
#-----------------------------------------------------------------------
# Copyright (C) 2000-2001, Jean-Sebastien Morisset <jsmoriss@mvlan.net>
#-----------------------------------------------------------------------
# $Id: cross_interface_access.sh,v 1.7 2001/11/25 18:36:04 jsmoriss Exp $
#-----------------------------------------------------------------------
#  $RCSfile: cross_interface_access.sh,v $
#   $Author: jsmoriss $
# $Revision: 1.7 $
#     $Date: 2001/11/25 18:36:04 $
#   $Locker:  $ 
#     $Name:  $
#-----------------------------------------------------------------------
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by 
# the Free Software Foundation <http://www.gnu.org/copyleft/gpl.txt>.
# 
# This program is distributed in the hope that it will be useful, but
# WITHOUT ANY WARRANTY; without even the implied warranty of 
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# General Public License (LICENSE file in archive) for more details.
#
#-----------------------------------------------------------------------
# README
#-----------------------------------------------------------------------
#
# A bourne shell function used by rcf; a very secure, fast, and complete
# firewall for linux <http://jsmoriss.mvlan.net/linux/rcf.html>.
#
# When packets come in on an interface, but their destination is the IP
# of another interface, send the packet to the destination interface's 
# input chain. This prevents one interface's input rules from over-
# riding the access of another.
#
#-----------------------------------------------------------------------
# FUNCTION
#-----------------------------------------------------------------------

Cross_Interface_Access () {

	# private/mz/dmz -> private/mz/dmz/public
	for FIRST_INTERFACE in $PRIVATE_INTERFACES $MZ_INTERFACES $DMZ_INTERFACES
	do
		for SECOND_INTERFACE in $PRIVATE_INTERFACES $MZ_INTERFACES $DMZ_INTERFACES $PUBLIC_INTERFACES
		do
			Cross_Interface_Access_Chain
		done
    done

	# public -> dmz/public
	for FIRST_INTERFACE in $PUBLIC_INTERFACES
	do
		for SECOND_INTERFACE in $DMZ_INTERFACES $PUBLIC_INTERFACES
		do
			Cross_Interface_Access_Chain
		done
	done
}

Cross_Interface_Access_Chain () {

	if [ "`Match_Interface ALL $FIRST_INTERFACE`" -o \
	     "`Match_Interface ALL $SECOND_INTERFACE`" ]
	then

		Get_Interface_Vars $FIRST_INTERFACE FIRST
		Get_Interface_Vars $SECOND_INTERFACE SECOND

		if [ "$FIRST_VIRTUAL" = "no" \
			-a "$FIRST_IPSEC" = "no" \
			-a "$SECOND_IPSEC" = "no" \
			-a "$FIRST_DEVICE" != "$SECOND_DEVICE" \
			-a "$FIRST_IPADDR" != "$SECOND_IPADDR" ]
		then
			echo "Inserting Jump $FIRST_INCHAIN -> $SECOND_INCHAIN for $ANY -> $SECOND_IPADDR $LOG_MSG"
			ipchains -I $FIRST_INCHAIN -j $SECOND_INCHAIN -s $ANY -d $SECOND_IPADDR $LOG
		fi
	fi
}

