diff --git a/build_num b/build_num index c84d7dd05..9dbef578e 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2805 +#define BUILD_NUM 2807 diff --git a/doc/ChangeLog b/doc/ChangeLog index 34efe1949..fd9c37213 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,5 +1,9 @@ 2010-04-09 vadim + * NATCompiler_pf.cpp (ReplaceFirewallObjectsODst::processNext): + fixes #1397 PF compiler fix: destination nat rule with fw object + in ODst should skip "on intf" + * NATCompiler_ipt.cpp (AssignInterface::processNext): fixes #1403 refs #1150 "Using ip address of wrong interface" is broken in v4.0. This effectively rolls back change r2437. With no "Interface" column diff --git a/src/pflib/NATCompiler_pf.cpp b/src/pflib/NATCompiler_pf.cpp index 9f1e6cdca..6364a9c98 100644 --- a/src/pflib/NATCompiler_pf.cpp +++ b/src/pflib/NATCompiler_pf.cpp @@ -695,6 +695,12 @@ bool NATCompiler_pf::AssignInterface::processNext() NATCompiler_pf *pf_comp=dynamic_cast(compiler); NATRule *rule=getNext(); if (rule==NULL) return false; + if (rule->getInterfaceStr() != "") + { + tmp_queue.push_back(rule); + return true; + } + switch ( rule->getRuleType() ) { case NATRule::SNAT: @@ -747,13 +753,13 @@ bool NATCompiler_pf::ReplaceFirewallObjectsODst::processNext() list cl; RuleElementODst *rel; - Address *obj=NULL; - - rel=rule->getODst(); assert(rel); - obj=compiler->getFirstODst(rule); assert(obj); - - if (obj->getId()==compiler->getFwId() ) { + Address *obj=NULL; + rel = rule->getODst(); assert(rel); + obj =compiler->getFirstODst(rule); assert(obj); + + if (obj->getId()==compiler->getFwId() ) + { list l2=compiler->fw->getByType(Interface::TYPENAME); for (list::iterator i=l2.begin(); i!=l2.end(); ++i) { Interface *interface_=Interface::cast(*i); @@ -768,14 +774,19 @@ bool NATCompiler_pf::ReplaceFirewallObjectsODst::processNext() if (! interface_->isLoopback() ) cl.push_back(interface_); } - if ( ! cl.empty() ) { + if ( ! cl.empty() ) + { rel->clearChildren(); - for (FWObject::iterator i1=cl.begin(); i1!=cl.end(); ++i1) { rel->addRef( *i1 ); } } +/* + * update for ticket 1397 + * If firewall object is in ODst, do not assign the rule to any interface + */ + rule->setInterfaceStr("nil"); } return true;