From e01c7f37a29ccc3e8a660c3c9995fd077948cc5d Mon Sep 17 00:00:00 2001
From: An-Cheng Huang <ancheng@vyatta.com>
Date: Mon, 3 Nov 2008 18:30:18 -0800
Subject: fix for bug 3717: enforce interface restrictions

---
 Makefile.am              |  2 +-
 cfg-version/nat@2        |  0
 cfg-version/nat@3        |  0
 scripts/VyattaNatRule.pm | 11 ++++++++---
 4 files changed, 9 insertions(+), 4 deletions(-)
 delete mode 100644 cfg-version/nat@2
 create mode 100644 cfg-version/nat@3

diff --git a/Makefile.am b/Makefile.am
index 63966e0..b6e68e2 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -12,7 +12,7 @@ bin_sudo_users_SCRIPTS  = scripts/vyatta-clear-nat
 bin_sudo_users_SCRIPTS += scripts/vyatta-nat-translations.pl
 
 share_perl5_DATA = scripts/VyattaNatRule.pm
-curver_DATA = cfg-version/nat@2
+curver_DATA = cfg-version/nat@3
 
 cpiop = find  . ! -regex '\(.*~\|.*\.bak\|.*\.swp\|.*\#.*\#\)' -print0 | \
 	cpio -0pd
diff --git a/cfg-version/nat@2 b/cfg-version/nat@2
deleted file mode 100644
index e69de29..0000000
diff --git a/cfg-version/nat@3 b/cfg-version/nat@3
new file mode 100644
index 0000000..e69de29
diff --git a/scripts/VyattaNatRule.pm b/scripts/VyattaNatRule.pm
index a5a96ae..a648035 100644
--- a/scripts/VyattaNatRule.pm
+++ b/scripts/VyattaNatRule.pm
@@ -148,6 +148,10 @@ sub rule_str {
     $can_use_port = 0;
   }
   if (($self->{_type} eq "source") || ($self->{_type} eq "masquerade")) {
+    return (undef, 'cannot specify inbound interface with '
+                   . '"masquerade" or "source" rules')
+      if (defined($self->{_inbound_if}));
+
     if ($self->{_exclude}) {
       $rule_str .= "-j RETURN";
     } elsif ($self->{_type} eq "masquerade") {
@@ -186,9 +190,6 @@ sub rule_str {
       $to_src .= "$start-$stop";
     }
    
-    return (undef, 'cannot specify inbound interface with "masquerade"')
-      if (defined($self->{_inbound_if}) && ($self->{_type} eq "masquerade"));
-
     if (($to_src ne "") && ($self->{_type} eq "masquerade")) {
       return (undef, "cannot specify outside IP address with \"masquerade\"");
     }
@@ -227,6 +228,10 @@ sub rule_str {
     }
   } elsif ($self->{_type} eq "destination") {
     # type is destination
+    return (undef,
+            'cannot specify outbound interface with "destination" rules')
+      if (defined($self->{_outbound_if}));
+
     if ($self->{_exclude}) {
       $rule_str .= "-j RETURN";
     } else {
-- 
cgit v1.2.3