From f768d6058ec3c5079b225e38de03cd51f9fa68f5 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Fri, 11 Nov 2011 07:28:35 -0800 Subject: [PATCH] More corrections to wildcard interfaces Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Misc.pm | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/Shorewall/Perl/Shorewall/Misc.pm b/Shorewall/Perl/Shorewall/Misc.pm index d6e6c3334..39b24d23a 100644 --- a/Shorewall/Perl/Shorewall/Misc.pm +++ b/Shorewall/Perl/Shorewall/Misc.pm @@ -1170,6 +1170,7 @@ sub add_interface_jumps { our %input_jump_added; our %output_jump_added; our %forward_jump_added; + my $lo_jump_added = 0; # # Add Nat jumps # @@ -1195,14 +1196,14 @@ sub add_interface_jumps { # # Add the jumps to the interface chains from filter FORWARD, INPUT, OUTPUT # - add_ijump $filter_table->{INPUT} , j => 'ACCEPT', i => 'lo'; - for my $interface ( grep $_ ne '%vserver%', @_ ) { my $forwardref = $filter_table->{forward_chain $interface}; my $inputref = $filter_table->{input_chain $interface}; my $outputref = $filter_table->{output_chain $interface}; my $interfaceref = find_interface($interface); + add_ijump $filter_table->{INPUT} , j => 'ACCEPT', i => 'lo' if $interfaceref->{physical} eq '+' && ! $lo_jump_added++; + if ( $interfaceref->{options}{port} ) { my $bridge = $interfaceref->{bridge}; add_ijump ( $filter_table->{forward_chain $bridge}, @@ -1230,15 +1231,17 @@ sub add_interface_jumps { } else { add_ijump ( $filter_table->{FORWARD}, j => 'ACCEPT', imatch_source_dev( $interface) , imatch_dest_dev( $interface) ) unless $interfaceref->{nets} || ! $interfaceref->{options}{bridge}; - add_ijump( $filter_table->{FORWARD} , j => $forwardref , imatch_source_dev( $interface ) ) unless $forward_jump_added{$interface}++ || ! use_forward_chain $interface, $forwardref; - add_ijump( $filter_table->{INPUT} , j => $inputref , imatch_source_dev( $interface ) ) unless $input_jump_added{$interface}++ || ! use_input_chain $interface, $inputref; + add_ijump( $filter_table->{FORWARD} , j => $forwardref , imatch_source_dev( $interface ) ) if use_forward_chain( $interface, $forwardref ) && ! $forward_jump_added{$interface}++; + add_ijump( $filter_table->{INPUT} , j => $inputref , imatch_source_dev( $interface ) ) if use_input_chain( $interface, $inputref ) && ! $input_jump_added{$interface}++; - unless ( $output_jump_added{$interface}++ || ! use_output_chain $interface, $outputref ) { - add_ijump $filter_table->{OUTPUT} , j => $outputref , imatch_dest_dev( $interface ) unless get_interface_option( $interface, 'port' ); + if ( use_output_chain $interface, $outputref ) { + add_ijump $filter_table->{OUTPUT} , j => $outputref , imatch_dest_dev( $interface ) unless get_interface_option( $interface, 'port' ) || $output_jump_added{$interface}++; } } } + add_ijump $filter_table->{INPUT} , j => 'ACCEPT', i => 'lo' unless $lo_jump_added++; + handle_loopback_traffic; }