IPSEC 2.6 Fixes

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1537 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Shorewall2/changelog.txt

@@ -36,3 +36,7 @@ Changes since 2.0.3
 16) Added DNAT ONLY column to /etc/shorewall/nat.
 
 17) Removed SNAT from ORIGINAL DESTINATION column.
+
+18) Removed DNAT ONLY column.
+
+19) Added IPSEC column to /etc/shorewall/masq.

Shorewall2/firewall

@@ -613,7 +613,11 @@ match_ipsec_in() # $1 = zone, $2 = host
 {
     eval local hosts=\"\$${1}_ipsec_hosts\"
 
-    list_search $2 $hosts && echo "-m policy --pol ipsec --dir in"
+    if list_search $2 $hosts; then
+	echo "-m policy --pol ipsec --dir in"
+    elif [ -n "$POLICY_MATCH" ]; then
+	echo "-m policy --pol none --dir in"
+    fi
 }
 
 #
@@ -623,26 +627,10 @@ match_ipsec_out() # $1 = zone, $2 = host
 {
     eval local hosts=\"\$${1}_ipsec_hosts\"
 
-   list_search $2 $hosts && echo "-m policy --pol ipsec --dir out"
+    if list_search $2 $hosts; then
-}
+	echo "-m policy --pol ipsec --dir out"
-
+    elif [ -n "$POLICY_MATCH" ]; then
-#
+	echo "-m policy --pol none --dir out"
-# Generate a match for packets that have been decrypted and that will be encrypted
-#
-match_ipsec_inout() # $1 =input zone, $2 = input host, $3 = output zone, $4 = output host"
-{
-    local result="-m policy --pol ipsec"
-    eval local input_hosts=\"\$${1}_ipsec_hosts\"
-    eval local output_hosts=\"\$${3}_ipsec_hosts\"
-
-    if list_search $2 $input_hosts; then
-	result="$result --dir in"
-        if list_search $4 $output_hosts; then
-	    result="$result --dir out"
-        fi
-	echo $result
-    elif list_search $4 $output_hosts; then
-	echo "$result --dir out"
     fi
 }
 
@@ -898,7 +886,10 @@ validate_hosts_file() {
 		    maclist|norfc1918|nobogons|blacklist|tcpflags|nosmurfs|newnotsyn|-)
 			;;
 		    ipsec)
+			[ -n "$POLICY_MATCH" ] || \
+			    startup_error "Your kernel and/or iptables does not not support policy match: ipsec"
 			eval ${z}_ipsec_hosts=\"\$${z}_ipsec_hosts $interface:$host\"
+			eval ${z}_is_complex=Yes
 			;;
 		    routeback)
 			[ -z "$ports" ] && \
@@ -4464,7 +4455,27 @@ get_routed_networks() # $1 = interface name
 setup_masq()
 {
     setup_one() {
-	local add_snat_aliases=$ADD_SNAT_ALIASES, pre_nat=
+	local add_snat_aliases=$ADD_SNAT_ALIASES, pre_nat= policy=
+
+	[ "x$ipsec" = x- ] && ipsec=
+
+	case $ipsec in
+	    Yes|yes)
+		[ -n "$POLICY_MATCH" ] || \
+		    fatal_error "IPSEC=Yes requires policy match support in your kernel and iptables"
+		policy="-m policy --pol ipsec --dir out"
+		;;
+	    No|no)
+		[ -n "$POLICY_MATCH" ] || \
+		    fatal_error "IPSEC=No requires policy match support in your kernel and iptables"
+		policy="-m policy --pol none --dir out"
+		;;
+	    *)
+		[ -n "$ipsec" ] && \
+		    fatal_error "Invalid value in IPSEC column: $ipsec"
+		[ -n "$POLICY_MATCH" ] && policy="-m policy --pol none --dir out"
+		;;
+	esac
 
 	case $fullinterface in
 	    +*)
@@ -4612,7 +4623,7 @@ setup_masq()
 
 		if [ -n "$networks" ]; then
 		    for s in $networks; do
-			addnatrule $chain -s $s $proto $ports -j $newchain
+			addnatrule $chain -s $s $proto $ports $policy -j $newchain
 		    done
 		    networks=
 		else
@@ -4624,6 +4635,7 @@ setup_masq()
 		destnets=0.0.0.0/0
 		proto=
 		ports=
+		policy=
 
 		if [ -n "$nomasq" ]; then
 		    for addr in $(separate_list $nomasq); do
@@ -4645,7 +4657,7 @@ setup_masq()
 			done
 		    else
 			for destnet in $(separate_list $destnets); do
-			    addnatrule $chain -d $destnet $proto $ports -j $newchain
+			    addnatrule $chain -d $destnet $proto $ports $policy -j $newchain
 			done
 		    fi
 
@@ -4655,6 +4667,7 @@ setup_masq()
 		    destnets=0.0.0.0/0
 		    proto=
 		    ports=
+		    policy=
 
 		    for addr in $(separate_list $nomasq); do
 			addnatrule $chain -s $addr -j RETURN
@@ -4677,24 +4690,24 @@ setup_masq()
 	    for s in $networks; do
 		if [ -n "$addresses" ]; then
 		    for destnet in $(separate_list $destnets); do
-			addnatrule $chain -s $s -d $destnet $proto $ports -j SNAT $addrlist
+			addnatrule $chain -s $s -d $destnet $proto $ports $policy -j SNAT $addrlist
 		    done
 		    progress_message "   To $destination $displayproto from $s through ${interface} using $addresses"
 		else
 		    for destnet in $(separate_list $destnets); do
-			addnatrule $chain -s $s -d $destnet $proto $ports -j MASQUERADE
+			addnatrule $chain -s $s -d $destnet $proto $ports $policy -j MASQUERADE
 		    done
 		    progress_message "   To $destination $displayproto from $s through ${interface}"
 		fi
 	    done
 	elif [ -n "$addresses" ]; then
 	    for destnet in $(separate_list $destnets); do
-		addnatrule $chain -d $destnet $proto $ports -j SNAT $addrlist
+		addnatrule $chain -d $destnet $proto $ports $policy -j SNAT $addrlist
 	    done
 	    echo "   To $destination $displayproto from $source through ${interface} using $addresses"
 	else
 	    for destnet in $(separate_list $destnets); do
-		addnatrule $chain -d $destnet $proto $ports -j MASQUERADE
+		addnatrule $chain -d $destnet $proto $ports $policy -j MASQUERADE
 	    done
 	    progress_message "   To $destination $displayproto from $source through ${interface}"
 	fi
@@ -4705,8 +4718,8 @@ setup_masq()
 
     [ -n "$NAT_ENABLED" ] && echo "Masqueraded Networks and Hosts:" && save_progress_message "Restoring Masquerading/SNAT..."
 
-    while read fullinterface networks addresses proto ports; do
+    while read fullinterface networks addresses proto ports ipsec; do
-	expandv fullinterface networks addresses proto ports
+	expandv fullinterface networks addresses proto ports ipsec
 	[ -n "$NAT_ENABLED" ] && setup_one || \
 	    error_message "Warning: NAT disabled; masq rule ignored"
     done < $TMP_DIR/masq
@@ -5000,10 +5013,13 @@ determine_capabilities() {
 
     CONNTRACK_MATCH=
     MULTIPORT=
+    POLICY_MATCH=
 
     if qt iptables -N fooX1234 ; then
 	qt iptables -A fooX1234 -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT && CONNTRACK_MATCH=Yes
         qt iptables -A fooX1234 -p tcp -m multiport --dports 21,22 -j ACCEPT   && MULTIPORT=Yes
+	qt iptables -A fooX1234 -m policy --pol ipsec --dir in -j ACCEPT       && POLICY_MATCH=Yes
+	
 
 	qt iptables -F fooX1234
 	qt iptables -X fooX1234
@@ -5035,6 +5051,7 @@ report_capabilities() {
     report_capability $MULTIPORT "Multi-port Match"
     report_capability $CONNTRACK_MATCH "Connection Tracking Match"
     report_capability $PKTTYPE "Packet Type Match"
+    report_capability $POLICY_MATCH "Policy Match"
 }
 
 #
@@ -5796,7 +5813,7 @@ activate_rules()
 			networks1=${host1#*:}
 
 			if [ "$host" != "$host1" ] || list_search $host $routeback; then
-			    run_iptables -A $chain1 $(match_source_hosts $networks) -o $interface1 $(match_dest_hosts $networks1) $(match_ipsec_inout $zone $host $zone1 $host1) -j $chain
+			    run_iptables -A $chain1 $(match_source_hosts $networks) -o $interface1 $(match_dest_hosts $networks1) $(match_ipsec_out $zone1 $host1) -j $chain
 			fi
 		    done
 		done

Shorewall2/masq

@@ -93,6 +93,22 @@
 #				support and a maximum of 15 ports may be 
 #				listed.
 #				
+#	IPSEC -- (Optional)	If you specify a value other than "-" in this
+#				column, you must be running kernel 2.6 and 
+#				your kernel and iptables must include policy
+#				match support.
+#
+#				Yes -- Only packets that will be encrypted using
+#				       an ipsec policy will have their source
+#				       address changed.
+#
+#				No  -- Only packets that will not be encrypted
+#				       using an ipsec policy will have their
+#				       source address changed.
+#
+#				- or empty is the same as No providing that 
+#				your kernel and iptables contain policy match
+#				support.
 #
 #	Example 1:
 #
@@ -147,5 +163,5 @@
 #		THE ORDER OF THE ABOVE TWO RULES IS SIGNIFICANT!!!!!
 #
 ###############################################################################
-#INTERFACE	        SUBNET		ADDRESS		PROTO	PORT(S)
+#INTERFACE	        SUBNET		ADDRESS		PROTO	PORT(S)	IPSEC
 #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

Shorewall2/releasenotes.txt

@@ -256,3 +256,9 @@ New Features:
 	/etc/shorewall/hosts:
 
 	vpn	eth0:0.0.0.0/0	ipsec
+
+    The /etc/shorewall/masq file has a new IPSEC column added. If you
+    specify Yes or yes in that column then the unencrypted packets will
+    have their source address changed. Otherwise, the unencrypted
+    packets will not have their source addresses changed.
+