mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-12 18:54:25 +01:00
A better patch to avoid blocking DHCP broadcasts during MAC verification
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2330 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
ef9d22b647
commit
379b58f628
@ -2392,10 +2392,6 @@ setup_mac_lists() {
|
||||
run_iptables -A $chain -s $address -d 224.0.0.0/4 -j $chain1
|
||||
done
|
||||
|
||||
if $(interface_has_option $interface dhcp); then
|
||||
run_iptables -A $chain -p udp --sport 68 --dport 67 -s 0.0.0.0 -d 255.255.255.255 -j ACCEPT
|
||||
fi
|
||||
|
||||
if [ -n "$MACLIST_LOG_LEVEL" ]; then
|
||||
log_rule $MACLIST_LOG_LEVEL $chain $MACLIST_DISPOSITION
|
||||
fi
|
||||
@ -6697,7 +6693,7 @@ add_common_rules() {
|
||||
|
||||
for interface in $interfaces; do
|
||||
if [ -n "$BRIDGING" ]; then
|
||||
eval is_bridge=\$$(chain_base $interface)_ports
|
||||
is_bridge=$( brctl show $interface 2> /dev/null | grep ^$interface[[:space:]] )
|
||||
[ -n "$is_bridge" ] && \
|
||||
$IPTABLES -A $(forward_chain $interface) -p udp -o $interface --dport 67:68 -j ACCEPT
|
||||
fi
|
||||
|
Loading…
Reference in New Issue
Block a user