From f4102417ff85a41a5378566b9ca5b978b413c7b7 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sun, 17 Jan 2010 08:15:14 -0800 Subject: [PATCH] Shorewall::Config changes for TPROXY from 4.5 Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Config.pm | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index 3ffff3091..76424b1ee 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -244,6 +244,7 @@ our %capdesc = ( NAT_ENABLED => 'NAT', IPMARK_TARGET => 'IPMARK Target', PERSISTENT_SNAT => 'Persistent SNAT', OLD_HL_MATCH => 'Old Hash Limit Match', + TPROXY_TARGET => 'TPROXY Target', CAPVERSION => 'Capability Version', KERNELVERSION => 'Kernel Version', ); @@ -642,6 +643,7 @@ sub initialize( $ ) { GOTO_TARGET => undef, LOGMARK_TARGET => undef, IPMARK_TARGET => undef, + TPROXY_TARGET => undef, LOG_TARGET => 1, # Assume that we have it. PERSISTENT_SNAT => undef, OLD_HL_MATCH => undef, @@ -2142,6 +2144,7 @@ sub determine_capabilities( $ ) { $capabilities{CLASSIFY_TARGET} = qt1( "$iptables -t mangle -A $sillyname -j CLASSIFY --set-class 1:1" ); $capabilities{IPMARK_TARGET} = qt1( "$iptables -t mangle -A $sillyname -j IPMARK --addr src" ); + $capabilities{TPROXY_TARGET} = qt1( "$iptables -t mangle -A $sillyname -p tcp -j TPROXY --on-port 0 --tproxy-mark 1" ); qt1( "$iptables -t mangle -F $sillyname" ); qt1( "$iptables -t mangle -X $sillyname" );