- for rule_proto in $rule_proto; do
- fw add $mode f $chain $target $rule_pos { $rule_src_ip $rule_dest_ip } { \
- ${rule_proto:+-p $rule_proto} \
- ${rule_src_ip:+-s $rule_src_ip} \
- ${rule_src_port:+--sport $rule_src_port} \
- ${rule_src_mac:+-m mac --mac-source $rule_src_mac} \
- ${rule_dest_ip:+-d $rule_dest_ip} \
- ${rule_dest_port:+--dport $rule_dest_port} \
- ${rule_icmp_type:+--icmp-type $rule_icmp_type} \
- }
+ local pr; for pr in $rule_proto; do
+ local sports dports itypes
+ case "$pr" in
+ icmp|icmpv6|1|58)
+ sports=""; dports=""
+ itypes="$rule_icmp_type"
+ ;;
+ *)
+ sports="$rule_src_port"
+ dports="$rule_dest_port"
+ itypes=""
+ ;;
+ esac
+
+ fw_get_negation pr '-p' "$pr"
+ local sp; for sp in ${sports:-""}; do
+ fw_get_port_range sp $sp
+ fw_get_negation sp '--sport' "$sp"
+ local dp; for dp in ${dports:-""}; do
+ fw_get_port_range dp $dp
+ fw_get_negation dp '--dport' "$dp"
+ local sm; for sm in ${rule_src_mac:-""}; do
+ fw_get_negation sm '--mac-source' "$sm"
+ local it; for it in ${itypes:-""}; do
+ fw_get_negation it '--icmp-type' "$it"
+ fw add $mode $table $chain $target + \
+ { $rule_src_ip $rule_dest_ip } { \
+ $src_spec $dest_spec \
+ $pr $sp $dp $it \
+ ${sm:+-m mac $sm} \
+ ${rule_limit:+-m limit --limit $rule_limit \
+ ${rule_limit_burst:+--limit-burst $rule_limit_burst}} \
+ $rule_extra \
+ }
+ done
+ done
+ done
+ done