) {
@@ -173,8 +173,8 @@ sub update_rules() {
             last;
           }
 	  system ("$logger Running: iptables --insert $name $iptablesrule $_");
-          system ("iptables --insert $name $iptablesrule $_ 2>&1 | $logger") == 0
-            || die "iptables error: $? - $rule_str\n";
+          system ("iptables --insert $name $iptablesrule $_");
+          die "iptables error: $! - $rule_str" if ($? >> 8);
           $iptablesrule++;
         }
       } elsif ("$rulehash{$rule}" eq "deleted") {
@@ -184,8 +184,8 @@ sub update_rules() {
         my $ipt_rules = $node->get_num_ipt_rules();
         for (1 .. $ipt_rules) {
 	  system ("$logger Running: iptables --delete $name $iptablesrule");
-          system ("iptables --delete $name $iptablesrule 2>&1 | $logger") == 0
-            || die "iptables error: $? - $rule\n";
+          system ("iptables --delete $name $iptablesrule");
+          die "iptables error: $! - $rule" if ($? >> 8);
         }
       }
     }
@@ -285,7 +285,7 @@ sub update_ints() {
   }
 
   system ("$logger Running: iptables $cmd");
-  system("iptables $cmd 2>&1 | $logger");
+  system("iptables $cmd");
   exit 1 if ($? >> 8);
   
   if ($action eq 'replace' || $action eq 'delete') {
@@ -366,7 +366,8 @@ sub setup_chain($) {
 
   $_ = $configured;
   if (!/^Chain $chain/) {
-    system("iptables --new-chain $chain 2>&1 | $logger") == 0 || die "iptables error: $chain --new-chain: $?\n";
+    system("iptables --new-chain $chain");
+    die "iptables error: $chain --new-chain: $!" if ($? >> 8);
     add_default_drop_rule($chain);
   }
 }
@@ -387,9 +388,11 @@ sub delete_chain($) {
   my $configured = `iptables -n -L $chain 2>&1 | head -1`;
 
   if ($configured =~ /^Chain $chain/) {
-    system("iptables --flush $chain 2>&1 | $logger") == 0        || die "iptables error: $chain --flush: $?\n";
+    system("iptables --flush $chain");
+    die "iptables error: $chain --flush: $!" if ($? >> 8);
     if (!chain_referenced($chain)) {
-      system("iptables --delete-chain $chain 2>&1 | $logger") == 0 || die "iptables error: $chain --delete-chain: $?\n";
+      system("iptables --delete-chain $chain");
+      die "iptables error: $chain --delete-chain: $!" if ($? >> 8);
     } else {
       add_default_drop_rule($chain);
     }