extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-03-13 05:48:54 +01:00
Code Issues Packages Projects Releases Wiki Activity

Near complete removal of the 'multi' pseudo-zone

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@31 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2002-05-18 19:04:45 +00:00
parent bb65b34210
commit 4c1193e4cd
3 changed files with 66 additions and 93 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

142
Shorewall/firewall
View File

@ -300,8 +300,6 @@ find_interfaces() # $1 = interface zone
{ {
local zne=$1 local zne=$1
[ $zne = multi ] && zne="-"
while read z interface subnet options; do while read z interface subnet options; do
[ "x`expand $z`" = "x$zne" ] && echo `expand $interface` [ "x`expand $z`" = "x$zne" ] && echo `expand $interface`
done < $TMP_DIR/interfaces done < $TMP_DIR/interfaces
@ -365,7 +363,7 @@ find_hosts() # $1 = host zone
# variable contains a space-separated list of interfaces to the zone # # variable contains a space-separated list of interfaces to the zone #
################################################################################ ################################################################################
determine_interfaces() { determine_interfaces() {
for zone in $zones multi; do for zone in $zones; do
interfaces=`find_interfaces $zone` interfaces=`find_interfaces $zone`
interfaces=`echo $interfaces` # Remove extra trash interfaces=`echo $interfaces` # Remove extra trash
eval ${zone}_interfaces="\$interfaces" eval ${zone}_interfaces="\$interfaces"
@ -389,7 +387,7 @@ determine_hosts() {
done done
} }
for zone in $zones multi; do for zone in $zones; do
hosts=`find_hosts $zone` hosts=`find_hosts $zone`
hosts=`echo $hosts` # Remove extra trash hosts=`echo $hosts` # Remove extra trash
@ -406,7 +404,7 @@ determine_hosts() {
if [ -n "$hosts" ]; then if [ -n "$hosts" ]; then
eval display=\$${zone}_display eval display=\$${zone}_display
display_list "$display Zone:" $hosts display_list "$display Zone:" $hosts
elif [ "$zone" != "multi" ]; then else
error_message " Warning: Zone $zone is empty" error_message " Warning: Zone $zone is empty"
fi fi
done done
@ -576,6 +574,15 @@ validate_rule() {
proto="${proto:+-p $proto}" proto="${proto:+-p $proto}"
case "$logtarget" in
REJECT)
target=reject
;;
REDIRECT)
servport=${servport:=$port}
;;
esac
if [ -z "$proto" -a -z "$cli" -a -z "$serv" -a -z "$servport" ]; then if [ -z "$proto" -a -z "$cli" -a -z "$serv" -a -z "$servport" ]; then
error_message " Warning -- Rule \"$rule\" is a POLICY" error_message " Warning -- Rule \"$rule\" is a POLICY"
error_message " -- and should be moved to the policy file" error_message " -- and should be moved to the policy file"
@ -780,27 +787,20 @@ validate_policy()
} }
################################################################################ ################################################################################
# Find broadcast addresses corresponding to interfaces to a given zone # # Find broadcast addresses #
################################################################################ ################################################################################
find_broadcast() # $1 = zone find_broadcasts() {
{
local zne=$1
[ $zne = multi ] && zne="-"
while read z interface bcast options; do while read z interface bcast options; do
expandv z interface bcast expandv interface bcast
if [ "x$z" = "x$zne" -a -n "$bcast" ]; then if [ "x$bcast" = "xdetect" ]; then
if [ "x$bcast" = "xdetect" ]; then addr="`ip addr show $interface 2> /dev/null`"
addr="`ip addr show $interface 2> /dev/null`" if [ -n "`echo "$addr" | grep 'inet.*brd '`" ]; then
if [ -n "`echo "$addr" | grep 'inet.*brd '`" ]; then addr="`echo "$addr" | \
addr="`echo "$addr" | \ grep "inet " | sed 's/^.* inet.*brd //;s/scope.*//'`"
grep "inet " | sed 's/^.* inet.*brd //;s/scope.*//'`" echo $addr | cut -d' ' -f 1
echo $addr | cut -d' ' -f 1
fi
elif [ "x${bcast}" != "x-" ]; then
echo `separate_list $bcast`
fi fi
elif [ "x${bcast}" != "x-" ]; then
echo `separate_list $bcast`
fi fi
done < $TMP_DIR/interfaces done < $TMP_DIR/interfaces
} }
@ -848,8 +848,6 @@ have_interfaces_in_zone_with_option() # $1 = zone, $2 = option
{ {
local zne=$1 local zne=$1
[ $zne = multi ] && zne="-"
while read z interface broadcast options; do while read z interface broadcast options; do
[ "x`expand $z`" = "x$zne" ] && \ [ "x`expand $z`" = "x$zne" ] && \
expandv options && \ expandv options && \
@ -2312,7 +2310,7 @@ setup_blacklist() {
for interface in $interfaces; do for interface in $interfaces; do
for chain in `first_chains $interface`; do for chain in `first_chains $interface`; do
run_iptables -A $chain -i $interface -j blacklst run_iptables -A $chain -j blacklst
done done
echo " Blacklisting enabled on $interface" echo " Blacklisting enabled on $interface"
@ -2528,7 +2526,7 @@ add_common_rules() {
for interface in $interfaces; do for interface in $interfaces; do
for chain in `first_chains $interface`; do for chain in `first_chains $interface`; do
run_iptables -A $chain -i $interface --match unclean -j badpkt run_iptables -A $chain --match unclean -j badpkt
done done
echo " $interface" echo " $interface"
done done
@ -2551,7 +2549,7 @@ add_common_rules() {
for interface in $interfaces; do for interface in $interfaces; do
for chain in `first_chains $interface`; do for chain in `first_chains $interface`; do
run_iptables -A $chain -i $interface --match unclean -j logpkt run_iptables -A $chain --match unclean -j logpkt
done done
echo " $interface" echo " $interface"
done done
@ -2584,12 +2582,7 @@ add_common_rules() {
########################################################################### ###########################################################################
# BROADCASTS # BROADCASTS
# #
for zone in $zones multi; do drop_broadcasts `find_broadcasts`
eval interfaces=\$${zone}_interfaces
[ -n "$interfaces" ] && drop_broadcasts `find_broadcast $zone`
setup_intrazone $zone
done
norfc1918_interfaces="`find_interfaces_by_option norfc1918`" norfc1918_interfaces="`find_interfaces_by_option norfc1918`"
@ -2644,7 +2637,7 @@ add_common_rules() {
for interface in $norfc1918_interfaces; do for interface in $norfc1918_interfaces; do
for chain in `first_chains $interface`; do for chain in `first_chains $interface`; do
run_iptables -A $chain -i $interface -j rfc1918 run_iptables -A $chain -j rfc1918
done done
[ -n "$MANGLE_ENABLED" ] && \ [ -n "$MANGLE_ENABLED" ] && \
@ -2755,6 +2748,7 @@ apply_policy_rules() {
done < $TMP_DIR/policy done < $TMP_DIR/policy
for zone in $FW $zones; do for zone in $FW $zones; do
setup_intrazone $zone
for zone1 in $FW $zones; do for zone1 in $FW $zones; do
chain=${zone}2${zone1} chain=${zone}2${zone1}
if havechain $chain; then if havechain $chain; then
@ -2770,41 +2764,26 @@ apply_policy_rules() {
################################################################################ ################################################################################
activate_rules() { activate_rules() {
for zone in multi $zones; do for zone in $zones; do
eval source_hosts=\$${zone}_hosts eval source_hosts=\$${zone}_hosts
for host in $source_hosts; do for host in $source_hosts; do
interface=${host%:*} interface=${host%:*}
subnet=${host#*:} subnet=${host#*:}
chain=`input_chain $interface`
if [ "$zone" != "multi" ]; then run_iptables -A OUTPUT -o \
# $interface -d $subnet -j `rules_chain $FW $zone`
# If we have a 'multi2fw' chain and the current interface is
# in the 'multi' pseudo-zone, then we will add the rule to
# multi2fw rather than to INPUT
#
if havechain multi2fw; then
for interface1 in $multi_interfaces; do
[ "$interface" = "$interface1" ] && \
chain=multi2fw && break
done
fi
run_iptables -A OUTPUT -o \ if havenatchain $zone; then
$interface -d $subnet -j `rules_chain $FW $zone` run_iptables -t nat -A PREROUTING \
-i $interface -s $subnet -j $zone
fi
if havenatchain $zone; then run_iptables -A `input_chain $interface` -s $subnet \
run_iptables -t nat -A PREROUTING \
-i $interface -s $subnet -j $zone
fi
fi
run_iptables -A $chain -i $interface -s $subnet \
-j `rules_chain $zone $FW` -j `rules_chain $zone $FW`
done done
[ "$zone" != multi ] && for zone1 in $zones; do for zone1 in $zones; do
eval dest_hosts=\$${zone1}_hosts eval dest_hosts=\$${zone1}_hosts
chain="`rules_chain $zone $zone1`" chain="`rules_chain $zone $zone1`"
@ -2819,7 +2798,7 @@ activate_rules() {
subnet1=${host1#*:} subnet1=${host1#*:}
[ $interface = $interface1 -a "x$subnet" = "x$subnet1" ] ||\ [ $interface = $interface1 -a "x$subnet" = "x$subnet1" ] ||\
run_iptables -A $chain1 -i $interface -s $subnet \ run_iptables -A $chain1 -s $subnet \
-o $interface1 -d $subnet1 -j $chain -o $interface1 -d $subnet1 -j $chain
done done
@ -2829,18 +2808,16 @@ activate_rules() {
done done
while read zone interface broadcast options; do while read zone interface broadcast options; do
[ "x`expand $zone`" = "x-" ] && zone=multi expandv zone
for z in $zones; do if [ "x$zone" != "x-" ]; then
[ "x$z" = "x$zone" ] && \ expandv interface options
expandv interface options && \ for option in `separate_list $options`; do
for option in `separate_list $options`; do [ "$option" = "multi" ] && \
[ "$option" = "multi" ] && \ run_iptables -A `forward_chain $interface` \
run_iptables -A `forward_chain $interface` \ -o $interface -j ${zone}2${zone} && \
-i $interface \ break 1
-o $interface -j ${zone}2${zone} && \ done
break 1 fi
done
done
done < $TMP_DIR/interfaces done < $TMP_DIR/interfaces
for interface in $all_interfaces; do for interface in $all_interfaces; do
@ -2907,15 +2884,11 @@ define_firewall() # $1 = Command (Start or Restart)
noping_interfaces="`find_interfaces_by_option noping`" noping_interfaces="`find_interfaces_by_option noping`"
for zone in $zones multi; do for interface in $all_interfaces; do
eval interfaces=\$${zone}_interfaces [ -n "`echo $noping_interfaces | grep $interface`" ] && \
target=DROP || target=ACCEPT
for interface in $interfaces; do run_iptables -A `input_chain $interface` \
[ -n "`echo $noping_interfaces | grep $interface`" ] && \ -p icmp --icmp-type echo-request -j $target
target=DROP || target=ACCEPT
addrule ${zone}2${FW} -i $interface \
-p icmp --icmp-type echo-request -j $target
done
done done
[ -z "$NAT_BEFORE_RULES" ] && setup_nat [ -z "$NAT_BEFORE_RULES" ] && setup_nat
@ -2938,6 +2911,7 @@ define_firewall() # $1 = Command (Start or Restart)
[ -n "$TC_ENABLED" ] && setup_tc [ -n "$TC_ENABLED" ] && setup_tc
echo "Activating Rules..." echo "Activating Rules..."
activate_rules activate_rules
@ -3031,11 +3005,7 @@ refresh_firewall()
########################################################################### ###########################################################################
# BROADCASTS # BROADCASTS
# #
for zone in $zones multi; do drop_broadcasts `find_broadcasts`
eval interfaces=\"\$${zone}_interfaces\"
[ -n "$interfaces" ] && drop_broadcasts `find_broadcast $zone`
done
########################################################################### ###########################################################################
# Blacklist # Blacklist

9
Shorewall/rules
View File

@ -31,9 +31,12 @@
# level (e.g, REJECT:info). This causes the packet to be # level (e.g, REJECT:info). This causes the packet to be
# logged at the specified level. # logged at the specified level.
# #
# SOURCE Hosts permitted to be clients. May be a zone defined # SOURCE Source hosts to which the rule applies. May be a zone
# in /etc/shorewall/zones or $FW to indicate the # defined in /etc/shorewall/zones or $FW to indicate the
# firewall itself. # firewall itself. If the ACTION is DNAT or REDIRECT,
# sub-zones of the specified zone may be excluded from
# the rule by following the zone name with "!' and a
# comma-separated list of sub-zone names.
# #
# Clients may be further restricted to a list of subnets # Clients may be further restricted to a list of subnets
# and/or hosts by appending ":" and a comma-separated # and/or hosts by appending ":" and a comma-separated

2
Shorewall/shorewall
View File

@ -156,7 +156,7 @@ display_chains()
timed_read timed_read
for zone in $zones multi; do for zone in $zones; do
if [ -n "`grep "^Chain \.*${zone}" /tmp/chains-$$`" ] ; then if [ -n "`grep "^Chain \.*${zone}" /tmp/chains-$$`" ] ; then
clear clear