DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

[server] allow FORWARD_ALL to control whether FORCE_NAT is required

Browse Source
This commit is contained in:
Michael Rash
2015-04-19 07:11:10 -07:00
parent 0ecc2d2333
commit 68db4b77a5
4 changed files with 28 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/access.c
+2 -2
View File
@@ -1142,14 +1142,14 @@ acc_data_is_valid(fko_srv_options_t *opts, struct passwd *user_pw, acc_stanza_t
if((acc->force_snat == 1 || acc->force_masquerade == 1)
&& acc->force_nat == 0)
{
if(acc->disable_dnat == 1)
if(acc->forward_all == 1)
{
add_acc_force_nat(opts, acc, "0.0.0.0 0");
}
else
{
log_msg(LOG_ERR,
"[*] FORCE_SNAT/FORCE_MASQUERADE requires either FORCE_NAT or DISABLE_DNAT: '%s'",
"[*] FORCE_SNAT/FORCE_MASQUERADE requires either FORCE_NAT or FORWARD_ALL: '%s'",
acc->source
);
return(0);
test/conf/open_ports_force_masq_access.conf
+1
View File
@@ -3,4 +3,5 @@ OPEN_PORTS udp/6001, tcp/22, tcp/80, tcp/12345
KEY fwknoptest
FW_ACCESS_TIMEOUT 3
FORCE_MASQUERADE Y
FORWARD_ALL Y
DISABLE_DNAT Y
test/tests/basic_operations.pl
+23 -5
View File
@@ -3075,13 +3075,31 @@
{
'category' => 'basic operations',
'subcategory' => 'server',
'detail' => 'FORCE_SNAT -> FORCE_NAT/DISABLE_DNAT',
'detail' => 'FORCE_SNAT -> FORCE_NAT/FORWARD_ALL',
'function' => \&generic_exec,
'cmdline' => qq/$fwknopdCmd -c $cf{"${fw_conf_prefix}_nat"} -a $cf{'require_force_nat_access'} / .
"-d $default_digest_file -p $default_pid_file $intf_str --exit-parse-config",
'positive_output_matches' => [qr/requires either FORCE_NAT or DISABLE_DNAT/i],
'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/i],
'exec_err' => $YES,
},
{
'category' => 'basic operations',
'subcategory' => 'server',
'detail' => 'FORCE_MASQUERADE -> FORCE_NAT/FORWARD_ALL',
'function' => \&server_conf_files,
'fwknopd_cmdline' => "$server_rewrite_conf_files --exit-parse-config",
'exec_err' => $YES,
'server_access_file' => [
'SOURCE any',
'KEY testtest',
'FORCE_MASQUERADE Y'
],
'server_conf_file' => [
"ENABLE_${FW_PREFIX}_FORWARDING Y;",
"ENABLE_${FW_PREFIX}_SNAT Y;"
],
'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/i],
},
{
'category' => 'basic operations',
@@ -3675,7 +3693,7 @@
'server_conf_file' => [
"ENABLE_${FW_PREFIX}_FORWARDING Y"
],
'positive_output_matches' => [qr/requires either FORCE_NAT or DISABLE_DNAT/],
'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/],
},
{
'category' => 'basic operations',
@@ -3688,7 +3706,7 @@
'SOURCE any',
'KEY testtest',
'FORCE_SNAT 1.2.3.4',
'DISABLE_DNAT Y'
'FORWARD_ALL Y'
],
'server_conf_file' => [
"ENABLE_${FW_PREFIX}_FORWARDING Y"
@@ -3711,7 +3729,7 @@
'server_conf_file' => [
"ENABLE_${FW_PREFIX}_FORWARDING Y"
],
'positive_output_matches' => [qr/requires either FORCE_NAT or DISABLE_DNAT/],
'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/],
},
{
test/tests/rijndael.pl
+2 -3
View File
@@ -860,9 +860,8 @@
qq/-a $cf{'open_ports_force_masq_access'} / .
"-d $default_digest_file -p $default_pid_file $intf_str",
'server_positive_output_matches' => [
qr/FWKNOP_FORWARD\s.*dport\s22\s/,
qr/\*\/\sto\:$internal_nat_host\:22/i,
qr/MASQUERADE\s.*to\-ports/,
qr/FWKNOP_FORWARD\s.*0.0.0.0\s/,
qr/MASQUERADE\s.*all/,
],
'no_ip_check' => 1,
'fw_rule_created' => $NEW_RULE_REQUIRED,