extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-22 22:30:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Support '+' after a zone list in the policy files.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2016-09-10 10:06:38 -07:00
parent 2c90a8bfb5
commit 8bb7c2363b
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
3 changed files with 35 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -628,15 +628,15 @@ sub handle_nfqueue( $$ ) {
# #
# Process an entry in the policy file. # Process an entry in the policy file.
# #
sub process_a_policy1($$$$$$) { sub process_a_policy1($$$$$$$) {
our %validpolicies; our %validpolicies;
our @zonelist; our @zonelist;
my ( $client, $server, $originalpolicy, $loglevel, $synparams, $connlimit ) = @_; my ( $client, $server, $originalpolicy, $loglevel, $synparams, $connlimit, $intrazone ) = @_;
my $clientwild = ( "\L$client" =~ /^all(\+)?$/ ); my $clientwild = ( "\L$client" =~ /^all(\+)?$/ );
my $intrazone = $clientwild && $1; $intrazone = $clientwild && $1;
fatal_error "Undefined zone ($client)" unless $clientwild || defined_zone( $client ); fatal_error "Undefined zone ($client)" unless $clientwild || defined_zone( $client );
@ -761,13 +761,24 @@ sub process_a_policy() {
$synparams = '' if $synparams eq '-'; $synparams = '' if $synparams eq '-';
$connlimit = '' if $connlimit eq '-'; $connlimit = '' if $connlimit eq '-';
my $intrazone;
if ( $intrazone = $clients =~ /.*,.*\+$/) {
$clients =~ s/\+$//;
}
if ( $servers =~ /.*,.*\+$/ ) {
$servers =~ s/\+$//;
$intrazone = 1;
}
fatal_error 'SOURCE must be specified' if $clients eq '-'; fatal_error 'SOURCE must be specified' if $clients eq '-';
fatal_error 'DEST must be specified' if $servers eq '-'; fatal_error 'DEST must be specified' if $servers eq '-';
fatal_error 'POLICY must be specified' if $policy eq '-'; fatal_error 'POLICY must be specified' if $policy eq '-';
for my $client ( split_list( $clients, 'zone' ) ) { for my $client ( split_list( $clients, 'zone' ) ) {
for my $server ( split_list( $servers, 'zone' ) ) { for my $server ( split_list( $servers, 'zone' ) ) {
process_a_policy1( $client, $server, $policy, $loglevel, $synparams, $connlimit ); process_a_policy1( $client, $server, $policy, $loglevel, $synparams, $connlimit, $intrazone );
} }
} }
} }

14
Shorewall/manpages/shorewall-policy.xml
View File

@ -61,7 +61,7 @@
<variablelist> <variablelist>
<varlistentry> <varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> - <term><emphasis role="bold">SOURCE</emphasis> -
<emphasis>zone</emphasis>[,...]|<emphasis <emphasis>zone</emphasis>[,...[+]]|<emphasis
role="bold">$FW</emphasis>|<emphasis role="bold">$FW</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis role="bold">all</emphasis>|<emphasis
role="bold">all+</emphasis></term> role="bold">all+</emphasis></term>
@ -76,13 +76,16 @@
does.</para> does.</para>
<para>Beginning with Shorewall 5.0.12, multiple zones may be listed <para>Beginning with Shorewall 5.0.12, multiple zones may be listed
separated by commas.</para> separated by commas. As above, if '+' is specified after two or more
zone names, then the policy overrides the implicit intra-zone ACCEPT
policy if the same <replaceable>zone</replaceable> appears in both
the SOURCE and DEST columns.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><emphasis role="bold">DEST</emphasis> - <term><emphasis role="bold">DEST</emphasis> -
<emphasis>zone</emphasis>[,...]|<emphasis <emphasis>zone</emphasis>[,...[+]]|<emphasis
role="bold">$FW</emphasis>|<emphasis role="bold">$FW</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis role="bold">all</emphasis>|<emphasis
role="bold">all+</emphasis></term> role="bold">all+</emphasis></term>
@ -100,7 +103,10 @@
does.</para> does.</para>
<para>Beginning with Shorewall 5.0.12, multiple zones may be listed <para>Beginning with Shorewall 5.0.12, multiple zones may be listed
separated by commas.</para> separated by commas. As above, if '+' is specified after two or more
zone names, then the policy overrides the implicit intra-zone ACCEPT
policy if the same <replaceable>zone</replaceable> appears in both
the SOURCE and DEST columns.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>

14
Shorewall6/manpages/shorewall6-policy.xml
View File

@ -61,7 +61,7 @@
<variablelist> <variablelist>
<varlistentry> <varlistentry>
<term><emphasis role="bold">SOURCE</emphasis> - <term><emphasis role="bold">SOURCE</emphasis> -
<emphasis>zone</emphasis>[,...]|<emphasis <emphasis>zone</emphasis>[,...[+]]|<emphasis
role="bold">$FW</emphasis>|<emphasis role="bold">$FW</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis role="bold">all</emphasis>|<emphasis
role="bold">all+</emphasis></term> role="bold">all+</emphasis></term>
@ -76,13 +76,16 @@
does.</para> does.</para>
<para>Beginning with Shorewall 5.0.12, multiple zones may be listed <para>Beginning with Shorewall 5.0.12, multiple zones may be listed
separated by commas.</para> separated by commas. As above, if '+' is specified after two or more
zone names, then the policy overrides the implicit intra-zone ACCEPT
policy if the same <replaceable>zone</replaceable> appears in both
the SOURCE and DEST columns.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry> <varlistentry>
<term><emphasis role="bold">DEST</emphasis> - <term><emphasis role="bold">DEST</emphasis> -
<emphasis>zone</emphasis>[,...]|<emphasis <emphasis>zone</emphasis>[,...[+]]|<emphasis
role="bold">$FW</emphasis>|<emphasis role="bold">$FW</emphasis>|<emphasis
role="bold">all</emphasis>|<emphasis role="bold">all</emphasis>|<emphasis
role="bold">all+</emphasis></term> role="bold">all+</emphasis></term>
@ -100,7 +103,10 @@
does.</para> does.</para>
<para>Beginning with Shorewall 5.0.12, multiple zones may be listed <para>Beginning with Shorewall 5.0.12, multiple zones may be listed
separated by commas.</para> separated by commas. As above, if '+' is specified after two or more
zone names, then the policy overrides the implicit intra-zone ACCEPT
policy if the same <replaceable>zone</replaceable> appears in both
the SOURCE and DEST columns.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>