From a88be42a73048c6833cc6915caac2e141169ab26 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sun, 14 Feb 2010 07:22:12 -0800 Subject: [PATCH] Fix for OLD_HL_MATCH. Signed-off-by: Tom Eastep --- Shorewall/lib.base | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Shorewall/lib.base b/Shorewall/lib.base index 9c97eb307..5b46d4017 100644 --- a/Shorewall/lib.base +++ b/Shorewall/lib.base @@ -956,7 +956,7 @@ determine_capabilities() { qt $IPTABLES -A $chain -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1000:1500 -j ACCEPT && TCPMSS_MATCH=Yes qt $IPTABLES -A $chain -m hashlimit --hashlimit-upto 4 --hashlimit-burst 5 --hashlimit-name $chain --hashlimit-mode dstip -j ACCEPT && HASHLIMIT_MATCH=Yes if [ -z "$HASHLIMIT_MATCH" ]; then - qt $IPTABLES -A $chain -m hashlimit --hashlimit 4 --hashlimit-burst 5 --hashlimit-name $chain --hashlimit-mode dstip -j ACCEPT && NEW_HL_MATCH=Yes + qt $IPTABLES -A $chain -m hashlimit --hashlimit 4 --hashlimit-burst 5 --hashlimit-name $chain --hashlimit-mode dstip -j ACCEPT && OLD_HL_MATCH=Yes HASHLIMIT_MATCH=$OLD_HL_MATCH fi qt $IPTABLES -A $chain -j NFQUEUE --queue-num 4 && NFQUEUE_TARGET=Yes