Preserve canonical the order of IP tables.

I.e., as packets are treated along the way: mangle -> nat -> filter.

1 files changed, 3 insertions, 3 deletions

diff --git a/roles/common/files/usr/local/sbin/update-firewall.sh b/roles/common/files/usr/local/sbin/update-firewall.sh
index f7ab925..c6d9de8 100755
--- a/roles/common/files/usr/local/sbin/update-firewall.sh
+++ b/roles/common/files/usr/local/sbin/update-firewall.sh
@@ -119,67 +119,67 @@ ipt-persist() {
         chmod 0600 "$rs"
     done
 }
 
 ipt-revert() {
     [ $check -eq 0 ] || return
     log "Reverting to old ruleset... "
 
     local rs
     for f in "${!rss[@]}"; do
         /sbin/$(inet46 $f iptables ip6tables)-restore -c < "${rss[$f]}"
         rm -f "${rss[$f]}"
     done
     exit 1
 }
 
 run() {
     # Build and apply the firewall for IPv4/6.
     local f="$1"
     local ipt=/sbin/$(inet46 $f iptables ip6tables)
-    tables+=( [$f]=filter )
+    tables[$f]=filter
 
     # The default interface associated with this address.
     local if=$( /bin/ip -$f route show to default scope global \
               | sed -nr '/^default via \S+ dev (\S+).*/ {s//\1/p;q}' )
     [ -n "$if" ] || return 0
 
     # The virtual interface reserved for IPSec.
     local ifsec=$( /bin/ip -o -$f link show \
                  | sed -nr "/^[0-9]+:\s+(sec[0-9]+)@$if:\s.*/ {s//\1/p;q}" )
 
     # The (host-scoped) IP reserved for IPSec.
     local ipsec= secmark
     if [ -n "$ifsec" -a $f = 4 ]; then
-        tables+=( [$f]=' mangle nat' )
+        tables[$f]='mangle nat filter'
         ipsec=$( /bin/ip -$f address show dev "$ifsec" scope host \
                | sed -nr '/^\s+inet\s(\S+).*/ {s//\1/p;q}' )
         secmark=0x1
     fi
 
     # Store the old (current) ruleset
     local old=$(mktemp -t current-rules.v$f.XXXXXX) \
           new=$(mktemp -t new-rules.v$f.XXXXXX)
     for table in ${tables[$f]}; do
         $ipt-save -ct $table
     done > "$old"
-    rss+=( [$f]="$old" )
+    rss[$f]="$old"
 
     local fail2ban=0
     # XXX: As of Wheezy, fail2ban is IPv4 only.  See
     #      https://github.com/fail2ban/fail2ban/issues/39 for the current
     #      state of the art.
     if [ "$f" = 4 ] && which /usr/bin/fail2ban-server >/dev/null; then
         fail2ban=1
     fi
 
     if [ -n "$ipsec" ]; then
         # DNAT the IPSec paquets to $ipsec after decapsulation, and SNAT
         # them before encapsulation.  We need to do the NAT'ing before
         # packets enter the IPSec stack because they are signed
         # afterwards, and NAT'ing would mess up the signature.
         ipt-chains mangle PREROUTING:ACCEPT INPUT:ACCEPT \
                           FORWARD:DROP \
                           OUTPUT:ACCEPT POSTROUTING:ACCEPT
         # Mark all IPSec packets to keep track of them and NAT them
         # after decapsulation.  Unmarked packets that are to be sent to
         # $ipsec are dropped.