'allow' now works with ipset-based dynamic blacklisting

Signed-off-by: Tom Eastep <teastep@shorewall.net>

Shorewall-core/lib.cli

@@ -2525,54 +2525,81 @@ allow_command() {
     [ -n "$g_debugging" ] && set -x
     [ $# -eq 1 ] && missing_argument
     if product_is_started ; then
-	local which
+	if [ -n "$g_blacklistipset" ]; then
-	which='-s'
-	local range
-	range='--src-range'
 
-	if ! chain_exists dynamic; then
+	    case ${IPSET:=ipset} in
-	    fatal_error "Dynamic blacklisting is not enabled in the current $g_product configuration"
+		*/*)
-	fi
+		    if [ ! -x "$IPSET" ]; then
-
+			fatal_error "IPSET=$IPSET does not exist or is not executable"
-	[ -n "$g_nolock" ] || mutex_on
-	while [ $# -gt 1 ]; do
-	    shift
-	    case $1 in
-		from)
-		    which='-s'
-		    range='--src-range'
-		    continue
-		    ;;
-		to)
-		    which='-d'
-		    range='--dst-range'
-		    continue
-		    ;;
-		*-*)
-		    if  qt $g_tool -D dynamic -m iprange $range $1 -j reject    ||\
-			qt $g_tool -D dynamic -m iprange $range $1 -j DROP      ||\
-			qt $g_tool -D dynamic -m iprange $range $1 -j logdrop   ||\
-			qt $g_tool -D dynamic -m iprange $range $1 -j logreject
-			then
-			echo "$1 Allowed"
-		    else
-			echo "$1 Not Dropped or Rejected"
 		    fi
 		    ;;
 		*)
-		    if  qt $g_tool -D dynamic $which $1 -j reject    ||\
+		    IPSET="$(mywhich $IPSET)"
-			qt $g_tool -D dynamic $which $1 -j DROP      ||\
+		    [ -n "$IPSET" ] || fatal_error "The ipset utility cannot be located"
-			qt $g_tool -D dynamic $which $1 -j logdrop   ||\
-			qt $g_tool -D dynamic $which $1 -j logreject
-			then
-			echo "$1 Allowed"
-		    else
-			echo "$1 Not Dropped or Rejected"
-		    fi
 		    ;;
 	    esac
-	done
+
-	[ -n "$g_nolock" ] || mutex_off
+	    [ -n "$g_nolock" ] || mutex_on
+
+	    while [ $# -gt 1 ]; do
+		shift
+
+		qt $IPSET -D $g_blacklistipset $1 && progress_message2 "$1 Allowed" || error_message "WARNING: Address $1 was not currently blacklisted"
+	    done
+
+	    [ -n "$g_nolock" ] || mutex_off
+	else
+	    local which
+	    which='-s'
+	    local range
+	    range='--src-range'
+
+	    if ! chain_exists dynamic; then
+		fatal_error "Dynamic blacklisting is not enabled in the current $g_product configuration"
+	    fi
+
+	    [ -n "$g_nolock" ] || mutex_on
+
+	    while [ $# -gt 1 ]; do
+		shift
+		case $1 in
+		    from)
+			which='-s'
+			range='--src-range'
+			continue
+			;;
+		    to)
+			which='-d'
+			range='--dst-range'
+			continue
+			;;
+		    *-*)
+			if  qt $g_tool -D dynamic -m iprange $range $1 -j reject    ||\
+				qt $g_tool -D dynamic -m iprange $range $1 -j DROP      ||\
+				qt $g_tool -D dynamic -m iprange $range $1 -j logdrop   ||\
+				qt $g_tool -D dynamic -m iprange $range $1 -j logreject
+			then
+			    echo "$1 Allowed"
+			else
+			    echo "$1 Not Dropped or Rejected"
+			fi
+			;;
+		    *)
+			if  qt $g_tool -D dynamic $which $1 -j reject    ||\
+			    qt $g_tool -D dynamic $which $1 -j DROP      ||\
+		            qt $g_tool -D dynamic $which $1 -j logdrop   ||\
+			    qt $g_tool -D dynamic $which $1 -j logreject
+			then
+			    echo "$1 Allowed"
+			else
+			    echo "$1 Not Dropped or Rejected"
+			fi
+			;;
+		esac
+	    done
+
+	    [ -n "$g_nolock" ] || mutex_off
+	fi
     else
 	error_message "ERROR: $g_product is not started"
 	exit 2
@@ -3507,7 +3534,7 @@ blacklist_command() {
 	    ;;
     esac
 
-    $IPSET -A $g_blacklistipset $@ || { error_message "ERROR: Address $1 not blacklisted"; return 1; }
+    $IPSET -A $g_blacklistipset $@ && progress_message2 "$1 Blacklisted" || { error_message "ERROR: Address $1 not blacklisted"; return 1; }
 
     return 0
 }

Shorewall-lite/manpages/shorewall-lite.xml

@@ -702,7 +702,9 @@
           blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
           role="bold">logdrop</emphasis>, <emphasis
           role="bold">reject</emphasis>, or <emphasis
-          role="bold">logreject</emphasis> command.</para>
+          role="bold">logreject</emphasis> command. Beginning with Shorewall
+          5.0.10, this command can also re-enable addresses blacklisted using
+          the <command>blacklist</command> command.</para>
         </listitem>
       </varlistentry>
 

Shorewall/manpages/shorewall-interfaces.xml

@@ -380,7 +380,7 @@ loc     eth2            -</programlisting>
             </varlistentry>
 
             <varlistentry>
-              <term>loopback</term>
+              <term><emphasis role="bold">loopback</emphasis></term>
 
               <listitem>
                 <para>Added in Shorewall 4.6.6. Designates the interface as
@@ -451,8 +451,8 @@ loc     eth2            -</programlisting>
             </varlistentry>
 
             <varlistentry>
-              <term><emphasis
+              <term><emphasis role="bold"><emphasis
-              role="bold">mss</emphasis>=<emphasis>number</emphasis></term>
+              role="bold">mss</emphasis>=</emphasis><emphasis>number</emphasis></term>
 
               <listitem>
                 <para>Added in Shorewall 4.0.3. Causes forwarded TCP SYN

Shorewall/manpages/shorewall.xml

@@ -964,7 +964,9 @@
           blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
           role="bold">logdrop</emphasis>, <emphasis
           role="bold">reject</emphasis>, or <emphasis
-          role="bold">logreject</emphasis> command.</para>
+          role="bold">logreject</emphasis> command. Beginning with Shorewall
+          5.0.10, this command can also re-enable addresses blacklisted using
+          the <command>blacklist</command> command.</para>
         </listitem>
       </varlistentry>
 

Shorewall6-lite/manpages/shorewall6-lite.xml

@@ -679,7 +679,9 @@
           <para>Re-enables receipt of packets from hosts previously
           blacklisted by a <command>drop</command>,
           <command>logdrop</command>, <command>reject</command>, or
-          <command>logreject</command> command.</para>
+          <command>logreject</command> command. Beginning with Shorewall
+          5.0.10, this command can also re-enable addresses blacklisted using
+          the <command>blacklist</command> command.</para>
         </listitem>
       </varlistentry>
 

Shorewall6/manpages/shorewall6-interfaces.xml

@@ -321,7 +321,7 @@ loc     eth2            -</programlisting>
             </varlistentry>
 
             <varlistentry>
-              <term>loopback</term>
+              <term><emphasis role="bold">loopback</emphasis></term>
 
               <listitem>
                 <para>Added in Shorewall 4.6.6. Designates the interface as

Shorewall6/manpages/shorewall6.xml

@@ -932,7 +932,9 @@
           blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
           role="bold">logdrop</emphasis>, <emphasis
           role="bold">reject</emphasis>, or <emphasis
-          role="bold">logreject</emphasis> command.</para>
+          role="bold">logreject</emphasis> command. Beginning with Shorewall
+          5.0.10, this command can also re-enable addresses blacklisted using
+          the <command>blacklist</command> command.</para>
         </listitem>
       </varlistentry>