From e903e01368e14da91b7fca79198449b97528cd61 Mon Sep 17 00:00:00 2001
From: Jo-Philipp Wich <jow@openwrt.org>
Date: Wed, 19 May 2010 21:35:23 +0000
Subject: [package] firewall: 	- fix ip6tables rules when icmp_type option is
 set 	- add "family" option to zones, forwardings, redirects and rules to
 selectively apply rules to iptables and/or ip6tables

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@21508 3c298f89-4303-0410-b956-a3cf2f4a3e73
---
 package/firewall/files/lib/core_interface.sh | 33 +++++++++++++++-------------
 1 file changed, 18 insertions(+), 15 deletions(-)

(limited to 'package/firewall/files/lib/core_interface.sh')

diff --git a/package/firewall/files/lib/core_interface.sh b/package/firewall/files/lib/core_interface.sh
index 9b35c8b2bc..de5fd9a0ea 100644
--- a/package/firewall/files/lib/core_interface.sh
+++ b/package/firewall/files/lib/core_interface.sh
@@ -17,23 +17,26 @@ fw_configure_interface() {
 
 	fw__do_rules() {
 		local action=$1
-		local chain=$2
+		local zone=$2
+		local chain=zone_${zone}
 		local ifname=$3
 
-		fw $action i f ${chain}_ACCEPT ACCEPT ^ { -o "$ifname" }
-		fw $action i f ${chain}_ACCEPT ACCEPT ^ { -i "$ifname" }
-		fw $action i f ${chain}_DROP   DROP   ^ { -o "$ifname" }
-		fw $action i f ${chain}_DROP   DROP   ^ { -i "$ifname" }
-		fw $action i f ${chain}_REJECT reject ^ { -o "$ifname" }
-		fw $action i f ${chain}_REJECT reject ^ { -i "$ifname" }
+		local mode=$(fw_get_family_mode x $zone i)
 
-		fw $action i n ${chain}_nat MASQUERADE ^ { -o "$ifname" }
-		fw $action i f ${chain}_MSSFIX TCPMSS  ^ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu }
+		fw $action $mode f ${chain}_ACCEPT ACCEPT ^ { -o "$ifname" }
+		fw $action $mode f ${chain}_ACCEPT ACCEPT ^ { -i "$ifname" }
+		fw $action $mode f ${chain}_DROP   DROP   ^ { -o "$ifname" }
+		fw $action $mode f ${chain}_DROP   DROP   ^ { -i "$ifname" }
+		fw $action $mode f ${chain}_REJECT reject ^ { -o "$ifname" }
+		fw $action $mode f ${chain}_REJECT reject ^ { -i "$ifname" }
 
-		fw $action i f input   ${chain}         $ { -i "$ifname" }
-		fw $action i f forward ${chain}_forward $ { -i "$ifname" }
-		fw $action i n PREROUTING ${chain}_prerouting ^ { -i "$ifname" }
-		fw $action i r PREROUTING ${chain}_notrack    ^ { -i "$ifname" }
+		fw $action $mode n ${chain}_nat MASQUERADE ^ { -o "$ifname" }
+		fw $action $mode f ${chain}_MSSFIX TCPMSS  ^ { -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu }
+
+		fw $action $mode f input   ${chain}         $ { -i "$ifname" }
+		fw $action $mode f forward ${chain}_forward $ { -i "$ifname" }
+		fw $action $mode n PREROUTING ${chain}_prerouting ^ { -i "$ifname" }
+		fw $action $mode r PREROUTING ${chain}_notrack    ^ { -i "$ifname" }
 	}
 
 	local old_zones old_ifname
@@ -42,7 +45,7 @@ fw_configure_interface() {
 		config_get old_ifname core "${iface}_ifname"
 		for z in $old_zones; do
 			fw_log info "removing $iface ($old_ifname) from zone $z"
-			fw__do_rules del zone_$z $old_ifname
+			fw__do_rules del $z $old_ifname
 
 			ACTION=remove ZONE="$z" INTERFACE="$iface" DEVICE="$ifname" /sbin/hotplug-call firewall
 		done
@@ -57,7 +60,7 @@ fw_configure_interface() {
 		list_contains zone_network "$iface" || return
 
 		fw_log info "adding $iface ($ifname) to zone $zone_name"
-		fw__do_rules add zone_${zone_name} "$ifname"
+		fw__do_rules add ${zone_name} "$ifname"
 		append new_zones $zone_name
 
 		ACTION=add ZONE="$zone_name" INTERFACE="$iface" DEVICE="$ifname" /sbin/hotplug-call firewall
-- 
cgit v1.2.3