[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 1b34f6cd64a7344220e69822175b26849caaa823

[git.ipfire.org] IPFire 2.x development tree branch, master, updated. 1b34f6cd64a7344220e69822175b26849caaa823

[git]

[-- Attachment #1: Type: text/plain, Size: 2560 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  1b34f6cd64a7344220e69822175b26849caaa823 (commit)
      from  325a846a10e80385e12f08c72bfda19690c0aa5d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1b34f6cd64a7344220e69822175b26849caaa823
Author: Michael Tremer <michael.tremer(a)ipfire.org>
Date:   Thu Jan 22 16:06:25 2015 +0100

    firewall: Fix SNAT rules that use a default network as source
    
    In the POSTROUTING chain using -i intf0 does not work at all.
    We now only use the -s parameter to figure out if the rule applied.
    The filter chain still uses -i and -o to match patches not only
    by the network address, but also by the incoming/outgoing interface.

-----------------------------------------------------------------------

Summary of changes:
 config/firewall/rules.pl | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

Difference in files:
diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index a475e2d..97b8897 100755
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -368,20 +368,12 @@ sub buildrules {
 						push(@source_options, ("-s", $source));
 					}
 
-					if ($source_intf) {
-						push(@source_options, ("-i", $source_intf));
-					}
-
 					# Prepare destination options.
 					my @destination_options = ();
 					if ($destination) {
 						push(@destination_options, ("-d", $destination));
 					}
 
-					if ($destination_intf) {
-						push(@destination_options, ("-o", $destination_intf));
-					}
-
 					# Add time constraint options.
 					push(@options, @time_options);
 
@@ -476,6 +468,17 @@ sub buildrules {
 						}
 					}
 
+					# Add source and destination interface to the filter rules.
+					# These are supposed to help filtering forged packets that originate
+					# from BLUE with an IP address from GREEN for instance.
+					if ($source_intf) {
+						push(@source_options, ("-i", $source_intf));
+					}
+
+					if ($destination_intf) {
+						push(@destination_options, ("-o", $destination_intf));
+					}
+
 					push(@options, @source_options);
 					push(@options, @destination_options);
 


hooks/post-receive
--
IPFire 2.x development tree