extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-20 09:47:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move 'dynamic' jumps to the INPUT and FORWARD chains

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8117 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2008-01-28 19:41:23 +00:00
parent 3cad33ea20
commit 4be347d1cc
2 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Shorewall-perl/Shorewall/Compiler.pm
View File

@ -817,10 +817,6 @@ sub compiler {
# #
generate_script_2 unless $command eq 'check'; generate_script_2 unless $command eq 'check';
# #
# Set up MSS rules
#
setup_mss;
#
# Do all of the zone-independent stuff # Do all of the zone-independent stuff
# #
add_common_rules; add_common_rules;

19
Shorewall-perl/Shorewall/Rules.pm
View File

@ -472,6 +472,8 @@ sub process_routestopped() {
} }
} }
sub setup_mss();
sub add_common_rules() { sub add_common_rules() {
my $interface; my $interface;
my $chainref; my $chainref;
@ -481,6 +483,14 @@ sub add_common_rules() {
my $list; my $list;
my $chain; my $chain;
new_standard_chain 'dynamic';
my $state = $config{BLACKLISTNEWONLY} ? '-m state --state NEW,INVALID ' : '';
add_rule $filter_table->{$_}, "$state -j dynamic" for qw( INPUT FORWARD );
setup_mss;
if ( $config{FASTACCEPT} ) { if ( $config{FASTACCEPT} ) {
add_rule( $filter_table->{$_} , "-m state --state ESTABLISHED,RELATED -j ACCEPT" ) for qw( INPUT FORWARD OUTPUT ); add_rule( $filter_table->{$_} , "-m state --state ESTABLISHED,RELATED -j ACCEPT" ) for qw( INPUT FORWARD OUTPUT );
} }
@ -492,15 +502,8 @@ sub add_common_rules() {
add_rule_pair new_standard_chain( 'logdrop' ), ' ' , 'DROP' , $level ; add_rule_pair new_standard_chain( 'logdrop' ), ' ' , 'DROP' , $level ;
add_rule_pair new_standard_chain( 'logreject' ), ' ' , 'reject' , $level ; add_rule_pair new_standard_chain( 'logreject' ), ' ' , 'reject' , $level ;
new_standard_chain 'dynamic';
my $state = $config{BLACKLISTNEWONLY} ? '-m state --state NEW,INVALID ' : '';
for $interface ( all_interfaces ) { for $interface ( all_interfaces ) {
for $chain ( first_chains $interface ) { new_standard_chain( $_ ) for first_chains( $interface );
add_rule new_standard_chain( $chain ) , "$state -j dynamic";
}
new_standard_chain output_chain( $interface ); new_standard_chain output_chain( $interface );
} }