From 2174fdf5bb791ba58a8cf1134856d05d5bf9e4ff Mon Sep 17 00:00:00 2001
From: teastep <teastep@fbd18981-670d-0410-9b5c-8dc0c1a9a2bb>
Date: Thu, 9 Dec 2004 02:58:30 +0000
Subject: [PATCH] Corrections to ipsec and dynamic zones

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1812 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
---
 Shorewall2/firewall | 56 +++++++++++++++++++++++++++++----------------
 1 file changed, 36 insertions(+), 20 deletions(-)

diff --git a/Shorewall2/firewall b/Shorewall2/firewall
index d7db13a62..aa7b0fe5c 100755
--- a/Shorewall2/firewall
+++ b/Shorewall2/firewall
@@ -6772,16 +6772,20 @@ add_to_zone() # $1...${n-1} = <interface>[:<hosts>] $n = zone
 		    do_iptables -A $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j $chain
 		else
 		    source_chain=$(dynamic_fwd $interface)
-		    eval dest_hosts=\"\$${z2}_hosts\"
+		    if is_ipsec_host $z1 $newhost ; then
+			do_iptables -A $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd
+		    else
+			eval dest_hosts=\"\$${z2}_hosts\"
 
-		    for h in $dest_hosts; do
-			iface=${h%%:*}
-			hosts=${h#*:}
-
-			if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
-			    do_iptables -A $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain
-			fi
-		    done
+			for h in $dest_hosts; do
+			    iface=${h%%:*}
+			    hosts=${h#*:}
+			    
+			    if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
+				do_iptables -A $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain
+			    fi
+			done
+		    fi
 		fi
 	    elif [ "$z2" = "$zone" ]; then
 		if [ "$z1" = "$FW" ]; then
@@ -6797,7 +6801,11 @@ add_to_zone() # $1...${n-1} = <interface>[:<hosts>] $n = zone
 			hosts=${h#*:}
 
 			if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
-			    do_iptables -A $(dynamic_fwd $iface) $rulenum $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
+			    if is_ipsec_host $z1 $h; then
+				do_iptables -I ${z1}_frwd $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
+			    else
+				do_iptables -A $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
+			    fi
 			fi
 		    done
 		fi
@@ -6940,18 +6948,26 @@ delete_from_zone() # $1 = <interface>[:<hosts>] $2 = zone
 		    qt_iptables -D $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j $chain
 		else
 		    source_chain=$(dynamic_fwd $interface)
-		    eval dest_hosts=\"\$${z2}_hosts\"
+		    if is_ipsec_host $z1 $newhost ; then
+			do_iptables -D $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd
+		    else
+			eval dest_hosts=\"\$${z2}_hosts\"
 
-		    [ "$z2" = "$zone" ] && dest_hosts="$dest_hosts $hostlist"
+			[ "$z2" = "$zone" ] && dest_hosts="$dest_hosts $hostlist"
 		    
-		    for h in $dest_hosts; do
-			iface=${h%%:*}
-			hosts=${h#*:}
-			
-			if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
-			    qt_iptables -D $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain
-			fi
-		    done
+			for h in $dest_hosts; do
+			    iface=${h%%:*}
+			    hosts=${h#*:}
+			    
+			    if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
+				if is_ipsec_host $z1 $h; then
+				    do_iptables -D ${z1}_frwd $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
+				else
+				    qt_iptables -D $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain
+				fi
+			    fi
+			done
+		    fi
 		fi
 	    elif [ "$z2" = "$zone" ]; then
 		if [ "$z1" = "$FW" ]; then