extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-18 12:20:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Tweak to Run-time gateway variables

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2012-02-24 09:02:04 -08:00
parent b78d4ca41f
commit 47453a20f7
3 changed files with 29 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -4431,12 +4431,7 @@ sub record_runtime_address( $$;$ ) {
if ( $addrtype eq '&' ) {
$addr = get_interface_address( $interface );
} else {
$addr = get_interface_gateway( $interface );
if ( $protect ) {
$addr =~ s/\$/\${/;
$addr .= ( NILIP . '}' );
}
$addr = get_interface_gateway( $interface, $protect );
}
$addr . ' ';
@ -5161,8 +5156,8 @@ sub interface_gateway( $ ) {
#
# Record that the ruleset requires the gateway address on the passed interface
#
sub get_interface_gateway ( $ ) {
my ( $logical ) = $_[0];
sub get_interface_gateway ( $;$ ) {
my ( $logical, $protect ) = @_;
my $interface = get_physical $logical;
my $variable = interface_gateway( $interface );
@ -5179,7 +5174,7 @@ sub get_interface_gateway ( $ ) {
);
}
"\$$variable";
$protect ? "\${$variable:-" . NILIP . '}' : "\$$variable";
}
#

5
Shorewall/Perl/Shorewall/Misc.pm
View File

@ -1013,9 +1013,10 @@ sub add_common_rules ( $ ) {
for $interface ( @$list ) {
my $chainref = $filter_table->{input_option_chain $interface};
my $base = uc chain_base get_physical $interface;
my $variable = get_interface_gateway $interface;
my $optional = interface_is_optional( $interface );
my $variable = get_interface_gateway( $interface, ! $optional );
if ( interface_is_optional $interface ) {
if ( $optional ) {
add_commands( $chainref,
qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
incr_cmd_level( $chainref );

28
docs/configuration_file_basics.xml
View File

@ -1329,17 +1329,29 @@ SHELL cat /etc/shorewall/rules.d/*.rules 2&gt; /dev/null || true</programlisting
</itemizedlist>
<para>For optional interfaces, if the interface is not usable at the time
that the firewall starts, the all-zero address will be used (0.0.0.0 in
IPv4 and :: in IPv6), resulting in no packets matching the rule.</para>
that the firewall starts, one of two approaches are taken, depending on
the context:</para>
<itemizedlist>
<listitem>
<para>the all-zero address will be used (0.0.0.0 in IPv4 and :: in
IPv6), resulting in no packets matching the rule (or all packets if
used with exclusion).</para>
</listitem>
<listitem>
<para>the entire rule is omitted from the ruleset.</para>
</listitem>
</itemizedlist>
<para>Beginning with Shorewall 4.5.1, <firstterm>Run-time Gateway
Variables</firstterm> in the form of a percent sign ('%') followed by a
logical interface name are also supported. These are expanded at run-time
to the gateway through the named interface. For optional interfaces, if
the interface is not usable at the time that the firewall starts, the
all-zero address will be used (0.0.0.0 in IPv4 and :: in IPv6), resulting
in no packets matching the rule. Run-time gateway variables may be used in
the SOURCE and DEST columns of the following configuration files:</para>
the interface is not usable at the time that the firewall starts, the nil
address will be used (0.0.0.0 in IPv4 and :: in IPv6), resulting in no
packets matching the rule. Run-time gateway variables may be used in the
SOURCE and DEST columns of the following configuration files:</para>
<itemizedlist>
<listitem>
@ -1396,6 +1408,10 @@ SHELL cat /etc/shorewall/rules.d/*.rules 2&gt; /dev/null || true</programlisting
</varlistentry>
</variablelist>
<para>If there is no gateway out of the named interface, the nil IP
address is used (0.0.0.0 in IPv4 and :: in IPv6). That way, the generated
rule will match no packets (or all packets if used with exclusion).</para>
<para>Beginning with Shorewall 4.4.27, you may also use options in <ulink
url="manpages/shorewall.conf.html">shorewall.conf</ulink> (5) (e.g.,
$BLACKLIST_LOGLEVEL).</para>