From e3060b618dcc81d6e08de46948ac410ce842bbe0 Mon Sep 17 00:00:00 2001
From: jow <jow@3c298f89-4303-0410-b956-a3cf2f4a3e73>
Date: Thu, 15 Jul 2010 22:01:48 +0000
Subject: [package] firewall: 	- notrack support was broken in multiple ways,
 fix it 	- also consider a zone conntracked if any redirect references
 it (#7196)

git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22215 3c298f89-4303-0410-b956-a3cf2f4a3e73
---
 package/firewall/files/lib/core.sh            | 2 +-
 package/firewall/files/lib/core_forwarding.sh | 8 ++++----
 package/firewall/files/lib/core_init.sh       | 5 ++---
 package/firewall/files/lib/core_redirect.sh   | 3 +++
 4 files changed, 10 insertions(+), 8 deletions(-)

(limited to 'package/firewall/files')

diff --git a/package/firewall/files/lib/core.sh b/package/firewall/files/lib/core.sh
index 5880cd3ac..03a80c6f6 100644
--- a/package/firewall/files/lib/core.sh
+++ b/package/firewall/files/lib/core.sh
@@ -39,7 +39,7 @@ fw_start() {
 	echo "Loading includes"
 	config_foreach fw_load_include include
 
-	[ -n "$FW_NOTRACK_DISABLED" ] && {
+	[ -z "$FW_NOTRACK_DISABLED" ] && {
 		echo "Optimizing conntrack"
 		config_foreach fw_load_notrack_zone zone
 	}
diff --git a/package/firewall/files/lib/core_forwarding.sh b/package/firewall/files/lib/core_forwarding.sh
index 689e2628c..b62e18a76 100644
--- a/package/firewall/files/lib/core_forwarding.sh
+++ b/package/firewall/files/lib/core_forwarding.sh
@@ -32,11 +32,11 @@ fw_load_forwarding() {
 	fw add $mode f $chain $target ^
 
 	# propagate masq zone flag
-	[ -n "$forwarding_src" ] && list_contains CONNTRACK_ZONES $forwarding_src && {
-		append CONNTRACK_ZONES $forwarding_dest
+	[ -n "$forwarding_src" ] && list_contains FW_CONNTRACK_ZONES $forwarding_src && {
+		append FW_CONNTRACK_ZONES $forwarding_dest
 	}
-	[ -n "$forwarding_dest" ] && list_contains CONNTRACK_ZONES $forwarding_dest && {
-		append CONNTRACK_ZONES $forwarding_src
+	[ -n "$forwarding_dest" ] && list_contains FW_CONNTRACK_ZONES $forwarding_dest && {
+		append FW_CONNTRACK_ZONES $forwarding_src
 	}
 
 	fw_callback post forwarding
diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh
index 92d117160..a55ace17c 100644
--- a/package/firewall/files/lib/core_init.sh
+++ b/package/firewall/files/lib/core_init.sh
@@ -228,13 +228,12 @@ fw_load_zone() {
 }
 
 fw_load_notrack_zone() {
-	list_contains FW_CONNTRACK_ZONES "$1" && return
-
 	fw_config_get_zone "$1"
+	list_contains FW_CONNTRACK_ZONES "${zone_name}" && return
 
 	fw_callback pre notrack
 
-	fw add i f zone_${zone_name}_notrack NOTRACK $
+	fw add i r zone_${zone_name}_notrack NOTRACK $
 
 	fw_callback post notrack
 }
diff --git a/package/firewall/files/lib/core_redirect.sh b/package/firewall/files/lib/core_redirect.sh
index 87f584e37..b51f79390 100644
--- a/package/firewall/files/lib/core_redirect.sh
+++ b/package/firewall/files/lib/core_redirect.sh
@@ -30,6 +30,9 @@ fw_load_redirect() {
 		fw_die "redirect ${redirect_name}: needs src and dest_ip"
 	}
 
+	list_contains FW_CONNTRACK_ZONES $redirect_src || \
+		append FW_CONNTRACK_ZONES $redirect_src
+
 	local mode=$(fw_get_family_mode ${redirect_family:-x} $redirect_src I)
 
 	local nat_dest_port=$redirect_dest_port
-- 
cgit v1.2.3