extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-12 04:37:01 +02:00
Code Issues Packages Projects Releases Wiki Activity

First round of changes to Shorewall6

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8958 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2008-12-09 19:05:18 +00:00
parent d1ecdcf4a3
commit 8b036f23f2
13 changed files with 278 additions and 3948 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Shorewall6/configpath
View File

@ -1,13 +1,13 @@
# #
# Shorewall version 4 - Default Config Path # Shorewall6 version 4 - Default Config Path
# #
# /usr/share/shorewall/configpath # /usr/share/shorewall6/configpath
# #
# Note to maintainers. # Note to maintainers.
# #
# The CONFDIR variable is normally set to /etc/shorewall but when # The CONFDIR variable is normally set to /etc/shorewall6 but when
# the command is "compile -e" then CONFDIR is set to # the command is "compile -e" then CONFDIR is set to
# /usr/share/shorewall/configfiles/. This prevents 'compile -e' # /usr/share/shorewall6/configfiles/. This prevents 'compile -e'
# from trying to use configuration information from /etc/shorewall. # from trying to use configuration information from /etc/shorewall.
CONFIG_PATH=${CONFDIR}:/usr/share/shorewall CONFIG_PATH=${CONFDIR}:/usr/share/shorewall6

8
Shorewall6/interfaces
View File

@ -1,11 +1,11 @@
# #
# Shorewall version 4 - Interfaces File # Shorewall6 version 4 - Interfaces File
# #
# For information about entries in this file, type "man shorewall-interfaces" # For information about entries in this file, type "man shorewall6-interfaces"
# #
# The manpage is also online at # The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-interfaces.html # http://www.shorewall.net/manpages6/shorewall6-interfaces.html
# #
############################################################################### ###############################################################################
#ZONE INTERFACE BROADCAST OPTIONS #ZONE INTERFACE ANYCAST OPTIONS
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

706
Shorewall6/lib.base
View File

@ -1,10 +1,10 @@
#!/bin/sh #!/bin/sh
# #
# Shorewall 4.2 -- /usr/share/shorewall/lib.base # Shorewall6 4.4 -- /usr/share/shorewall/lib.base
# #
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
# #
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007 - Tom Eastep (teastep@shorewall.net) # (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008 - Tom Eastep (teastep@shorewall.net)
# #
# Complete documentation is available at http://shorewall.net # Complete documentation is available at http://shorewall.net
# #
@ -23,8 +23,6 @@
# #
# This library contains the code common to all Shorewall components. # This library contains the code common to all Shorewall components.
# #
# - It is copied into the compiled script with the -e compiler flag is specified to
# shorewall-shell.
# - It is loaded by /sbin/shorewall. # - It is loaded by /sbin/shorewall.
# - It is loaded by /usr/share/shorewall/firewall. # - It is loaded by /usr/share/shorewall/firewall.
# - It is loaded by /usr/share/shorewall-shell/compiler. # - It is loaded by /usr/share/shorewall-shell/compiler.
@ -34,13 +32,12 @@
# by the compiler. # by the compiler.
# #
SHOREWALL_LIBVERSION=40000 SHOREWALL_LIBVERSION=40300
SHOREWALL_CAPVERSION=40203 SHOREWALL_CAPVERSION=40203
[ -n "${VARDIR:=/var/lib/shorewall}" ] [ -n "${VARDIR:=/var/lib/shorewall6}" ]
[ -n "${SHAREDIR:=/usr/share/shorewall}" ] [ -n "${SHAREDIR:=/usr/share/shorewall6}" ]
[ -n "${CONFDIR:=/etc/shorewall}" ] [ -n "${CONFDIR:=/etc/shorewall6}" ]
SHELLSHAREDIR=/usr/share/shorewall-shell
PERLSHAREDIR=/usr/share/shorewall-perl PERLSHAREDIR=/usr/share/shorewall-perl
# #
@ -142,8 +139,8 @@ qt()
# #
# Determine if Shorewall is "running" # Determine if Shorewall is "running"
# #
shorewall_is_started() { shorewall6_is_started() {
qt $IPTABLES -L shorewall -n qt $IP6TABLES -L shorewall -n
} }
# #
@ -263,7 +260,7 @@ reload_kernel_modules() {
[ -n "${MODULE_SUFFIX:=o gz ko o.gz ko.gz}" ] [ -n "${MODULE_SUFFIX:=o gz ko o.gz ko.gz}" ]
[ -z "$MODULESDIR" ] && MODULESDIR=/lib/modules/$(uname -r)/kernel/net/ipv4/netfilter:/lib/modules/$(uname -r)/kernel/net/netfilter [ -z "$MODULESDIR" ] && MODULESDIR=/lib/modules/$(uname -r)/kernel/net/ipv6/netfilter:/lib/modules/$(uname -r)/kernel/net/netfilter
MODULES=$(lsmod | cut -d ' ' -f1) MODULES=$(lsmod | cut -d ' ' -f1)
for directory in $(split $MODULESDIR); do for directory in $(split $MODULESDIR); do
@ -299,7 +296,7 @@ load_kernel_modules() # $1 = Yes, if we are to save moduleinfo in $VARDIR
[ -n "${MODULE_SUFFIX:=o gz ko o.gz ko.gz}" ] [ -n "${MODULE_SUFFIX:=o gz ko o.gz ko.gz}" ]
[ -z "$MODULESDIR" ] && \ [ -z "$MODULESDIR" ] && \
MODULESDIR=/lib/modules/$(uname -r)/kernel/net/ipv4/netfilter:/lib/modules/$(uname -r)/kernel/net/netfilter MODULESDIR=/lib/modules/$(uname -r)/kernel/net/ipv6/netfilter:/lib/modules/$(uname -r)/kernel/net/netfilter
for directory in $(split $MODULESDIR); do for directory in $(split $MODULESDIR); do
[ -d $directory ] && moduledirectories="$moduledirectories $directory" [ -d $directory ] && moduledirectories="$moduledirectories $directory"
@ -397,312 +394,12 @@ lib_load() # $1 = Name of the Library, $2 = Error Message heading if the library
fi fi
} }
#
# Determine if an optional library is available
#
lib_avail() # $1 = Name of the Library
{
[ -f ${SHAREDIR}/lib.$1 ]
}
#
# Note: The following set of IP address manipulation functions have anomalous
# behavior when the shell only supports 32-bit signed arithmetic and
# the IP address is 128.0.0.0 or 128.0.0.1.
#
LEFTSHIFT='<<'
#
# Validate an IP address
#
valid_address() {
local x
local y
local ifs
ifs=$IFS
IFS=.
for x in $1; do
case $x in
[0-9]|[0-9][0-9]|[1-2][0-9][0-9])
[ $x -lt 256 ] || { IFS=$ifs; return 2; }
;;
*)
IFS=$ifs
return 2
;;
esac
done
IFS=$ifs
return 0
}
#
# Convert an IP address in dot quad format to an integer
#
decodeaddr() {
local x
local temp
temp=0
local ifs
ifs=$IFS
IFS=.
for x in $1; do
temp=$(( $(( $temp $LEFTSHIFT 8 )) | $x ))
done
echo $temp
IFS=$ifs
}
#
# convert an integer to dot quad format
#
encodeaddr() {
addr=$1
local x
local y
y=$(($addr & 255))
for x in 1 2 3 ; do
addr=$(($addr >> 8))
y=$(($addr & 255)).$y
done
echo $y
}
#
# Miserable Hack to work around broken BusyBox ash in OpenWRT
#
addr_comp() {
test $(bc <<EOF
$1 > $2
EOF
) -eq 1
}
#
# Enumerate the members of an IP range -- When using a shell supporting only
# 32-bit signed arithmetic, the range cannot span 128.0.0.0.
#
# Comes in two flavors:
#
# ip_range() - produces a mimimal list of network/host addresses that spans
# the range.
#
# ip_range_explicit() - explicitly enumerates the range.
#
ip_range() {
local first
local last
local l
local x
local y
local z
local vlsm
case $1 in
!*)
#
# Let iptables complain if it's a range
#
echo $1
return
;;
[0-9]*.*.*.*-*.*.*.*)
;;
*)
echo $1
return
;;
esac
first=$(decodeaddr ${1%-*})
last=$(decodeaddr ${1#*-})
if addr_comp $first $last; then
fatal_error "Invalid IP address range: $1"
fi
l=$(( $last + 1 ))
while addr_comp $l $first; do
vlsm=
x=31
y=2
z=1
while [ $(( $first % $y )) -eq 0 ] && addr_comp $l $(( $first + $y )) ; do
vlsm=/$x
x=$(( $x - 1 ))
z=$y
y=$(( $y * 2 ))
done
echo $(encodeaddr $first)$vlsm
first=$(($first + $z))
done
}
ip_range_explicit() {
local first
local last
case $1 in
[0-9]*.*.*.*-*.*.*.*)
;;
*)
echo $1
return
;;
esac
first=$(decodeaddr ${1%-*})
last=$(decodeaddr ${1#*-})
if addr_comp $first $last; then
fatal_error "Invalid IP address range: $1"
fi
while ! addr_comp $first $last; do
echo $(encodeaddr $first)
first=$(($first + 1))
done
}
#
# Netmask from CIDR
#
ip_netmask() {
local vlsm
vlsm=${1#*/}
[ $vlsm -eq 0 ] && echo 0 || echo $(( -1 $LEFTSHIFT $(( 32 - $vlsm )) ))
}
#
# Network address from CIDR
#
ip_network() {
local decodedaddr
decodedaddr=$(decodeaddr ${1%/*})
local netmask
netmask=$(ip_netmask $1)
echo $(encodeaddr $(($decodedaddr & $netmask)))
}
#
# The following hack is supplied to compensate for the fact that many of
# the popular light-weight Bourne shell derivatives don't support XOR ("^").
#
ip_broadcast() {
local x
x=$(( 32 - ${1#*/} ))
[ $x -eq 32 ] && echo -1 || echo $(( $(( 1 $LEFTSHIFT $x )) - 1 ))
}
#
# Calculate broadcast address from CIDR
#
broadcastaddress() {
local decodedaddr
decodedaddr=$(decodeaddr ${1%/*})
local netmask
netmask=$(ip_netmask $1)
local broadcast
broadcast=$(ip_broadcast $1)
echo $(encodeaddr $(( $(($decodedaddr & $netmask)) | $broadcast )))
}
#
# Test for network membership
#
in_network() # $1 = IP address, $2 = CIDR network
{
local netmask
netmask=$(ip_netmask $2)
#
# We compare the values as strings rather than integers to work around broken BusyBox ash on OpenWRT
#
test $(( $(decodeaddr $1) & $netmask)) = $(( $(decodeaddr ${2%/*}) & $netmask ))
}
#
# Netmask to VLSM
#
ip_vlsm() {
local mask
mask=$(decodeaddr $1)
local vlsm
vlsm=0
local x
x=$(( 128 << 24 )) # 0x80000000
while [ $(( $x & $mask )) -ne 0 ]; do
[ $mask -eq $x ] && mask=0 || mask=$(( $mask $LEFTSHIFT 1 )) # Not all shells shift 0x80000000 left properly.
vlsm=$(($vlsm + 1))
done
if [ $(( $mask & 2147483647 )) -ne 0 ]; then # 2147483647 = 0x7fffffff
echo "Invalid net mask: $1" >&2
else
echo $vlsm
fi
}
#
# Chain name base for an interface -- replace all periods with underscores in the passed name.
# The result is echoed (less trailing "+").
#
chain_base() #$1 = interface
{
local c
c=${1%%+}
while true; do
case $c in
@*)
c=at_${c#@}
;;
*.*)
c="${c%.*}_${c##*.}"
;;
*-*)
c="${c%-*}_${c##*-}"
;;
*%*)
c="${c%\%*}_${c##*%}"
;;
*@*)
c="${c%@*}_${c##*@}"
;;
*)
echo ${c:=common}
return
;;
esac
done
}
# #
# Query NetFilter about the existence of a filter chain # Query NetFilter about the existence of a filter chain
# #
chain_exists() # $1 = chain name chain_exists() # $1 = chain name
{ {
qt $IPTABLES -L $1 -n qt $IP6TABLES -L $1 -n
} }
# #
@ -750,61 +447,23 @@ find_peer() {
done done
} }
#
# Find the interfaces that have a route to the passed address - the default
# route is not used.
#
find_rt_interface() {
ip route list | while read addr rest; do
case $addr in
*/*)
in_network ${1%/*} $addr && echo $(find_device $rest)
;;
default)
;;
*)
if [ "$addr" = "$1" -o "$addr/32" = "$1" ]; then
echo $(find_device $rest)
fi
;;
esac
done
}
# #
# Try to find the gateway through an interface looking for 'nexthop' # Try to find the gateway through an interface looking for 'nexthop'
find_nexthop() # $1 = interface find_nexthop() # $1 = interface
{ {
echo $(find_gateway `ip route list | grep "[[:space:]]nexthop.* $1"`) echo $(find_gateway `ip -6 route list | grep "[[:space:]]nexthop.* $1"`)
} }
# #
# Find the default route's interface # Find the default route's interface
# #
find_default_interface() { find_default_interface() {
ip route list | while read first rest; do ip -6 route list | while read first rest; do
[ "$first" = default ] && echo $(find_device $rest) && return [ "$first" = default ] && echo $(find_device $rest) && return
done done
} }
#
# Echo the name of the interface(s) that will be used to send to the
# passed address
#
find_interface_by_address() {
local dev
dev="$(find_rt_interface $1)"
local first
local rest
[ -z "$dev" ] && dev=$(find_default_interface)
[ -n "$dev" ] && echo $dev
}
# #
# Find the interface with the passed MAC address # Find the interface with the passed MAC address
# #
@ -847,16 +506,16 @@ find_first_interface_address() # $1 = interface
# #
# get the line of output containing the first IP address # get the line of output containing the first IP address
# #
addr=$(ip -f inet addr show $1 2> /dev/null | grep 'inet .* global' | head -n1) addr=$(ip -f inet6 addr show $1 2> /dev/null | grep 'inet6 .* global' | head -n1)
# #
# If there wasn't one, bail out now # If there wasn't one, bail out now
# #
[ -n "$addr" ] || fatal_error "Can't determine the IP address of $1" [ -n "$addr" ] || fatal_error "Can't determine the IPv6 address of $1"
# #
# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link) # Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)
# along with everything else on the line # along with everything else on the line
# #
echo $addr | sed 's/\s*inet //;s/\/.*//;s/ peer.*//' echo $addr | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//'
} }
find_first_interface_address_if_any() # $1 = interface find_first_interface_address_if_any() # $1 = interface
@ -864,12 +523,12 @@ find_first_interface_address_if_any() # $1 = interface
# #
# get the line of output containing the first IP address # get the line of output containing the first IP address
# #
addr=$(ip -f inet addr show $1 2> /dev/null | grep 'inet .* global' | head -n1) addr=$(ip -f inet6 addr show $1 2> /dev/null | grep 'inet6 .* global' | head -n1)
# #
# Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link) # Strip off the trailing VLSM mask (or the peer IP in case of a P-t-P link)
# along with everything else on the line # along with everything else on the line
# #
[ -n "$addr" ] && echo $addr | sed 's/\s*inet //;s/\/.*//;s/ peer.*//' || echo 0.0.0.0 [ -n "$addr" ] && echo $addr | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//' || echo ::
} }
# #
@ -877,7 +536,7 @@ find_first_interface_address_if_any() # $1 = interface
# #
interface_is_usable() # $1 = interface interface_is_usable() # $1 = interface
{ {
interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != 0.0.0.0 ] interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != :: ]
} }
# #
@ -886,7 +545,7 @@ interface_is_usable() # $1 = interface
# #
find_interface_addresses() # $1 = interface find_interface_addresses() # $1 = interface
{ {
ip -f inet addr show $1 2> /dev/null | grep inet\ | sed 's/\s*inet //;s/\/.*//;s/ peer.*//' ip -f inet6 addr show $1 2> /dev/null | grep inet\ | sed 's/\s*inet6 //;s/\/.*//;s/ peer.*//'
} }
# #
@ -897,7 +556,7 @@ get_routed_networks() # $1 = interface name, $2-n = Fatal error message
local address local address
local rest local rest
ip route show dev $1 2> /dev/null | ip -6 route show dev $1 2> /dev/null |
while read address rest; do while read address rest; do
case "$address" in case "$address" in
default) default)
@ -911,18 +570,13 @@ get_routed_networks() # $1 = interface name, $2-n = Fatal error message
multicast|broadcast|prohibit|nat|throw|nexthop) multicast|broadcast|prohibit|nat|throw|nexthop)
;; ;;
*) *)
[ "$address" = "${address%/*}" ] && address="${address}/32" [ "$address" = "${address%/*}" ] && address="${address}/128"
echo $address echo $address
;; ;;
esac esac
done done
} }
get_interface_bcasts() # $1 = interface
{
ip -f inet addr show dev $1 2> /dev/null | grep 'inet.*brd' | sed 's/inet.*brd //; s/scope.*//;' | sort -u
}
# #
# Internal version of 'which' # Internal version of 'which'
# #
@ -1042,7 +696,6 @@ set_state () # $1 = state
# Determine which optional facilities are supported by iptables/netfilter # Determine which optional facilities are supported by iptables/netfilter
# #
determine_capabilities() { determine_capabilities() {
qt $IPTABLES -t nat -L -n && NAT_ENABLED=Yes || NAT_ENABLED=
qt $IPTABLES -t mangle -L -n && MANGLE_ENABLED=Yes || MANGLE_ENABLED= qt $IPTABLES -t mangle -L -n && MANGLE_ENABLED=Yes || MANGLE_ENABLED=
CONNTRACK_MATCH= CONNTRACK_MATCH=
@ -1084,126 +737,126 @@ determine_capabilities() {
chain=fooX$$ chain=fooX$$
[ -n "$IPTABLES" ] || IPTABLES=$(mywhich iptables) [ -n "$IP6TABLES" ] || IP6TABLES=$(mywhich ip6tables)
if [ -z "$IPTABLES" ]; then if [ -z "$IP6TABLES" ]; then
echo " ERROR: No executable iptables binary can be found on your PATH" >&2 echo " ERROR: No executable iptables binary can be found on your PATH" >&2
exit 1 exit 1
fi fi
qt $IPTABLES -F $chain qt $IP6TABLES -F $chain
qt $IPTABLES -X $chain qt $IP6TABLES -X $chain
if ! $IPTABLES -N $chain; then if ! $IP6TABLES -N $chain; then
echo " ERROR: The command \"$IPTABLES -N $chain\" failed" >&2 echo " ERROR: The command \"$IP6TABLES -N $chain\" failed" >&2
exit 1 exit 1
fi fi
chain1=${chain}1 chain1=${chain}1
qt $IPTABLES -F $chain1 qt $IP6TABLES -F $chain1
qt $IPTABLES -X $chain1 qt $IP6TABLES -X $chain1
if ! $IPTABLES -N $chain1; then if ! $IP6TABLES -N $chain1; then
echo " ERROR: The command \"$IPTABLES -N $chain1\" failed" >&2 echo " ERROR: The command \"$IP6TABLES -N $chain1\" failed" >&2
exit 1 exit 1
fi fi
if ! qt $IPTABLES -A $chain -m state --state ESTABLISHED,RELATED -j ACCEPT; then if ! qt $IP6TABLES -A $chain -m state --state ESTABLISHED,RELATED -j ACCEPT; then
echo " ERROR: Your kernel lacks connection tracking and/or state matching -- Shorewall will not run on this system" >&2 echo " ERROR: Your kernel lacks connection tracking and/or state matching -- Shorewall will not run on this system" >&2
exit 1 exit 1
fi fi
qt $IPTABLES -A $chain -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT && CONNTRACK_MATCH=Yes qt $IP6TABLES -A $chain -m conntrack --ctorigdst ::1 -j ACCEPT && CONNTRACK_MATCH=Yes
if [ -n "$CONNTRACK_MATCH" ]; then if [ -n "$CONNTRACK_MATCH" ]; then
qt $IPTABLES -A $chain -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT && NEW_CONNTRACK_MATCH=Yes qt $IP6TABLES -A $chain -m conntrack -p tcp --ctorigdstport 22 -j ACCEPT && NEW_CONNTRACK_MATCH=Yes
qt $IPTABLES -A $chain -m conntrack ! --ctorigdst 1.2.3.4 || OLD_CONNTRACK_MATCH=Yes qt $IP6TABLES -A $chain -m conntrack ! --ctorigdst ::1 || OLD_CONNTRACK_MATCH=Yes
fi fi
if qt $IPTABLES -A $chain -p tcp -m multiport --dports 21,22 -j ACCEPT; then if qt $IP6TABLES -A $chain -p tcp -m multiport --dports 21,22 -j ACCEPT; then
MULTIPORT=Yes MULTIPORT=Yes
qt $IPTABLES -A $chain -p tcp -m multiport --sports 60 -m multiport --dports 99 -j ACCEPT && KLUDEFREE=Yes qt $IP6TABLES -A $chain -p tcp -m multiport --sports 60 -m multiport --dports 99 -j ACCEPT && KLUDEFREE=Yes
fi fi
qt $IPTABLES -A $chain -p tcp -m multiport --dports 21:22 -j ACCEPT && XMULTIPORT=Yes qt $IP6TABLES -A $chain -p tcp -m multiport --dports 21:22 -j ACCEPT && XMULTIPORT=Yes
qt $IPTABLES -A $chain -m policy --pol ipsec --mode tunnel --dir in -j ACCEPT && POLICY_MATCH=Yes qt $IP6TABLES -A $chain -m policy --pol ipsec --mode tunnel --dir in -j ACCEPT && POLICY_MATCH=Yes
if qt $IPTABLES -A $chain -m physdev --physdev-out eth0 -j ACCEPT; then if qt $IP6TABLES -A $chain -m physdev --physdev-out eth0 -j ACCEPT; then
PHYSDEV_MATCH=Yes PHYSDEV_MATCH=Yes
qt $IPTABLES -A $chain -m physdev --physdev-is-bridged --physdev-in eth0 --physdev-out eth0 -j ACCEPT && PHYSDEV_BRIDGE=Yes qt $IP6TABLES -A $chain -m physdev --physdev-is-bridged --physdev-in eth0 --physdev-out eth0 -j ACCEPT && PHYSDEV_BRIDGE=Yes
if [ -z "${KLUDGEFREE}" ]; then if [ -z "${KLUDGEFREE}" ]; then
qt $IPTABLES -A $chain -m physdev --physdev-in eth0 -m physdev --physdev-out eth0 -j ACCEPT && KLUDGEFREE=Yes qt $IP6TABLES -A $chain -m physdev --physdev-in eth0 -m physdev --physdev-out eth0 -j ACCEPT && KLUDGEFREE=Yes
fi fi
fi fi
if qt $IPTABLES -A $chain -m iprange --src-range 192.168.1.5-192.168.1.124 -j ACCEPT; then if qt $IP6TABLES -A $chain -m iprange --src-range ::1-::2 -j ACCEPT; then
IPRANGE_MATCH=Yes IPRANGE_MATCH=Yes
if [ -z "${KLUDGEFREE}" ]; then if [ -z "${KLUDGEFREE}" ]; then
qt $IPTABLES -A $chain -m iprange --src-range 192.168.1.5-192.168.1.124 -m iprange --dst-range 192.168.1.5-192.168.1.124 -j ACCEPT && KLUDGEFREE=Yes qt $IP6TABLES -A $chain -m iprange --src-range ::1-::2 -m iprange --dst-range ::1-::2 -j ACCEPT && KLUDGEFREE=Yes
fi fi
fi fi
qt $IPTABLES -A $chain -m recent --update -j ACCEPT && RECENT_MATCH=Yes qt $IP6TABLES -A $chain -m recent --update -j ACCEPT && RECENT_MATCH=Yes
qt $IPTABLES -A $chain -m owner --uid-owner 0 -j ACCEPT && OWNER_MATCH=Yes qt $IP6TABLES -A $chain -m owner --uid-owner 0 -j ACCEPT && OWNER_MATCH=Yes
if qt $IPTABLES -A $chain -m connmark --mark 2 -j ACCEPT; then if qt $IP6TABLES -A $chain -m connmark --mark 2 -j ACCEPT; then
CONNMARK_MATCH=Yes CONNMARK_MATCH=Yes
qt $IPTABLES -A $chain -m connmark --mark 2/0xFF -j ACCEPT && XCONNMARK_MATCH=Yes qt $IP6TABLES -A $chain -m connmark --mark 2/0xFF -j ACCEPT && XCONNMARK_MATCH=Yes
fi fi
qt $IPTABLES -A $chain -p tcp -m ipp2p --edk -j ACCEPT && IPP2P_MATCH=Yes qt $IP6TABLES -A $chain -p tcp -m ipp2p --edk -j ACCEPT && IPP2P_MATCH=Yes
qt $IPTABLES -A $chain -m length --length 10:20 -j ACCEPT && LENGTH_MATCH=Yes qt $IP6TABLES -A $chain -m length --length 10:20 -j ACCEPT && LENGTH_MATCH=Yes
qt $IPTABLES -A $chain -j REJECT --reject-with icmp-host-prohibited && ENHANCED_REJECT=Yes qt $IP6TABLES -A $chain -j REJECT --reject-with icmp-host-prohibited && ENHANCED_REJECT=Yes
qt $IPTABLES -A $chain -j ACCEPT -m comment --comment "This is a comment" && COMMENTS=Yes qt $IP6TABLES -A $chain -j ACCEPT -m comment --comment "This is a comment" && COMMENTS=Yes
if [ -n "$MANGLE_ENABLED" ]; then if [ -n "$MANGLE_ENABLED" ]; then
qt $IPTABLES -t mangle -N $chain qt $IP6TABLES -t mangle -N $chain
if qt $IPTABLES -t mangle -A $chain -j MARK --set-mark 1; then if qt $IP6TABLES -t mangle -A $chain -j MARK --set-mark 1; then
MARK=Yes MARK=Yes
qt $IPTABLES -t mangle -A $chain -j MARK --and-mark 0xFF && XMARK=Yes qt $IP6TABLES -t mangle -A $chain -j MARK --and-mark 0xFF && XMARK=Yes
fi fi
if qt $IPTABLES -t mangle -A $chain -j CONNMARK --save-mark; then if qt $IP6TABLES -t mangle -A $chain -j CONNMARK --save-mark; then
CONNMARK=Yes CONNMARK=Yes
qt $IPTABLES -t mangle -A $chain -j CONNMARK --save-mark --mask 0xFF && XCONNMARK=Yes qt $IP6TABLES -t mangle -A $chain -j CONNMARK --save-mark --mask 0xFF && XCONNMARK=Yes
fi fi
qt $IPTABLES -t mangle -A $chain -j CLASSIFY --set-class 1:1 && CLASSIFY_TARGET=Yes qt $IP6TABLES -t mangle -A $chain -j CLASSIFY --set-class 1:1 && CLASSIFY_TARGET=Yes
qt $IPTABLES -t mangle -F $chain qt $IP6TABLES -t mangle -F $chain
qt $IPTABLES -t mangle -X $chain qt $IP6TABLES -t mangle -X $chain
qt $IPTABLES -t mangle -L FORWARD -n && MANGLE_FORWARD=Yes qt $IP6TABLES -t mangle -L FORWARD -n && MANGLE_FORWARD=Yes
fi fi
qt $IPTABLES -t raw -L -n && RAW_TABLE=Yes qt $IP6TABLES -t raw -L -n && RAW_TABLE=Yes
if qt mywhich ipset; then if qt mywhich ipset; then
qt ipset -X $chain # Just in case something went wrong the last time qt ipset -X $chain # Just in case something went wrong the last time
if qt ipset -N $chain iphash ; then if qt ipset -N $chain iphash ; then
if qt $IPTABLES -A $chain -m set --set $chain src -j ACCEPT; then if qt $IP6TABLES -A $chain -m set --set $chain src -j ACCEPT; then
qt $IPTABLES -D $chain -m set --set $chain src -j ACCEPT qt $IP6TABLES -D $chain -m set --set $chain src -j ACCEPT
IPSET_MATCH=Yes IPSET_MATCH=Yes
fi fi
qt ipset -X $chain qt ipset -X $chain
fi fi
fi fi
qt $IPTABLES -A $chain -m pkttype --pkt-type broadcast -j ACCEPT && USEPKTTYPE=Yes qt $IP6TABLES -A $chain -m pkttype --pkt-type broadcast -j ACCEPT && USEPKTTYPE=Yes
qt $IPTABLES -A $chain -m addrtype --src-type BROADCAST -j ACCEPT && ADDRTYPE=Yes qt $IP6TABLES -A $chain -m addrtype --src-type BROADCAST -j ACCEPT && ADDRTYPE=Yes
qt $IPTABLES -A $chain -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1000:1500 -j ACCEPT && TCPMSS_MATCH=Yes qt $IP6TABLES -A $chain -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1000:1500 -j ACCEPT && TCPMSS_MATCH=Yes
qt $IPTABLES -A $chain -m hashlimit --hashlimit 4 --hashlimit-burst 5 --hashlimit-name $chain --hashlimit-mode dstip -j ACCEPT && HASHLIMIT_MATCH=Yes qt $IP6TABLES -A $chain -m hashlimit --hashlimit 4 --hashlimit-burst 5 --hashlimit-name $chain --hashlimit-mode dstip -j ACCEPT && HASHLIMIT_MATCH=Yes
qt $IPTABLES -A $chain -j NFQUEUE --queue-num 4 && NFQUEUE_TARGET=Yes qt $IP6TABLES -A $chain -j NFQUEUE --queue-num 4 && NFQUEUE_TARGET=Yes
qt $IPTABLES -A $chain -m realm --realm 4 && REALM_MATCH=Yes qt $IP6TABLES -A $chain -m realm --realm 4 && REALM_MATCH=Yes
qt $IPTABLES -A $chain -m helper --helper "ftp" && HELPER_MATCH=Yes qt $IP6TABLES -A $chain -m helper --helper "ftp" && HELPER_MATCH=Yes
qt $IPTABLES -A $chain -m connlimit --connlimit-above 8 -j DROP && CONNLIMIT_MATCH=Yes qt $IP6TABLES -A $chain -m connlimit --connlimit-above 8 -j DROP && CONNLIMIT_MATCH=Yes
qt $IPTABLES -A $chain -m time --timestart 23:00 -j DROP && TIME_MATCH=Yes qt $IP6TABLES -A $chain -m time --timestart 23:00 -j DROP && TIME_MATCH=Yes
qt $IPTABLES -A $chain -g $chain1 && GOTO_TARGET=Yes qt $IP6TABLES -A $chain -g $chain1 && GOTO_TARGET=Yes
qt $IPTABLES -F $chain qt $IP6TABLES -F $chain
qt $IPTABLES -X $chain qt $IP6TABLES -X $chain
qt $IPTABLES -F $chain1 qt $IP6TABLES -F $chain1
qt $IPTABLES -X $chain1 qt $IP6TABLES -X $chain1
CAPVERSION=$SHOREWALL_CAPVERSION CAPVERSION=$SHOREWALL_CAPVERSION
} }
@ -1220,8 +873,7 @@ report_capabilities() {
} }
if [ $VERBOSE -gt 1 ]; then if [ $VERBOSE -gt 1 ]; then
echo "Shorewall has detected the following iptables/netfilter capabilities:" echo "Shorewall6 has detected the following ip6tables/netfilter capabilities:"
report_capability "NAT" $NAT_ENABLED
report_capability "Packet Mangling" $MANGLE_ENABLED report_capability "Packet Mangling" $MANGLE_ENABLED
report_capability "Multi-port Match" $MULTIPORT report_capability "Multi-port Match" $MULTIPORT
[ -n "$MULTIPORT" ] && report_capability "Extended Multi-port Match" $XMULTIPORT [ -n "$MULTIPORT" ] && report_capability "Extended Multi-port Match" $XMULTIPORT
@ -1274,9 +926,8 @@ report_capabilities1() {
} }
echo "#" echo "#"
echo "# Shorewall $VERSION detected the following iptables/netfilter capabilities - $(date)" echo "# Shorewall6 $VERSION detected the following ip6tables/netfilter capabilities - $(date)"
echo "#" echo "#"
report_capability1 NAT_ENABLED
report_capability1 MANGLE_ENABLED report_capability1 MANGLE_ENABLED
report_capability1 MULTIPORT report_capability1 MULTIPORT
report_capability1 XMULTIPORT report_capability1 XMULTIPORT
@ -1318,81 +969,6 @@ report_capabilities1() {
echo CAPVERSION=$SHOREWALL_CAPVERSION echo CAPVERSION=$SHOREWALL_CAPVERSION
} }
#
# Delete IP address
#
del_ip_addr() # $1 = address, $2 = interface
{
[ $(find_first_interface_address_if_any $2) = $1 ] || qt ip addr del $1 dev $2
}
# Add IP Aliases
#
add_ip_aliases() # $* = List of addresses
{
local addresses
local external
local interface
local inet
local cidr
local rest
local val1
local arping
arping=$(mywhich arping)
address_details()
{
#
# Folks feel uneasy if they don't see all of the same
# decoration on these IP addresses that they see when their
# distro's net config tool adds them. In an attempt to reduce
# the anxiety level, we have the following code which sets
# the VLSM and BRD from an existing address in the same networks
#
# Get all of the lines that contain inet addresses with broadcast
#
ip -f inet addr show $interface 2> /dev/null | grep 'inet.*brd' | while read inet cidr rest ; do
case $cidr in
*/*)
if in_network $external $cidr; then
echo "/${cidr#*/} brd $(broadcastaddress $cidr)"
break
fi
;;
esac
done
}
do_one()
{
val=$(address_details)
ip addr add ${external}${val} dev $interface $label
[ -n "$arping" ] && qt $arping -U -c 2 -I $interface $external
echo "$external $interface" >> $VARDIR/nat
[ -n "$label" ] && label="with $label"
progress_message " IP Address $external added to interface $interface $label"
}
progress_message "Adding IP Addresses..."
while [ $# -gt 0 ]; do
external=$1
interface=$2
label=
if [ "$interface" != "${interface%:*}" ]; then
label="${interface#*:}"
interface="${interface%:*}"
label="label $interface:$label"
fi
shift 2
list_search $external $(find_interface_addresses $interface) || do_one
done
}
detect_gateway() # $1 = interface detect_gateway() # $1 = interface
{ {
local interface local interface
@ -1400,11 +976,11 @@ detect_gateway() # $1 = interface
# #
# First assume that this is some sort of point-to-point interface # First assume that this is some sort of point-to-point interface
# #
gateway=$( find_peer $(ip addr list $interface ) ) gateway=$( find_peer $(ip -6 addr list $interface ) )
# #
# Maybe there's a default route through this gateway already # Maybe there's a default route through this gateway already
# #
[ -n "$gateway" ] || gateway=$(find_gateway $(ip route list dev $interface)) [ -n "$gateway" ] || gateway=$(find_gateway $(ip -6 route list dev $interface))
# #
# Last hope -- is there a load-balancing route through the interface? # Last hope -- is there a load-balancing route through the interface?
# #
@ -1415,28 +991,6 @@ detect_gateway() # $1 = interface
[ -n "$gateway" ] && echo $gateway [ -n "$gateway" ] && echo $gateway
} }
#
# Disable IPV6
#
disable_ipv6() {
local foo
foo="$(ip -f inet6 addr list 2> /dev/null)"
if [ -n "$foo" ]; then
if qt mywhich ip6tables; then
ip6tables -P FORWARD DROP
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -F
ip6tables -X
ip6tables -A OUTPUT -o lo -j ACCEPT
ip6tables -A INPUT -i lo -j ACCEPT
else
error_message "WARNING: DISABLE_IPV6=Yes in shorewall.conf but this system does not appear to have ip6tables"
fi
fi
}
# Function to truncate a string -- It uses 'cut -b -<n>' # Function to truncate a string -- It uses 'cut -b -<n>'
# rather than ${v:first:last} because light-weight shells like ash and # rather than ${v:first:last} because light-weight shells like ash and
# dash do not support that form of expansion. # dash do not support that form of expansion.
@ -1447,94 +1001,6 @@ truncate() # $1 = length
cut -b -${1} cut -b -${1}
} }
#
# Add a logging rule.
#
do_log_rule_limit() # $1 = log level, $2 = chain, $3 = display Chain $4 = disposition , $5 = rate limit $6=log tag $7=command $... = predicates for the rule
{
local level
level=$1
local chain
chain=$2
local displayChain
displayChain=$3
local disposition
disposition=$4
local rulenum
rulenum=
local limit
limit=
local tag
tag=
local command
command=
local prefix
local base
base=$(chain_base $displayChain)
local pf
limit="${5:-$LOGLIMIT}" # Do this here rather than in the declaration above to appease /bin/ash.
tag=${6:+$6 }
command=${7:--A}
shift 7
if [ -n "$tag" -a -n "$LOGTAGONLY" ]; then
displayChain=$tag
tag=
fi
if [ -n "$LOGRULENUMBERS" ]; then
#
# Hack for broken printf on some lightweight shells
#
[ $(printf "%d" 1) = "1" ] && pf=printf || pf=$(mywhich printf)
eval rulenum=\$${base}_logrules
rulenum=${rulenum:-1}
prefix="$($pf "$LOGFORMAT" $displayChain $rulenum $disposition)${tag}"
rulenum=$(($rulenum + 1))
eval ${base}_logrules=$rulenum
else
prefix="$(printf "$LOGFORMAT" $displayChain $disposition)${tag}"
fi
if [ ${#prefix} -gt 29 ]; then
prefix="`echo "$prefix" | truncate 28` "
error_message "WARNING: Log Prefix shortened to \"$prefix\""
fi
case $level in
ULOG)
$IPTABLES $command $chain $@ $limit -j ULOG $LOGPARMS --ulog-prefix "$prefix"
;;
*)
$IPTABLES $command $chain $@ $limit -j LOG $LOGPARMS --log-level $level --log-prefix "$prefix"
;;
esac
if [ $? -ne 0 ] ; then
[ -z "$STOPPING" ] && { stop_firewall; exit 2; }
fi
}
do_log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates for the rule
{
local level
level=$1
local chain
chain=$2
local disposition
disposition=$3
shift 3
do_log_rule_limit $level $chain $chain $disposition "$LOGLIMIT" "" -A $@
}
delete_tc1() delete_tc1()
{ {
clear_one_tc() { clear_one_tc() {
@ -1609,7 +1075,7 @@ undo_routing() {
# #
if [ -f ${VARDIR}/undo_routing ]; then if [ -f ${VARDIR}/undo_routing ]; then
. ${VARDIR}/undo_routing . ${VARDIR}/undo_routing
progress_message "Shorewall-generated routing tables and routing rules removed" progress_message "Shorewall6-generated routing tables and routing rules removed"
rm -f ${VARDIR}/undo_routing rm -f ${VARDIR}/undo_routing
fi fi
fi fi
@ -1631,11 +1097,11 @@ restore_default_route() {
# #
# Don't restore a route with a metric -- we only replace the one with metric == 0 # Don't restore a route with a metric -- we only replace the one with metric == 0
# #
qt ip route delete default metric 0 && \ qt ip -6 route delete default metric 0 && \
progress_message "Default Route with metric 0 deleted" progress_message "Default Route with metric 0 deleted"
;; ;;
*) *)
qt ip route replace $default_route && \ qt ip -6 route replace $default_route && \
progress_message "Default Route (${default_route# }) restored" progress_message "Default Route (${default_route# }) restored"
;; ;;
esac esac

190
Shorewall6/lib.cli
View File

@ -1,10 +1,10 @@
#!/bin/sh #!/bin/sh
# #
# Shorewall 4.2 -- /usr/share/shorewall/lib.cli. # Shorewall6 4.4 -- /usr/share/shorewall6/lib.cli.
# #
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
# #
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007 - Tom Eastep (teastep@shorewall.net) # (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008 - Tom Eastep (teastep@shorewall.net)
# #
# Complete documentation is available at http://shorewall.net # Complete documentation is available at http://shorewall.net
# #
@ -21,8 +21,8 @@
# along with this program; if not, write to the Free Software # along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
# This library contains the command processing code common to /sbin/shorewall and # This library contains the command processing code common to /sbin/shorewall6 and
# /sbin/shorewall-lite. # /sbin/shorewall6-lite.
# #
# #
@ -64,25 +64,6 @@ showchain() # $1 = name of chain
fi fi
} }
#
# The 'awk' hack that compensates for bugs in iptables-save (or rather in the extension modules).
#
iptablesbug()
{
if qt mywhich awk ; then
awk 'BEGIN { sline=""; };\
/^-j/ { print sline $0; next };\
/-m policy.*-j/ { print $0; next };\
/-m policy/ { sline=$0; next };\
/--mask ff/ { sub( /--mask ff/, "--mask 0xff" ) };\
{ print ; sline="" }'
else
echo " WARNING: You don't have 'awk' on this system so the output of the save command may be unusable" >&2
cat
fi
}
# #
# Validate the value of RESTOREFILE # Validate the value of RESTOREFILE
# #
@ -216,7 +197,7 @@ logwatch() # $1 = timeout -- if negative, prompt each time that
{ {
host=$(echo $HOSTNAME | sed 's/\..*$//') host=$(echo $HOSTNAME | sed 's/\..*$//')
oldrejects=$($IPTABLES -L -v -n | grep 'LOG') oldrejects=$($IP6TABLES -L -v -n | grep 'LOG')
if [ $1 -lt 0 ]; then if [ $1 -lt 0 ]; then
timeout=$((- $1)) timeout=$((- $1))
@ -238,7 +219,7 @@ logwatch() # $1 = timeout -- if negative, prompt each time that
show_reset show_reset
rejects=$($IPTABLES -L -v -n | grep 'LOG') rejects=$($IP6TABLES -L -v -n | grep 'LOG')
if [ "$rejects" != "$oldrejects" ]; then if [ "$rejects" != "$oldrejects" ]; then
oldrejects="$rejects" oldrejects="$rejects"
@ -270,11 +251,11 @@ save_config() {
local result local result
result=1 result=1
iptables_save=${IPTABLES}-save iptables_save=${IP6TABLES}-save
[ -x $iptables_save ] || echo "$iptables-save does not exist or is not executable" >&2 [ -x $iptables_save ] || echo "$ip6tables-save does not exist or is not executable" >&2
if shorewall_is_started ; then if shorewall66_is_started ; then
[ -d ${VARDIR} ] || mkdir -p ${VARDIR} [ -d ${VARDIR} ] || mkdir -p ${VARDIR}
if [ -f $RESTOREPATH -a ! -x $RESTOREPATH ]; then if [ -f $RESTOREPATH -a ! -x $RESTOREPATH ]; then
@ -295,45 +276,6 @@ save_config() {
mv -f ${VARDIR}/restore-$$ ${RESTOREPATH}-iptables mv -f ${VARDIR}/restore-$$ ${RESTOREPATH}-iptables
chmod +x $RESTOREPATH chmod +x $RESTOREPATH
echo " Currently-running Configuration Saved to $RESTOREPATH" echo " Currently-running Configuration Saved to $RESTOREPATH"
rm -f ${RESTOREPATH}-ipsets
case ${SAVE_IPSETS:-No} in
[Yy][Ee][Ss])
RESTOREPATH=${RESTOREPATH}-ipsets
f=${VARDIR}/restore-$$
echo "#!/bin/sh" > $f
echo "#This ipset restore file generated $(date) by Shorewall $version" >> $f
echo >> $f
echo ". ${SHAREDIR}/lib.base" >> $f
echo >> $f
cat ${VARDIR}/.modulesdir >> $f
echo >> $f
echo "reload_kernel_modules << __EOF__" >> $f
grep 'loadmodule ip_set' ${VARDIR}/.modules >> $f
echo "__EOF__" >> $f
echo >> $f
echo "ipset -U :all: :all:" >> $f
echo "ipset -U :all: :default:" >> $f
echo "ipset -F" >> $f
echo "ipset -X" >> $f
echo "ipset -R << __EOF__" >> $f
ipset -S >> $f
echo "__EOF__" >> $f
mv -f $f $RESTOREPATH
chmod +x $RESTOREPATH
echo " Current Ipset Contents Saved to $RESTOREPATH"
result=0
;;
[Nn][Oo])
;;
*)
echo " WARNING: Invalid value ($SAVE_IPSETS) for SAVE_IPSETS. Ipset contents not saved" >&2
;;
esac
run_user_exit save run_user_exit save
else else
rm -f ${VARDIR}/restore-$$ rm -f ${VARDIR}/restore-$$
@ -349,7 +291,7 @@ save_config() {
esac esac
fi fi
else else
echo "Shorewall isn't started" >&2 echo "Shorewall6 isn't started" >&2
fi fi
return 0 return 0
@ -360,18 +302,18 @@ save_config() {
# Show routing configuration # Show routing configuration
# #
show_routing() { show_routing() {
if [ -n "$(ip rule list)" ]; then if [ -n "$(ip -6 rule list)" ]; then
heading "Routing Rules" heading "Routing Rules"
ip rule list ip -6 rule list
ip rule list | while read rule; do ip -6 rule list | while read rule; do
echo ${rule##* } echo ${rule##* }
done | sort -u | while read table; do done | sort -u | while read table; do
heading "Table $table:" heading "Table $table:"
ip route list table $table ip -6 route list table $table
done done
else else
heading "Routing Table" heading "Routing Table"
ip route list ip -6 route list
fi fi
} }
@ -464,19 +406,13 @@ show_command() {
echo echo
[ -f /proc/net/ip_conntrack ] && cat /proc/net/ip_conntrack || cat /proc/net/nf_conntrack [ -f /proc/net/ip_conntrack ] && cat /proc/net/ip_conntrack || cat /proc/net/nf_conntrack
;; ;;
nat)
[ $# -gt 1 ] && usage 1
echo "$PRODUCT $version NAT Table at $HOSTNAME - $(date)"
echo
show_reset
$IPTABLES -t nat -L $IPT_OPTIONS
;; ;;
tos|mangle) tos|mangle)
[ $# -gt 1 ] && usage 1 [ $# -gt 1 ] && usage 1
echo "$PRODUCT $version Mangle Table at $HOSTNAME - $(date)" echo "$PRODUCT $version Mangle Table at $HOSTNAME - $(date)"
echo echo
show_reset show_reset
$IPTABLES -t mangle -L $IPT_OPTIONS $IP6TABLES -t mangle -L $IPT_OPTIONS
;; ;;
log) log)
[ $# -gt 1 ] && usage 1 [ $# -gt 1 ] && usage 1
@ -536,7 +472,7 @@ show_command() {
[ $# -gt 1 ] && usage 1 [ $# -gt 1 ] && usage 1
echo "$PRODUCT $version IP at $HOSTNAME - $(date)" echo "$PRODUCT $version IP at $HOSTNAME - $(date)"
echo echo
ip -4 addr list ip -6 addr list
;; ;;
routing) routing)
[ $# -gt 1 ] && usage 1 [ $# -gt 1 ] && usage 1
@ -556,33 +492,24 @@ show_command() {
show_reset show_reset
if [ $# -gt 0 ]; then if [ $# -gt 0 ]; then
for chain in $*; do for chain in $*; do
$IPTABLES -t $table -L $chain $IPT_OPTIONS $IP6TABLES -t $table -L $chain $IPT_OPTIONS
done done
else else
$IPTABLES -t $table -L $IPT_OPTIONS $IP6TABLES -t $table -L $IPT_OPTIONS
fi fi
;; ;;
vardir) vardir)
echo $VARDIR; echo $VARDIR;
;; ;;
*) *)
if [ "$PRODUCT" = Shorewall ]; then if [ "$PRODUCT" = Shorewall6 ]; then
case $1 in case $1 in
actions) actions)
[ $# -gt 1 ] && usage 1 [ $# -gt 1 ] && usage 1
echo "allowBcast # Silently Allow Broadcast/multicast"
echo "allowInvalid # Accept packets that are in the INVALID conntrack state." echo "allowInvalid # Accept packets that are in the INVALID conntrack state."
echo "allowinUPnP # Allow UPnP inbound (to firewall) traffic"
echo "allowoutUPnP # Allow traffic from local command 'upnpd' (does not work with kernels after 2.6.13)"
echo "dropBcast # Silently Drop Broadcast/multicast"
echo "dropInvalid # Silently Drop packets that are in the INVALID conntrack state" echo "dropInvalid # Silently Drop packets that are in the INVALID conntrack state"
echo "dropNotSyn # Silently Drop Non-syn TCP packets" echo "dropNotSyn # Silently Drop Non-syn TCP packets"
echo "drop1918src # Drop packets with an RFC 1918 source address (Shorewall-perl only)"
echo "drop1918dst # Drop packets with an RFC 1918 original dest address (Shorewall-perl only)"
echo "forwardUPnP # Allow traffic that upnpd has redirected from"
echo "rejNotSyn # Silently Reject Non-syn TCP packets" echo "rejNotSyn # Silently Reject Non-syn TCP packets"
echo "rej1918src # Reject packets with an RFC 1918 source address (Shorewall-perl only)"
echo "rej1918dst # Reject packets with an RFC 1918 original dest address (Shorewall-perl only)"
if [ -f ${CONFDIR}/actions ]; then if [ -f ${CONFDIR}/actions ]; then
cat ${SHAREDIR}/actions.std ${CONFDIR}/actions | grep -Ev '^\#|^$' cat ${SHAREDIR}/actions.std ${CONFDIR}/actions | grep -Ev '^\#|^$'
@ -620,8 +547,8 @@ show_command() {
if [ $# -gt 0 ]; then if [ $# -gt 0 ]; then
[ -n "$table_given" ] || for chain in $*; do [ -n "$table_given" ] || for chain in $*; do
if ! qt $IPTABLES -t $table -L $chain $IPT_OPTIONS; then if ! qt $IP6TABLES -t $table -L $chain $IPT_OPTIONS; then
echo "usage $(basename $0) show [ -x ] [ -m ] [-f] [ -t {filter|mangle|nat} ] [ {chain [<chain> [ <chain> ... ]|actions|capabilities|classifiers|config|connections|filters|ip|log|macros|mangle|nat|routing|tc|zones} ] " >&2 echo "usage $(basename $0) show [ -x ] [ -m ] [-f] [ -t {filter|mangle} ] [ {chain [<chain> [ <chain> ... ]|actions|capabilities|classifiers|config|connections|filters|ip|log|macros|mangle|routing|tc|zones} ] " >&2
exit 1 exit 1
fi fi
done done
@ -630,13 +557,13 @@ show_command() {
echo echo
show_reset show_reset
for chain in $*; do for chain in $*; do
$IPTABLES -t $table -L $chain $IPT_OPTIONS $IP6TABLES -t $table -L $chain $IPT_OPTIONS
done done
else else
echo "$PRODUCT $version $table Table at $HOSTNAME - $(date)" echo "$PRODUCT $version $table Table at $HOSTNAME - $(date)"
echo echo
show_reset show_reset
$IPTABLES -t $table -L $IPT_OPTIONS $IP6TABLES -t $table -L $IPT_OPTIONS
fi fi
;; ;;
esac esac
@ -689,35 +616,32 @@ dump_command() {
clear_term clear_term
echo "$PRODUCT $version Dump at $HOSTNAME - $(date)" echo "$PRODUCT $version Dump at $HOSTNAME - $(date)"
echo echo
if [ -f /usr/share/shorewall-shell/version ]; then if [ -f /usr/share/shorewall6-shell/version ]; then
echo " Shorewall-shell $(cat /usr/share/shorewall-shell/version)" echo " Shorewall6-shell $(cat /usr/share/shorewall6-shell/version)"
if [ -f /usr/share/shorewall-perl/version ]; then if [ -f /usr/share/shorewall6-perl/version ]; then
echo " Shorewall-perl $(cat /usr/share/shorewall-perl/version)" echo " Shorewall6-perl $(cat /usr/share/shorewall6-perl/version)"
fi fi
echo echo
elif [ -f /usr/share/shorewall-perl/version ]; then elif [ -f /usr/share/shorewall6-perl/version ]; then
echo " Shorewall-perl $(cat /usr/share/shorewall-perl/version)" echo " Shorewall6-perl $(cat /usr/share/shorewall6-perl/version)"
echo echo
fi fi
show_reset show_reset
host=$(echo $HOSTNAME | sed 's/\..*$//') host=$(echo $HOSTNAME | sed 's/\..*$//')
$IPTABLES -L $IPT_OPTIONS $IP6TABLES -L $IPT_OPTIONS
heading "Log ($LOGFILE)" heading "Log ($LOGFILE)"
packet_log 20 packet_log 20
heading "NAT Table"
$IPTABLES -t nat -L $IPT_OPTIONS
heading "Mangle Table" heading "Mangle Table"
$IPTABLES -t mangle -L $IPT_OPTIONS $IP6TABLES -t mangle -L $IPT_OPTIONS
heading "Conntrack Table" heading "Conntrack Table"
[ -f /proc/net/ip_conntrack ] && cat /proc/net/ip_conntrack || cat /proc/net/nf_conntrack [ -f /proc/net/ip_conntrack ] && cat /proc/net/ip_conntrack || cat /proc/net/nf_conntrack
heading "IP Configuration" heading "IP Configuration"
ip -4 addr list ip -6 addr list
heading "IP Stats" heading "IP Stats"
ip -stat link list ip -stat link list
@ -736,11 +660,9 @@ dump_command() {
heading "/proc" heading "/proc"
show_proc /proc/version show_proc /proc/version
show_proc /proc/sys/net/ipv4/ip_forward
show_proc /proc/sys/net/ipv4/icmp_echo_ignore_all
for directory in /proc/sys/net/ipv4/conf/*; do for directory in /proc/sys/net/ipv6/conf/*; do
for file in proxy_arp arp_filter arp_ignore rp_filter log_martians; do for file in proxy_ra proxy_ndp; do
show_proc $directory/$file show_proc $directory/$file
done done
done done
@ -752,7 +674,7 @@ dump_command() {
if qt mywhich lsmod; then if qt mywhich lsmod; then
heading "Modules" heading "Modules"
lsmod | grep -E '^(ip_|ipt_|iptable_|nf_|xt_)' | sort lsmod | grep -E '^(ip_|ipt_|ip6table_|nf_|xt_)' | sort
fi fi
determine_capabilities determine_capabilities
@ -837,7 +759,7 @@ restore_command() {
$SHOREWALL_SHELL ${RESTOREPATH}-ipsets $SHOREWALL_SHELL ${RESTOREPATH}-ipsets
fi fi
progress_message3 "Restoring Shorewall..." progress_message3 "Restoring Shorewall6..."
$SHOREWALL_SHELL $RESTOREPATH restore && progress_message3 "$PRODUCT restored from ${VARDIR}/$RESTOREFILE" $SHOREWALL_SHELL $RESTOREPATH restore && progress_message3 "$PRODUCT restored from ${VARDIR}/$RESTOREFILE"
@ -939,18 +861,18 @@ block() # $1 = command, $2 = Finished, $3 - $n addresses
while [ $# -gt 0 ]; do while [ $# -gt 0 ]; do
case $1 in case $1 in
*-*) *-*)
qt $IPTABLES -D dynamic -m iprange --src-range $1 -j reject qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j reject
qt $IPTABLES -D dynamic -m iprange --src-range $1 -j DROP qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j DROP
qt $IPTABLES -D dynamic -m iprange --src-range $1 -j logreject qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j logreject
qt $IPTABLES -D dynamic -m iprange --src-range $1 -j logdrop qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j logdrop
$IPTABLES -A dynamic -m iprange --src-range $1 -j $chain || break 1 $IP6TABLES -A dynamic -m iprange --src-range $1 -j $chain || break 1
;; ;;
*) *)
qt $IPTABLES -D dynamic -s $1 -j reject qt $IP6TABLES -D dynamic -s $1 -j reject
qt $IPTABLES -D dynamic -s $1 -j DROP qt $IP6TABLES -D dynamic -s $1 -j DROP
qt $IPTABLES -D dynamic -s $1 -j logreject qt $IP6TABLES -D dynamic -s $1 -j logreject
qt $IPTABLES -D dynamic -s $1 -j logdrop qt $IP6TABLES -D dynamic -s $1 -j logdrop
$IPTABLES -A dynamic -s $1 -j $chain || break 1 $IP6TABLES -A dynamic -s $1 -j $chain || break 1
;; ;;
esac esac
@ -1054,16 +976,16 @@ hits_command() {
allow_command() { allow_command() {
[ -n "$debugging" ] && set -x [ -n "$debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if shorewall6_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
while [ $# -gt 1 ]; do while [ $# -gt 1 ]; do
shift shift
case $1 in case $1 in
*-*) *-*)
if qt $IPTABLES -D dynamic -m iprange --src-range $1 -j reject ||\ if qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j reject ||\
qt $IPTABLES -D dynamic -m iprange --src-range $1 -j DROP ||\ qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j DROP ||\
qt $IPTABLES -D dynamic -m iprange --src-range $1 -j logdrop ||\ qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j logdrop ||\
qt $IPTABLES -D dynamic -m iprange --src-range $1 -j logreject qt $IP6TABLES -D dynamic -m iprange --src-range $1 -j logreject
then then
echo "$1 Allowed" echo "$1 Allowed"
else else
@ -1071,10 +993,10 @@ allow_command() {
fi fi
;; ;;
*) *)
if qt $IPTABLES -D dynamic -s $1 -j reject ||\ if qt $IP6TABLES -D dynamic -s $1 -j reject ||\
qt $IPTABLES -D dynamic -s $1 -j DROP ||\ qt $IP6TABLES -D dynamic -s $1 -j DROP ||\
qt $IPTABLES -D dynamic -s $1 -j logdrop ||\ qt $IP6TABLES -D dynamic -s $1 -j logdrop ||\
qt $IPTABLES -D dynamic -s $1 -j logreject qt $IP6TABLES -D dynamic -s $1 -j logreject
then then
echo "$1 Allowed" echo "$1 Allowed"
else else

2296
Shorewall6/lib.config
View File

File diff suppressed because it is too large Load Diff

427
Shorewall6/lib.dynamiczones
View File

@ -1,427 +0,0 @@
#!/bin/sh
#
# Shorewall 4.2 -- /usr/share/shorewall/lib.dynamiczones
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# This library is loaded by /usr/share/shorewall/firewall when processing
# the 'add' and 'delete' commands.
#
#
# Add a host or networks to a zone
#
add_to_zone() # $1...${n-1} = <interface>[:<hosts>] $n = zone
{
local interface host zone z h z1 z2 chain
local dhcp_interfaces blacklist_interfaces maclist_interfaces
local tcpflags_interfaces newhostlist=
local rulenum source_chain dest_hosts iface hosts hostlist=
nat_chain_exists() # $1 = chain name
{
qt $IPTABLES -t nat -L $1 -n
}
do_iptables() # $@ = command
{
[ -n "$PHYSDEV_MATCH" ] && [ -f $TMP_DIR/physdev ] && rm -f $TMP_DIR/physdev
[ -n "$IPRANGE_MATCH" ] && [ -f $TMP_DIR/iprange ] && rm -f $TMP_DIR/iprange
if ! $IPTABLES $@ ; then
error_message "ERROR: Can't add $newhost to zone $zone"
fi
}
DOING=Processing
DONE=Processed
#
# Load $zones
#
determine_zones
#
# Validate Interfaces File
#
validate_interfaces_file
#
# Validate Hosts File
#
validate_hosts_file
#
# Validate IPSec File
#
f=$(find_file $IPSECFILE)
[ -f $f ] && setup_ipsec $f
#
# Normalize host list
#
while [ $# -gt 1 ]; do
interface=${1%%:*}
host=${1#*:}
[ "$host" = "$1" ] && host=
#
# Be sure that the interface was dynamic at last [re]start
#
if ! chain_exists $(input_chain $interface) ; then
startup_error "Unknown interface $interface"
fi
if ! chain_exists $(dynamic_in $interface) ; then
startup_error "At last Shorewall [re]start, DYNAMIC_ZONES=No in shorewall.conf"
fi
if [ -z "$host" ]; then
hostlist="$hostlist $interface:0.0.0.0/0"
else
for h in $(separate_list $host); do
hostlist="$hostlist $interface:$h"
done
fi
shift
done
#
# Validate Zone
#
zone=$1
validate_zone $zone || startup_error "Unknown zone: $zone"
[ "$zone" = $FW ] && startup_error "Can't add $1 to firewall zone"
#
# Be sure that Shorewall has been restarted using a DZ-aware version of the code
#
[ -f ${VARDIR}/chains ] || startup_error "${VARDIR}/chains -- file not found"
[ -f ${VARDIR}/zones ] || startup_error "${VARDIR}/zones -- file not found"
#
# Check for duplicates and create a new zone state file
#
> ${VARDIR}/zones_$$
while read z type hosts; do
if [ "$z" = "$zone" ]; then
case $type in
bport4:*)
rm -f ${VARDIR}/zones_$$
startup_error "Bridge Port zones may not be dynamically modified"
;;
esac
case "$hosts" in
*exclude*)
rm -f ${VARDIR}/zones_$$
startup_error "Modifying a zone that has an exclude list is not supported"
;;
*)
for h in $hostlist; do
if ! list_search +$h $hosts; then
if ! list_search $h $hosts; then
newhostlist="$newhostlist +$h"
else
error_message "$h is already in zone $zone"
fi
else
error_message "$h is already in zone $zone"
fi
done
[ -z "$hosts" ] && hosts=$newhostlist || hosts="$hosts $newhostlist"
;;
esac
fi
eval ${z}_hosts=\"$hosts\"
echo "$z $type $hosts" >> ${VARDIR}/zones_$$
done < ${VARDIR}/zones
mv -f ${VARDIR}/zones_$$ ${VARDIR}/zones
TERMINATOR=fatal_error
#
# Create a new Zone state file
#
for newhost in $newhostlist; do
newhost=${newhost#+}
#
# Isolate interface and host parts
#
interface=${newhost%%:*}
host=${newhost#*:}
#
# If the zone passed in the command has a dnat chain then insert a rule in
# the nat table PREROUTING chain to jump to that chain when the source
# matches the new host(s)#
#
chain=${zone}_dnat
if nat_chain_exists $chain; then
do_iptables -t nat -A $(dynamic_in $interface) $(source_ip_range $host) $(match_ipsec_in $zone $newhost) -j $chain
fi
#
# Insert new rules into the filter table for the passed interface
#
while read z1 z2 chain; do
[ "$z1" = "$z2" ] && op="-I" || op="-A"
if [ "$z1" = "$zone" ]; then
if [ "$z2" = "$FW" ]; then
do_iptables $op $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j $chain
else
source_chain=$(dynamic_fwd $interface)
if is_ipsec_host $z1 $newhost ; then
do_iptables $op $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd
else
eval dest_hosts=\"\$${z2}_hosts\"
for h in $dest_hosts; do
[ "$h" = exclude ] && break
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
do_iptables $op $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain
fi
done
fi
fi
elif [ "$z2" = "$zone" ]; then
if [ "$z1" = "$FW" ]; then
#
# Add a rule to the dynamic out chain for the interface
#
do_iptables $op $(dynamic_out $interface) $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
else
eval source_hosts=\"\$${z1}_hosts\"
for h in $source_hosts; do
[ "$h" = exclude ] && break
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
if is_ipsec_host $z1 $h; then
do_iptables $op ${z1}_dyn -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
else
do_iptables $op $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain
fi
fi
done
fi
fi
done < ${VARDIR}/chains
progress_message "$newhost added to zone $zone"
done
rm -rf $TMP_DIR
}
#
# Delete a host or networks from a zone
#
delete_from_zone() # $1 = <interface>[:<hosts>] $2 = zone
{
local interface host zone z h z1 z2 chain delhost
local dhcp_interfaces blacklist_interfaces maclist_interfaces tcpflags_interfaces
local rulenum source_chain dest_hosts iface hosts hostlist=
DOING=Processing
DONE=Processed
#
# Load $zones
#
determine_zones
#
# Validate Interfaces File
#
validate_interfaces_file
#
# Validate Hosts File
#
validate_hosts_file
#
# Validate IPSec File
#
f=$(find_file ipsec)
[ -f $f ] && setup_ipsec $f
#
# Normalize host list
#
while [ $# -gt 1 ]; do
interface=${1%%:*}
host=${1#*:}
[ "$host" = "$1" ] && host=
#
# Be sure that the interface was dynamic at last [re]start
#
if ! chain_exists $(input_chain $interface) ; then
startup_error "Unknown interface $interface"
fi
if ! chain_exists $(dynamic_in $interface) ; then
startup_error "At last Shorewall [re]start, DYNAMIC_ZONES=No in shorewall.conf"
fi
if [ -z "$host" ]; then
hostlist="$hostlist $interface:0.0.0.0/0"
else
for h in $(separate_list $host); do
hostlist="$hostlist $interface:$h"
done
fi
shift
done
#
# Validate Zone
#
zone=$1
validate_zone $zone || startup_error "Unknown zone: $zone"
[ "$zone" = $FW ] && startup_error "Can't delete from the firewall zone"
#
# Be sure that Shorewall has been restarted using a DZ-aware version of the code
#
[ -f ${VARDIR}/chains ] || startup_error "${VARDIR}/chains -- file not found"
[ -f ${VARDIR}/zones ] || startup_error "${VARDIR}/zones -- file not found"
#
# Delete the passed hosts from the zone state file
#
> ${VARDIR}/zones_$$
while read z hosts; do
if [ "$z" = "$zone" ]; then
temp=$hosts
hosts=
for host in $hostlist; do
found=
for h in $temp; do
if [ "$h" = "+$host" ]; then
found=Yes
break
fi
if [ "$h" = "$host" ]; then
found=No
break
fi
done
[ -n "$found" ] || error_message "WARNING: $host does not appear to be in zone $zone"
[ "$found" = No ] && startup_error "$host is a permanent member of zone $zone"
done
for h in $temp; do
found=
for host in $hostlist; do
if [ "$h" = "+$host" ]; then
found=Yes
break
fi
done
[ -n "$found" ] || hosts="$hosts $h"
done
fi
eval ${z}_hosts=\"$hosts\"
echo "$z $hosts" >> ${VARDIR}/zones_$$
done < ${VARDIR}/zones
mv -f ${VARDIR}/zones_$$ ${VARDIR}/zones
TERMINATOR=fatal_error
for delhost in $hostlist; do
interface=${delhost%%:*}
host=${delhost#*:}
#
# Delete any nat table entries for the host(s)
#
qt_iptables -t nat -D $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $zone $delhost) -j ${zone}_dnat
#
# Delete rules rules the input chains for the passed interface
#
while read z1 z2 chain; do
if [ "$z1" = "$zone" ]; then
if [ "$z2" = "$FW" ]; then
qt_iptables -D $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $delhost) -j $chain
else
source_chain=$(dynamic_fwd $interface)
if is_ipsec_host $z1 $delhost ; then
qt_iptables -D $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd
else
eval dest_hosts=\"\$${z2}_hosts\"
[ "$z2" = "$zone" ] && dest_hosts="$dest_hosts $hostlist"
for h in $dest_hosts; do
[ "$h" = exclude ] && break
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
qt_iptables -D $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain
fi
done
fi
fi
elif [ "$z2" = "$zone" ]; then
if [ "$z1" = "$FW" ]; then
qt_iptables -D $(dynamic_out $interface) $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain
else
eval source_hosts=\"\$${z1}_hosts\"
for h in $source_hosts; do
[ "$h" = exclude ] && break
iface=${h%%:*}
iface=${iface#+}
hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
if is_ipsec_host $z1 $h; then
qt_iptables -D ${z1}_dyn -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain
else
qt_iptables -D $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain
fi
fi
done
fi
fi
done < ${VARDIR}/chains
progress_message "$delhost removed from zone $zone"
done
rm -rf $TMP_DIR
}

11
Shorewall6/masq
View File

@ -1,11 +0,0 @@
#
# Shorewall version 4 - Masq file
#
# For information about entries in this file, type "man shorewall-masq"
#
# The manpage is also online at
# http://www.shorewall.net/manpages/shorewall-masq.html
#
###############################################################################
#INTERFACE SOURCE ADDRESS PROTO PORT(S) IPSEC MARK
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

11
Shorewall6/nat
View File

@ -1,11 +0,0 @@
#
# Shorewall version 4 - Nat File
#
# For information about entries in this file, type "man shorewall-nat"
#
# For additional information, see http://shorewall.net/NAT.htm
#
###############################################################################
#EXTERNAL INTERFACE INTERNAL ALL LOCAL
# INTERFACES
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

11
Shorewall6/netmap
View File

@ -1,11 +0,0 @@
#
# Shorewall version 4 - Netmap File
#
# For information about entries in this file, type "man shorewall-netmap"
#
# See http://shorewall.net/netmap.html for an example and usage
# information.
#
###############################################################################
#TYPE NET1 INTERFACE NET2
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

10
Shorewall6/proxyarp
View File

@ -1,10 +0,0 @@
#
# Shorewall version 4 - Proxyarp File
#
# For information about entries in this file, type "man shorewall-proxyarp"
#
# See http://shorewall.net/ProxyARP.htm for additional information.
#
###############################################################################
#ADDRESS INTERFACE EXTERNAL HAVEROUTE PERSISTENT
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

9
Shorewall6/rfc1918
View File

@ -1,9 +0,0 @@
#
# Shorewall version 4 - Rfc1918 File
#
###############################################################################
#SUBNETS TARGET
172.16.0.0/12 logdrop # RFC 1918
192.168.0.0/16 logdrop # RFC 1918
10.0.0.0/8 logdrop # RFC 1918
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

427
Shorewall6/shorewall → Shorewall6/shorewall6
View File

@ -6,7 +6,7 @@
# #
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008 - Tom Eastep (teastep@shorewall.net) # (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008 - Tom Eastep (teastep@shorewall.net)
# #
# This file should be placed in /sbin/shorewall. # This file should be placed in /sbin/shorewall6.
# #
# Shorewall documentation is available at http://www.shorewall.net # Shorewall documentation is available at http://www.shorewall.net
# #
@ -31,93 +31,93 @@
# #
# Commands are: # Commands are:
# #
# shorewall add <iface>[:<host>] zone Adds a host or subnet to a zone # shorewall6 add <iface>[:<host>] zone Adds a host or subnet to a zone
# shorewall delete <iface>[:<host>] zone Deletes a host or subnet from a zone # shorewall6 delete <iface>[:<host>] zone Deletes a host or subnet from a zone
# shorewall dump Dumps all Shorewall-related information # shorewall6 dump Dumps all Shorewall6-related information
# for problem analysis # for problem analysis
# shorewall start Starts the firewall # shorewall6 start Starts the firewall
# shorewall restart Restarts the firewall # shorewall6 restart Restarts the firewall
# shorewall stop Stops the firewall # shorewall6 stop Stops the firewall
# shorewall status Displays firewall status # shorewall6 status Displays firewall status
# shorewall reset Resets iptables packet and # shorewall6 reset Resets iptables packet and
# byte counts # byte counts
# shorewall clear Open the floodgates by # shorewall6 clear Open the floodgates by
# removing all iptables rules # removing all iptables rules
# and setting the three permanent # and setting the three permanent
# chain policies to ACCEPT # chain policies to ACCEPT
# shorewall refresh Rebuild the common chain to # shorewall6 refresh Rebuild the common chain to
# compensate for a change of # compensate for a change of
# broadcast address on any "detect" # broadcast address on any "detect"
# interface. # interface.
# shorewall [re]load [ <directory> ] <system> # shorewall6 [re]load [ <directory> ] <system>
# Compile a script and install it on a # Compile a script and install it on a
# remote Shorewall Lite system. # remote Shorewall6 Lite system.
# shorewall show <chain> [ <chain> ... ] Display the rules in each <chain> listed # shorewall6 show <chain> [ <chain> ... ] Display the rules in each <chain> listed
# shorewall show actions Displays the available actions # shorewall6 show actions Displays the available actions
# shorewall show log Print the last 20 log messages # shorewall6 show log Print the last 20 log messages
# shorewall show connections Show the kernel's connection # shorewall6 show connections Show the kernel's connection
# tracking table # tracking table
# shorewall show nat Display the rules in the nat table # shorewall6 show nat Display the rules in the nat table
# shorewall show {mangle|tos} Display the rules in the mangle table # shorewall6 show {mangle|tos} Display the rules in the mangle table
# shorewall show tc Display traffic control info # shorewall6 show tc Display traffic control info
# shorewall show classifiers Display classifiers # shorewall6 show classifiers Display classifiers
# shorewall show capabilities Display iptables/kernel capabilities # shorewall6 show capabilities Display iptables/kernel capabilities
# shorewall show vardir Display the VARDIR setting. # shorewall6 show vardir Display the VARDIR setting.
# shorewall version Display the installed version id # shorewall6 version Display the installed version id
# shorewall check [ -e ] [ <directory> ] Dry-run compilation. # shorewall6 check [ -e ] [ <directory> ] Dry-run compilation.
# shorewall try <directory> [ <timeout> ] Try a new configuration and if # shorewall6 try <directory> [ <timeout> ] Try a new configuration and if
# it doesn't work, revert to the # it doesn't work, revert to the
# standard one. If a timeout is supplied # standard one. If a timeout is supplied
# the command reverts back to the # the command reverts back to the
# standard configuration after that many # standard configuration after that many
# seconds have elapsed after successfully # seconds have elapsed after successfully
# starting the new configuration. # starting the new configuration.
# shorewall logwatch [ refresh-interval ] Monitor the local log for Shorewall # shorewall6 logwatch [ refresh-interval ] Monitor the local log for Shorewall6
# messages. # messages.
# shorewall drop <address> ... Temporarily drop all packets from the # shorewall6 drop <address> ... Temporarily drop all packets from the
# listed address(es) # listed address(es)
# shorewall reject <address> ... Temporarily reject all packets from the # shorewall6 reject <address> ... Temporarily reject all packets from the
# listed address(es) # listed address(es)
# shorewall allow <address> ... Reenable address(es) previously # shorewall6 allow <address> ... Reenable address(es) previously
# disabled with "drop" or "reject" # disabled with "drop" or "reject"
# shorewall save [ <file> ] Save the list of "rejected" and # shorewall6 save [ <file> ] Save the list of "rejected" and
# "dropped" addresses so that it will # "dropped" addresses so that it will
# be automatically reinstated the # be automatically reinstated the
# next time that Shorewall starts. # next time that Shorewall6 starts.
# Save the current state so that 'shorewall # Save the current state so that 'shorewall6
# restore' can be used. # restore' can be used.
# #
# shorewall forget [ <file> ] Discard the data saved by 'shorewall save' # shorewall6 forget [ <file> ] Discard the data saved by 'shorewall6 save'
# #
# shorewall restore [ <file> ] Restore the state of the firewall from # shorewall6 restore [ <file> ] Restore the state of the firewall from
# previously saved information. # previously saved information.
# #
# shorewall ipaddr { <address>/<cidr> | <address> <netmask> } # shorewall6 ipaddr { <address>/<cidr> | <address> <netmask> }
# #
# Displays information about the network # Displays information about the network
# defined by the argument[s] # defined by the argument[s]
# #
# shorewall iprange <address>-<address> Decomposes a range of IP addresses into # shorewall6 iprange <address>-<address> Decomposes a range of IP addresses into
# a list of network/host addresses. # a list of network/host addresses.
# #
# shorewall ipdecimal { <address> | <integer> } # shorewall6 ipdecimal { <address> | <integer> }
# #
# Displays the decimal equivalent of an IP # Displays the decimal equivalent of an IP
# address and vice versa. # address and vice versa.
# #
# shorewall safe-start [ <directory> ] Starts the firewall and promtp for a c # shorewall6 safe-start [ <directory> ] Starts the firewall and promtp for a c
# confirmation to accept or reject the new # confirmation to accept or reject the new
# configuration # configuration
# #
# shorewall safe-restart [ <directory> ] Restarts the firewall and prompt for a # shorewall6 safe-restart [ <directory> ] Restarts the firewall and prompt for a
# confirmation to accept or reject the new # confirmation to accept or reject the new
# configuration # configuration
# #
# shorewall compile [ -e ] [ <directory> ] <filename> # shorewall6 compile [ -e ] [ <directory> ] <filename>
# Compile a firewall program file. # Compile a firewall program file.
# #
# Set the configuration variables from shorewall.conf # Set the configuration variables from shorewall6.conf
# #
# $1 = Yes: read the params file # $1 = Yes: read the params file
# $2 = Yes: check for STARTUP_ENABLED # $2 = Yes: check for STARTUP_ENABLED
@ -136,7 +136,7 @@ get_config() {
fi fi
fi fi
config=$(find_file shorewall.conf) config=$(find_file shorewall6.conf)
if [ -f $config ]; then if [ -f $config ]; then
if [ -r $config ]; then if [ -r $config ]; then
@ -198,7 +198,7 @@ get_config() {
if [ "$2" = Yes ]; then if [ "$2" = Yes ]; then
case $STARTUP_ENABLED in case $STARTUP_ENABLED in
No|no|NO) No|no|NO)
echo " ERROR: Shorewall startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${CONFDIR}/shorewall.conf" >&2 echo " ERROR: Shorewall6 startup is disabled. To enable startup, set STARTUP_ENABLED=Yes in ${CONFDIR}/shorewall6.conf" >&2
exit 2 exit 2
;; ;;
Yes|yes|YES) Yes|yes|YES)
@ -220,7 +220,7 @@ get_config() {
[ -n "LOGFORMAT" ] && LOGFORMAT="${LOGFORMAT%%%*}" [ -n "LOGFORMAT" ] && LOGFORMAT="${LOGFORMAT%%%*}"
[ -n "$LOGFORMAT" ] || LOGFORMAT="Shorewall:" [ -n "$LOGFORMAT" ] || LOGFORMAT="Shorewall6:"
export LOGFORMAT export LOGFORMAT
@ -250,7 +250,7 @@ get_config() {
if [ -n "$SHOREWALL_SHELL" ]; then if [ -n "$SHOREWALL_SHELL" ]; then
if [ ! -x "$SHOREWALL_SHELL" ]; then if [ ! -x "$SHOREWALL_SHELL" ]; then
echo " WARNING: The program specified in SHOREWALL_SHELL does not exist or is not executable; falling back to /bin/sh" >&2 echo " WARNING: The program specified in SHOREWALL6_SHELL does not exist or is not executable; falling back to /bin/sh" >&2
SHOREWALL_SHELL=/bin/sh SHOREWALL_SHELL=/bin/sh
fi fi
fi fi
@ -318,8 +318,8 @@ compiler() {
shift shift
if [ $(id -u) -ne 0 ]; then if [ $(id -u) -ne 0 ]; then
if [ -z "$SHOREWALL_DIR" -o "$SHOREWALL_DIR" = /etc/shorewall ]; then if [ -z "$SHOREWALL_DIR" -o "$SHOREWALL_DIR" = /etc/shorewall6 ]; then
startup_error "Ordinary users may not compile the /etc/shorewall configuration" startup_error "Ordinary users may not compile the /etc/shorewall6 configuration"
fi fi
fi fi
# #
@ -327,49 +327,9 @@ compiler() {
# #
ensure_config_path ensure_config_path
compiler= compiler=perl
haveparams= haveparams=
if [ -n "$SHOREWALL_COMPILER" ]; then
compiler="$SHOREWALL_COMPILER" #Compiler specified in /etc/shorewall/shorewall.conf or on the run-line
elif [ -x $sc ]; then
if [ ! -x $pc ]; then
compiler=shell
fi
elif [ -x $pc ]; then
compiler=perl
else
fatal_error "No shorewall compiler installed"
fi
if [ -z "$compiler" ]; then
#
# Both compilers installed. Read the appropriate shorewall.conf to learn the setting of SHOREWALL_COMPILER
#
if [ -n "$SHOREWALL_DIR" ]; then
shell=$SHOREWALL_SHELL
[ -x $pc ] && set -a
run_user_exit params
set +a
haveparams=Yes
get_config No No No
SHOREWALL_SHELL=$shell
fi
#
# And initiate the appropriate compiler
#
if [ -n "$SHOREWALL_COMPILER" ]; then
compiler="$SHOREWALL_COMPILER"
elif [ -x $sc ]; then
compiler=shell
else
compiler=perl
fi
fi
case $COMMAND in case $COMMAND in
*start|try|refresh) *start|try|refresh)
;; ;;
@ -381,48 +341,36 @@ compiler() {
[ $command = exec ] || command= [ $command = exec ] || command=
case "$compiler" in debugflags="-w"
perl) [ -n "$DEBUG" ] && debugflags='-wd'
debugflags="-w" [ -n "$PROFILE" ] && debugflags='-wd:DProf'
[ -n "$DEBUG" ] && debugflags='-wd'
[ -n "$PROFILE" ] && debugflags='-wd:DProf'
# Perl compiler only takes the output file as a argument # Perl compiler only takes the output file as a argument
[ "$1" = debug -o "$1" = trace ] && shift; [ "$1" = debug -o "$1" = trace ] && shift;
[ "$1" = nolock ] && shift; [ "$1" = nolock ] && shift;
shift shift
options="--verbose=$VERBOSE" options="--verbose=$VERBOSE"
[ -n "$STARTUP_LOG" ] && options="$options --log=$STARTUP_LOG" [ -n "$STARTUP_LOG" ] && options="$options --log=$STARTUP_LOG"
[ -n "$LOG_VERBOSITY" ] && options="$options --log_verbosity=$LOG_VERBOSITY"; [ -n "$LOG_VERBOSITY" ] && options="$options --log_verbosity=$LOG_VERBOSITY";
[ -n "$EXPORT" ] && options="$options --export" [ -n "$EXPORT" ] && options="$options --export"
[ -n "$SHOREWALL_DIR" ] && options="$options --directory=$SHOREWALL_DIR" [ -n "$SHOREWALL_DIR" ] && options="$options --directory=$SHOREWALL_DIR"
[ -n "$TIMESTAMP" ] && options="$options --timestamp" [ -n "$TIMESTAMP" ] && options="$options --timestamp"
[ -n "$TEST" ] && options="$options --test" [ -n "$TEST" ] && options="$options --test"
[ "$debugging" = trace ] && options="$options --debug" [ "$debugging" = trace ] && options="$options --debug"
[ -n "$REFRESHCHAINS" ] && options="$options --refresh=$REFRESHCHAINS" [ -n "$REFRESHCHAINS" ] && options="$options --refresh=$REFRESHCHAINS"
[ -x $pc ] || startup_error "SHOREWALL_COMPILER=perl requires the shorewall-perl package which is not installed" [ -x $pc ] || startup_error "Shorewall6 requires the shorewall-perl package which is not installed"
# #
# Run the appropriate params file # Run the appropriate params file
# #
if [ -z "$haveparams" ]; then if [ -z "$haveparams" ]; then
set -a; set -a;
run_user_exit params run_user_exit params
set +a set +a
fi fi
$command perl $debugflags $pc $options $@ $command perl $debugflags $pc $options $@
;;
shell)
[ -x $sc ] || startup_error "SHOREWALL_COMPILER=shell requires the shorewall-shell package which is not installed"
[ -n "$REFRESHCHAINS" ] && startup_error "Shorewall-shell does not support refresh of specific chains"
$command $SHOREWALL_SHELL $sc $@
;;
*)
startup_error "Invalid value ($SHOREWALL_COMPILER) for SHOREWALL_COMPILER"
;;
esac
} }
# #
@ -445,14 +393,14 @@ start_command() {
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
rc=$? rc=$?
logger -p kern.err "ERROR:Shorewall start failed" logger -p kern.err "ERROR:Shorewall6 start failed"
fi fi
exit $rc exit $rc
} }
if shorewall_is_started; then if shorewall6_is_started; then
error_message "Shorewall is already running" error_message "Shorewall6 is already running"
exit 0 exit 0
fi fi
@ -470,12 +418,6 @@ start_command() {
finished=1 finished=1
option= option=
;; ;;
C)
[ $# -gt 1 ] || fatal_error "-C must be followed by a compiler name"
SHOREWALL_COMPILER=$2
option=
shift
;;
d*) d*)
DEBUG=Yes DEBUG=Yes
option=${option#d} option=${option#d}
@ -551,10 +493,10 @@ start_command() {
$SHOREWALL_SHELL ${RESTOREPATH}-ipsets $SHOREWALL_SHELL ${RESTOREPATH}-ipsets
fi fi
echo Restoring Shorewall... echo Restoring Shorewall6...
$SHOREWALL_SHELL $RESTOREPATH restore $SHOREWALL_SHELL $RESTOREPATH restore
date > ${VARDIR}/restarted date > ${VARDIR}/restarted
progress_message3 Shorewall restored from $RESTOREPATH progress_message3 Shorewall6 restored from $RESTOREPATH
else else
do_it do_it
fi fi
@ -593,12 +535,6 @@ compile_command() {
PROFILE=Yes PROFILE=Yes
option=${option#p} option=${option#p}
;; ;;
C)
[ $# -gt 0 ] || fatal_error "-C must be followed by a compiler name"
SHOREWALL_COMPILER=$1
option=
shift
;;
t*) t*)
TEST=Yes TEST=Yes
option=${option#t} option=${option#t}
@ -688,12 +624,6 @@ check_command() {
DEBUG=Yes; DEBUG=Yes;
option=${option#d} option=${option#d}
;; ;;
C)
[ $# -gt 0 ] || fatal_error "-C must be followed by a compiler name"
SHOREWALL_COMPILER=$2
option=
shift
;;
*) *)
usage 1 usage 1
;; ;;
@ -769,12 +699,6 @@ restart_command() {
NOROUTES=Yes NOROUTES=Yes
option=${option#n} option=${option#n}
;; ;;
C)
[ $# -gt 1 ] || fatal_error "-C must be followed by a compiler name"
SHOREWALL_COMPILER=$2
option=
shift
;;
p*) p*)
[ -n "$(which conntrack)" ] || fatal_error "The '-p' option requires the conntrack utility which does not appear to be installed on this system" [ -n "$(which conntrack)" ] || fatal_error "The '-p' option requires the conntrack utility which does not appear to be installed on this system"
PURGE=Yes PURGE=Yes
@ -831,7 +755,7 @@ restart_command() {
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
rc=$? rc=$?
logger -p kern.err "ERROR:Shorewall restart failed" logger -p kern.err "ERROR:Shorewall6 restart failed"
fi fi
else else
[ -x ${VARDIR}/.restore ] || fatal_error "No ${VARDIR}/.restore file found" [ -x ${VARDIR}/.restore ] || fatal_error "No ${VARDIR}/.restore file found"
@ -863,12 +787,6 @@ refresh_command() {
finished=1 finished=1
option= option=
;; ;;
C)
[ $# -gt 1 ] || fatal_error "-C must be followed by a compiler name"
SHOREWALL_COMPILER=$2
option=
shift
;;
*) *)
usage 1 usage 1
;; ;;
@ -892,7 +810,7 @@ refresh_command() {
done done
fi fi
shorewall_is_started || fatal_error "Shorewall is not running" shorewall6_is_started || fatal_error "Shorewall6 is not running"
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled" [ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
@ -942,12 +860,6 @@ safe_commands() {
NOROUTES=Yes NOROUTES=Yes
option=${option#n} option=${option#n}
;; ;;
C)
[ $# -gt 1 ] || fatal_error "-C must be followed by a compiler name"
SHOREWALL_COMPILER=$2
option=
shift
;;
*) *)
usage 1 usage 1
;; ;;
@ -985,7 +897,7 @@ safe_commands() {
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled" [ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
if shorewall_is_started; then if shorewall6_is_started; then
running=Yes running=Yes
else else
running= running=
@ -993,12 +905,12 @@ safe_commands() {
if [ "$COMMAND" = "safe-start" -a -n "$running" ]; then if [ "$COMMAND" = "safe-start" -a -n "$running" ]; then
# the command is safe-start but the firewall is already running # the command is safe-start but the firewall is already running
error_message "Shorewall is already started" error_message "Shorewall6 is already started"
exit 0 exit 0
fi fi
if [ "$COMMAND" = "safe-start" -o -z "$running" ]; then if [ "$COMMAND" = "safe-start" -o -z "$running" ]; then
# the command is safe-start or shorewall is not started yet # the command is safe-start or shorewall6 is not started yet
command="start" command="start"
else else
# the command is safe-restart and the firewall is already running # the command is safe-restart and the firewall is already running
@ -1091,12 +1003,6 @@ try_command() {
NOROUTES=Yes NOROUTES=Yes
option=${option#n} option=${option#n}
;; ;;
C)
[ $# -gt 1 ] || fatal_error "-C must be followed by a compiler name"
SHOREWALL_COMPILER=$2
option=
shift
;;
*) *)
usage 1 usage 1
;; ;;
@ -1134,14 +1040,14 @@ try_command() {
[ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled" [ -n "$STARTUP_ENABLED" ] || fatal_error "Startup is disabled"
if shorewall_is_started; then if shorewall6_is_started; then
running=Yes running=Yes
else else
running= running=
fi fi
if [ -z "$running" ]; then if [ -z "$running" ]; then
# shorewall is not started yet # shorewall6 is not started yet
command="start" command="start"
else else
# the firewall is already running # the firewall is already running
@ -1223,7 +1129,7 @@ reload_command() # $* = original arguments less the command.
local compiler local compiler
compiler= compiler=
LITEDIR=/var/lib/shorewall-lite LITEDIR=/var/lib/shorewall6-lite
while [ $finished -eq 0 -a $# -gt 0 ]; do while [ $finished -eq 0 -a $# -gt 0 ]; do
option=$1 option=$1
@ -1251,12 +1157,6 @@ reload_command() # $* = original arguments less the command.
option= option=
shift shift
;; ;;
C)
[ $# -gt 1 ] || fatal_error "-C must be followed by a compiler name"
compiler="-C $2"
option=
shift
;;
*) *)
usage 1 usage 1
;; ;;
@ -1284,7 +1184,7 @@ reload_command() # $* = original arguments less the command.
;; ;;
esac esac
litedir=$(rsh_command /sbin/shorewall-lite show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //') litedir=$(rsh_command /sbin/shorewall6-lite show config 2> /dev/null | grep ^LITEDIR | sed 's/LITEDIR is //')
[ -n "$litedir" ] && LITEDIR=$litedir [ -n "$litedir" ] && LITEDIR=$litedir
@ -1296,13 +1196,13 @@ reload_command() # $* = original arguments less the command.
fi fi
if [ -n "$getcaps" ]; then if [ -n "$getcaps" ]; then
if [ -f $directory/shorewall.conf ]; then if [ -f $directory/shorewall6.conf ]; then
. $directory/shorewall.conf . $directory/shorewall6.conf
ensure_config_path ensure_config_path
fi fi
progress_message "Getting Capabilities on system $system..." progress_message "Getting Capabilities on system $system..."
if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES /usr/share/shorewall-lite/shorecap" > $directory/capabilities; then if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES /usr/share/shorewall6-lite/shorecap" > $directory/capabilities; then
fatal_error "ERROR: Capturing capabilities on system $system failed" fatal_error "ERROR: Capturing capabilities on system $system failed"
fi fi
fi fi
@ -1311,25 +1211,25 @@ reload_command() # $* = original arguments less the command.
[ -n "$TIMESTAMP" ] && timestamp='-t' || timestamp= [ -n "$TIMESTAMP" ] && timestamp='-t' || timestamp=
if shorewall $debugging $verbose $timestamp compile -e $compiler $directory $directory/firewall && \ if shorewall6 $debugging $verbose $timestamp compile -e $compiler $directory $directory/firewall && \
progress_message3 "Copying $file and ${file}.conf to ${system}:${LITEDIR}..." && \ progress_message3 "Copying $file and ${file}.conf to ${system}:${LITEDIR}..." && \
rcp_command "$directory/firewall $directory/firewall.conf" ${LITEDIR} rcp_command "$directory/firewall $directory/firewall.conf" ${LITEDIR}
then then
save=$(find_file save); save=$(find_file save);
[ -f $save ] && progress_message3 "Copying $save to ${system}:/etc/shorewall-lite/" && rcp_command $save /etc/shorewall-lite/ [ -f $save ] && progress_message3 "Copying $save to ${system}:/etc/shorewall6-lite/" && rcp_command $save /etc/shorewall6-lite/
progress_message3 "Copy complete" progress_message3 "Copy complete"
if [ $COMMAND = reload ]; then if [ $COMMAND = reload ]; then
rsh_command "/sbin/shorewall-lite $debugging $verbose $timestamp restart" && \ rsh_command "/sbin/shorewall6-lite $debugging $verbose $timestamp restart" && \
progress_message3 "System $system reloaded" || saveit= progress_message3 "System $system reloaded" || saveit=
else else
rsh_command "/sbin/shorewall-lite $debugging $verbose $timestamp start" && \ rsh_command "/sbin/shorewall6-lite $debugging $verbose $timestamp start" && \
progress_message3 "System $system loaded" || saveit= progress_message3 "System $system loaded" || saveit=
fi fi
if [ -n "$saveit" ]; then if [ -n "$saveit" ]; then
rsh_command "/sbin/shorewall-lite $debugging $verbose $timestamp save" && \ rsh_command "/sbin/shorewall6-lite $debugging $verbose $timestamp save" && \
progress_message3 "Configuration on system $system saved" progress_message3 "Configuration on system $system saved"
fi fi
fi fi
@ -1363,12 +1263,6 @@ export_command() # $* = original arguments less the command.
finished=1 finished=1
option= option=
;; ;;
C)
[ $# -gt 1 ] || fatal_error "-C must be followed by a compiler name"
compiler="-C $2"
option=
shift
;;
*) *)
fatal_error "Unrecognized option \"$option\"" fatal_error "Unrecognized option \"$option\""
;; ;;
@ -1392,7 +1286,7 @@ export_command() # $* = original arguments less the command.
target=$2 target=$2
;; ;;
*) *)
fatal_error "ERROR: Invalid command syntax (\"man shorewall\" for help)" fatal_error "ERROR: Invalid command syntax (\"man shorewall6\" for help)"
;; ;;
esac esac
@ -1406,7 +1300,7 @@ export_command() # $* = original arguments less the command.
file=$(resolve_file $directory/firewall) file=$(resolve_file $directory/firewall)
if shorewall $debugging $verbose compile -e $compiler $directory $directory/firewall && \ if shorewall6 $debugging $verbose compile -e $compiler $directory $directory/firewall && \
echo "Copying $file and ${file}.conf to ${target#*@}..." && \ echo "Copying $file and ${file}.conf to ${target#*@}..." && \
scp $directory/firewall $directory/firewall.conf $target scp $directory/firewall $directory/firewall.conf $target
then then
@ -1427,32 +1321,28 @@ usage() # $1 = exit status
echo "where <command> is one of:" echo "where <command> is one of:"
echo " add <interface>[:<host-list>] ... <zone>" echo " add <interface>[:<host-list>] ... <zone>"
echo " allow <address> ..." echo " allow <address> ..."
echo " check [ -e ] [ -C {shell|perl} ] [ <directory> ]" echo " check [ -e ] [ <directory> ]"
echo " clear [ -f ]" echo " clear [ -f ]"
echo " compile [ -e ] [ -C {shell|perl} ] [ <directory name> ] <path name>" echo " compile [ -e ] [ <directory name> ] <path name>"
echo " delete <interface>[:<host-list>] ... <zone>" echo " delete <interface>[:<host-list>] ... <zone>"
echo " drop <address> ..." echo " drop <address> ..."
echo " dump [ -x ]" echo " dump [ -x ]"
echo " export [ -C {shell|perl} ] [ <directory1> ] [<user>@]<system>[:<directory2>]" echo " export [ <directory1> ] [<user>@]<system>[:<directory2>]"
echo " forget [ <file name> ]" echo " forget [ <file name> ]"
echo " help" echo " help"
echo " hits [ -t ]"
echo " ipcalc { <address>/<vlsm> | <address> <netmask> }"
echo " ipdecimal { <address> | <integer> }"
echo " iprange <address>-<address>"
echo " load [ -s ] [ -c ] [ -r <root user> ] [ -C {shell|perl} ] [ <directory> ] <system>" echo " load [ -s ] [ -c ] [ -r <root user> ] [ -C {shell|perl} ] [ <directory> ] <system>"
echo " logdrop <address> ..." echo " logdrop <address> ..."
echo " logreject <address> ..." echo " logreject <address> ..."
echo " logwatch [<refresh interval>]" echo " logwatch [<refresh interval>]"
echo " refresh [ -C {shell|perl} ] [ <chain>... ]" echo " refresh [ <chain>... ]"
echo " reject <address> ..." echo " reject <address> ..."
echo " reload [ -s ] [ -c ] [ -r <root user> ] [ -C {shell|perl} ] [ <directory> ] <system>" echo " reload [ -s ] [ -c ] [ -r <root user> ] [ <directory> ] <system>"
echo " reset [ <chain> ... ]" echo " reset [ <chain> ... ]"
echo " restart [ -n ] [ -p ] [ -f ] [ -C {shell|perl} ] [ <directory> ]" echo " restart [ -n ] [ -p ] [ -f ] [ <directory> ]"
echo " restore [ -n ] [ <file name> ]" echo " restore [ -n ] [ <file name> ]"
echo " save [ <file name> ]" echo " save [ <file name> ]"
echo " show [ -x ] [ -m ] [-f] [ -t {filter|mangle|nat} ] [ {chain [<chain> [ <chain> ... ]|actions|capabilities|classifiers|config|connections|filters|ip|log|macros|mangle|nat|routing|tc|vardir|zones} ]" echo " show [ -x ] [ -m ] [-f] [ -t {filter|mangle} ] [ {chain [<chain> [ <chain> ... ]|actions|capabilities|classifiers|config|connections|filters|ip|log|macros|mangle|nat|routing|tc|vardir|zones} ]"
echo " start [ -f ] [ -n ] [ -p ] [ -C {shell|perl} ] [ <directory> ]" echo " start [ -f ] [ -n ] [ -p ] [ <directory> ]"
echo " stop [ -f ]" echo " stop [ -f ]"
echo " status" echo " status"
echo " try [ -C {shell|perl} ] <directory> [ <timeout> ]" echo " try [ -C {shell|perl} ] <directory> [ <timeout> ]"
@ -1626,10 +1516,6 @@ version_command() {
echo $version echo $version
if [ -n "$all" ]; then if [ -n "$all" ]; then
if [ -f /usr/share/shorewall-shell/version ]; then
echo "Shorewall-shell $(cat /usr/share/shorewall-shell/version)"
fi
if [ -f /usr/share/shorewall-perl/version ]; then if [ -f /usr/share/shorewall-perl/version ]; then
echo "Shorewall-perl $(cat /usr/share/shorewall-perl/version)" echo "Shorewall-perl $(cat /usr/share/shorewall-perl/version)"
fi fi
@ -1644,13 +1530,13 @@ fi
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
MUTEX_TIMEOUT= MUTEX_TIMEOUT=
SHAREDIR=/usr/share/shorewall SHAREDIR=/usr/share/shorewall6
CONFDIR=/etc/shorewall CONFDIR=/etc/shorewall6
export PRODUCT="Shorewall" export PRODUCT="Shorewall6"
[ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir [ -f ${CONFDIR}/vardir ] && . ${CONFDIR}/vardir
[ -n "${VARDIR:=/var/lib/shorewall}" ] [ -n "${VARDIR:=/var/lib/shorewall6}" ]
FIREWALL=$SHAREDIR/firewall FIREWALL=$SHAREDIR/firewall
LIBRARIES="$SHAREDIR/lib.base $SHAREDIR/lib.cli" LIBRARIES="$SHAREDIR/lib.base $SHAREDIR/lib.cli"
@ -1667,7 +1553,7 @@ for library in $LIBRARIES; do
done done
if [ ! -f $FIREWALL ]; then if [ ! -f $FIREWALL ]; then
echo " ERROR: Shorewall is not properly installed" >&2 echo " ERROR: Shorewall6 is not properly installed" >&2
if [ -L $FIREWALL ]; then if [ -L $FIREWALL ]; then
echo " $FIREWALL is a symbolic link to a" >&2 echo " $FIREWALL is a symbolic link to a" >&2
echo " non-existant file" >&2 echo " non-existant file" >&2
@ -1681,12 +1567,12 @@ fi
if [ -f $VERSION_FILE ]; then if [ -f $VERSION_FILE ]; then
version=$(cat $VERSION_FILE) version=$(cat $VERSION_FILE)
else else
echo " ERROR: Shorewall is not properly installed" >&2 echo " ERROR: Shorewall6 is not properly installed" >&2
echo " The file $VERSION_FILE does not exist" >&2 echo " The file $VERSION_FILE does not exist" >&2
exit 1 exit 1
fi fi
banner="Shorewall-$version Status at $HOSTNAME -" banner="Shorewall6-$version Status at $HOSTNAME -"
case $(echo -e) in case $(echo -e) in
-e*) -e*)
@ -1782,13 +1668,13 @@ case "$COMMAND" in
status) status)
[ $# -eq 1 ] || usage 1 [ $# -eq 1 ] || usage 1
get_config get_config
echo "Shorewall-$version Status at $HOSTNAME - $(date)" echo "Shorewall6-$version Status at $HOSTNAME - $(date)"
echo echo
if shorewall_is_started ; then if shorewall6_is_started ; then
echo "Shorewall is running" echo "Shorewall6 is running"
status=0 status=0
else else
echo "Shorewall is stopped" echo "Shorewall6 is stopped"
status=4 status=4
fi fi
@ -1811,12 +1697,6 @@ case "$COMMAND" in
shift shift
dump_command $@ dump_command $@
;; ;;
hits)
get_config Yes No Yes
[ -n "$debugging" ] && set -x
shift
hits_command $@
;;
version) version)
shift shift
version_command $@ version_command $@
@ -1828,43 +1708,43 @@ case "$COMMAND" in
;; ;;
logwatch) logwatch)
get_config Yes Yes Yes get_config Yes Yes Yes
banner="Shorewall-$version Logwatch at $HOSTNAME -" banner="Shorewall6-$version Logwatch at $HOSTNAME -"
logwatch_command $@ logwatch_command $@
;; ;;
drop) drop)
get_config get_config
[ -n "$debugging" ] && set -x [ -n "$debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if shorewall6_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
block DROP Dropped $* block DROP Dropped $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
fatal_error "Shorewall is not started" fatal_error "Shorewall6 is not started"
fi fi
;; ;;
logdrop) logdrop)
get_config get_config
[ -n "$debugging" ] && set -x [ -n "$debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if shorewall6_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
block logdrop Dropped $* block logdrop Dropped $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
fatal_error "Shorewall is not started" fatal_error "Shorewall6 is not started"
fi fi
;; ;;
reject|logreject) reject|logreject)
get_config get_config
[ -n "$debugging" ] && set -x [ -n "$debugging" ] && set -x
[ $# -eq 1 ] && usage 1 [ $# -eq 1 ] && usage 1
if shorewall_is_started ; then if shorewall6_is_started ; then
[ -n "$nolock" ] || mutex_on [ -n "$nolock" ] || mutex_on
block $COMMAND Rejected $* block $COMMAND Rejected $*
[ -n "$nolock" ] || mutex_off [ -n "$nolock" ] || mutex_off
else else
fatal_error "Shorewall is not started" fatal_error "Shorewall6 is not started"
fi fi
;; ;;
allow) allow)
@ -1927,63 +1807,10 @@ case "$COMMAND" in
rm -f ${RESTOREPATH}-iptables rm -f ${RESTOREPATH}-iptables
echo " $RESTOREPATH removed" echo " $RESTOREPATH removed"
elif [ -f $RESTOREPATH ]; then elif [ -f $RESTOREPATH ]; then
echo " $RESTOREPATH exists and is not a saved Shorewall configuration" echo " $RESTOREPATH exists and is not a saved Shorewall6 configuration"
fi fi
rm -f ${VARDIR}/save rm -f ${VARDIR}/save
;; ;;
ipcalc)
[ -n "$debugging" ] && set -x
if [ $# -eq 2 ]; then
address=${2%/*}
vlsm=${2#*/}
elif [ $# -eq 3 ]; then
address=$2
vlsm=$(ip_vlsm $3)
else
usage 1
fi
valid_address $address || fatal_error "Invalid IP address: $address"
[ -z "$vlsm" ] && exit 2
[ "x$address" = "x$vlsm" ] && usage 2
[ $vlsm -gt 32 ] && echo "Invalid VLSM: /$vlsm" >&2 && exit 2
address=$address/$vlsm
echo " CIDR=$address"
temp=$(ip_netmask $address); echo " NETMASK=$(encodeaddr $temp)"
temp=$(ip_network $address); echo " NETWORK=$temp"
temp=$(broadcastaddress $address); echo " BROADCAST=$temp"
;;
iprange)
[ -n "$debugging" ] && set -x
case $2 in
*.*.*.*-*.*.*.*)
for address in ${2%-*} ${2#*-}; do
valid_address $address || fatal_error "Invalid IP address: $address"
done
ip_range $2
;;
*)
usage 1
;;
esac
;;
ipdecimal)
[ -n "$debugging" ] && set -x
[ $# -eq 2 ] || usage 1
case $2 in
*.*.*.*)
valid_address $2 || fatal_error "Invalid IP address: $2"
echo " $(decodeaddr $2)"
;;
*)
echo " $(encodeaddr $2)"
;;
esac
;;
restore) restore)
get_config get_config
shift shift

110
Shorewall6/strip
View File

@ -1,110 +0,0 @@
#! /bin/sh
#
# Script for use from Perl to strip config files and perform shell variable
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2000,2001,2002,2003,2004,2005 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
###############################################################################
# Filter that expands variables
#
expand_line() {
local line
while read line; do
echo $(expand $line)
done
}
#
# Read a file and handle "INCLUDE" directives
#
read_file() # $1 = file name, $2 = nest count
{
local first
local rest
if [ -f $1 ]; then
while read first rest; do
if [ "x$first" = "xINCLUDE" ]; then
if [ $2 -lt 4 ]; then
read_file $(find_file $(expand ${rest%#*})) $(($2 + 1))
else
echo " WARNING: INCLUDE in $1 ignored (nested too deeply)" >&2
fi
else
eval "$first $rest"
fi
done < $1
else
echo " WARNING -- No such file: $1" >&2
fi
}
#
# Split a colon-separated list into a space-separated list
#
split() {
local ifs
ifs=$IFS
IFS=:
echo $*
IFS=$ifs
}
#
# Find a File -- For relative file name, look in ${SHOREWALL_DIR} then each ${CONFIG_PATH} then ${CONFDIR}
#
find_file()
{
local saveifs
saveifs=
local directory
case $1 in
/*)
echo $1
;;
*)
for directory in $(split $CONFIG_PATH); do
if [ -f $directory/$1 ]; then
echo $directory/$1
return
fi
done
echo ${CONFDIR}/$1
;;
esac
}
#
# Strip comments and blank lines from a file and place the result in the
# temporary directory
#
if [ ! -f $TMP_DIR/$1 ]; then
[ $# = 1 ] && fname=$(find_file $1) || fname=$2
if [ -f $fname ]; then
read_file $fname 0 | cut -d'#' -f1 | grep -v '^[[:space:]]*$' | expand_line > $TMP_DIR/$1
else
> $TMP_DIR/$1
fi
fi