holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Correct handling of a zone with two interfaces

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2016-04-11 10:32:26 -07:00
parent 3028dafbac
commit 2cf3706864
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Shorewall/Perl/Shorewall/Misc.pm
View File

@ -1838,12 +1838,14 @@ sub add_output_jumps( $$$$$$$$ ) {
my $use_output = 0;
my @dest = imatch_dest_net $net;
my @ipsec_out_match = match_ipsec_out $zone , $hostref;
my @zone_interfaces = keys %{zone_interfaces( $zone )};
if ( @vservers || use_output_chain( $interface, $interfacechainref ) || ( @{$interfacechainref->{rules}} && ! $chain1ref ) ) {
if ( @vservers || use_output_chain( $interface, $interfacechainref ) || ( @{$interfacechainref->{rules}} && ! $chain1ref ) || @zone_interfaces > 1 ) {
#
# - There are vserver zones (so OUTPUT will have multiple source; or
# - We must use the interface output chain; or
# - There are rules in the interface chain and none in the rules chain
# - The zone has multiple interfaces
#
# In any of these cases use the inteface output chain
#
@ -1860,7 +1862,7 @@ sub add_output_jumps( $$$$$$$$ ) {
unless $output_jump_added{$interface}++;
} else {
#
# Not a bridge -- match the input interface
# Not a bridge -- match the output interface
#
add_ijump_extended $filter_table->{OUTPUT}, j => $outputref, $origin, imatch_dest_dev( $interface ) unless $output_jump_added{$interface}++;
}