extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-22 06:10:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

'allow' now works with ipset-based dynamic blacklisting

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2016-06-09 08:44:25 -07:00
parent cd01df4200
commit 4869f61a25
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
7 changed files with 86 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
Shorewall-core/lib.cli
View File

@ -2525,6 +2525,30 @@ allow_command() {
[ -n "$g_debugging" ] && set -x
[ $# -eq 1 ] && missing_argument
if product_is_started ; then
if [ -n "$g_blacklistipset" ]; then
case ${IPSET:=ipset} in
*/*)
if [ ! -x "$IPSET" ]; then
fatal_error "IPSET=$IPSET does not exist or is not executable"
fi
;;
*)
IPSET="$(mywhich $IPSET)"
[ -n "$IPSET" ] || fatal_error "The ipset utility cannot be located"
;;
esac
[ -n "$g_nolock" ] || mutex_on
while [ $# -gt 1 ]; do
shift
qt $IPSET -D $g_blacklistipset $1 && progress_message2 "$1 Allowed" || error_message "WARNING: Address $1 was not currently blacklisted"
done
[ -n "$g_nolock" ] || mutex_off
else
local which
which='-s'
local range
@ -2535,6 +2559,7 @@ allow_command() {
fi
[ -n "$g_nolock" ] || mutex_on
while [ $# -gt 1 ]; do
shift
case $1 in
@ -2572,7 +2597,9 @@ allow_command() {
;;
esac
done
[ -n "$g_nolock" ] || mutex_off
fi
else
error_message "ERROR: $g_product is not started"
exit 2
@ -3507,7 +3534,7 @@ blacklist_command() {
;;
esac
$IPSET -A $g_blacklistipset $@ || { error_message "ERROR: Address $1 not blacklisted"; return 1; }
$IPSET -A $g_blacklistipset $@ && progress_message2 "$1 Blacklisted" || { error_message "ERROR: Address $1 not blacklisted"; return 1; }
return 0
}

4
Shorewall-lite/manpages/shorewall-lite.xml
View File

@ -702,7 +702,9 @@
blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
role="bold">logdrop</emphasis>, <emphasis
role="bold">reject</emphasis>, or <emphasis
role="bold">logreject</emphasis> command.</para>
role="bold">logreject</emphasis> command. Beginning with Shorewall
5.0.10, this command can also re-enable addresses blacklisted using
the <command>blacklist</command> command.</para>
</listitem>
</varlistentry>

6
Shorewall/manpages/shorewall-interfaces.xml
View File

@ -380,7 +380,7 @@ loc eth2 -</programlisting>
</varlistentry>
<varlistentry>
<term>loopback</term>
<term><emphasis role="bold">loopback</emphasis></term>
<listitem>
<para>Added in Shorewall 4.6.6. Designates the interface as
@ -451,8 +451,8 @@ loc eth2 -</programlisting>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">mss</emphasis>=<emphasis>number</emphasis></term>
<term><emphasis role="bold"><emphasis
role="bold">mss</emphasis>=</emphasis><emphasis>number</emphasis></term>
<listitem>
<para>Added in Shorewall 4.0.3. Causes forwarded TCP SYN

4
Shorewall/manpages/shorewall.xml
View File

@ -964,7 +964,9 @@
blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
role="bold">logdrop</emphasis>, <emphasis
role="bold">reject</emphasis>, or <emphasis
role="bold">logreject</emphasis> command.</para>
role="bold">logreject</emphasis> command. Beginning with Shorewall
5.0.10, this command can also re-enable addresses blacklisted using
the <command>blacklist</command> command.</para>
</listitem>
</varlistentry>

4
Shorewall6-lite/manpages/shorewall6-lite.xml
View File

@ -679,7 +679,9 @@
<para>Re-enables receipt of packets from hosts previously
blacklisted by a <command>drop</command>,
<command>logdrop</command>, <command>reject</command>, or
<command>logreject</command> command.</para>
<command>logreject</command> command. Beginning with Shorewall
5.0.10, this command can also re-enable addresses blacklisted using
the <command>blacklist</command> command.</para>
</listitem>
</varlistentry>

2
Shorewall6/manpages/shorewall6-interfaces.xml
View File

@ -321,7 +321,7 @@ loc eth2 -</programlisting>
</varlistentry>
<varlistentry>
<term>loopback</term>
<term><emphasis role="bold">loopback</emphasis></term>
<listitem>
<para>Added in Shorewall 4.6.6. Designates the interface as

4
Shorewall6/manpages/shorewall6.xml
View File

@ -932,7 +932,9 @@
blacklisted by a <emphasis role="bold">drop</emphasis>, <emphasis
role="bold">logdrop</emphasis>, <emphasis
role="bold">reject</emphasis>, or <emphasis
role="bold">logreject</emphasis> command.</para>
role="bold">logreject</emphasis> command. Beginning with Shorewall
5.0.10, this command can also re-enable addresses blacklisted using
the <command>blacklist</command> command.</para>
</listitem>
</varlistentry>