[package] firewall: do not produce 0.0.0.0/0 if a symbolic masq_src or masq_dest...

[openwrt.git] / package / firewall / files / lib / core_init.sh

diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh
index 185fffb..a0b0958 100644 (file)
--- a/package/firewall/files/lib/core_init.sh
+++ b/package/firewall/files/lib/core_init.sh
@@ -1,4 +1,4 @@
-# Copyright (C) 2009-2010 OpenWrt.org
+# Copyright (C) 2009-2011 OpenWrt.org
 # Copyright (C) 2008 John Crispin <blogic@openwrt.org>
 
 FW_INITIALIZED=
@@ -66,17 +66,17 @@ fw_load_defaults() {
        done
        fw_sysctl_interface all
 
+       fw add i f INPUT   ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+       fw add i f OUTPUT  ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+       fw add i f FORWARD ACCEPT { -m conntrack --ctstate RELATED,ESTABLISHED }
+
        [ $defaults_drop_invalid == 1 ] && {
-               fw add i f INPUT   DROP { -m state --state INVALID }
-               fw add i f OUTPUT  DROP { -m state --state INVALID }
-               fw add i f FORWARD DROP { -m state --state INVALID }
+               fw add i f INPUT   DROP { -m conntrack --ctstate INVALID }
+               fw add i f OUTPUT  DROP { -m conntrack --ctstate INVALID }
+               fw add i f FORWARD DROP { -m conntrack --ctstate INVALID }
                FW_NOTRACK_DISABLED=1
        }
 
-       fw add i f INPUT   ACCEPT { -m state --state RELATED,ESTABLISHED }
-       fw add i f OUTPUT  ACCEPT { -m state --state RELATED,ESTABLISHED }
-       fw add i f FORWARD ACCEPT { -m state --state RELATED,ESTABLISHED }
-
        fw add i f INPUT  ACCEPT { -i lo }
        fw add i f OUTPUT ACCEPT { -o lo }
 
@@ -247,13 +247,13 @@ fw_load_zone() {
                for msrc in ${zone_masq_src:-0.0.0.0/0}; do
                        case "$msrc" in
                                *.*) fw_get_negation msrc '-s' "$msrc" ;;
-                               *)   fw_get_subnet4 msrc '-s' "$msrc" ;;
+                               *)   fw_get_subnet4 msrc '-s' "$msrc" || break ;;
                        esac
 
                        for mdst in ${zone_masq_dest:-0.0.0.0/0}; do
                                case "$mdst" in
                                        *.*) fw_get_negation mdst '-d' "$mdst" ;;
-                                       *)   fw_get_subnet4 mdst '-d' "$mdst" ;;
+                                       *)   fw_get_subnet4 mdst '-d' "$mdst" || break ;;
                                esac
 
                                fw add $mode n ${chain}_nat MASQUERADE $ { $msrc $mdst }