holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Correct handling of ORIGDEST with OLD_CONNTRACK_MATCH

Browse Source 
- Also correct detection of OLD_CONNTRACK_MATCH in shorewall6

Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2020-02-25 13:08:58 -08:00
parent f4e6d2fa56
commit 387b861759
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
2 changed files with 27 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -1143,16 +1143,30 @@ sub set_rule_option( $$$ ) {
# #
# Consider each subtype as a separate type # Consider each subtype as a separate type
# #
my ( $invert, $subtype, $val, $rest ) = split ' ', $value; if ( have_capability( 'OLD_CONNTRACK_MATCH' ) ) {
my ( $subtype, $invert, $val, $rest ) = split ' ', $value;
if ( $invert eq '!' ) { if ( $invert eq '!' ) {
assert( ! supplied $rest ); assert( ! supplied $rest );
$option = join( ' ', $option, $invert, $subtype ); $option = join( ' ', $option, $subtype );
$value = $val; $value = join( ' ', $invert, $val );
} else {
assert( ! supplied $val );
$option = join( ' ', $invert , $option );
$value = $invert;
}
} else { } else {
assert( ! supplied $val ); my ( $invert, $subtype, $val, $rest ) = split ' ', $value;
$option = join( ' ', $option, $invert );
$value = $subtype; if ( $invert eq '!' ) {
assert( ! supplied $rest );
$option = join( ' ', $option, $invert, $subtype );
$value = $val;
} else {
assert( ! supplied $val );
$option = join( ' ', $option, $invert );
$value = $subtype;
}
} }
$opttype = EXCLUSIVE; $opttype = EXCLUSIVE;

6
Shorewall/Perl/Shorewall/Config.pm
View File

@ -4603,7 +4603,11 @@ sub New_Conntrack_Match() {
} }
sub Old_Conntrack_Match() { sub Old_Conntrack_Match() {
! qt1( "$iptables $iptablesw -A $sillyname -m conntrack ! --ctorigdst 1.2.3.4" ); if ( $family == F_IPV4 ) {
! qt1( "$iptables $iptablesw -A $sillyname -m conntrack ! --ctorigdst 1.2.3.4" );
} else {
! qt1( "$iptables $iptablesw -A $sillyname -m conntrack ! --ctorigdst ::1" );
}
} }
sub Multiport() { sub Multiport() {