From c6ffdd67e291ddd4fadb9d4b2d7e009e7d30804b Mon Sep 17 00:00:00 2001
From: Tom Eastep <teastep@shorewall.net>
Date: Sun, 18 Nov 2012 11:35:40 -0800
Subject: [PATCH] Add DROP target to the conntrack file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
---
 Shorewall/Perl/Shorewall/Raw.pm              |  2 +-
 Shorewall/manpages/shorewall-conntrack.xml   | 19 +++++++++++++++++--
 Shorewall6/manpages/shorewall6-conntrack.xml |  7 +++++++
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/Shorewall/Perl/Shorewall/Raw.pm b/Shorewall/Perl/Shorewall/Raw.pm
index 03dca0a80..ae1c02781 100644
--- a/Shorewall/Perl/Shorewall/Raw.pm
+++ b/Shorewall/Perl/Shorewall/Raw.pm
@@ -80,7 +80,7 @@ sub process_conntrack_rule( $$$$$$$$$ ) {
 	# Netfilter development list
 	#
 	$action = 'CT --notrack' if have_capability 'CT_TARGET';
-    } else {
+    } elsif ( $action ne 'DROP' ) {
 	(  $target, my ( $option, $args, $junk ) ) = split ':', $action, 4;
 
 	fatal_error "Invalid notrack ACTION ( $action )" if $junk || $target ne 'CT';
diff --git a/Shorewall/manpages/shorewall-conntrack.xml b/Shorewall/manpages/shorewall-conntrack.xml
index 33289134e..c9fe273d7 100644
--- a/Shorewall/manpages/shorewall-conntrack.xml
+++ b/Shorewall/manpages/shorewall-conntrack.xml
@@ -67,8 +67,8 @@
 
         <listitem>
           <para>This column is only present when FORMAT = 2. Values other than
-          NOTRACK require <firstterm>CT Target </firstterm>support in your
-          iptables and kernel.</para>
+          NOTRACK or DROP require <firstterm>CT Target </firstterm>support in
+          your iptables and kernel.</para>
 
           <itemizedlist>
             <listitem>
@@ -78,6 +78,13 @@
               <para>Disables connection tracking for this packet.</para>
             </listitem>
 
+            <listitem>
+              <para><option>DROP</option></para>
+
+              <para>Added in Shorewall 4.5.10. Silently discard the
+              packet.</para>
+            </listitem>
+
             <listitem>
               <para><option>helper</option>:<replaceable>name</replaceable></para>
 
@@ -143,6 +150,14 @@
                   </listitem>
                 </varlistentry>
 
+                <varlistentry>
+                  <term/>
+
+                  <listitem>
+                    <para/>
+                  </listitem>
+                </varlistentry>
+
                 <varlistentry>
                   <term>sane</term>
 
diff --git a/Shorewall6/manpages/shorewall6-conntrack.xml b/Shorewall6/manpages/shorewall6-conntrack.xml
index a1eab9dd5..b2087c337 100644
--- a/Shorewall6/manpages/shorewall6-conntrack.xml
+++ b/Shorewall6/manpages/shorewall6-conntrack.xml
@@ -77,6 +77,13 @@
               <para>Disables connection tracking for this packet.</para>
             </listitem>
 
+            <listitem>
+              <para>DROP</para>
+
+              <para>Added in Shorewall 4.5.10. Silently discard the
+              packet.</para>
+            </listitem>
+
             <listitem>
               <para><option>helper</option>:<replaceable>name</replaceable></para>