extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-06 01:36:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Move IPSEC option constants to the Zones module; Add Rules module

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@5528 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2007-03-14 23:09:05 +00:00
parent 299d15d992
commit 5ec37963d8
4 changed files with 91 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
New/Shorewall/Chains.pm
View File

@ -416,7 +416,7 @@ sub finish_section ( $ ) {
for my $zone ( @zones ) { for my $zone ( @zones ) {
for my $zone1 ( @zones ) { for my $zone1 ( @zones ) {
my $chainref = $chain_table{'filter'}{"${zone}2${zone1}"}; my $chainref = $chain_table{'filter'}{"$zone}2${zone1}"};
if ( $chainref->{referenced} ) { if ( $chainref->{referenced} ) {
finish_chain_section $chainref, $sections; finish_chain_section $chainref, $sections;
} }

64
New/Shorewall/Rules.pm Normal file
View File

@ -0,0 +1,64 @@
package Shorewall::Rules;
require Exporter;
our @ISA = qw(Exporter);
our @EXPORT = qw( STANDARD
NATRULE
BUILTIN
NONAT
NATONLY
REDIRECT
ACTION
MACRO
LOGRULE
%targets
);
our @EXPORT_OK = ();
our @VERSION = 1.00;
#
# Target Table. Each entry maps a target to a set of flags defined as follows.
#
use constant { STANDARD => 1, #defined by Netfilter
NATRULE => 2, #Involved NAT
BUILTIN => 4, #A built-in action
NONAT => 8, #'NONAT' or 'ACCEPT+'
NATONLY => 16, #'DNAT-' or 'REDIRECT-'
REDIRECT => 32, #'REDIRECT'
ACTION => 64, #An action
MACRO => 128, #A Macro
LOGRULE => 256, #'LOG'
};
#
# As new targets (Actions and Macros) are discovered, they are added to the table
#
our %targets = ('ACCEPT' => STANDARD,
'ACCEPT+' => STANDARD + NONAT,
'ACCEPT!' => STANDARD,
'NONAT' => STANDARD + NONAT,
'DROP' => STANDARD,
'DROP!' => STANDARD,
'REJECT' => STANDARD,
'REJECT!' => STANDARD,
'DNAT' => NATRULE,
'DNAT-' => NATRULE + NATONLY,
'REDIRECT' => NATRULE + REDIRECT,
'REDIRECT-' => NATRULE + REDIRECT + NATONLY,
'LOG' => STANDARD + LOGRULE,
'CONTINUE' => STANDARD,
'QUEUE' => STANDARD,
'SAME' => NATRULE,
'SAME-' => NATRULE + NATONLY,
'dropBcast' => BUILTIN + ACTION,
'allowBcast' => BUILTIN + ACTION,
'dropNotSyn' => BUILTIN + ACTION,
'rejNotSyn' => BUILTIN + ACTION,
'dropInvalid' => BUILTIN + ACTION,
'allowInvalid' => BUILTIN + ACTION,
'allowinUPnP' => BUILTIN + ACTION,
'forwardUPnP' => BUILTIN + ACTION,
'Limit' => BUILTIN + ACTION,
);
1;

25
New/Shorewall/Zones.pm
View File

@ -4,10 +4,33 @@ use Shorewall::Common;
use Shorewall::Config; use Shorewall::Config;
our @ISA = qw(Exporter); our @ISA = qw(Exporter);
our @EXPORT = qw( determine_zones add_group_to_zone dump_zone_info zone_report @zones %zones $firewall_zone ); our @EXPORT = qw( NOTHING
NUMERIC
NETWORK
IPSECPROTO
IPSECMODE
determine_zones
add_group_to_zone
dump_zone_info
zone_report
@zones
%zones
$firewall_zone );
our @EXPORT_OK = (); our @EXPORT_OK = ();
our @VERSION = 1.00; our @VERSION = 1.00;
#
# IPSEC Option types
#
use constant { NOTHING => 'NOTHING',
NUMERIC => '0x[\da-fA-F]+|\d+',
NETWORK => '\d+.\d+.\d+.\d+(\/\d+)?',
IPSECPROTO => 'ah|esp|ipcomp',
IPSECMODE => 'tunnel|transport'
};
# #
# Zone Table. # Zone Table.
# #

55
New/compiler.pl
View File

@ -10,16 +10,8 @@ use Shorewall::Chains;
use Shorewall::Zones; use Shorewall::Zones;
use Shorewall::Interfaces; use Shorewall::Interfaces;
use Shorewall::Hosts; use Shorewall::Hosts;
use Shorewall::Rules;
#
# IPSEC Option types
#
use constant { NOTHING => 'NOTHING',
NUMERIC => '0x[\da-fA-F]+|\d+',
NETWORK => '\d+.\d+.\d+.\d+(\/\d+)?',
IPSECPROTO => 'ah|esp|ipcomp',
IPSECMODE => 'tunnel|transport'
};
my ( $command, $doing, $done ) = qw/ compile Compiling Compiled/; #describe the current command, it's present progressive, and it's completion. my ( $command, $doing, $done ) = qw/ compile Compiling Compiled/; #describe the current command, it's present progressive, and it's completion.
@ -57,50 +49,7 @@ my @allipv4 = ( '0.0.0.0/0' );
use constant { ALLIPv4 => '0.0.0.0/0' }; use constant { ALLIPv4 => '0.0.0.0/0' };
my @rfc1918_networks = ( "10.0.0.0/24", "172.16.0.0/12", "192.168.0.0/16" ); my @rfc1918_networks = ( "10.0.0.0/24", "172.16.0.0/12", "192.168.0.0/16" );
#
# Target Table. Each entry maps a target to a set of flags defined as follows.
#
use constant { STANDARD => 1, #defined by Netfilter
NATRULE => 2, #Involved NAT
BUILTIN => 4, #A built-in action
NONAT => 8, #'NONAT' or 'ACCEPT+'
NATONLY => 16, #'DNAT-' or 'REDIRECT-'
REDIRECT => 32, #'REDIRECT'
ACTION => 64, #An action
MACRO => 128, #A Macro
LOGRULE => 256, #'LOG'
};
#
# As new targets (Actions and Macros) are discovered, they are added to the table
#
my %targets = ('ACCEPT' => STANDARD,
'ACCEPT+' => STANDARD + NONAT,
'ACCEPT!' => STANDARD,
'NONAT' => STANDARD + NONAT,
'DROP' => STANDARD,
'DROP!' => STANDARD,
'REJECT' => STANDARD,
'REJECT!' => STANDARD,
'DNAT' => NATRULE,
'DNAT-' => NATRULE + NATONLY,
'REDIRECT' => NATRULE + REDIRECT,
'REDIRECT-' => NATRULE + REDIRECT + NATONLY,
'LOG' => STANDARD + LOGRULE,
'CONTINUE' => STANDARD,
'QUEUE' => STANDARD,
'SAME' => NATRULE,
'SAME-' => NATRULE + NATONLY,
'dropBcast' => BUILTIN + ACTION,
'allowBcast' => BUILTIN + ACTION,
'dropNotSyn' => BUILTIN + ACTION,
'rejNotSyn' => BUILTIN + ACTION,
'dropInvalid' => BUILTIN + ACTION,
'allowInvalid' => BUILTIN + ACTION,
'allowinUPnP' => BUILTIN + ACTION,
'forwardUPnP' => BUILTIN + ACTION,
'Limit' => BUILTIN + ACTION,
);
#
# Action Table # Action Table
# #
# %actions{ <action1> => { requires => { <requisite1> = 1, # %actions{ <action1> => { requires => { <requisite1> = 1,