extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-23 22:18:57 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix multiple 'drop/reject' bug

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@727 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2003-08-24 15:36:13 +00:00
parent 41de5afd06
commit 47c914a86b
3 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Shorewall/changelog.txt
View File

@ -60,3 +60,6 @@ Changes since 1.4.6
conflict between that facility and rate-limited logging rules. conflict between that facility and rate-limited logging rules.
27) Add User Set capability. 27) Add User Set capability.
28) Deimplement Smart Blacklisting and fix problem with multiple
'drop'/'reject' commands for the same address.

6
Shorewall/releasenotes.txt
View File

@ -28,6 +28,12 @@ Problems Corrected since version 1.4.6:
6) Thanks to Henry Yang, LOGRATE and LOGBURST now work again. 6) Thanks to Henry Yang, LOGRATE and LOGBURST now work again.
7) The 'shorewall reject' and 'shorewall drop' commands now delete any
existing rules for the subject IP address before adding a new DROP
or REJECT rule. Previously, there could be many rules for the same
IP address in the dynamic chain so that multiple 'allow' commands
were required to re-enable traffic to/from the address.
Migration Issues: Migration Issues:
1) IP Traffic Accounting is changed from Snapshot 20030813. 1) IP Traffic Accounting is changed from Snapshot 20030813.

12
Shorewall/shorewall
View File

@ -861,6 +861,8 @@ case "$1" in
mutex_on mutex_on
while [ $# -gt 1 ]; do while [ $# -gt 1 ]; do
shift shift
qt iptables -D dynamic -s $1 -j reject
qt iptables -D dynamic -s $1 -j DROP
iptables -A dynamic -s $1 -j DROP || break 1 iptables -A dynamic -s $1 -j DROP || break 1
echo "$1 Dropped" echo "$1 Dropped"
done done
@ -871,6 +873,8 @@ case "$1" in
mutex_on mutex_on
while [ $# -gt 1 ]; do while [ $# -gt 1 ]; do
shift shift
qt iptables -D dynamic -s $1 -j reject
qt iptables -D dynamic -s $1 -j DROP
iptables -A dynamic -s $1 -j reject || break 1 iptables -A dynamic -s $1 -j reject || break 1
echo "$1 Rejected" echo "$1 Rejected"
done done
@ -881,13 +885,7 @@ case "$1" in
mutex_on mutex_on
while [ $# -gt 1 ]; do while [ $# -gt 1 ]; do
shift shift
if qt iptables -D dynamic -s $1 -j reject; then if qt iptables -D dynamic -s $1 -j reject || qt iptables -D dynamic -s $1 -j DROP; then
#
# Address was rejected -- silently remove any drop as well
#
qt iptables -D dynamic -s $1 -j DROP
echo "$1 Allowed"
elif qt iptables -D dynamic -s $1 -j DROP; then
echo "$1 Allowed" echo "$1 Allowed"
else else
echo "$1 Not Dropped or Rejected" echo "$1 Not Dropped or Rejected"