diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index 181f84f80..f40758bca 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -2122,11 +2122,11 @@ sub set_action_param( $$ ) { } # -# Expand Shell Variables in the passed buffer using %params and @actparms +# Expand Shell Variables in the passed buffer using @actparms, %params, %shorewallrc and %config, # sub expand_variables( \$ ) { my ( $lineref, $count ) = ( $_[0], 0 ); - # $1 $2 $3 - $4 + # $1 $2 $3 - $4 while ( $$lineref =~ m( ^(.*?) \$({)? (\w+) (?(2)}) (.*)$ )x ) { my ( $first, $var, $rest ) = ( $1, $3, $4); @@ -2164,7 +2164,7 @@ sub handle_first_entry() { } # -# Read a line from the current include stack. +# Read a line from the current include stack. Based on the passed options, it will conditionally: # # - Ignore blank or comment-only lines. # - Remove trailing comments. diff --git a/Shorewall/Perl/Shorewall/Misc.pm b/Shorewall/Perl/Shorewall/Misc.pm index 0262c2591..1c5885254 100644 --- a/Shorewall/Perl/Shorewall/Misc.pm +++ b/Shorewall/Perl/Shorewall/Misc.pm @@ -1483,7 +1483,7 @@ sub generate_matrix() { next if @zones <= 2 && ! $zoneref->{complex}; # - # Complex zone or we have more than one non-firewall zone -- process_rules created a zone forwarding chain + # Complex zone or we have more than one non-firewall zone -- Shorewall::Rules::classic_blacklist created a zone forwarding chain # my $frwd_ref = $filter_table->{zone_forward_chain( $zone )}; @@ -1509,6 +1509,9 @@ sub generate_matrix() { copy_rules( $sourcechainref, $frwd_ref, 1 ) unless $ipsec_jump_added{$zone}++; $sourcechainref = $filter_table->{FORWARD}; } elsif ( $interfaceref->{options}{port} ) { + # + # The forwarding chain for a bridge with ports is always used + # add_ijump( $filter_table->{ forward_chain $interfaceref->{bridge} } , j => $sourcechainref , imatch_source_dev( $interface , 1 ) ) @@ -1518,6 +1521,9 @@ sub generate_matrix() { } } else { if ( $interfaceref->{options}{port} ) { + # + # The forwarding chain for a bridge with ports is always used + # $sourcechainref = $filter_table->{ forward_chain $interfaceref->{bridge} }; @interfacematch = imatch_source_dev $interface, 1; } else {