From d0aed87546a970ae8d23596982ca33acfaca88ff Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Sat, 19 Jul 2014 10:25:46 -0700 Subject: [PATCH] Correct IPV6 ipset capabilities checking on 3.14 kernels Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Config.pm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index b257100db..8dc387ed0 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -4118,7 +4118,7 @@ sub IPSet_Match() { if ( $ipset && -x $ipset ) { qt( "$ipset -X $sillyname" ); - if ( qt( "$ipset -N $sillyname iphash" ) || qt( "$ipset -N $sillyname hash:ip family $fam") ) { + if ( qt( "$ipset -N $sillyname hash:ip family $fam") || qt( "$ipset -N $sillyname iphash" ) ) { if ( qt1( "$iptables $iptablesw -A $sillyname -m set --match-set $sillyname src -j ACCEPT" ) ) { $capabilities{IPSET_MATCH_NOMATCH} = qt1( "$iptables $iptablesw -A $sillyname -m set --match-set $sillyname src --return-nomatch -j ACCEPT" ); $capabilities{IPSET_MATCH_COUNTERS} = qt1( "$iptables $iptablesw -A $sillyname -m set --match-set $sillyname src --packets-lt 100 -j ACCEPT" );