diff --git a/build_num b/build_num index ff0a0f465..5bc50a4ce 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2021 +#define BUILD_NUM 2022 diff --git a/src/gui/NATRuleOptionsDialog.cpp b/src/gui/NATRuleOptionsDialog.cpp index d5c269f07..deb362126 100644 --- a/src/gui/NATRuleOptionsDialog.cpp +++ b/src/gui/NATRuleOptionsDialog.cpp @@ -101,6 +101,8 @@ void NATRuleOptionsDialog::loadFWObject(FWObject *o) { data.registerOption(m_dialog->ipt_use_snat_instead_of_masq, ropt, "ipt_use_snat_instead_of_masq"); + data.registerOption(m_dialog->ipt_snat_random, ropt, + "ipt_snat_random"); } if (platform=="pf") diff --git a/src/gui/natruleoptionsdialog_q.ui b/src/gui/natruleoptionsdialog_q.ui index 043576ffe..7ab4628cd 100644 --- a/src/gui/natruleoptionsdialog_q.ui +++ b/src/gui/natruleoptionsdialog_q.ui @@ -1,72 +1,71 @@ - - + NATRuleOptionsDialog_q - - + + 0 0 - 609 - 234 + 726 + 333 - + NAT Rule Options - - - - + + + + QFrame::Box - + QFrame::Sunken - + 1 - - - - 2 + + + + 12 - - 2 + + 12 - - + + QFrame::NoFrame - + QFrame::Raised - - + + 2 - + 2 - - - + + + No options are available for this firewall platform - + false - + - + Qt::Vertical - + QSizePolicy::MinimumExpanding - + 20 0 @@ -79,31 +78,41 @@ - - - - - - Normally, if object used to define translated source address is an interface marked as "dynamic", fwbuilder generates NAT rule with target MASQUERADE. However masquerading has problems with policy routing. This option makes fwbuilder use SNAT target instead. + + + + 12 + + + + + Normally, if object used to define translated source address is an interface marked as "dynamic", fwbuilder generates NAT rule with target MASQUERADE. However masquerading has problems with policy routing. This option makes fwbuilder use SNAT target instead. - + true - - - + + + Use SNAT target instead of MASQUERADING for NAT rules with dynamic interfaces - - - + + + + Randomize source port mapping in SNAT rules + + + + + + Qt::Vertical - + 20 81 @@ -113,23 +122,23 @@ - - - + + + 12 - + 12 - + - + Qt::Vertical - + QSizePolicy::Expanding - + 20 20 @@ -137,58 +146,58 @@ - - - - + + + + 0 0 - + Pool type - - + + 12 - + 12 - - - + + + default - + true - - - + + + bitmask - - - + + + random - - - + + + source-hash - - - + + + round-robin @@ -196,15 +205,15 @@ - + - + Qt::Horizontal - + QSizePolicy::Expanding - + 81 20 @@ -212,15 +221,15 @@ - + - + Qt::Vertical - + QSizePolicy::Expanding - + 20 130 @@ -228,22 +237,22 @@ - - - + + + static-port - + - + Qt::Vertical - + QSizePolicy::Fixed - + 20 10 @@ -265,11 +274,11 @@ NATRuleOptionsDialog_q changed() - + 20 20 - + 20 20 @@ -281,11 +290,11 @@ NATRuleOptionsDialog_q changed() - + 20 20 - + 20 20 @@ -297,11 +306,11 @@ NATRuleOptionsDialog_q changed() - + 20 20 - + 20 20 @@ -313,11 +322,11 @@ NATRuleOptionsDialog_q changed() - + 20 20 - + 20 20 @@ -329,11 +338,11 @@ NATRuleOptionsDialog_q changed() - + 20 20 - + 20 20 @@ -345,11 +354,11 @@ NATRuleOptionsDialog_q changed() - + 20 20 - + 20 20 @@ -361,16 +370,32 @@ NATRuleOptionsDialog_q changed() - + 307 108 - + 304 116 + + ipt_snat_random + toggled(bool) + NATRuleOptionsDialog_q + changed() + + + 366 + 123 + + + 362 + 166 + + + changed() diff --git a/src/gui/platforms.cpp b/src/gui/platforms.cpp index b03bbc345..769f2db06 100644 --- a/src/gui/platforms.cpp +++ b/src/gui/platforms.cpp @@ -320,14 +320,12 @@ bool isDefaultNATRuleOptions(FWOptions *opt) QString platform = p->getStr("platform").c_str(); -// if (fwbdebug) -// qDebug(QString("Options object type: %1 platform: %2 pf_pool_type_none: '%3'").arg(opt->getTypeName()).arg(platform).arg(opt->getStr("pf_pool_type_none").c_str())); - if (NATRuleOptions::isA(opt)) { if (platform=="iptables") { - res = !opt->getBool("ipt_use_snat_instead_of_masq"); + res = !opt->getBool("ipt_use_snat_instead_of_masq") && + !opt->getBool("ipt_snat_random"); } if (platform=="pf") diff --git a/src/iptlib/NATCompiler_PrintRule.cpp b/src/iptlib/NATCompiler_PrintRule.cpp index b8f41e1e2..b2f3d668a 100644 --- a/src/iptlib/NATCompiler_PrintRule.cpp +++ b/src/iptlib/NATCompiler_PrintRule.cpp @@ -597,6 +597,8 @@ bool NATCompiler_ipt::PrintRule::processNext() NATRule *rule=getNext(); if (rule==NULL) return false; + FWOptions *ropt = rule->getOptionsObject(); + string chain = rule->getStr("ipt_chain"); if (ipt_comp->chain_usage_counter[chain] == 0) { @@ -693,6 +695,10 @@ bool NATCompiler_ipt::PrintRule::processNext() if (!tsrc->isAny()) cmdout << _printAddr(tsrc, false, true); string ports = _printSNATPorts(tsrv); if (!ports.empty()) cmdout << ":" << ports; + + if (ropt->getBool("ipt_snat_random")) + cmdout << " --random"; + } break; /* diff --git a/src/res/help/en_US/release_notes_3.1.0.html b/src/res/help/en_US/release_notes_3.1.0.html index a1fae52b1..17dc7982f 100644 --- a/src/res/help/en_US/release_notes_3.1.0.html +++ b/src/res/help/en_US/release_notes_3.1.0.html @@ -467,3 +467,6 @@ rule sets of this object rather than in the actual firewalls. configure bridge, bonding and vlan interfaces (see above).

+

+ Added support for option "--random" in SNAT rules +

diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb index e5f86ab81..5f777bca8 100644 --- a/test/ipt/objects-for-regression-tests.fwb +++ b/test/ipt/objects-for-regression-tests.fwb @@ -6527,6 +6527,8 @@ + +