extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-22 23:53:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update for 2.2.6

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@2433 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2005-07-30 14:21:40 +00:00
parent 86f20a374b
commit 303b01e254
3 changed files with 36 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
Lrp2/usr/share/shorewall/bogons
View File

@ -35,6 +35,7 @@
# #
# The program was contributed by Andy Wiggin # The program was contributed by Andy Wiggin
# #
0.0.0.0/7 logdrop # Reserved 0.0.0.0/7 logdrop # Reserved
2.0.0.0/8 logdrop # Reserved 2.0.0.0/8 logdrop # Reserved
5.0.0.0/8 logdrop # Reserved 5.0.0.0/8 logdrop # Reserved
@ -45,25 +46,21 @@
36.0.0.0/7 logdrop # Reserved 36.0.0.0/7 logdrop # Reserved
39.0.0.0/8 logdrop # Reserved 39.0.0.0/8 logdrop # Reserved
42.0.0.0/8 logdrop # Reserved 42.0.0.0/8 logdrop # Reserved
49.0.0.0/8 logdrop # JTC - Returned to IANA Mar 98 77.0.0.0/8 logdrop # Reserved
50.0.0.0/8 logdrop # JTC - Returned to IANA Mar 98 78.0.0.0/7 logdrop # Reserved
74.0.0.0/7 logdrop # Reserved
76.0.0.0/6 logdrop # Reserved
89.0.0.0/8 logdrop # Reserved
90.0.0.0/7 logdrop # Reserved
92.0.0.0/6 logdrop # Reserved 92.0.0.0/6 logdrop # Reserved
96.0.0.0/3 logdrop # Reserved 96.0.0.0/4 logdrop # Reserved
127.0.0.0/8 logdrop # Loopback 112.0.0.0/5 logdrop # Reserved
120.0.0.0/6 logdrop # Reserved
127.0.0.0/8 logdrop # Reserved
173.0.0.0/8 logdrop # Reserved 173.0.0.0/8 logdrop # Reserved
174.0.0.0/7 logdrop # Reserved 174.0.0.0/7 logdrop # Reserved
176.0.0.0/5 logdrop # Reserved 176.0.0.0/5 logdrop # Reserved
184.0.0.0/6 logdrop # Reserved 184.0.0.0/6 logdrop # Reserved
189.0.0.0/8 logdrop # Reserved
190.0.0.0/8 logdrop # Reserved
197.0.0.0/8 logdrop # Reserved 197.0.0.0/8 logdrop # Reserved
198.18.0.0/15 logdrop # Reserved 223.0.0.0/8 logdrop # Reserved
223.0.0.0/8 logdrop # Reserved - Returned by APNIC in 2003
240.0.0.0/4 logdrop # Reserved 240.0.0.0/4 logdrop # Reserved
# #
# End of generated entries # End of generated entries
# #

43
Lrp2/usr/share/shorewall/firewall
View File

@ -464,11 +464,6 @@ mac_chain() # $1 = interface
echo $(chain_base $1)_mac echo $(chain_base $1)_mac
} }
macrecent_target() # $1 - interface
{
[ -n "$MACLIST_TTL" ] && echo $(chain_base $1)_rec || echo RETURN
}
# #
# Functions for creating dynamic zone rules # Functions for creating dynamic zone rules
# #
@ -494,6 +489,11 @@ dynamic_chains() #$1 = interface
echo ${c}_dyni ${c}_dynf ${c}_dyno echo ${c}_dyni ${c}_dynf ${c}_dyno
} }
macrecent_target() # $1 - interface
{
[ -n "$MACLIST_TTL" ] && echo $(chain_base $1)_rec || echo RETURN
}
# #
# DNAT Chain from a zone # DNAT Chain from a zone
# #
@ -2047,9 +2047,10 @@ setup_mac_lists() {
if [ -n "$MACLIST_TTL" ]; then if [ -n "$MACLIST_TTL" ]; then
chain1=$(macrecent_target $interface) chain1=$(macrecent_target $interface)
createchain $chain1 no createchain $chain1 no
run_iptables -A $chain -m recent --rcheck --seconds $MACLIST_TTL --name $chain -j $chain1 run_iptables -A $chain -m recent --rcheck --seconds $MACLIST_TTL --name $chain -j RETURN
run_iptables -A $chain1 -m recent --update --name $chain -j ACCEPT run_iptables -A $chain -j $chain1
run_iptables -A $chain1 -m recent --set --name $chain -j ACCEPT run_iptables -A $chain -m recent --update --name $chain -j RETURN
run_iptables -A $chain -m recent --set --name $chain
fi fi
done done
# #
@ -2069,8 +2070,7 @@ setup_mac_lists() {
esac esac
fi fi
chain=$(mac_chain $interface) [ -n "$MACLIST_TTL" ] && chain=$(macrecent_target $interface) || chain=$(mac_chain $interface)
chain1=$(macrecent_target $interface)
if ! havechain $chain ; then if ! havechain $chain ; then
fatal_error "No hosts on $interface have the maclist option specified" fatal_error "No hosts on $interface have the maclist option specified"
@ -2079,10 +2079,10 @@ setup_mac_lists() {
macpart=$(mac_match $mac) macpart=$(mac_match $mac)
if [ -z "$addresses" ]; then if [ -z "$addresses" ]; then
run_iptables -A $chain $macpart $physdev_part -j $chain1 run_iptables -A $chain $macpart $physdev_part -j RETURN
else else
for address in $(separate_list $addresses) ; do for address in $(separate_list $addresses) ; do
run_iptables2 -A $chain $macpart -s $address $physdev_part -j $chain1 run_iptables2 -A $chain $macpart -s $address $physdev_part -j RETURN
done done
fi fi
done < $TMP_DIR/maclist done < $TMP_DIR/maclist
@ -2091,8 +2091,7 @@ setup_mac_lists() {
# chains # chains
# #
for interface in $maclist_interfaces; do for interface in $maclist_interfaces; do
chain=$(mac_chain $interface) [ -n "$MACLIST_TTL" ] && chain=$(macrecent_target $interface) || chain=$(mac_chain $interface)
chain1=$(macrecent_target $interface)
blob=$(ip link show $interface 2> /dev/null) blob=$(ip link show $interface 2> /dev/null)
@ -2100,12 +2099,13 @@ setup_mac_lists() {
fatal_error "Interface $interface must be up before Shorewall can start" fatal_error "Interface $interface must be up before Shorewall can start"
ip -f inet addr show $interface 2> /dev/null | grep 'inet.*brd' | sed 's/inet //; s/brd //; s/scope.*//;' | while read address broadcast; do ip -f inet addr show $interface 2> /dev/null | grep 'inet.*brd' | sed 's/inet //; s/brd //; s/scope.*//;' | while read address broadcast; do
address=${address%/*}
if [ -n "$broadcast" ]; then if [ -n "$broadcast" ]; then
run_iptables -A $chain -s ${address%/*} -d $broadcast -j $chain1 run_iptables -A $chain -s $address -d $broadcast -j RETURN
fi fi
run_iptables -A $chain -s $address -d 255.255.255.255 -j $chain1 run_iptables -A $chain -s $address -d 255.255.255.255 -j RETURN
run_iptables -A $chain -s $address -d 224.0.0.0/4 -j $chain1 run_iptables -A $chain -s $address -d 224.0.0.0/4 -j RETURN
done done
if [ -n "$MACLIST_LOG_LEVEL" ]; then if [ -n "$MACLIST_LOG_LEVEL" ]; then
@ -6207,7 +6207,7 @@ add_common_rules() {
savelogparms="$LOGPARMS" savelogparms="$LOGPARMS"
LOGPARMS="$LOGPARMS --log-ip-options" [ "$TCP_FLAGS_LOG_LEVEL" = ULOG ] || LOGPARMS="$LOGPARMS --log-ip-options"
log_rule $TCP_FLAGS_LOG_LEVEL logflags $TCP_FLAGS_DISPOSITION log_rule $TCP_FLAGS_LOG_LEVEL logflags $TCP_FLAGS_DISPOSITION
@ -7525,8 +7525,11 @@ do_initialize() {
case $MACLIST_DISPOSITION in case $MACLIST_DISPOSITION in
REJECT) REJECT)
;; ;;
ACCEPT|DROP) DROP)
maclist_target=$MACLIST_DISPOSITION maclist_target=DROP
;;
ACCEPT)
maclist_target=RETURN
;; ;;
*) *)
startup_error "Invalid value ($MACLIST_DISPOSITION) for MACLIST_DISPOSITION" startup_error "Invalid value ($MACLIST_DISPOSITION) for MACLIST_DISPOSITION"

2
Lrp2/usr/share/shorewall/version
View File

@ -1 +1 @@
2.2.5 2.2.6