From 01af0eb020052f29b63f6b6024352f65fb153733 Mon Sep 17 00:00:00 2001
From: teastep <teastep@fbd18981-670d-0410-9b5c-8dc0c1a9a2bb>
Date: Thu, 26 Apr 2007 16:56:04 +0000
Subject: [PATCH] Fix another iprange bug in generate_matrix()

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@6121 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
---
 Shorewall-perl/Shorewall/Rules.pm | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/Shorewall-perl/Shorewall/Rules.pm b/Shorewall-perl/Shorewall/Rules.pm
index ddfc8e153..efa86d67a 100644
--- a/Shorewall-perl/Shorewall/Rules.pm
+++ b/Shorewall-perl/Shorewall/Rules.pm
@@ -1458,7 +1458,7 @@ sub generate_matrix() {
 		    my $ipsec_in_match  = match_ipsec_in  $zone , $hostref;
 		    my $ipsec_out_match = match_ipsec_out $zone , $hostref;
 		    for my $net ( @{$hostref->{hosts}} ) {
-			my $dest   = match_dest_net   $net;
+			my $dest   = match_dest_net $net;
 
 			if ( $chain1 ) {
 			    if ( @$exclusions ) {
@@ -1629,7 +1629,6 @@ sub generate_matrix() {
 			my $chain3ref = $filter_table->{forward_chain $interface};
 			for my $hostref ( @$arrayref ) {
 			    for my $net ( @{$hostref->{hosts}} ) {
-				my $source_match = match_source_net $net;
 				for my $type1ref ( values %$dest_hosts_ref ) {
 				    for my $interface1 ( keys %$type1ref ) {
 					my $array1ref = $type1ref->{$interface1};
@@ -1637,9 +1636,12 @@ sub generate_matrix() {
 					    my $ipsec_out_match = match_ipsec_out $zone1 , $host1ref;
 					    for my $net1 ( @{$host1ref->{hosts}} ) {
 						unless ( $interface eq $interface1 && $net eq $net1 && ! $host1ref->{options}{routeback} ) {
+						    #
+						    # We have to defer evaluation of the source net match to accomodate systems without $capabilities{KLUDEFREE};
+						    #
 						    add_rule
 							$chain3ref ,
-							join( '', "-o $interface1 ", $source_match, match_dest_net($net1), $ipsec_out_match, "-j $chain" );
+							join( '', "-o $interface1 ", match_source_net($net), match_dest_net($net1), $ipsec_out_match, "-j $chain" );
 						}
 					    }
 					}