+static bool
+check_snat(struct fw3_state *state, struct fw3_snat *snat, struct uci_element *e)
+{
+ if (!snat->enabled)
+ return false;
+
+ if (snat->src.invert)
+ {
+ warn_section("nat", snat, e, "must not have an inverted source");
+ return false;
+ }
+ else if (snat->src.set && !snat->src.any &&
+ !(snat->_src = fw3_lookup_zone(state, snat->src.name)))
+ {
+ warn_section("nat", snat, e, "refers to not existing zone '%s'", snat->src.name);
+ return false;
+ }
+ else if (snat->ipset.set && state->disable_ipsets)
+ {
+ warn_section("nat", snat, e, "skipped due to disabled ipset support");
+ return false;
+ }
+ else if (snat->ipset.set &&
+ !(snat->ipset.ptr = fw3_lookup_ipset(state, snat->ipset.name)))
+ {
+ warn_section("nat", snat, e, "refers to unknown ipset '%s'", snat->ipset.name);
+ return false;
+ }
+
+ if (!check_families(e, snat))
+ return false;
+
+ if (snat->target == FW3_FLAG_UNSPEC)
+ {
+ warn_section("nat", snat, e, "has no target specified, defaulting to MASQUERADE");
+ snat->target = FW3_FLAG_MASQUERADE;
+ }
+ else if (snat->target != FW3_FLAG_ACCEPT && snat->target != FW3_FLAG_SNAT &&
+ snat->target != FW3_FLAG_MASQUERADE)
+ {
+ warn_section("nat", snat, e, "has invalid target specified, defaulting to MASQUERADE");
+ snat->target = FW3_FLAG_MASQUERADE;
+ }
+
+ if (snat->target == FW3_FLAG_SNAT &&
+ !snat->ip_snat.set && !snat->port_snat.set)
+ {
+ warn_section("nat", snat, e, "needs either 'snat_ip' or 'snat_port' for SNAT");
+ return false;
+ }
+ else if (snat->target != FW3_FLAG_SNAT && snat->ip_snat.set)
+ {
+ warn_section("nat", snat, e, "must not use 'snat_ip' for non-SNAT");
+ return false;
+ }
+ else if (snat->target != FW3_FLAG_SNAT && snat->port_snat.set)
+ {
+ warn_section("nat", snat, e, "must not use 'snat_port' for non-SNAT");
+ return false;
+ }
+
+ if (list_empty(&snat->proto))
+ {
+ warn_section("nat", snat, e, "does not specify a protocol, assuming all");
+ fw3_parse_protocol(&snat->proto, "all", true);
+ }
+
+ if (snat->_src)
+ set(snat->_src->flags, FW3_FAMILY_V4, FW3_FLAG_SNAT);
+
+ return true;
+}
+