Merge branch 'next' of ssh://git.ipfire.org/pub/git/ipfire-2.x into asterisk-update

[ipfire-2.x.git] / config / firewall / rules.pl

diff --git a/config/firewall/rules.pl b/config/firewall/rules.pl
index 40fb8dd2ac821f360b3f77c57624e09ce2893773..75a9357f64bc6047a47f81ad56f9c9e46301489f 100755 (executable)
--- a/config/firewall/rules.pl
+++ b/config/firewall/rules.pl
@@ -131,6 +131,12 @@ sub print_rule {
        print "\n";
 }
 
+sub count_elements {
+       my $hash = shift;
+
+       return scalar @$hash;
+}
+
 sub flush {
        run("$IPTABLES -F $CHAIN_INPUT");
        run("$IPTABLES -F $CHAIN_FORWARD");
@@ -186,6 +192,9 @@ sub buildrules {
                # Skip disabled rules.
                next unless ($$hash{$key}[2] eq 'ON');
 
+               # Count number of elements in this line
+               my $elements = &count_elements($$hash{$key});
+
                if ($DEBUG) {
                        print_rule($$hash{$key});
                }
@@ -270,7 +279,8 @@ sub buildrules {
 
                # Concurrent connection limit
                my @ratelimit_options = ();
-               if ($$hash{$key}[32] eq 'ON') {
+
+               if (($elements gt 34) && ($$hash{$key}[32] eq 'ON')) {
                        my $conn_limit = $$hash{$key}[33];
 
                        if ($conn_limit ge 1) {
@@ -286,7 +296,7 @@ sub buildrules {
                }
 
                # Ratelimit
-               if ($$hash{$key}[34] eq 'ON') {
+               if (($elements gt 37) && ($$hash{$key}[34] eq 'ON')) {
                        my $rate_limit = "$$hash{$key}[35]/$$hash{$key}[36]";
 
                                if ($rate_limit) {
@@ -544,29 +554,19 @@ sub time_convert_to_minutes {
 }
 
 sub p2pblock {
-       my $search_action;
-       my $target;
-
-       if ($fwdfwsettings{"POLICY"} eq "MODE1") {
-               $search_action = "on";
-               $target = "ACCEPT";
-       } else {
-               $search_action = "off";
-               $target = "DROP";
-       }
-
        open(FILE, "<$p2pfile") or die "Unable to read $p2pfile";
        my @protocols = ();
        foreach my $p2pentry (<FILE>) {
                my @p2pline = split(/\;/, $p2pentry);
-               next unless ($p2pline[2] eq $search_action);
+               next unless ($p2pline[2] eq "off");
 
                push(@protocols, "--$p2pline[1]");
        }
        close(FILE);
 
+       run("$IPTABLES -F P2PBLOCK");
        if (@protocols) {
-               run("$IPTABLES -A FORWARDFW -m ipp2p @protocols -j $target");
+               run("$IPTABLES -A P2PBLOCK -m ipp2p @protocols -j DROP");
        }
 }