extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-19 17:28:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '4.4.22'

Browse Source
This commit is contained in:
Tom Eastep 2011-08-10 09:34:37 -07:00
commit 39c71418da
3 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -4786,7 +4786,7 @@ sub expand_rule( $$$$$$$$$$;$ )
if ( $origdest ) { if ( $origdest ) {
if ( $origdest eq '-' || ! have_capability( 'CONNTRACK_MATCH' ) ) { if ( $origdest eq '-' || ! have_capability( 'CONNTRACK_MATCH' ) ) {
$origdest = ''; $onets = $oexcl = '';
} elsif ( $origdest =~ /^detect:(.*)$/ ) { } elsif ( $origdest =~ /^detect:(.*)$/ ) {
# #
# Either the filter part of a DNAT rule or 'detect' was given in the ORIG DEST column # Either the filter part of a DNAT rule or 'detect' was given in the ORIG DEST column
@ -4816,7 +4816,7 @@ sub expand_rule( $$$$$$$$$$;$ )
$rule .= "-m conntrack --ctorigdst $variable "; $rule .= "-m conntrack --ctorigdst $variable ";
} }
$origdest = ''; $onets = $oexcl = '';
} else { } else {
fatal_error "Invalid ORIGINAL DEST" if $origdest =~ /^([^!]+)?,!([^!]+)$/ || $origdest =~ /.*!.*!/; fatal_error "Invalid ORIGINAL DEST" if $origdest =~ /^([^!]+)?,!([^!]+)$/ || $origdest =~ /.*!.*!/;

7
Shorewall/Perl/Shorewall/Misc.pm
View File

@ -152,7 +152,10 @@ sub setup_ecn()
if ( my $fn = open_file 'ecn' ) { if ( my $fn = open_file 'ecn' ) {
first_entry "$doing $fn..."; first_entry( sub { progress_message2 "$doing $fn...";
require_capability 'MANGLE_ENABLED', 'Entries in the ecn file', '';
warning_message 'ECN will not be applied to forwarded packets' unless have_capability 'MANGLE_FORWARD';
} );
while ( read_a_line ) { while ( read_a_line ) {
@ -178,7 +181,7 @@ sub setup_ecn()
for my $interface ( @interfaces ) { for my $interface ( @interfaces ) {
my $chainref = ensure_chain 'mangle', ecn_chain( $interface ); my $chainref = ensure_chain 'mangle', ecn_chain( $interface );
add_ijump $mangle_table->{POSTROUTING} , j => $chainref, p => 'tcp', imatch_dest_dev( $interface ); add_ijump $mangle_table->{POSTROUTING} , j => $chainref, p => 'tcp', imatch_dest_dev( $interface ) if have_capability 'MANGLE_FORWARD';
add_ijump $mangle_table->{OUTPUT}, j => $chainref, p => 'tcp', imatch_dest_dev( $interface ); add_ijump $mangle_table->{OUTPUT}, j => $chainref, p => 'tcp', imatch_dest_dev( $interface );
} }

2
docs/PortKnocking.xml
View File

@ -108,7 +108,7 @@ if ( $level ) {
'', '',
$tag, $tag,
'add', 'add',
'-p tcp --dport ! 22 ' ); '-p tcp ! --dport 22 ' );
} }
add_rule( $chainref, '-p tcp --dport 22 -m recent --rcheck --seconds 60 --name SSH -j ACCEPT' ); add_rule( $chainref, '-p tcp --dport 22 -m recent --rcheck --seconds 60 --name SSH -j ACCEPT' );