holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Improve IPSEC hosts fix

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1670 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-10-09 00:16:42 +00:00
parent d34d2e1393
commit fa0c2ec9ab
1 changed files with 7 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
Shorewall2/firewall
View File

@ -700,7 +700,7 @@ verify_interface()
# Generate a match for decrypted packets
#
ipsec_source() # $1 = zone, $2 = host
ipsec_host() # $1 = zone, $2 = host
{
eval local is_ipsec=\$${1}_is_ipsec
eval local hosts=\"\$${1}_ipsec_hosts\"
@ -710,9 +710,8 @@ ipsec_source() # $1 = zone, $2 = host
match_ipsec_in() # $1 = zone, $2 = host
{
eval local options=\"\$${1}_ipsec_options \$${1}_ipsec_in_options\"
if ipsec_source $1 $2 ; then
if ipsec_host $1 $2 ; then
eval local options=\"\$${1}_ipsec_options \$${1}_ipsec_in_options\"
echo "-m policy --pol ipsec --dir in $options"
elif [ -n "$POLICY_MATCH" ]; then
echo "-m policy --pol none --dir in"
@ -724,11 +723,8 @@ match_ipsec_in() # $1 = zone, $2 = host
#
match_ipsec_out() # $1 = zone, $2 = host
{
eval local is_ipsec=\$${1}_is_ipsec
eval local hosts=\"\$${1}_ipsec_hosts\"
eval local options=\"\$${1}_ipsec_options \$${1}_ipsec_out_options\"
if [ -n "$is_ipsec" ] || list_search $2 $hosts; then
if ipsec_host $1 $2 ; then
eval local options=\"\$${1}_ipsec_options \$${1}_ipsec_out_options\"
echo "-m policy --pol ipsec --dir out $options"
elif [ -n "$POLICY_MATCH" ]; then
echo "-m policy --pol none --dir out"
@ -6113,7 +6109,7 @@ activate_rules()
interface=${host%%:*}
networks=${host#*:}
ipsec_source $zone $host && \
ipsec_host $zone $host && \
run_iptables -A $(forward_chain $interface) $(match_source_hosts $networks) $(match_ipsec_in $zone $host) -j $frwd_chain
done
fi
@ -6150,7 +6146,7 @@ activate_rules()
run_iptables -A $(input_chain $interface) $(match_source_hosts $networks) $(match_ipsec_in $zone $host) -j $chain2
if [ -n "$complex" ] && ! ipsec_source $zone $host ; then
if [ -n "$complex" ] && ! ipsec_host $zone $host ; then
run_iptables -A $(forward_chain $interface) $(match_source_hosts $networks) $(match_ipsec_in $zone $host) -j $frwd_chain
fi