diff --git a/build_num b/build_num index 6bcd078b9..5b435eb62 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 2552 +#define BUILD_NUM 2553 diff --git a/doc/ChangeLog b/doc/ChangeLog index 5bd0bbd13..847dc5390 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,7 +1,11 @@ 2010-02-16 vadim - * ../src/compiler_lib/Configlet.cpp (Configlet::expand): added - basic protection against infinite loops in configlet expansion. + * NATCompiler_pf.cpp (NATCompiler_pf::assignInterfaceToNATRule): + fixes #1240 nat rule should get "on interface" when cluster + interface is used in TSrc. + + * Configlet.cpp (Configlet::expand): added basic protection + against infinite loops in configlet expansion. 2010-02-15 vadim diff --git a/src/pflib/NATCompiler_pf.cpp b/src/pflib/NATCompiler_pf.cpp index deba5c0c3..9f1e6cdca 100644 --- a/src/pflib/NATCompiler_pf.cpp +++ b/src/pflib/NATCompiler_pf.cpp @@ -116,33 +116,6 @@ string NATCompiler_pf::debugPrintRule(libfwbuilder::Rule *r) " (type="+rule->getRuleTypeAsString()+")"; } -bool NATCompiler_pf::assignInterfaceToNATRule(Rule *rule, Address *addr) -{ - if ( (Interface::isA(addr) || IPv4::isA(addr)) && addr->isChildOf(fw)) - { - FWObject *p = addr; - while ( ! Interface::isA(p) ) p=p->getParent(); - Interface *intf = Interface::cast(p); - - // TODO: use replaceFailoverInterfaceInRE to replace cluster interfaces - if (intf->getOptionsObject()->getBool("cluster_interface")) - { - string base_interface_id = intf->getOptionsObject()->getStr("base_interface_id"); - if (!base_interface_id.empty()) - { - FWObject *base_interface = dbcopy->findInIndex( - FWObjectDatabase::getIntId(base_interface_id)); - if (base_interface) intf = Interface::cast(base_interface); - } - } - - rule->setInterfaceId(intf->getId()); - rule->setInterfaceStr(intf->getName()); - return true; - } - return false; -} - bool NATCompiler_pf::NATRuleType::processNext() { NATRule *rule=getNext(); if (rule==NULL) return false; @@ -691,31 +664,37 @@ bool NATCompiler_pf::splitForTSrc::processNext() } +bool NATCompiler_pf::assignInterfaceToNATRule(Rule *rule, Address *addr) +{ + if (Interface::isA(addr) || IPv4::isA(addr)) + { + FWObject *p = addr; + while ( p && ! Interface::isA(p) ) p = p->getParent(); + Interface *intf = Interface::cast(p); + + if (intf && intf->isFailoverInterface()) + { + FailoverClusterGroup *fg = FailoverClusterGroup::cast( + intf->getFirstByType(FailoverClusterGroup::TYPENAME)); + if (fg) + intf = fg->getInterfaceForMemberFirewall(fw); + } + + if (intf && intf->isChildOf(fw)) + { + rule->setInterfaceId(intf->getId()); + rule->setInterfaceStr(intf->getName()); + return true; + } + } + return false; +} + bool NATCompiler_pf::AssignInterface::processNext() { NATCompiler_pf *pf_comp=dynamic_cast(compiler); NATRule *rule=getNext(); if (rule==NULL) return false; - if (regular_interfaces.empty()) - { - int n=0; - list l2=compiler->fw->getByType(Interface::TYPENAME); - for (list::iterator i=l2.begin(); i!=l2.end(); ++i) - { - Interface *iface=Interface::cast(*i); - assert(iface); - - if (iface->isLoopback() || - iface->isUnnumbered() || - iface->isBridgePort()) continue; - - if (n) regular_interfaces+=","; - regular_interfaces+= iface->getName(); - n++; - } - if (n>1) regular_interfaces="{ "+regular_interfaces+" }"; - } - switch ( rule->getRuleType() ) { case NATRule::SNAT: diff --git a/test/pf/cluster-tests.fwb b/test/pf/cluster-tests.fwb index a41912afc..d218ddc1d 100644 --- a/test/pf/cluster-tests.fwb +++ b/test/pf/cluster-tests.fwb @@ -1,6 +1,418 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + established + + established + -m state --state ESTABLISHED,RELATED + + + + established + + established + -m state --state ESTABLISHED,RELATED + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -m record_rpc + + + + + + + + + + -m irc + + + + + + + + + + -m psd --psd-weight-threshold 5 --psd-delay-threshold 10000 + + + + + + + + + + -m string --string test_pattern + + + + + + + + + + -m talk + + + + + + + + + + + + + + + + + + @@ -1204,7 +1616,7 @@ - + @@ -1269,7 +1681,70 @@ - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1290,7 +1765,7 @@ - + @@ -1311,7 +1786,7 @@ - + @@ -2130,30 +2605,4 @@ - - - - - - - - - - - - - - - - - - - - - - - - - -