From: Steven Barth <steven@midlink.org>
Date: Thu, 10 Apr 2014 12:26:57 +0000 (+0200)
Subject: nat: allow ACCEPT-target to explicitely disable NAT
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=6907da00bbf0a5c6778f3ca8c9646bdc04119705;p=oweals%2Ffirewall3.git

nat: allow ACCEPT-target to explicitely disable NAT

Signed-off-by: Steven Barth <steven@midlink.org>
---

diff --git a/snats.c b/snats.c
index 00fd57c..11bcc06 100644
--- a/snats.c
+++ b/snats.c
@@ -179,7 +179,8 @@ fw3_load_snats(struct fw3_state *state, struct uci_package *p)
 			warn_elem(e, "has no target specified, defaulting to MASQUERADE");
 			snat->target = FW3_FLAG_MASQUERADE;
 		}
-		else if (snat->target < FW3_FLAG_SNAT || snat->target > FW3_FLAG_MASQUERADE)
+		else if (snat->target != FW3_FLAG_ACCEPT && snat->target != FW3_FLAG_SNAT &&
+				snat->target != FW3_FLAG_MASQUERADE)
 		{
 			warn_elem(e, "has invalid target specified, defaulting to MASQUERADE");
 			snat->target = FW3_FLAG_MASQUERADE;
@@ -192,15 +193,15 @@ fw3_load_snats(struct fw3_state *state, struct uci_package *p)
 			fw3_free_snat(snat);
 			continue;
 		}
-		else if (snat->target == FW3_FLAG_MASQUERADE && snat->ip_snat.set)
+		else if (snat->target != FW3_FLAG_SNAT && snat->ip_snat.set)
 		{
-			warn_elem(e, "must not use 'snat_ip' for MASQUERADE");
+			warn_elem(e, "must not use 'snat_ip' for non-SNAT");
 			fw3_free_snat(snat);
 			continue;
 		}
-		else if (snat->target == FW3_FLAG_MASQUERADE && snat->port_snat.set)
+		else if (snat->target != FW3_FLAG_SNAT && snat->port_snat.set)
 		{
-			warn_elem(e, "must not use 'snat_port' for MASQUERADE");
+			warn_elem(e, "must not use 'snat_port' for non-SNAT");
 			fw3_free_snat(snat);
 			continue;
 		}
@@ -258,6 +259,10 @@ set_target(struct fw3_ipt_rule *r, struct fw3_snat *snat,
 		fw3_ipt_rule_target(r, "SNAT");
 		fw3_ipt_rule_addarg(r, false, "--to-source", buf);
 	}
+	else if (snat->target == FW3_FLAG_ACCEPT)
+	{
+		fw3_ipt_rule_target(r, "ACCEPT");
+	}
 	else
 	{
 		fw3_ipt_rule_target(r, "MASQUERADE");