From 8f6d93f2c1af4084366cc2d6e835535608fc1e4e Mon Sep 17 00:00:00 2001
From: Guilhem Moulin <guilhem@fripost.org>
Date: Sun, 3 Nov 2013 06:07:18 +0100
Subject: Preserve canonical the order of IP tables.

I.e., as packets are treated along the way: mangle -> nat -> filter.
---
 roles/common/files/usr/local/sbin/update-firewall.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'roles')

diff --git a/roles/common/files/usr/local/sbin/update-firewall.sh b/roles/common/files/usr/local/sbin/update-firewall.sh
index f7ab925..c6d9de8 100755
--- a/roles/common/files/usr/local/sbin/update-firewall.sh
+++ b/roles/common/files/usr/local/sbin/update-firewall.sh
@@ -136,7 +136,7 @@ run() {
     # Build and apply the firewall for IPv4/6.
     local f="$1"
     local ipt=/sbin/$(inet46 $f iptables ip6tables)
-    tables+=( [$f]=filter )
+    tables[$f]=filter
 
     # The default interface associated with this address.
     local if=$( /bin/ip -$f route show to default scope global \
@@ -150,7 +150,7 @@ run() {
     # The (host-scoped) IP reserved for IPSec.
     local ipsec= secmark
     if [ -n "$ifsec" -a $f = 4 ]; then
-        tables+=( [$f]=' mangle nat' )
+        tables[$f]='mangle nat filter'
         ipsec=$( /bin/ip -$f address show dev "$ifsec" scope host \
                | sed -nr '/^\s+inet\s(\S+).*/ {s//\1/p;q}' )
         secmark=0x1
@@ -162,7 +162,7 @@ run() {
     for table in ${tables[$f]}; do
         $ipt-save -ct $table
     done > "$old"
-    rss+=( [$f]="$old" )
+    rss[$f]="$old"
 
     local fail2ban=0
     # XXX: As of Wheezy, fail2ban is IPv4 only.  See
-- 
cgit v1.2.3