extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-24 15:18:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

Correct wording regarding connection tracking match

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1996 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2005-03-10 23:53:50 +00:00
parent 25f6815c4f
commit 573ff6ae57
9 changed files with 101 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Lrp2/usr/share/shorewall/firewall
View File

@ -5634,7 +5634,7 @@ initialize_netfilter () {
[ -n "$RFC1918_STRICT" -a -z "$CONNTRACK_MATCH" ] && \
startup_error "RFC1918_STRICT=Yes requires conntrack state match"
startup_error "RFC1918_STRICT=Yes requires Connection Tracking match"
echo "Determining Zones..."

2
STABLE2/changelog.txt
View File

@ -21,6 +21,8 @@ Changes in 2.2.2
9) Fix installer's handling of action.* files.
10) Implement RFC1918_STRICT
Changes in 2.2.1
1) Add examples to the zones and policy files.

29
STABLE2/firewall
View File

@ -5632,6 +5632,10 @@ initialize_netfilter () {
[ -n "$PHYSDEV_MATCH" ] || startup_error "BRIDGING=Yes requires Physdev Match support in your Kernel and iptables"
fi
[ -n "$RFC1918_STRICT" -a -z "$CONNTRACK_MATCH" ] && \
startup_error "RFC1918_STRICT=Yes requires Connection Tracking match"
echo "Determining Zones..."
determine_zones
@ -5922,7 +5926,15 @@ add_common_rules() {
run_iptables -A rfc1918 -j DROP
if [ -n "$MANGLE_ENABLED" -a -z "$CONNTRACK_MATCH" ]; then
chain=norfc1918
if [ -n "$RFC1918_STRICT" ]; then
#
# We'll generate two chains - one for source and one for destination
#
chain=rfc1918d
createchain $chain no
elif [ -n "$MANGLE_ENABLED" -a -z "$CONNTRACK_MATCH" ]; then
#
# Mangling is enabled but conntrack match isn't available --
# create a chain in the mangle table to filter RFC1918 destination
@ -5941,8 +5953,13 @@ add_common_rules() {
case $target in
logdrop)
target=rfc1918
s_target=rfc1918
;;
DROP|RETURN)
DROP)
s_target=DROP
;;
RETURN)
[ -n "$RFC1918_STRICT" ] && s_target=rfc1918d || s_target=RETURN
;;
*)
fatal_error "Invalid target ($target) for $networks"
@ -5950,13 +5967,13 @@ add_common_rules() {
esac
for network in $(separate_list $networks); do
run_iptables2 -A norfc1918 $(source_ip_range $network) -j $target
run_iptables2 -A norfc1918 $(source_ip_range $network) -j $s_target
if [ -n "$CONNTRACK_MATCH" ]; then
#
# We have connection tracking match -- match on the original destination
#
run_iptables2 -A norfc1918 -m conntrack --ctorigdst $network -j $target
run_iptables2 -A $chain -m conntrack --ctorigdst $network -j $target
elif [ -n "$MANGLE_ENABLED" ]; then
#
# No connection tracking match but we have mangling -- add a rule to
@ -5967,6 +5984,8 @@ add_common_rules() {
done
done < $TMP_DIR/rfc1918
[ -n "$RFC1918_STRICT" ] && run_iptables -A norfc1918 -j rfc1918d
for host in $hosts; do
ipsec=${host%^*}
host=${host#*^}
@ -7207,6 +7226,7 @@ do_initialize() {
LOGTAGONLY=
LOGALLNEW=
DROPINVALID=
RFC1918_STRICT=
RESTOREBASE=
TMP_DIR=
@ -7402,6 +7422,7 @@ do_initialize() {
DELAYBLACKLISTLOAD=$(added_param_value_no DELAYBLACKLISTLOAD $DELAYBLACKLISTLOAD)
LOGTAGONLY=$(added_param_value_no LOGTAGONLY $LOGTAGONLY)
DROPINVALID=$(added_param_value_yes DROPINVALID $DROPINVALID)
RFC1918_STRICT=$(added_param_value_no RFC1918_STRICT $RFC1918_STRICT)
#
# Strip the files that we use often
#

22
STABLE2/releasenotes.txt
View File

@ -45,6 +45,28 @@ New Features in version 2.2.2
with "multiport match", a separate iptables rule will be generated
for each element in the list.
5) Traditionally, the RETURN target in the 'rfc1918' file has caused
'norfc1918' processing to cease for a packet if the packet's source
IP address matches the rule. Thus, if you have:
SUBNETS TARGET
192.168.1.0/24 RETURN
then traffic from 192.168.1.4 to 10.0.3.9 will be accepted even
though you also have:
SUBNETS TARGET
10.0.0.0/8 logdrop
Setting RFC1918_STRICT=Yes in shorewall.conf will cause such traffic
to be logged and dropped since while the packet's source matches the
RETURN rule, the packet's destination matches the 'logdrop' rule.
If not specified or specified as empty (e.g., RFC1918_STRICT="")
then RFC1918_STRICT=No is assumed.
WARNING: RFC1918_STRICT=Yes requires that your kernel and iptables
support 'Connection Tracking' match.
-----------------------------------------------------------------------
Problems corrected in version 2.2.1

19
STABLE2/rfc1918
View File

@ -21,7 +21,24 @@
# DROP - silently drop the packet
# logdrop - log then drop
#
###############################################################################
# By default, the RETURN target in the 'rfc1918' causes 'norfc1918'
# processing to cease for a packet if the packet's source IP address matches
# the rule. Thus, if you have:
#
# SUBNETS TARGET
# 192.168.1.0/24 RETURN
#
# then traffic from 192.168.1.4 to 10.0.3.9 will be accepted even though you
# also have:
#
# SUBNETS TARGET
# 10.0.0.0/8 logdrop
#
# Setting RFC1918_STRICT=Yes in shorewall.conf will cause such traffic to be
# logged and dropped since while the packet's source matches the RETURN rule,
# the packet's destination matches the 'logdrop' rule.
#
################################################################################
#SUBNETS TARGET
172.16.0.0/12 logdrop # RFC 1918
192.168.0.0/16 logdrop # RFC 1918

29
STABLE2/shorewall.conf
View File

@ -739,6 +739,35 @@ PKTTYPE=Yes
# DROPINVALID=Yes is assumed.
DROPINVALID=No
#
# RFC 1918 BEHAVIOR
#
# Traditionally, the RETURN target in the 'rfc1918' file has caused 'norfc1918'
# processing to cease for a packet if the packet's source IP address matches
# the rule. Thus, if you have:
#
# SUBNETS TARGET
# 192.168.1.0/24 RETURN
#
# then traffic from 192.168.1.4 to 10.0.3.9 will be accepted even though you
# also have:
#
# SUBNETS TARGET
# 10.0.0.0/8 logdrop
#
# Setting RFC1918_STRICT=Yes will cause such traffic to be logged and dropped
# since while the packet's source matches the RETURN rule, the packet's
# destination matches the 'logdrop' rule.
#
# If not specified or specified as empty (e.g., RFC1918_STRICT="") then
# RFC1918_STRICT=No is assumed.
#
# WARNING: RFC1918_STRICT=Yes requires that your kernel and iptables support
# 'conntrack state' match.
RFC1918_STRICT=No
################################################################################
# P A C K E T D I S P O S I T I O N
################################################################################

4
Shorewall-docs2/Documentation.xml
View File

@ -2681,7 +2681,7 @@ eth0 eth1 206.124.146.176</programlisting>
<warning>
<para>RFC1918_STRICT=Yes requires that your kernel and iptables
support 'conntrack state' match.</para>
support 'Connection Tracking' match.</para>
</warning>
</listitem>
</varlistentry>
@ -3743,7 +3743,7 @@ all all tcp ftp-data - 8</programlisting
</section>
<section id="Bogons" xreflabel="/etc/shorewall/rfc1918">
<title>/usr/share//shorewall/bogons — Added in Version 2.0.1</title>
<title>/usr/share/shorewall/bogons — Added in Version 2.0.1</title>
<para>This file lists the subnets affected by the <link
linkend="Interfaces">nobogons interface option</link> and <link

2
Shorewall2/firewall
View File

@ -5634,7 +5634,7 @@ initialize_netfilter () {
[ -n "$RFC1918_STRICT" -a -z "$CONNTRACK_MATCH" ] && \
startup_error "RFC1918_STRICT=Yes requires conntrack state match"
startup_error "RFC1918_STRICT=Yes requires Connection Tracking match"
echo "Determining Zones..."

2
Shorewall2/releasenotes.txt
View File

@ -66,7 +66,7 @@ New Features in version 2.2.2
then RFC1918_STRICT=No is assumed.
WARNING: RFC1918_STRICT=Yes requires that your kernel and iptables
support 'conntrack state' match.
support 'Connection Tracking' match.
-----------------------------------------------------------------------
Problems corrected in version 2.2.1