From 68db4b77a5c0c87682160e212a81acb4e682d8ee Mon Sep 17 00:00:00 2001
From: Michael Rash <mbr@cipherdyne.org>
Date: Sun, 19 Apr 2015 07:11:10 -0700
Subject: [PATCH] [server] allow FORWARD_ALL to control whether FORCE_NAT is
 required

---
 server/access.c                             |  4 +--
 test/conf/open_ports_force_masq_access.conf |  1 +
 test/tests/basic_operations.pl              | 28 +++++++++++++++++----
 test/tests/rijndael.pl                      |  5 ++--
 4 files changed, 28 insertions(+), 10 deletions(-)

diff --git a/server/access.c b/server/access.c
index 532dc969..38d7aaa3 100644
--- a/server/access.c
+++ b/server/access.c
@@ -1142,14 +1142,14 @@ acc_data_is_valid(fko_srv_options_t *opts, struct passwd *user_pw, acc_stanza_t
     if((acc->force_snat == 1 || acc->force_masquerade == 1)
             && acc->force_nat == 0)
     {
-        if(acc->disable_dnat == 1)
+        if(acc->forward_all == 1)
         {
             add_acc_force_nat(opts, acc, "0.0.0.0 0");
         }
         else
         {
             log_msg(LOG_ERR,
-                    "[*] FORCE_SNAT/FORCE_MASQUERADE requires either FORCE_NAT or DISABLE_DNAT: '%s'",
+                    "[*] FORCE_SNAT/FORCE_MASQUERADE requires either FORCE_NAT or FORWARD_ALL: '%s'",
                     acc->source
             );
             return(0);
diff --git a/test/conf/open_ports_force_masq_access.conf b/test/conf/open_ports_force_masq_access.conf
index 37f75f12..8cf013dd 100644
--- a/test/conf/open_ports_force_masq_access.conf
+++ b/test/conf/open_ports_force_masq_access.conf
@@ -3,4 +3,5 @@ OPEN_PORTS                  udp/6001, tcp/22, tcp/80, tcp/12345
 KEY                         fwknoptest
 FW_ACCESS_TIMEOUT           3
 FORCE_MASQUERADE            Y
+FORWARD_ALL                 Y
 DISABLE_DNAT                Y
diff --git a/test/tests/basic_operations.pl b/test/tests/basic_operations.pl
index 3b308d93..f4dde2ec 100644
--- a/test/tests/basic_operations.pl
+++ b/test/tests/basic_operations.pl
@@ -3075,13 +3075,31 @@
     {
         'category' => 'basic operations',
         'subcategory' => 'server',
-        'detail'   => 'FORCE_SNAT -> FORCE_NAT/DISABLE_DNAT',
+        'detail'   => 'FORCE_SNAT -> FORCE_NAT/FORWARD_ALL',
         'function' => \&generic_exec,
         'cmdline' =>  qq/$fwknopdCmd -c $cf{"${fw_conf_prefix}_nat"} -a $cf{'require_force_nat_access'} / .
             "-d $default_digest_file -p $default_pid_file $intf_str --exit-parse-config",
-        'positive_output_matches' => [qr/requires either FORCE_NAT or DISABLE_DNAT/i],
+        'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/i],
         'exec_err' => $YES,
     },
+    {
+        'category' => 'basic operations',
+        'subcategory' => 'server',
+        'detail'   => 'FORCE_MASQUERADE -> FORCE_NAT/FORWARD_ALL',
+        'function' => \&server_conf_files,
+        'fwknopd_cmdline' => "$server_rewrite_conf_files --exit-parse-config",
+        'exec_err' => $YES,
+        'server_access_file' => [
+            'SOURCE                  any',
+            'KEY                     testtest',
+            'FORCE_MASQUERADE        Y'
+        ],
+        'server_conf_file' => [
+            "ENABLE_${FW_PREFIX}_FORWARDING       Y;",
+            "ENABLE_${FW_PREFIX}_SNAT             Y;"
+        ],
+        'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/i],
+    },
 
     {
         'category' => 'basic operations',
@@ -3675,7 +3693,7 @@
         'server_conf_file' => [
             "ENABLE_${FW_PREFIX}_FORWARDING      Y"
         ],
-        'positive_output_matches' => [qr/requires either FORCE_NAT or DISABLE_DNAT/],
+        'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/],
     },
     {
         'category' => 'basic operations',
@@ -3688,7 +3706,7 @@
             'SOURCE         any',
             'KEY            testtest',
             'FORCE_SNAT     1.2.3.4',
-            'DISABLE_DNAT   Y'
+            'FORWARD_ALL    Y'
         ],
         'server_conf_file' => [
             "ENABLE_${FW_PREFIX}_FORWARDING      Y"
@@ -3711,7 +3729,7 @@
         'server_conf_file' => [
             "ENABLE_${FW_PREFIX}_FORWARDING      Y"
         ],
-        'positive_output_matches' => [qr/requires either FORCE_NAT or DISABLE_DNAT/],
+        'positive_output_matches' => [qr/requires either FORCE_NAT or FORWARD_ALL/],
     },
 
     {
diff --git a/test/tests/rijndael.pl b/test/tests/rijndael.pl
index 26fd710c..26aab6a6 100644
--- a/test/tests/rijndael.pl
+++ b/test/tests/rijndael.pl
@@ -860,9 +860,8 @@
             qq/-a $cf{'open_ports_force_masq_access'} / .
             "-d $default_digest_file -p $default_pid_file $intf_str",
         'server_positive_output_matches' => [
-            qr/FWKNOP_FORWARD\s.*dport\s22\s/,
-            qr/\*\/\sto\:$internal_nat_host\:22/i,
-            qr/MASQUERADE\s.*to\-ports/,
+            qr/FWKNOP_FORWARD\s.*0.0.0.0\s/,
+            qr/MASQUERADE\s.*all/,
         ],
         'no_ip_check' => 1,
         'fw_rule_created' => $NEW_RULE_REQUIRED,