2007-03-15 22:55:22 +01:00
|
|
|
#
|
2007-03-28 18:19:35 +02:00
|
|
|
# Shorewall-perl 3.9 -- /usr/share/shorewall-perl/Shorewall/Config.pm
|
2007-03-15 22:55:22 +01:00
|
|
|
#
|
|
|
|
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
|
|
|
#
|
|
|
|
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
|
|
|
#
|
|
|
|
# Complete documentation is available at http://shorewall.net
|
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or modify
|
|
|
|
# it under the terms of Version 2 of the GNU General Public License
|
|
|
|
# as published by the Free Software Foundation.
|
|
|
|
#
|
|
|
|
# This program is distributed in the hope that it will be useful,
|
|
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
# GNU General Public License for more details.
|
|
|
|
#
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
|
|
# along with this program; if not, write to the Free Software
|
|
|
|
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
|
|
|
#
|
|
|
|
#
|
2007-03-14 03:44:41 +01:00
|
|
|
package Shorewall::Config;
|
|
|
|
|
|
|
|
use strict;
|
|
|
|
use warnings;
|
|
|
|
use Shorewall::Common;
|
|
|
|
|
|
|
|
our @ISA = qw(Exporter);
|
2007-03-29 19:36:04 +02:00
|
|
|
our @EXPORT = qw(
|
|
|
|
warning_message
|
|
|
|
fatal_error
|
|
|
|
find_file
|
2007-03-30 01:07:15 +02:00
|
|
|
split_line
|
2007-03-29 17:47:47 +02:00
|
|
|
open_file
|
2007-03-31 20:44:48 +02:00
|
|
|
close_file
|
2007-03-29 17:47:47 +02:00
|
|
|
push_open
|
|
|
|
pop_open
|
|
|
|
read_a_line
|
2007-03-29 01:21:37 +02:00
|
|
|
get_configuration
|
|
|
|
require_capability
|
|
|
|
report_capabilities
|
|
|
|
propagateconfig
|
|
|
|
append_file
|
|
|
|
run_user_exit
|
|
|
|
generate_aux_config
|
|
|
|
|
|
|
|
%config
|
2007-03-31 19:44:16 +02:00
|
|
|
%globals
|
2007-03-29 19:36:04 +02:00
|
|
|
%capabilities );
|
2007-03-14 03:44:41 +01:00
|
|
|
our @EXPORT_OK = ();
|
|
|
|
our @VERSION = 1.00;
|
|
|
|
|
2007-03-24 19:11:32 +01:00
|
|
|
#
|
|
|
|
# Misc Globals
|
|
|
|
#
|
2007-03-31 19:44:16 +02:00
|
|
|
our %globals = ( SHAREDIR => '/usr/share/shorewall' ,
|
|
|
|
CONFDIR => '/etc/shorewall',
|
|
|
|
SHAREDIRPL => '/usr/share/shorewall-perl/',
|
|
|
|
LOGPARMS => '',
|
|
|
|
VERSION => '3.9.0-1',
|
|
|
|
);
|
2007-03-24 19:11:32 +01:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
#
|
|
|
|
# From shorewall.conf file
|
|
|
|
#
|
2007-03-14 05:06:32 +01:00
|
|
|
our %config =
|
2007-03-14 03:44:41 +01:00
|
|
|
( STARTUP_ENABLED => undef,
|
|
|
|
VERBOSITY => undef,
|
|
|
|
#
|
|
|
|
# Logging
|
|
|
|
#
|
|
|
|
LOGFILE => undef,
|
|
|
|
LOGFORMAT => undef,
|
|
|
|
LOGTAGONLY => undef,
|
|
|
|
LOGRATE => undef,
|
|
|
|
LOGBURST => undef,
|
|
|
|
LOGALLNEW => undef,
|
|
|
|
BLACKLIST_LOGLEVEL => undef,
|
|
|
|
MACLIST_LOG_LEVEL => undef,
|
|
|
|
TCP_FLAGS_LOG_LEVEL => undef,
|
|
|
|
RFC1918_LOG_LEVEL => undef,
|
|
|
|
SMURF_LOG_LEVEL => undef,
|
|
|
|
LOG_MARTIANS => undef,
|
|
|
|
#
|
|
|
|
# Location of Files
|
|
|
|
#
|
|
|
|
IPTABLES => undef,
|
2007-04-01 17:20:07 +02:00
|
|
|
#
|
2007-03-14 03:44:41 +01:00
|
|
|
#PATH is inherited
|
2007-04-01 17:20:07 +02:00
|
|
|
#
|
2007-03-14 03:44:41 +01:00
|
|
|
PATH => undef,
|
|
|
|
SHOREWALL_SHELL => undef,
|
|
|
|
SUBSYSLOCK => undef,
|
|
|
|
MODULESDIR => undef,
|
2007-04-01 17:20:07 +02:00
|
|
|
#
|
2007-03-14 03:44:41 +01:00
|
|
|
#CONFIG_PATH is inherited
|
2007-04-01 17:20:07 +02:00
|
|
|
#
|
2007-03-14 03:44:41 +01:00
|
|
|
CONFIG_PATH => undef,
|
|
|
|
RESTOREFILE => undef,
|
|
|
|
IPSECFILE => undef,
|
|
|
|
#
|
|
|
|
# Default Actions/Macros
|
|
|
|
#
|
|
|
|
DROP_DEFAULT => undef,
|
|
|
|
REJECT_DEFAULT => undef,
|
|
|
|
ACCEPT_DEFAULT => undef,
|
|
|
|
QUEUE_DEFAULT => undef,
|
|
|
|
#
|
|
|
|
# Firewall Options
|
|
|
|
#
|
|
|
|
BRIDGING => undef,
|
|
|
|
IP_FORWARDING => undef,
|
|
|
|
ADD_IP_ALIASES => undef,
|
|
|
|
ADD_SNAT_ALIASES => undef,
|
|
|
|
RETAIN_ALIASES => undef,
|
|
|
|
TC_ENABLED => undef,
|
|
|
|
TC_EXPERT => undef,
|
|
|
|
CLEAR_TC => undef,
|
|
|
|
MARK_IN_FORWARD_CHAIN => undef,
|
|
|
|
CLAMPMSS => undef,
|
|
|
|
ROUTE_FILTER => undef,
|
|
|
|
DETECT_DNAT_IPADDRS => undef,
|
|
|
|
MUTEX_TIMEOUT => undef,
|
|
|
|
ADMINISABSENTMINDED => undef,
|
|
|
|
BLACKLISTNEWONLY => undef,
|
|
|
|
DELAYBLACKLISTLOAD => undef,
|
|
|
|
MODULE_SUFFIX => undef,
|
|
|
|
DISABLE_IPV6 => undef,
|
|
|
|
DYNAMIC_ZONES => undef,
|
|
|
|
PKTTYPE=> undef,
|
|
|
|
RFC1918_STRICT => undef,
|
|
|
|
MACLIST_TABLE => undef,
|
|
|
|
MACLIST_TTL => undef,
|
|
|
|
SAVE_IPSETS => undef,
|
|
|
|
MAPOLDACTIONS => undef,
|
|
|
|
FASTACCEPT => undef,
|
|
|
|
IMPLICIT_CONTINUE => undef,
|
|
|
|
HIGH_ROUTE_MARKS => undef,
|
|
|
|
USE_ACTIONS=> undef,
|
|
|
|
OPTIMIZE => undef,
|
|
|
|
EXPORTPARAMS => undef,
|
2007-03-28 18:59:15 +02:00
|
|
|
SHOREWALL_COMPILER => undef,
|
2007-03-14 03:44:41 +01:00
|
|
|
#
|
|
|
|
# Packet Disposition
|
|
|
|
#
|
|
|
|
MACLIST_DISPOSITION => undef,
|
|
|
|
TCP_FLAGS_DISPOSITION => undef,
|
|
|
|
BLACKLIST_DISPOSITION => undef,
|
|
|
|
ORIGINAL_POLICY_MATCH => undef,
|
|
|
|
);
|
|
|
|
#
|
|
|
|
# Config options and global settings that are to be copied to object
|
|
|
|
#
|
|
|
|
my @propagateconfig = qw/ CLEAR_TC DISABLE_IPV6 ADMINISABSENTMINDED IP_FORWARDING MODULESDIR MODULE_SUFFIX LOGFORMAT SUBSYSLOCK/;
|
|
|
|
my @propagateenv = qw/ LOGLIMIT LOGTAGONLY LOGRULENUMBERS /;
|
|
|
|
|
|
|
|
|
|
|
|
#
|
|
|
|
# From parsing the capabilities file
|
|
|
|
#
|
2007-03-14 05:06:32 +01:00
|
|
|
our %capabilities =
|
2007-03-14 03:44:41 +01:00
|
|
|
( NAT_ENABLED => undef,
|
|
|
|
MANGLE_ENABLED => undef,
|
|
|
|
MULTIPORT => undef,
|
|
|
|
XMULTIPORT => undef,
|
|
|
|
CONNTRACK_MATCH => undef,
|
|
|
|
USEPKTTYPE => undef,
|
|
|
|
POLICY_MATCH => undef,
|
|
|
|
PHYSDEV_MATCH => undef,
|
|
|
|
LENGTH_MATCH => undef,
|
|
|
|
IPRANGE_MATCH => undef,
|
|
|
|
RECENT_MATCH => undef,
|
|
|
|
OWNER_MATCH => undef,
|
|
|
|
IPSET_MATCH => undef,
|
|
|
|
CONNMARK => undef,
|
|
|
|
XCONNMARK => undef,
|
|
|
|
CONNMARK_MATCH => undef,
|
|
|
|
XCONNMARK_MATCH => undef,
|
|
|
|
RAW_TABLE => undef,
|
|
|
|
IPP2P_MATCH => undef,
|
|
|
|
CLASSIFY_TARGET => undef,
|
|
|
|
ENHANCED_REJECT => undef,
|
|
|
|
KLUDGEFREE => undef,
|
|
|
|
MARK => undef,
|
|
|
|
XMARK => undef,
|
|
|
|
MANGLE_FORWARD => undef,
|
|
|
|
COMMENTS => undef,
|
|
|
|
ADDRTYPE => undef,
|
|
|
|
);
|
|
|
|
|
|
|
|
my %capdesc = ( NAT_ENABLED => 'NAT',
|
|
|
|
MANGLE_ENABLED => 'Packet Mangling',
|
|
|
|
MULTIPORT => 'Multi-port Match' ,
|
|
|
|
XMULTIPORT => 'Extended Multi-port Match',
|
|
|
|
CONNTRACK_MATCH => 'Connection Tracking Match',
|
|
|
|
USEPKTTYPE => 'Packet Type Match',
|
|
|
|
POLICY_MATCH => 'Policy Match',
|
|
|
|
PHYSDEV_MATCH => 'Physdev Match',
|
|
|
|
LENGTH_MATCH => 'Packet length Match',
|
|
|
|
IPRANGE_MATCH => 'IP Range Match',
|
|
|
|
RECENT_MATCH => 'Recent Match',
|
|
|
|
OWNER_MATCH => 'Owner Match',
|
|
|
|
IPSET_MATCH => 'Ipset Match',
|
|
|
|
CONNMARK => 'CONNMARK Target',
|
|
|
|
XCONNMARK => 'Extended CONNMARK Target',
|
|
|
|
CONNMARK_MATCH => 'Connmark Match',
|
|
|
|
XCONNMARK_MATCH => 'Extended Connmark Match',
|
|
|
|
RAW_TABLE => 'Raw Table',
|
|
|
|
IPP2P_MATCH => 'IPP2P Match',
|
|
|
|
CLASSIFY_TARGET => 'CLASSIFY Target',
|
|
|
|
ENHANCED_REJECT => 'Extended Reject',
|
|
|
|
KLUDGEFREE => 'Repeat match',
|
|
|
|
MARK => 'MARK Target',
|
|
|
|
XMARK => 'Extended Mark Target',
|
|
|
|
MANGLE_FORWARD => 'Mangle FORWARD Chain',
|
|
|
|
COMMENTS => 'Comments',
|
|
|
|
ADDRTYPE => 'Address Type Match',
|
|
|
|
);
|
2007-03-29 19:36:04 +02:00
|
|
|
|
2007-03-31 00:38:09 +02:00
|
|
|
my @config_path;
|
2007-03-29 19:36:04 +02:00
|
|
|
#
|
|
|
|
# Stash away file references here when we encounter INCLUDE
|
|
|
|
#
|
|
|
|
my @openstack;
|
2007-03-29 20:57:53 +02:00
|
|
|
|
2007-03-29 19:36:04 +02:00
|
|
|
my $currentfile;
|
|
|
|
my $currentfilename;
|
|
|
|
my $currentlinenumber = 0;
|
2007-03-31 19:29:17 +02:00
|
|
|
|
2007-04-01 16:07:06 +02:00
|
|
|
INIT {
|
2007-04-01 17:16:30 +02:00
|
|
|
@config_path = split /:/, $ENV{CONFIG_PATH};
|
|
|
|
|
2007-04-01 17:20:07 +02:00
|
|
|
for ( @config_path ) {
|
|
|
|
$_ .= '/' unless m|//$|;
|
|
|
|
}
|
2007-03-31 19:29:17 +02:00
|
|
|
}
|
2007-03-29 19:36:04 +02:00
|
|
|
|
|
|
|
#
|
|
|
|
# Issue a Warning Message
|
|
|
|
#
|
|
|
|
sub warning_message
|
|
|
|
{
|
2007-03-30 01:07:15 +02:00
|
|
|
my $lineinfo = $currentfile ? " : $currentfilename ( line $currentlinenumber )" : '';
|
|
|
|
|
|
|
|
print STDERR " WARNING: @_$lineinfo\n";
|
2007-03-29 19:36:04 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub fatal_error {
|
2007-03-30 01:07:15 +02:00
|
|
|
my $lineinfo = $currentfile ? " : $currentfilename ( line $currentlinenumber )" : '';
|
|
|
|
|
|
|
|
print STDERR " ERROR: @_$lineinfo\n";
|
2007-03-29 19:36:04 +02:00
|
|
|
|
2007-03-29 21:45:53 +02:00
|
|
|
exit 1;
|
2007-03-29 19:36:04 +02:00
|
|
|
}
|
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
#
|
|
|
|
# Search the CONFIG_PATH for the passed file
|
|
|
|
#
|
|
|
|
sub find_file($)
|
|
|
|
{
|
|
|
|
my $filename=$_[0];
|
|
|
|
|
2007-03-31 20:44:48 +02:00
|
|
|
return $filename if $filename =~ '/.*';
|
2007-03-14 03:44:41 +01:00
|
|
|
|
|
|
|
my $directory;
|
|
|
|
|
2007-03-31 00:38:09 +02:00
|
|
|
for $directory ( @config_path ) {
|
2007-03-30 01:07:15 +02:00
|
|
|
my $file = "$directory$filename";
|
|
|
|
return $file if -f $file;
|
2007-03-14 03:44:41 +01:00
|
|
|
}
|
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
"$globals{CONFDIR}/$filename";
|
2007-03-14 03:44:41 +01:00
|
|
|
}
|
2007-03-14 03:50:28 +01:00
|
|
|
|
2007-03-30 01:07:15 +02:00
|
|
|
#
|
|
|
|
# When splitting a line, don't pad out the columns with '-' if the first column contains one of these
|
|
|
|
#
|
|
|
|
|
|
|
|
my %no_pad = ( COMMENT => 1,
|
|
|
|
SECTION => 1 );
|
|
|
|
|
|
|
|
#
|
|
|
|
# Pre-process a line from a configuration file.
|
2007-04-01 01:43:10 +02:00
|
|
|
|
2007-03-30 01:07:15 +02:00
|
|
|
# chomp it.
|
|
|
|
# compress out redundent white space.
|
|
|
|
# ensure that it has an appropriate number of columns.
|
|
|
|
# supply '-' in omitted trailing columns.
|
|
|
|
#
|
2007-04-01 17:38:05 +02:00
|
|
|
sub split_line( $$$ ) {
|
|
|
|
my ( $mincolumns, $maxcolumns, $description ) = @_;
|
2007-03-30 01:07:15 +02:00
|
|
|
|
|
|
|
my @line = split /\s+/, $line;
|
|
|
|
|
|
|
|
return @line if $no_pad{$line[0]};
|
|
|
|
|
2007-04-01 17:38:05 +02:00
|
|
|
fatal_error "Invalid $description entry (too few columns)" if @line < $mincolumns;
|
|
|
|
fatal_error "Invalid $description entry (too many columns)" if @line > $maxcolumns;
|
2007-03-30 01:07:15 +02:00
|
|
|
|
2007-04-01 17:38:05 +02:00
|
|
|
push @line, '-' while @line < $maxcolumns;
|
2007-03-30 01:07:15 +02:00
|
|
|
|
|
|
|
@line;
|
|
|
|
}
|
|
|
|
|
2007-03-29 17:47:47 +02:00
|
|
|
#
|
2007-03-31 00:38:09 +02:00
|
|
|
# Open a file, setting $currentfile. Returns the file's absolute pathname if the file
|
2007-03-30 17:57:08 +02:00
|
|
|
# exists, is non-empty and was successfully opened. Terminates with a fatal error
|
|
|
|
# if the file exists, is non-empty, but the open fails.
|
2007-03-29 17:47:47 +02:00
|
|
|
#
|
2007-04-01 01:43:10 +02:00
|
|
|
sub do_open_file( $ ) {
|
|
|
|
my $fname = $_[0];
|
|
|
|
open $currentfile, '<', $fname or fatal_error "Unable to open $fname: $!";
|
|
|
|
$currentlinenumber = 0;
|
|
|
|
$currentfilename = $fname;
|
|
|
|
}
|
|
|
|
|
2007-03-29 17:47:47 +02:00
|
|
|
sub open_file( $ ) {
|
|
|
|
my $fname = find_file $_[0];
|
|
|
|
|
|
|
|
fatal_error 'Internal Error in open_file()' if defined $currentfile;
|
|
|
|
|
2007-04-01 01:43:10 +02:00
|
|
|
do_open_file $fname if -f $fname && -s _;
|
2007-03-29 17:47:47 +02:00
|
|
|
}
|
|
|
|
|
2007-03-31 20:44:48 +02:00
|
|
|
#
|
2007-04-01 01:43:10 +02:00
|
|
|
# This function is normally called below in read_a_line() when EOF is reached. Clients of the
|
2007-03-31 20:44:48 +02:00
|
|
|
# module may also call the function to close the file before EOF
|
|
|
|
#
|
|
|
|
|
|
|
|
sub close_file() {
|
|
|
|
if ( $currentfile ) {
|
|
|
|
close $currentfile;
|
|
|
|
|
|
|
|
my $arrayref = pop @openstack;
|
|
|
|
|
|
|
|
if ( $arrayref ) {
|
|
|
|
( $currentfile, $currentfilename, $currentlinenumber ) = @$arrayref;
|
|
|
|
} else {
|
|
|
|
$currentfile = undef;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-03-29 17:47:47 +02:00
|
|
|
#
|
|
|
|
# Allow nested opens
|
|
|
|
#
|
|
|
|
my @pushstack;
|
|
|
|
|
|
|
|
sub push_open( $ ) {
|
|
|
|
|
2007-03-29 19:36:04 +02:00
|
|
|
push @openstack, [ $currentfile, $currentfilename, $currentlinenumber ];
|
2007-03-29 17:47:47 +02:00
|
|
|
my @a = @openstack;
|
|
|
|
push @pushstack, \@a;
|
|
|
|
@openstack = ();
|
|
|
|
$currentfile = undef;
|
|
|
|
open_file( $_[0] );
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
sub pop_open() {
|
|
|
|
@openstack = @{pop @pushstack};
|
2007-03-29 19:36:04 +02:00
|
|
|
|
|
|
|
my $arrayref = pop @openstack;
|
|
|
|
|
|
|
|
if ( $arrayref ) {
|
|
|
|
( $currentfile, $currentfilename, $currentlinenumber ) = @$arrayref;
|
|
|
|
} else {
|
|
|
|
$currentfile = undef;
|
|
|
|
}
|
2007-03-29 17:47:47 +02:00
|
|
|
}
|
|
|
|
|
2007-03-29 19:02:13 +02:00
|
|
|
#
|
|
|
|
# Read a line from the current open stack.
|
|
|
|
#
|
|
|
|
# - Ignore blank or comment-only lines.
|
|
|
|
# - Remove trailing comments.
|
2007-04-01 01:43:10 +02:00
|
|
|
# - Handle Line Continuation
|
2007-03-29 19:02:13 +02:00
|
|
|
# - Expand shell variables from $ENV.
|
|
|
|
# - Handle INCLUDE <filename>
|
|
|
|
#
|
|
|
|
|
2007-03-29 06:22:10 +02:00
|
|
|
sub read_a_line {
|
2007-03-29 17:47:47 +02:00
|
|
|
while ( $currentfile ) {
|
2007-03-29 16:24:35 +02:00
|
|
|
|
2007-03-29 19:02:13 +02:00
|
|
|
$line = '';
|
|
|
|
|
|
|
|
while ( my $nextline = <$currentfile> ) {
|
2007-03-30 17:57:08 +02:00
|
|
|
|
2007-03-29 19:36:04 +02:00
|
|
|
$currentlinenumber++;
|
2007-03-31 01:21:08 +02:00
|
|
|
|
2007-04-01 01:43:10 +02:00
|
|
|
chomp $nextline;
|
|
|
|
#
|
2007-04-01 02:05:42 +02:00
|
|
|
# Continuation
|
2007-04-01 01:43:10 +02:00
|
|
|
#
|
2007-03-29 19:02:13 +02:00
|
|
|
if ( substr( $nextline, -1, 1 ) eq '\\' ) {
|
2007-04-01 16:07:06 +02:00
|
|
|
$line .= substr( $nextline, 0, -1 );
|
2007-03-29 19:02:13 +02:00
|
|
|
next;
|
|
|
|
}
|
|
|
|
|
2007-04-01 01:43:10 +02:00
|
|
|
$line .= $nextline;
|
2007-04-01 02:05:42 +02:00
|
|
|
|
2007-04-01 16:07:06 +02:00
|
|
|
$line =~ s/#.*$//; # Remove Trailing Comments -- result might be a blank line
|
2007-04-01 02:05:42 +02:00
|
|
|
#
|
|
|
|
# Ignore ( concatenated ) Blank Lines
|
|
|
|
#
|
|
|
|
if ( $line =~ /^\s*$/ ) {
|
|
|
|
$line = '';
|
|
|
|
next;
|
|
|
|
}
|
2007-04-01 02:10:17 +02:00
|
|
|
|
2007-04-01 01:43:10 +02:00
|
|
|
$line =~ s/^\s+//; # Remove Leading white space
|
|
|
|
$line =~ s/\s+$//; # Remove Trailing white space
|
|
|
|
#
|
|
|
|
# Expand Shell Variables using $ENV
|
|
|
|
#
|
|
|
|
$line = join( '', $1 , ( $ENV{$2} || '' ) , $3 ) while $line =~ /^(.*?)\${([a-zA-Z]\w*)}(.*)$/;
|
|
|
|
$line = join( '', $1 , ( $ENV{$2} || '' ) , $3 ) while $line =~ /^(.*?)\$([a-zA-Z]\w*)(.*)$/;
|
|
|
|
|
2007-04-01 16:07:06 +02:00
|
|
|
if ( $line =~ /^INCLUDE\s/ ) {
|
2007-03-29 16:24:35 +02:00
|
|
|
|
|
|
|
my @line = split /\s+/, $line;
|
2007-03-29 06:22:10 +02:00
|
|
|
|
|
|
|
fatal_error "Missing file name after 'INCLUDE'" unless @line > 1;
|
|
|
|
fatal_error "Invalid INCLUDE command: $line" if @line > 2;
|
2007-03-29 19:36:04 +02:00
|
|
|
fatal_error "INCLUDEs nested too deeply: $line" if @openstack >= 4;
|
2007-03-29 06:22:10 +02:00
|
|
|
|
|
|
|
my $filename = find_file $line[1];
|
|
|
|
|
2007-04-01 16:07:06 +02:00
|
|
|
fatal_error "INCLUDE file $filename not found" unless ( -f $filename );
|
2007-03-29 06:22:10 +02:00
|
|
|
|
2007-04-01 01:43:10 +02:00
|
|
|
if ( -s _ ) {
|
|
|
|
push @openstack, [ $currentfile, $currentfilename, $currentlinenumber ];
|
|
|
|
$currentfile = undef;
|
|
|
|
do_open_file $filename;
|
|
|
|
}
|
2007-04-01 01:58:13 +02:00
|
|
|
|
|
|
|
$line = '';
|
2007-03-29 06:22:10 +02:00
|
|
|
} else {
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-03-31 20:44:48 +02:00
|
|
|
close_file;
|
2007-03-29 06:22:10 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-03-30 05:30:28 +02:00
|
|
|
sub default ( $$ ) {
|
|
|
|
my ( $var, $val ) = @_;
|
|
|
|
|
|
|
|
$config{$var} = $val unless defined $config{$var} && $config{$var} ne '';
|
|
|
|
}
|
|
|
|
|
|
|
|
sub default_yes_no ( $$ ) {
|
|
|
|
my ( $var, $val ) = @_;
|
|
|
|
|
|
|
|
my $curval = "\L$config{$var}";
|
|
|
|
|
|
|
|
if ( $curval ) {
|
|
|
|
if ( $curval eq 'no' ) {
|
|
|
|
$config{$var} = '';
|
|
|
|
} else {
|
|
|
|
fatal_error "Invalid value for $var ($val)" unless $curval eq 'yes';
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
$config{$var} = $val;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
sub report_capabilities() {
|
|
|
|
sub report_capability( $ ) {
|
|
|
|
my $cap = $_[0];
|
|
|
|
print " $capdesc{$cap}: ";
|
|
|
|
print $capabilities{$cap} ? "Available\n" : "Not Available\n";
|
|
|
|
}
|
|
|
|
|
|
|
|
print "Shorewall has detected the following capabilities:\n";
|
|
|
|
|
|
|
|
for my $cap ( sort { $capdesc{$a} cmp $capdesc{$b} } keys %capabilities ) {
|
|
|
|
report_capability $cap;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
sub mywhich( $ ) {
|
|
|
|
my $prog = $_[0];
|
|
|
|
|
|
|
|
for my $dir ( split /:/, $ENV{PATH} ) {
|
|
|
|
return "$dir/$prog" if -x "$dir/$prog";
|
|
|
|
}
|
|
|
|
|
|
|
|
'';
|
|
|
|
}
|
|
|
|
|
2007-04-01 21:30:09 +02:00
|
|
|
sub load_kernel_modules( ) {
|
|
|
|
my $moduleloader = mywhich 'modprobe' ? 'modprobe' : 'insmod';
|
|
|
|
|
|
|
|
my $modulesdir = $config{MODULESDIR};
|
|
|
|
|
|
|
|
unless ( $modulesdir ) {
|
|
|
|
my $uname = `uname -r`;
|
|
|
|
fatal_error "The command 'uname -r' failed" unless $? == 0;
|
|
|
|
chomp $uname;
|
|
|
|
$modulesdir = "/lib/modules/$uname/kernel/net/ipv4/netfilter:/lib/modules/$uname/kernel/net/netfilter";
|
|
|
|
}
|
|
|
|
|
|
|
|
my @moduledirectories = split /:/, $modulesdir;
|
|
|
|
|
|
|
|
if ( @moduledirectories && open_file 'modules' ) {
|
|
|
|
my %loadedmodules;
|
|
|
|
|
|
|
|
progress_message "Loading Modules...";
|
|
|
|
|
|
|
|
open LSMOD , '-|', 'lsmod' or fatal_error "Can't run lsmod";
|
|
|
|
|
|
|
|
while ( $line = <LSMOD> ) {
|
|
|
|
my $module = ( split( /\s+/, $line ) )[0];
|
|
|
|
|
|
|
|
unless ( $module eq 'Module' ) {
|
|
|
|
$loadedmodules{$module} = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
close LSMOD;
|
|
|
|
|
|
|
|
$config{MODULE_SUFFIX} = 'o gz ko o.gz ko.gz' unless $config{MODULES_SUFFIX};
|
|
|
|
|
|
|
|
my @suffixes = split /\s+/ , $config{MODULE_SUFFIX};
|
|
|
|
|
|
|
|
while ( read_a_line ) {
|
|
|
|
fatal_error "Invalid modules file entry" unless ( $line =~ /^loadmodule\s+([a-zA-Z]\w*)\s*(.*)$/ );
|
|
|
|
my ( $module, $arguments ) = ( $1, $2 );
|
|
|
|
unless ( $loadedmodules{ $module } ) {
|
|
|
|
for my $suffix ( @suffixes ) {
|
|
|
|
for my $directory ( @moduledirectories ) {
|
|
|
|
my $modulefile = "$directory/$module.$suffix";
|
|
|
|
if ( -f $modulefile ) {
|
|
|
|
if ( $moduleloader eq 'insmod' ) {
|
|
|
|
system ("insmod $modulefile $arguments" );
|
|
|
|
} else {
|
|
|
|
system( "modprobe $module $arguments" );
|
|
|
|
}
|
|
|
|
|
|
|
|
$loadedmodules{ $module } = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
#
|
|
|
|
# Determine which optional facilities are supported by iptables/netfilter
|
|
|
|
#
|
|
|
|
sub determine_capabilities() {
|
|
|
|
|
|
|
|
my $iptables = $config{IPTABLES};
|
|
|
|
|
|
|
|
$capabilities{NAT_ENABLED} = system( "$iptables -t nat -L -n > /dev/null 2>&1" ) == 0 ? 1 : 0;
|
|
|
|
$capabilities{MANGLE_ENABLED} = system( "$iptables -t mangle -L -n > /dev/null 2>&1" ) == 0 ? 1 : 0;
|
|
|
|
|
|
|
|
system( "$iptables -N fooX1234 > /dev/null 2>&1" );
|
|
|
|
|
|
|
|
$capabilities{CONNTRACK_MATCH} = system( "$iptables -A fooX1234 -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{MULTIPORT} = system( "$iptables -A fooX1234 -p tcp -m multiport --dports 21,22 -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{XMULTIPORT} = system( "$iptables -A fooX1234 -p tcp -m multiport --dports 21:22 -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{POLICY_MATCH} = system( "$iptables -A fooX1234 -m policy --pol ipsec --mode tunnel --dir in -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{PHYSDEV_MATCH} = system( "$iptables -A fooX1234 -m physdev --physdev-in eth0 -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
|
|
|
|
if ( system( "$iptables -A fooX1234 -m iprange --src-range 192.168.1.5-192.168.1.124 -j ACCEPT > /dev/null 2>&1" ) == 0 ) {
|
|
|
|
$capabilities{IPRANGE_MATCH} = 1;
|
|
|
|
unless ( $capabilities{KLUDGEFREE} ) {
|
|
|
|
$capabilities{KLUDGEFREE} = system( "$iptables -A fooX1234 -m iprange --src-range 192.168.1.5-192.168.1.124 -m iprange --dst-range 192.168.1.5-192.168.1.124 -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
$capabilities{RECENT_MATCH} = system( "$iptables -A fooX1234 -m recent --update -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{OWNER_MATCH} = system( "$iptables -A fooX1234 -m owner --uid-owner 0 -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
|
|
|
|
if ( system( "$iptables -A fooX1234 -m connmark --mark 2 -j ACCEPT > /dev/null 2>&1" ) == 0 ) {
|
|
|
|
$capabilities{CONNMARK_MATCH} = 1;
|
|
|
|
$capabilities{XCONNMARK_MATCH} = system( "$iptables -A fooX1234 -m connmark --mark 2/0xFF -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
$capabilities{IPP2P_MATCH} = system( "$iptables -A fooX1234 -p tcp -m ipp2p --ipp2p -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{LENGTH_MATCH} = system( "$iptables -A fooX1234 -m length --length 10:20 -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{ENHANCED_REJECT} = system( "$iptables -A fooX1234 -j REJECT --reject-with icmp-host-prohibited > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{COMMENTS} = system( qq($iptables -A fooX1234 -j ACCEPT -m comment --comment "This is a comment" > /dev/null 2>&1) ) == 0;
|
|
|
|
|
|
|
|
if ( $capabilities{MANGLE_ENABLED} ) {
|
|
|
|
system( "$iptables -t mangle -N fooX1234 > /dev/null 2>&1" );
|
|
|
|
|
|
|
|
if ( system( "$iptables -t mangle -A fooX1234 -j MARK --set-mark 1 > /dev/null 2>&1" ) == 0 ) {
|
|
|
|
$capabilities{MARK} = 1;
|
|
|
|
$capabilities{XMARK} = system( "$iptables -t mangle -A fooX1234 -j MARK --and-mark 0xFF > /dev/null 2>&1" ) == 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ( system( "$iptables -t mangle -A fooX1234 -j CONNMARK --save-mark > /dev/null 2>&1" ) == 0 ) {
|
|
|
|
$capabilities{CONNMARK} = 1;
|
|
|
|
$capabilities{XCONNMARK} = system( "$iptables -t mangle -A fooX1234 -j CONNMARK --save-mark --mask 0xFF > /dev/null 2>&1" ) == 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
$capabilities{CLASSIFY_TARGET} = system( "$iptables -t mangle -A fooX1234 -j CLASSIFY --set-class 1:1 > /dev/null 2>&1" ) == 0;
|
|
|
|
system( "$iptables -t mangle -F fooX1234 > /dev/null 2>&1" );
|
|
|
|
system( "$iptables -t mangle -X fooX1234 > /dev/null 2>&1" );
|
|
|
|
|
|
|
|
$capabilities{MANGLE_FORWARD} = system( "$iptables -t mangle -L FORWARD -n > /dev/null 2>&1" ) == 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
$capabilities{RAW_TABLE} = system( "$iptables -t raw -L -n > /dev/null 2>&1" ) == 0;
|
|
|
|
|
|
|
|
if ( mywhich 'ipset' ) {
|
|
|
|
system( "ipset -X fooX1234 > /dev/null 2>&1" );
|
|
|
|
|
|
|
|
if ( system( "ipset -N fooX1234 > /dev/null 2>&1" ) ) {
|
|
|
|
if ( system( "$iptables -A fooX1234 -m set --set fooX1234 src -j ACCEPT > /dev/null 2>&1" ) == 0 ) {
|
|
|
|
system( "$iptables -D fooX1234 -m set --set fooX1234 src -j ACCEPT > /dev/null 2>&1" );
|
|
|
|
$capabilities{IPSET_MATCH} = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
system( "ipset -X fooX1234 > /dev/null 2>&1" );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
$capabilities{USEPKTTYPE} = system( "$iptables -A fooX1234 -m pkttype --pkt-type broadcast -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
$capabilities{ADDRTYPE} = system( "$iptables -A fooX1234 -m addrtype --src-type BROADCAST -j ACCEPT > /dev/null 2>&1" ) == 0;
|
|
|
|
|
|
|
|
system( "$iptables -F fooX1234 > /dev/null 2>&1" );
|
|
|
|
system( "$iptables -X fooX1234 > /dev/null 2>&1" );
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2007-03-30 05:30:28 +02:00
|
|
|
sub require_capability( $$ ) {
|
|
|
|
my ( $capability, $description ) = @_;
|
|
|
|
|
|
|
|
fatal_error "$description requires $capdesc{$capability} in your kernel and iptables"
|
|
|
|
unless $capabilities{$capability};
|
|
|
|
}
|
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
#
|
2007-03-29 16:24:35 +02:00
|
|
|
# - Read the shorewall.conf file
|
|
|
|
# - Read the capabilities file created by the compiler front-end
|
2007-03-31 19:44:16 +02:00
|
|
|
# - establish global hashes %config , %globals and %capabilities
|
2007-03-14 03:44:41 +01:00
|
|
|
#
|
2007-03-31 19:44:16 +02:00
|
|
|
sub get_configuration( $ ) {
|
|
|
|
|
|
|
|
my $export = $_[0];
|
2007-03-31 00:38:09 +02:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
my $file = find_file 'shorewall.conf';
|
|
|
|
|
|
|
|
if ( -f $file ) {
|
|
|
|
if ( -r _ ) {
|
2007-03-30 01:07:15 +02:00
|
|
|
open_file $file;
|
2007-03-14 03:44:41 +01:00
|
|
|
|
2007-03-29 06:22:10 +02:00
|
|
|
while ( read_a_line ) {
|
2007-03-31 01:31:22 +02:00
|
|
|
if ( $line =~ /^\s*([a-zA-Z]\w*)=(.*?)\s*$/ ) {
|
2007-03-14 03:44:41 +01:00
|
|
|
my ($var, $val) = ($1, $2);
|
|
|
|
unless ( exists $config{$var} ) {
|
|
|
|
warning_message "Unknown configuration option \"$var\" ignored";
|
|
|
|
next;
|
|
|
|
}
|
|
|
|
|
2007-03-31 01:21:08 +02:00
|
|
|
$config{$var} = ( $val =~ /\"([^\"]*)\"$/ ? $1 : $val );
|
2007-03-14 03:44:41 +01:00
|
|
|
} else {
|
|
|
|
fatal_error "Unrecognized entry in $file: $line";
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
fatal_error "Cannot read $file (Hint: Are you root?)";
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
fatal_error "$file does not exist!";
|
|
|
|
}
|
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
$globals{ORIGINAL_POLICY_MATCH} = $capabilities{POLICY_MATCH};
|
2007-03-14 03:44:41 +01:00
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
default 'MODULE_PREFIX', 'o gz ko o.gz ko.gz';
|
2007-03-14 03:44:41 +01:00
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
my $uid = `id -u`;
|
2007-03-14 03:44:41 +01:00
|
|
|
|
2007-04-01 19:05:27 +02:00
|
|
|
fatal_error "Command 'id -u' failed" unless $? == 0;
|
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
chomp $uid;
|
2007-03-14 03:44:41 +01:00
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
if ( ! $export && $uid == 0 ) {
|
|
|
|
unless ( $config{IPTABLES} ) {
|
|
|
|
$config{IPTABLES} = mywhich 'iptables';
|
|
|
|
fatal_error "Can't find iptables executable" unless $config{IPTABLES};
|
2007-03-14 03:44:41 +01:00
|
|
|
} else {
|
2007-04-01 18:42:49 +02:00
|
|
|
fatal_error "\$IPTABLES=$capabilities{IPTABLES} does not exist or is not executable" unless -x $capabilities{IPTABLES};
|
|
|
|
}
|
2007-04-01 21:30:09 +02:00
|
|
|
|
|
|
|
load_kernel_modules;
|
2007-04-01 18:42:49 +02:00
|
|
|
|
|
|
|
unless ( open_file 'capabilities' ) {
|
|
|
|
determine_capabilities;
|
2007-03-14 03:44:41 +01:00
|
|
|
}
|
|
|
|
} else {
|
2007-04-01 18:42:49 +02:00
|
|
|
fatal_error "The -e flag requires a capabilities file" unless open_file 'capabilities';
|
2007-03-14 03:44:41 +01:00
|
|
|
}
|
2007-04-01 19:05:27 +02:00
|
|
|
#
|
|
|
|
# If we successfully called open_file above, then this loop will read the capabilities file.
|
|
|
|
# Otherwise, the first call to read_a_line() below will return false
|
|
|
|
#
|
2007-04-01 18:42:49 +02:00
|
|
|
while ( read_a_line ) {
|
2007-04-01 19:05:27 +02:00
|
|
|
if ( $line =~ /^([a-zA-Z]\w*)=(.*)$/ ) {
|
2007-04-01 18:42:49 +02:00
|
|
|
my ($var, $val) = ($1, $2);
|
|
|
|
unless ( exists $capabilities{$var} ) {
|
|
|
|
warning_message "Unknown capability \"$var\" ignored";
|
|
|
|
next;
|
|
|
|
}
|
2007-03-14 03:44:41 +01:00
|
|
|
|
2007-04-01 18:42:49 +02:00
|
|
|
$capabilities{$var} = $val =~ /^\"([^\"]*)\"$/ ? $1 : $val;
|
|
|
|
} else {
|
2007-04-01 19:05:27 +02:00
|
|
|
fatal_error "Unrecognized capabilities entry";
|
2007-04-01 18:42:49 +02:00
|
|
|
}
|
|
|
|
}
|
2007-03-14 03:44:41 +01:00
|
|
|
|
|
|
|
if ( $config{LOGRATE} || $config{LOGBURST} ) {
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{LOGLIMIT} = '-m limit';
|
|
|
|
$globals{LOGLIMIT} .= " --limit $config{LOGRATE}" if $config{LOGRATE};
|
|
|
|
$globals{LOGLIMIT} .= " --limit-burst $config{LOGBURST}" if $config{LOGBURST};
|
2007-03-14 03:44:41 +01:00
|
|
|
} else {
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{LOGLIMIT} = '';
|
2007-03-14 03:44:41 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if ( $config{IP_FORWARDING} ) {
|
|
|
|
fatal_error "Invalid value ( $config{IP_FORWARDING} ) for IP_FORWARDING"
|
|
|
|
unless $config{IP_FORWARDING} =~ /^(On|Off|Keep)$/i;
|
|
|
|
} else {
|
|
|
|
$config{IP_FORWARDING} = 'On';
|
|
|
|
}
|
|
|
|
|
|
|
|
default_yes_no 'ADD_IP_ALIASES' , 'Yes';
|
|
|
|
default_yes_no 'ADD_SNAT_ALIASES' , '';
|
|
|
|
default_yes_no 'ROUTE_FILTER' , '';
|
|
|
|
default_yes_no 'LOG_MARTIANS' , '';
|
|
|
|
default_yes_no 'DETECT_DNAT_IPADDRS' , '';
|
|
|
|
default_yes_no 'DETECT_DNAT_IPADDRS' , '';
|
|
|
|
default_yes_no 'CLEAR_TC' , 'Yes';
|
|
|
|
default_yes_no 'CLAMPMSS' , '' unless $config{CLAMPMSS} =~ /^\d+$/;
|
|
|
|
|
2007-03-23 22:24:28 +01:00
|
|
|
unless ( $config{ADD_IP_ALIASES} || $config{ADD_SNAT_ALIASES} ) {
|
2007-03-14 03:44:41 +01:00
|
|
|
$config{RETAIN_ALIASES} = '';
|
|
|
|
} else {
|
|
|
|
default_yes_no 'RETAIN_ALIASES' , '';
|
|
|
|
}
|
|
|
|
|
|
|
|
default_yes_no 'ADMINISABSENTMINDED' , '';
|
|
|
|
default_yes_no 'BLACKLISTNEWONLY' , '';
|
|
|
|
default_yes_no 'DISABLE_IPV6' , '';
|
|
|
|
default_yes_no 'DYNAMIC_ZONES' , '';
|
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
fatal_error "DYNAMIC_ZONES=Yes is incompatible with the -e option" if $config{DYNAMIC_ZONES} && $export;
|
2007-03-24 20:19:29 +01:00
|
|
|
|
|
|
|
default_yes_no 'BRIDGING' , '';
|
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
fatal_error 'BRIDGING=Yes is not supported by Shorewall-perl' . $globals{VERSION} if $config{BRIDGING};
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
default_yes_no 'STARTUP_ENABLED' , 'Yes';
|
|
|
|
default_yes_no 'DELAYBLACKLISTLOAD' , '';
|
2007-04-01 17:20:07 +02:00
|
|
|
|
|
|
|
warning_message 'DELAYBLACKLISTLOAD=Yes is not supported by Shorewall-perl ' . $globals{VERSION} if $config{DELAYBLACKLISTLOAD};
|
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
default_yes_no 'LOGTAGONLY' , '';
|
|
|
|
default_yes_no 'RFC1918_STRICT' , '';
|
|
|
|
default_yes_no 'SAVE_IPSETS' , '';
|
2007-03-24 18:16:13 +01:00
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
warning_message 'SAVE_IPSETS=Yes is not supported by Shorewall-perl ' . $globals{VERSION} if $config{SAVE_IPSETS};
|
2007-03-24 18:16:13 +01:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
default_yes_no 'MAPOLDACTIONS' , '';
|
2007-03-24 18:16:13 +01:00
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
warning_message 'MAPOLDACTIONS=Yes is not supported by Shorewall-perl ' . $globals{VERSION} if $config{MAPOLDACTIONS};
|
2007-03-24 18:16:13 +01:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
default_yes_no 'FASTACCEPT' , '';
|
|
|
|
default_yes_no 'IMPLICIT_CONTINUE' , '';
|
|
|
|
default_yes_no 'HIGH_ROUTE_MARKS' , '';
|
|
|
|
default_yes_no 'TC_EXPERT' , '';
|
|
|
|
default_yes_no 'USE_ACTIONS' , 'Yes';
|
2007-03-31 20:44:48 +02:00
|
|
|
|
|
|
|
warning_message 'USE_ACTIONS=No is not supported by Shorewall-perl ' . $globals{VERSION} unless $config{USE_ACTIONS};
|
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
default_yes_no 'EXPORTPARAMS' , '';
|
2007-03-25 18:38:00 +02:00
|
|
|
default_yes_no 'MARK_IN_FORWARD_CHAIN' , '';
|
2007-03-14 03:44:41 +01:00
|
|
|
|
|
|
|
$capabilities{XCONNMARK} = '' unless $capabilities{XCONNMARK_MATCH} and $capabilities{XMARK};
|
|
|
|
|
|
|
|
default 'BLACKLIST_DISPOSITION' , 'DROP';
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
my $val;
|
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{MACLIST_TARGET} = 'reject';
|
2007-03-14 03:44:41 +01:00
|
|
|
|
|
|
|
if ( $val = $config{MACLIST_DISPOSITION} ) {
|
|
|
|
unless ( $val eq 'REJECT' ) {
|
|
|
|
if ( $val eq 'DROP' ) {
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{MACLIST_TARGET} = 'DROP';
|
2007-03-14 03:44:41 +01:00
|
|
|
} elsif ( $val eq 'ACCEPT' ) {
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{MACLIST_TARGET} = 'RETURN';
|
2007-03-14 03:44:41 +01:00
|
|
|
} else {
|
|
|
|
fatal_error "Invalid value ( $config{MACLIST_DISPOSITION} ) for MACLIST_DISPOSITION"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
$config{MACLIST_DISPOSITION} = 'REJECT';
|
|
|
|
}
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
if ( $val = $config{MACLIST_TABLE} ) {
|
|
|
|
if ( $val eq 'mangle' ) {
|
|
|
|
fatal_error 'MACLIST_DISPOSITION=REJECT is not allowed with MACLIST_TABLE=mangle' if $config{MACLIST_DISPOSITION} eq 'REJECT';
|
|
|
|
} else {
|
|
|
|
fatal_error "Invalid value ($val) for MACLIST_TABLE option" unless $val eq 'filter';
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
default 'MACLIST_TABLE' , 'filter';
|
|
|
|
}
|
|
|
|
|
|
|
|
if ( $val = $config{TCP_FLAGS_DISPOSITION} ) {
|
|
|
|
fatal_error "Invalid value ($config{TCP_FLAGS_DISPOSITION}) for TCP_FLAGS_DISPOSITION" unless $val =~ /^(REJECT|ACCEPT|DROP)$/;
|
|
|
|
} else {
|
|
|
|
$config{TCP_FLAGS_DISPOSITION} = 'DROP';
|
|
|
|
}
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{TC_SCRIPT} = '';
|
2007-03-14 03:44:41 +01:00
|
|
|
|
|
|
|
if ( $val = "\L$config{TC_ENABLED}" ) {
|
|
|
|
if ( $val eq 'yes' ) {
|
|
|
|
$file = find_file 'tcstart';
|
|
|
|
fatal_error "Unable to find tcstart file" unless -f $file;
|
|
|
|
} elsif ( $val ne 'internal' ) {
|
|
|
|
fatal_error "Invalid value ($config{TC_ENABLED}) for TC_ENABLED" unless $val eq 'no';
|
|
|
|
$config{TC_ENABLED} = '';
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
default 'RESTOREFILE' , 'restore';
|
|
|
|
default 'DROP_DEFAULT' , 'Drop';
|
|
|
|
default 'REJECT_DEFAULT' , 'Reject';
|
|
|
|
default 'QUEUE_DEFAULT' , 'none';
|
|
|
|
default 'ACCEPT_DEFAULT' , 'none';
|
|
|
|
default 'OPTIMIZE' , 0;
|
|
|
|
default 'IPSECFILE' , 'ipsec';
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-04-01 17:38:05 +02:00
|
|
|
fatal_error 'IPSECFILE=ipsec is not supported by Shorewall-perl ' . $globals{VERSION} unless $config{IPSECFILE} eq 'zones';
|
2007-04-01 17:20:07 +02:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
for my $default qw/DROP_DEFAULT REJECT_DEFAULT QUEUE_DEFAULT ACCEPT_DEFAULT/ {
|
|
|
|
$config{$default} = 'none' if "\L$config{$default}" eq 'none';
|
|
|
|
}
|
|
|
|
|
|
|
|
$val = $config{OPTIMIZE};
|
|
|
|
|
|
|
|
fatal_error "Invalid OPTIMIZE value ($val)" unless ( $val eq '0' ) || ( $val eq '1' );
|
|
|
|
|
|
|
|
fatal_error "Invalid IPSECFILE value ($config{IPSECFILE}" unless $config{IPSECFILE} eq 'zones';
|
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{MARKING_CHAIN} = $config{MARK_IN_FORWARD_CHAIN} ? 'tcfor' : 'tcpre';
|
2007-03-14 03:44:41 +01:00
|
|
|
|
|
|
|
if ( $val = $config{LOGFORMAT} ) {
|
|
|
|
my $result;
|
|
|
|
|
|
|
|
eval {
|
|
|
|
if ( $val =~ /%d/ ) {
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{LOGRULENUMBERS} = 'Yes';
|
2007-03-14 03:44:41 +01:00
|
|
|
$result = sprintf "$val", 'fooxx2barxx', 1, 'ACCEPT';
|
|
|
|
} else {
|
|
|
|
$result = sprintf "$val", 'fooxx2barxx', 'ACCEPT';
|
|
|
|
}
|
|
|
|
};
|
|
|
|
|
|
|
|
fatal_error "Invalid LOGFORMAT ($val)" if $@;
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-03-31 20:44:48 +02:00
|
|
|
fatal_error "LOGFORMAT string is longer than 29 characters: \"$val\"" if length $result > 29;
|
2007-03-14 03:44:41 +01:00
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{MAXZONENAMELENGTH} = int ( 5 + ( ( 29 - (length $result ) ) / 2) );
|
2007-03-14 03:44:41 +01:00
|
|
|
} else {
|
2007-03-31 19:44:16 +02:00
|
|
|
$globals{LOGFORMAT}='Shorewall:%s:%s:';
|
|
|
|
$globals{MAXZONENAMELENGTH} = 5;
|
2007-03-14 03:44:41 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
sub propagateconfig() {
|
|
|
|
for my $option ( @Shorewall::Config::propagateconfig ) {
|
|
|
|
my $value = $config{$option} || '';
|
|
|
|
emit "$option=\"$value\"";
|
|
|
|
}
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-03-14 03:44:41 +01:00
|
|
|
for my $option ( @Shorewall::Config::propagateenv ) {
|
2007-03-31 19:44:16 +02:00
|
|
|
my $value = $globals{$option} || '';
|
2007-03-14 03:44:41 +01:00
|
|
|
emit "$option=\"$value\"";
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-03-14 05:06:32 +01:00
|
|
|
sub append_file( $ ) {
|
|
|
|
my $user_exit = find_file $_[0];
|
|
|
|
|
2007-03-31 19:44:16 +02:00
|
|
|
unless ( $user_exit =~ /$globals{SHAREDIR}/ ) {
|
2007-03-14 05:06:32 +01:00
|
|
|
if ( -f $user_exit ) {
|
|
|
|
save_progress_message "Processing $user_exit ...";
|
|
|
|
copy1 $user_exit;
|
|
|
|
}
|
2007-03-27 01:17:46 +02:00
|
|
|
}
|
2007-03-14 05:06:32 +01:00
|
|
|
}
|
|
|
|
|
2007-03-23 00:06:16 +01:00
|
|
|
#
|
|
|
|
# Run a Perl extension script
|
|
|
|
#
|
|
|
|
sub run_user_exit( $ ) {
|
|
|
|
my $chainref = $_[0];
|
|
|
|
my $file = find_file $chainref->{name};
|
|
|
|
|
|
|
|
if ( -f $file ) {
|
|
|
|
progress_message "Processing $file...";
|
|
|
|
|
|
|
|
unless (my $return = do $file) {
|
|
|
|
fatal_error "Couldn't parse $file: $@" if $@;
|
|
|
|
fatal_error "Couldn't do $file: $!" unless defined $return;
|
|
|
|
fatal_error "Couldn't run $file" unless $return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-03-17 19:18:54 +01:00
|
|
|
sub generate_aux_config() {
|
|
|
|
sub conditionally_add_option( $ ) {
|
|
|
|
my $option = $_[0];
|
|
|
|
|
|
|
|
my $value = $config{$option};
|
|
|
|
|
|
|
|
emit "[ -n \"\${$option:=$value}\" ]" if $value;
|
|
|
|
}
|
|
|
|
|
|
|
|
sub conditionally_add_option1( $ ) {
|
|
|
|
my $option = $_[0];
|
|
|
|
|
|
|
|
my $value = $config{$option};
|
|
|
|
|
|
|
|
emit "$option=\"$value\"" if $value;
|
|
|
|
}
|
|
|
|
|
|
|
|
create_temp_aux_config;
|
|
|
|
|
2007-04-01 00:03:16 +02:00
|
|
|
emit join ( '', "#\n# Shorewall auxiliary configuration file created by Shorewall-perl version ", $globals{VERSION}, ' - ' , localtime , "\n#" );
|
2007-03-27 01:17:46 +02:00
|
|
|
|
2007-03-17 19:18:54 +01:00
|
|
|
for my $option qw(VERBOSITY LOGFILE LOGFORMAT IPTABLES PATH SHOREWALL_SHELL SUBSYSLOCK RESTOREFILE SAVE_IPSETS) {
|
|
|
|
conditionally_add_option $option;
|
|
|
|
}
|
|
|
|
|
|
|
|
conditionally_add_option1 'TC_ENABLED';
|
|
|
|
|
|
|
|
finalize_aux_config;
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
1;
|