forked from extern/shorewall_code
Add a new dynamic chain for ipsec zones
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1817 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
f263d7aabc
commit
a431c86df0
@ -6277,7 +6277,15 @@ activate_rules()
|
|||||||
if [ -n "$POLICY_MATCH" ]; then
|
if [ -n "$POLICY_MATCH" ]; then
|
||||||
eval is_ipsec=\$${zone}_is_ipsec
|
eval is_ipsec=\$${zone}_is_ipsec
|
||||||
|
|
||||||
[ -n "$is_ipsec" ] && eval source_hosts=\$${zone}_hosts || eval source_hosts=\$${zone}_ipsec_hosts
|
if [ -n "$is_ipsec" ]; then
|
||||||
|
eval source_hosts=\$${zone}_hosts
|
||||||
|
if [ -n "$DYNAMIC_ZONES" ]; then
|
||||||
|
createchain ${zone}_dynf No
|
||||||
|
run_iptables -A $frwd_chain -j ${zone}_dynf
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
eval source_hosts=\$${zone}_ipsec_hosts
|
||||||
|
fi
|
||||||
|
|
||||||
for host in $source_hosts; do
|
for host in $source_hosts; do
|
||||||
interface=${host%%:*}
|
interface=${host%%:*}
|
||||||
@ -6802,7 +6810,7 @@ add_to_zone() # $1...${n-1} = <interface>[:<hosts>] $n = zone
|
|||||||
|
|
||||||
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
|
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
|
||||||
if is_ipsec_host $z1 $h; then
|
if is_ipsec_host $z1 $h; then
|
||||||
do_iptables -I ${z1}_frwd -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
|
do_iptables -A ${z1}_dynf -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
|
||||||
else
|
else
|
||||||
do_iptables -A $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
|
do_iptables -A $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
|
||||||
fi
|
fi
|
||||||
@ -6977,7 +6985,7 @@ delete_from_zone() # $1 = <interface>[:<hosts>] $2 = zone
|
|||||||
|
|
||||||
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
|
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
|
||||||
if is_ipsec_host $z1 $h; then
|
if is_ipsec_host $z1 $h; then
|
||||||
qt_iptables -D ${z1}_frwd -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain
|
qt_iptables -D ${z1}_dynf -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain
|
||||||
else
|
else
|
||||||
qt_iptables -D $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain
|
qt_iptables -D $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain
|
||||||
fi
|
fi
|
||||||
|
Loading…
Reference in New Issue
Block a user