holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

A better patch to avoid blocking DHCP broadcasts during MAC verification

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2330 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2005-07-13 15:26:51 +00:00
parent ef9d22b647
commit 379b58f628
1 changed files with 1 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Shorewall/firewall
View File

@ -2392,10 +2392,6 @@ setup_mac_lists() {
run_iptables -A $chain -s $address -d 224.0.0.0/4 -j $chain1 run_iptables -A $chain -s $address -d 224.0.0.0/4 -j $chain1
done done
if $(interface_has_option $interface dhcp); then
run_iptables -A $chain -p udp --sport 68 --dport 67 -s 0.0.0.0 -d 255.255.255.255 -j ACCEPT
fi
if [ -n "$MACLIST_LOG_LEVEL" ]; then if [ -n "$MACLIST_LOG_LEVEL" ]; then
log_rule $MACLIST_LOG_LEVEL $chain $MACLIST_DISPOSITION log_rule $MACLIST_LOG_LEVEL $chain $MACLIST_DISPOSITION
fi fi
@ -6697,7 +6693,7 @@ add_common_rules() {
for interface in $interfaces; do for interface in $interfaces; do
if [ -n "$BRIDGING" ]; then if [ -n "$BRIDGING" ]; then
eval is_bridge=\$$(chain_base $interface)_ports is_bridge=$( brctl show $interface 2> /dev/null | grep ^$interface[[:space:]] )
[ -n "$is_bridge" ] && \ [ -n "$is_bridge" ] && \
$IPTABLES -A $(forward_chain $interface) -p udp -o $interface --dport 67:68 -j ACCEPT $IPTABLES -A $(forward_chain $interface) -p udp -o $interface --dport 67:68 -j ACCEPT
fi fi