diff --git a/Shorewall/firewall b/Shorewall/firewall index a06e4e79a..c07d51e35 100755 --- a/Shorewall/firewall +++ b/Shorewall/firewall @@ -8261,22 +8261,6 @@ add_common_rules() { done fi - if [ -n "$DYNAMIC_ZONES" ]; then - echo "Setting up Dynamic Zone Chains..." - - for interface in $ALL_INTERFACES; do - for chain in $(dynamic_chains $interface); do - createchain $chain no - done - - chain=$(dynamic_in $interface) - createnatchain $chain - - run_iptables -A $(input_chain $interface) -j $chain - run_iptables -A $(forward_chain $interface) -j $(dynamic_fwd $interface) - run_iptables -A OUTPUT -o $interface -j $(dynamic_out $interface) - done - fi # # UPnP # @@ -8405,12 +8389,6 @@ activate_rules() addnatjump POSTROUTING $(snat_chain $interface) -o $interface done # - # Add jumps for dynamic nat chains - # - [ -n "$DYNAMIC_ZONES" ] && for interface in $ALL_INTERFACES ; do - addrulejump PREROUTING $(dynamic_in $interface) -i $interface - done - # # Add jumps from the builtin chains to the nat chains # addnatjump PREROUTING nat_in @@ -8441,10 +8419,8 @@ activate_rules() if [ -n "$is_ipsec" ]; then eval source_hosts=\$${zone}_hosts - [ -n "$DYNAMIC_ZONES" ] && create_zone_dyn_chain $zone $frwd_chain else eval source_hosts=\$${zone}_ipsec_hosts - [ -n "$DYNAMIC_ZONES" -a -n "$source_hosts" ] && create_zone_dyn_chain $zone $frwd_chain fi for host in $source_hosts; do @@ -8470,11 +8446,6 @@ activate_rules() echo $zone $type $source_hosts >> /var/lib/shorewall/zones - if [ -n "$DYNAMIC_ZONES" ]; then - echo "$FW $zone $chain1" >> /var/lib/shorewall/chains - echo "$zone $FW $chain2" >> /var/lib/shorewall/chains - fi - need_broadcast= for host in $source_hosts; do @@ -8524,8 +8495,6 @@ activate_rules() [ -z "$chain" ] && continue # CONTINUE policy and there is no canonical chain. - [ -n "$DYNAMIC_ZONES" ] && echo "$zone $zone1 $chain" >> /var/lib/shorewall/chains - if [ $zone = $zone1 ]; then # # Try not to generate superfluous intra-zone rules @@ -8835,368 +8804,6 @@ refresh_firewall() rm -rf $TMP_DIR } -# -# Add a host or networks to a zone -# -add_to_zone() # $1...${n-1} = [:] $n = zone -{ - local interface host zone z h z1 z2 chain - local dhcp_interfaces blacklist_interfaces maclist_interfaces - local tcpflags_interfaces newhostlist= - local rulenum source_chain dest_hosts iface hosts hostlist= - - nat_chain_exists() # $1 = chain name - { - qt $IPTABLES -t nat -L $1 -n - } - - do_iptables() # $@ = command - { - [ -n "$BRIDGING" ] && [ -f $TMP_DIR/physdev ] && rm -f $TMP_DIR/physdev - [ -n "$IPRANGE_MATCH" ] && [ -f $TMP_DIR/iprange ] && rm -f $TMP_DIR/iprange - - if ! $IPTABLES $@ ; then - error_message "Can't add $newhost to zone $zone" - fi - } - - # - # Load $zones - # - determine_zones - # - # Validate Interfaces File - # - validate_interfaces_file - # - # Validate Hosts File - # - validate_hosts_file - # - # Validate IPSec File - # - f=$(find_file ipsec) - - [ -f $f ] && setup_ipsec $f - # - # Normalize host list - # - while [ $# -gt 1 ]; do - interface=${1%%:*} - host=${1#*:} - # - # Be sure that the interface was dynamic at last [re]start - # - if ! chain_exists $(input_chain $interface) ; then - startup_error "Unknown interface $interface" - fi - - if ! chain_exists $(dynamic_in $interface) ; then - startup_error "At last Shorewall [re]start, DYNAMIC_ZONES=No in shorewall.conf" - fi - - if [ -z "$host" ]; then - hostlist="$hostlist $interface:0.0.0.0/0" - else - for h in $(separate_list $host); do - hostlist="$hostlist $interface:$h" - done - fi - - shift - done - # - # Validate Zone - # - zone=$1 - - validate_zone $zone || startup_error "Unknown zone: $zone" - - [ "$zone" = $FW ] && startup_error "Can't add $1 to firewall zone" - - # - # Be sure that Shorewall has been restarted using a DZ-aware version of the code - # - [ -f /var/lib/shorewall/chains ] || startup_error "/var/lib/shorewall/chains -- file not found" - [ -f /var/lib/shorewall/zones ] || startup_error "/var/lib/shorewall/zones -- file not found" - # - # Check for duplicates and create a new zone state file - # - > /var/lib/shorewall/zones_$$ - - while read z type hosts; do - if [ "$z" = "$zone" ]; then - for h in $hostlist; do - list_search $h $hosts - if [ "$?" -gt 0 ]; then - newhostlist="$newhostlist $h" - else - error_message "$h already in zone $zone" - fi - done - - [ -z "$hosts" ] && hosts=$newhostlist || hosts="$hosts $newhostlist" - fi - - eval ${z}_hosts=\"$hosts\" - - echo "$z $type $hosts" >> /var/lib/shorewall/zones_$$ - done < /var/lib/shorewall/zones - - mv -f /var/lib/shorewall/zones_$$ /var/lib/shorewall/zones - - TERMINATOR=fatal_error - # - # Create a new Zone state file - # - for newhost in $newhostlist; do - # - # Isolate interface and host parts - # - interface=${newhost%%:*} - host=${newhost#*:} - # - # If the zone passed in the command has a dnat chain then insert a rule in - # the nat table PREROUTING chain to jump to that chain when the source - # matches the new host(s)# - # - chain=${zone}_dnat - - if nat_chain_exists $chain; then - do_iptables -t nat -A $(dynamic_in $interface) $(source_ip_range $host) $(match_ipsec_in $zone $newhost) -j $chain - fi - # - # Insert new rules into the filter table for the passed interface - # - while read z1 z2 chain; do - [ "$z1" = "$z2" ] && op="-I" || op="-A" - if [ "$z1" = "$zone" ]; then - if [ "$z2" = "$FW" ]; then - do_iptables $op $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j $chain - else - source_chain=$(dynamic_fwd $interface) - if is_ipsec_host $z1 $newhost ; then - do_iptables $op $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd - else - eval dest_hosts=\"\$${z2}_hosts\" - - for h in $dest_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - do_iptables $op $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain - fi - done - fi - fi - elif [ "$z2" = "$zone" ]; then - if [ "$z1" = "$FW" ]; then - # - # Add a rule to the dynamic out chain for the interface - # - do_iptables $op $(dynamic_out $interface) $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain - else - eval source_hosts=\"\$${z1}_hosts\" - - for h in $source_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - if is_ipsec_host $z1 $h; then - do_iptables $op ${z1}_dyn -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain - else - do_iptables $op $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain - fi - fi - done - fi - fi - done < /var/lib/shorewall/chains - - progress_message "$newhost added to zone $zone" - - done - - rm -rf $TMP_DIR -} - -# -# Delete a host or networks from a zone -# -delete_from_zone() # $1 = [:] $2 = zone -{ - local interface host zone z h z1 z2 chain delhost - local dhcp_interfaces blacklist_interfaces maclist_interfaces tcpflags_interfaces - local rulenum source_chain dest_hosts iface hosts hostlist= - - # - # Load $zones - # - determine_zones - # - # Validate Interfaces File - # - validate_interfaces_file - # - # Validate Hosts File - # - validate_hosts_file - # - # Validate IPSec File - # - f=$(find_file ipsec) - - [ -f $f ] && setup_ipsec $f - - # - # Normalize host list - # - while [ $# -gt 1 ]; do - interface=${1%%:*} - host=${1#*:} - # - # Be sure that the interface was dynamic at last [re]start - # - if ! chain_exists $(input_chain $interface) ; then - startup_error "Unknown interface $interface" - fi - - if ! chain_exists $(dynamic_in $interface) ; then - startup_error "At last Shorewall [re]start, DYNAMIC_ZONES=No in shorewall.conf" - fi - - if [ -z "$host" ]; then - hostlist="$hostlist $interface:0.0.0.0/0" - else - for h in $(separate_list $host); do - hostlist="$hostlist $interface:$h" - done - fi - - shift - done - # - # Validate Zone - # - zone=$1 - - validate_zone $zone || startup_error "Unknown zone: $zone" - - [ "$zone" = $FW ] && startup_error "Can't delete from the firewall zone" - - # - # Be sure that Shorewall has been restarted using a DZ-aware version of the code - # - [ -f /var/lib/shorewall/chains ] || startup_error "/var/lib/shorewall/chains -- file not found" - [ -f /var/lib/shorewall/zones ] || startup_error "/var/lib/shorewall/zones -- file not found" - # - # Delete the passed hosts from the zone state file - # - > /var/lib/shorewall/zones_$$ - - while read z hosts; do - if [ "$z" = "$zone" ]; then - temp=$hosts - hosts= - - for host in $hostlist; do - found= - for h in $temp; do - if [ "$h" = "$host" ]; then - found=Yes - break - fi - done - - [ -n "$found" ] || error_message "Warning: $host does not appear to be in zone $zone" - done - - for h in $temp; do - found= - for host in $hostlist; do - if [ "$h" = "$host" ]; then - found=Yes - break - fi - done - - [ -n "$found" ] || hosts="$hosts $h" - done - fi - - eval ${z}_hosts=\"$hosts\" - - echo "$z $hosts" >> /var/lib/shorewall/zones_$$ - done < /var/lib/shorewall/zones - - mv -f /var/lib/shorewall/zones_$$ /var/lib/shorewall/zones - - TERMINATOR=fatal_error - - for delhost in $hostlist; do - interface=${delhost%%:*} - host=${delhost#*:} - # - # Delete any nat table entries for the host(s) - # - qt_iptables -t nat -D $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $zone $delhost) -j ${zone}_dnat - # - # Delete rules rules the input chains for the passed interface - # - while read z1 z2 chain; do - if [ "$z1" = "$zone" ]; then - if [ "$z2" = "$FW" ]; then - qt_iptables -D $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $delhost) -j $chain - else - source_chain=$(dynamic_fwd $interface) - if is_ipsec_host $z1 $delhost ; then - qt_iptables -D $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd - else - eval dest_hosts=\"\$${z2}_hosts\" - - [ "$z2" = "$zone" ] && dest_hosts="$dest_hosts $hostlist" - - for h in $dest_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - qt_iptables -D $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain - fi - done - fi - fi - elif [ "$z2" = "$zone" ]; then - if [ "$z1" = "$FW" ]; then - qt_iptables -D $(dynamic_out $interface) $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain - else - eval source_hosts=\"\$${z1}_hosts\" - - for h in $source_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - if is_ipsec_host $z1 $h; then - qt_iptables -D ${z1}_dyn -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain - else - qt_iptables -D $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain - fi - fi - done - fi - fi - done < /var/lib/shorewall/chains - - progress_message "$delhost removed from zone $zone" - - done - - rm -rf $TMP_DIR -} - # # Determine the value for a parameter that defaults to Yes # @@ -9304,7 +8911,6 @@ do_initialize() { SMURF_LOG_LEVEL= DISABLE_IPV6= BRIDGING= - DYNAMIC_ZONES= PKTTYPE= USEPKTYPE= RETAIN_ALIASES= @@ -9497,7 +9103,6 @@ do_initialize() { BLACKLISTNEWONLY=$(added_param_value_no BLACKLISTNEWONLY $BLACKLISTNEWONLY) DISABLE_IPV6=$(added_param_value_no DISABLE_IPV6 $DISABLE_IPV6) BRIDGING=$(added_param_value_no BRIDGING $BRIDGING) - DYNAMIC_ZONES=$(added_param_value_no DYNAMIC_ZONES $DYNAMIC_ZONES) STARTUP_ENABLED=$(added_param_value_yes STARTUP_ENABLED $STARTUP_ENABLED) RETAIN_ALIASES=$(added_param_value_no RETAIN_ALIASES $RETAIN_ALIASES) DELAYBLACKLISTLOAD=$(added_param_value_no DELAYBLACKLISTLOAD $DELAYBLACKLISTLOAD) diff --git a/Shorewall/help b/Shorewall/help index febd8edcf..bb912bd47 100755 --- a/Shorewall/help +++ b/Shorewall/help @@ -28,28 +28,6 @@ case $1 in -add) - echo "add: add [:] ... - Adds a list of hosts or subnets to a dynamic zone usually used with VPN's. - - shorewall add interface:host-list ... zone - Adds the specified interface - (and host-list if included) to the specified zone. - - A host-list is a comma-separated list whose elements are: - - A host or network address - The name of a bridge port - The name of a bridge port followed by a colon (":") and a host or - network address. - - Example: - - shorewall add ipsec0:192.0.2.24 vpn1 -- adds the address 192.0.2.24 - from interface ipsec0 to the zone vpn1. - - See also \"help host\"" - ;; - address|host) echo "<$1>: May be either a host IP address such as 192.168.1.4 or a network address in @@ -104,28 +82,6 @@ debug) The word 'trace' is a synonym for 'debug'." ;; -delete) - echo "delete: delete [:] ... - Deletes a list of hosts or networks from a dynamic zone usually used with VPN's. - - shorewall delete interface[:host-list] ... zone - Deletes the specified - interfaces (and host list if included) from the specified zone. - - A host-list is a comma-separated list whose elements are: - - A host or network address - The name of a bridge port - The name of a bridge port followed by a colon (":") and a host or - network address. - - Example: - - shorewall delete ipsec0:192.0.2.24 vpn1 -- deletes the address - 192.0.2.24 from interface ipsec0 from zone vpn1 - - See also \"help host\"" - ;; - drop) echo "$1: $1
... Causes packets from the specified
to be ignored diff --git a/Shorewall/shorewall b/Shorewall/shorewall index 19a70a892..63ff55940 100755 --- a/Shorewall/shorewall +++ b/Shorewall/shorewall @@ -31,8 +31,6 @@ # # Commands are: # -# shorewall add [:] zone Adds a host or subnet to a zone -# shorewall delete [:] zone Deletes a host or subnet from a zone # shorewall dump Dumps all Shorewall-related information # for problem analysis # shorewall start Starts the firewall @@ -499,11 +497,9 @@ usage() # $1 = exit status { echo "Usage: $(basename $0) [debug|trace] [nolock] [ -x ] [ -q ] [ -f ] [ -v ] [ -n ] " echo "where is one of:" - echo " add [:{[:]|}[,...]] ... " echo " allow
..." echo " check [ ]" echo " clear" - echo " delete [:{[:]|}[,...]] ... " echo " drop
..." echo " dump" echo " forget [ ]" @@ -842,10 +838,6 @@ case "$1" in exec $SHOREWALL_SHELL $FIREWALL $debugging $nolock $1 ;; - add|delete) - [ $# -lt 3 ] && usage 1 - exec $SHOREWALL_SHELL $FIREWALL $debugging $nolock $@ - ;; show|list) [ -n "$debugging" ] && set -x case "$2" in diff --git a/Shorewall/shorewall.conf b/Shorewall/shorewall.conf index 786881127..0af560a9a 100755 --- a/Shorewall/shorewall.conf +++ b/Shorewall/shorewall.conf @@ -698,14 +698,6 @@ DISABLE_IPV6=Yes BRIDGING=No -# -# DYNAMIC ZONES -# -# If you need to be able to add and delete hosts from zones dynamically then -# set DYNAMIC_ZONES=Yes. Otherwise, set DYNAMIC_ZONES=No. - -DYNAMIC_ZONES=No - # # USE PKTTYPE MATCH #