holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Clear the connection mark in tunneled packets from tracked providers

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2018-01-09 14:51:57 -08:00
parent 6badf3ce1a
commit 62c6411cb0
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Shorewall/Perl/Shorewall/Providers.pm
View File

@ -161,6 +161,15 @@ sub setup_route_marking() {
add_ijump_extended $mangle_table->{PREROUTING} , j => $chainref, $origin, i => $physical, mark => "--mark 0/$mask";
add_ijump_extended $mangle_table->{PREROUTING} , j => $chainref1, $origin, i => "! $physical", mark => "--mark $mark/$mask";
add_ijump_extended $mangle_table->{OUTPUT} , j => $chainref2, $origin, mark => "--mark $mark/$mask";
if ( have_ipsec ) {
if ( have_capability( 'MARK_ANYWHERE' ) ) {
add_ijump_extended $filter_table->{forward_chain($interface)}, j => 'CONNMARK', $origin, targetopts => "--set-mark 0${exmask}", , state_imatch('NEW'), policy => '--dir in --pol ipsec';
} elsif ( have_capability( 'MANGLE_FORWARD' ) ) {
add_ijump_extended $mangle_table->{FORWARD}, j => 'CONNMARK', $origin, targetopts => "--set-mark 0${exmask}", i => $physical, state_imatch('NEW'), policy => '--dir in --pol ipsec';
}
}
$marked_interfaces{$interface} = 1;
}