extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-20 17:58:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

NewNotSyn Reimplimentation

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1365 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-05-27 18:18:41 +00:00
parent ccb3c8740c
commit 102743a0e3
4 changed files with 82 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall2/action.Drop
View File

@ -10,6 +10,6 @@ RejectAuth
dropBcast dropBcast
DropSMB DropSMB
DropUPnP DropUPnP
dropNonSyn dropNotSyn
DropDNSrep DropDNSrep
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

2
Shorewall2/action.Reject
View File

@ -10,6 +10,6 @@ RejectAuth
dropBcast dropBcast
RejectSMB RejectSMB
DropUPnP DropUPnP
dropNonSyn dropNotSyn
DropDNSrep DropDNSrep
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

69
Shorewall2/firewall
View File

@ -2745,37 +2745,9 @@ createactionchain() # $1 = chain name
# #
process_actions1() { process_actions1() {
#
# Add the builtin actions
#
add_builtin_actions() {
if [ "$COMMAND" != check ]; then ACTIONS="dropBcast dropNonSyn dropNotSyn rejectNotSyn logNotSyn rLogNotSyn dLogNotSyn"
createchain dropBcast no USEDACTIONS=
qt iptables -A dropBcast -m pkttype --pkt-type broadcast -j DROP
if ! qt iptables -A dropBcast -m pkttype --pkt-type multicast -j DROP; then
#
# No pkttype support -- do it the hard way
#
for address in $(find_broadcasts) 255.255.255.255 224.0.0.0/4 ; do
run_iptables -A dropBcast -d $address -j DROP
done
fi
createchain dropNonSyn no
run_iptables -A dropNonSyn -p tcp ! --syn -j DROP
createchain rejectNonSyn no
run_iptables -A rejectNonSyn -p tcp ! --syn -j REJECT --reject-with tcp-reset
fi
ACTIONS="dropBcast dropNonSyn RejectNonSyn"
USEDACTIONS="dropBcast dropNonSyn RejectNonSyn"
}
add_builtin_actions
strip_file actions strip_file actions
@ -2888,6 +2860,10 @@ process_actions2() {
process_action $xaction $xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec process_action $xaction $xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec
} }
log_action() {
[ "$COMMAND" != check ] && log_rule ${LOGNEWNOTSYN:-info} $1 $2 "" "" -p tcp ! --syn
}
# #
# Generate the transitive closure of $USEDACTIONS # Generate the transitive closure of $USEDACTIONS
# #
@ -2911,7 +2887,38 @@ process_actions2() {
# #
for xaction in $USEDACTIONS; do for xaction in $USEDACTIONS; do
case $xaction in case $xaction in
dropNonSyn|dropBcast|RejectNonSyn) dropBcast)
if [ "$COMMAND" != check ]; then
qt iptables -A dropBcast -m pkttype --pkt-type broadcast -j DROP
if ! qt iptables -A dropBcast -m pkttype --pkt-type multicast -j DROP; then
#
# No pkttype support -- do it the hard way
#
for address in $(find_broadcasts) 255.255.255.255 224.0.0.0/4 ; do
run_iptables -A dropBcast -d $address -j DROP
done
fi
fi
;;
dropNonSyn)
error_message "WARNING: \"dropNonSyn\" has been replaced by \"dropNotSyn\""
[ "$COMMAND" != check ] && run_iptables -A dropNonSyn -p tcp ! --syn -j DROP
;;
dropNotSyn)
[ "$COMMAND" != check ] && run_iptables -A dropNotSyn -p tcp ! --syn -j DROP
;;
rejectNotSyn)
[ "$COMMAND" != check ] && run_iptables -A rejectNotSyn -p tcp ! --syn -j REJECT --reject-with tcp-reset
;;
logNotSyn)
log_action logNotSyn LOG
;;
rLogNotSyn)
log_action rLogNotSyn REJECT
;;
dLogNotSyn)
log_action dLogNotSyn DROP
;; ;;
*) *)
f=action.$xaction f=action.$xaction

42
Shorewall2/releasenotes.txt
View File

@ -26,7 +26,14 @@ Problems Corrected since 2.0.2
----------------------------------------------------------------------- -----------------------------------------------------------------------
Issues when migrating from Shorewall 2.0.2 to Shorewall 2.0.3: Issues when migrating from Shorewall 2.0.2 to Shorewall 2.0.3:
None. 1) The 'dropNonSyn' standard builtin action has been replaced with the
'dropNotSyn' standard builtin action. The old name can still be used
but will generate a warning.
2) To lay the groundwork for eventual removal of NEWNOTSYN from
shorewall.conf and removal of the 'newnotsyn' interface option,
several new standard builtin actions have been defined. See New
Feature 3 below.
----------------------------------------------------------------------- -----------------------------------------------------------------------
New Features: New Features:
@ -41,4 +48,37 @@ New Features:
3) A new 'rejectNonSyn' built-in standard action has been added. This 3) A new 'rejectNonSyn' built-in standard action has been added. This
action responds to "New not SYN" packets with an RST. action responds to "New not SYN" packets with an RST.
The 'dropNonSyn' action has been superceded by the new 'dropNotSyn'
action. The old name will be accepted until the next major release
of Shorewall but will generate a warning.
Several new logging actions involving "New not SYN" packets have
been added:
logNewNotSyn -- logs the packet with disposition = LOG
dLogNewNotSyn -- logs the packet with disposition = DROP
rLogNewNotSyn -- logs the packet with disposition = REJECT
The packets are logged at the log level specified in the
LOGNEWNOTSYN option in shorewall.conf. If than option is empty or
not specified, then 'info' is assumed.
Examples (In all cases, set NEWNOTSYN=Yes in shorewall.conf):
A: To simulate the behavior of NEWNOTSYN=No:
a) Add 'NoNewNotSyn' to /etc/shorewall/actions.
b) Create /etc/shorewall/action.NoNewNotSyn containing:
dLogNotSyn
dropNotSyn
c) Early in your rules file, place:
NoNewNotSyn all all tcp
B: Drop 'New not SYN' packets from the net only. Don't log them.
a) Early in your rules file, place:
dropNotSyn net all tcp