X-Git-Url: http://git.openwrt.org/?p=openwrt%2Fsvn-archive%2Farchive.git;a=blobdiff_plain;f=package%2Ffirewall%2Ffiles%2Flib%2Fcore_init.sh;h=e93de1613ff091f9236eecea61ad07b0016584bc;hp=f2cde1c4704f148f1e60c68d9f16d91fb085b3ab;hb=be649f08c322a9d168d49741a51a72abce7a16c5;hpb=faf9c59c1b49950f81e9bb9ca80c5f940e456082

diff --git a/package/firewall/files/lib/core_init.sh b/package/firewall/files/lib/core_init.sh
index f2cde1c470..e93de1613f 100644
--- a/package/firewall/files/lib/core_init.sh
+++ b/package/firewall/files/lib/core_init.sh
@@ -195,7 +195,6 @@ fw_load_zone() {
 	fw add $mode f ${chain}_ACCEPT
 	fw add $mode f ${chain}_DROP
 	fw add $mode f ${chain}_REJECT
-	fw add $mode f ${chain}_MSSFIX
 
 	# TODO: Rename to ${chain}_input
 	fw add $mode f ${chain}
@@ -213,8 +212,11 @@ fw_load_zone() {
 
 	fw add $mode r ${chain}_notrack
 
-	[ $zone_mtu_fix == 1 ] && \
-		fw add $mode f FORWARD ${chain}_MSSFIX ^
+	[ $zone_mtu_fix == 1 ] && {
+		fw add $mode m ${chain}_MSSFIX
+		fw add $mode m FORWARD ${chain}_MSSFIX ^
+		uci_set_state firewall core ${zone_name}_tcpmss 1
+	}
 
 	[ $zone_custom_chains == 1 ] && {
 		[ $FW_ADD_CUSTOM_CHAINS == 1 ] || \
@@ -235,10 +237,14 @@ fw_load_zone() {
 			zone_log_limit="$zone_log_limit/minute"
 
 		local t
-		for t in REJECT DROP MSSFIX; do
+		for t in REJECT DROP; do
 			fw add $mode f ${chain}_${t} LOG ^ \
-				{ -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): "  }
+				{ -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
 		done
+
+		[ $zone_mtu_fix == 1 ] && \
+			fw add $mode m ${chain}_MSSFIX LOG ^ \
+				{ -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
 	}
 
 	# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
@@ -247,13 +253,13 @@ fw_load_zone() {
 		for msrc in ${zone_masq_src:-0.0.0.0/0}; do
 			case "$msrc" in
 				*.*) fw_get_negation msrc '-s' "$msrc" ;;
-				*)   fw_get_subnet4 msrc '-s' "$msrc" ;;
+				*)   fw_get_subnet4 msrc '-s' "$msrc" || break ;;
 			esac
 
 			for mdst in ${zone_masq_dest:-0.0.0.0/0}; do
 				case "$mdst" in
 					*.*) fw_get_negation mdst '-d' "$mdst" ;;
-					*)   fw_get_subnet4 mdst '-d' "$mdst" ;;
+					*)   fw_get_subnet4 mdst '-d' "$mdst" || break ;;
 				esac
 
 				fw add $mode n ${chain}_nat MASQUERADE $ { $msrc $mdst }