extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-20 17:58:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

Ignore 'inline' for certain actions.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2012-12-01 07:54:42 -08:00
parent 146402d9be
commit 8cbe26e32c
8 changed files with 91 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -986,13 +986,13 @@ sub externalize( $ ) {
# #
# Define an Action # Define an Action
# #
sub new_action( $$ ) { sub new_action( $$$ ) {
my ( $action , $type ) = @_; my ( $action , $type, $noinline ) = @_;
fatal_error "Invalid action name($action)" if reserved_name( $action ); fatal_error "Invalid action name($action)" if reserved_name( $action );
$actions{$action} = { actchain => '' } if $type & ACTION; $actions{$action} = { actchain => '' , noinline => $noinline } if $type & ACTION;
$targets{$action} = $type; $targets{$action} = $type;
} }
@ -1019,7 +1019,7 @@ sub createlogactionchain( $$$$$ ) {
validate_level $level; validate_level $level;
$actionref = new_action( $action , ACTION ) unless $actionref; $actionref = new_action( $action , ACTION , 0 ) unless $actionref;
$chain = substr $chain, 0, 28 if ( length $chain ) > 28; $chain = substr $chain, 0, 28 if ( length $chain ) > 28;
@ -1464,7 +1464,7 @@ my %builtinops = ( 'dropBcast' => \&dropBcast,
# This function is called prior to processing of the policy file. It: # This function is called prior to processing of the policy file. It:
# #
# - Adds the builtin actions to the target table # - Adds the builtin actions to the target table
# - Reads actions and actions.std (in that order) and for each entry: # - Reads actions.std and actions (in that order) and for each entry:
# o Adds the action to the target table # o Adds the action to the target table
# o Verifies that the corresponding action file exists # o Verifies that the corresponding action file exists
# #
@ -1475,15 +1475,16 @@ sub process_actions() {
# #
# Add built-in actions to the target table and create those actions # Add built-in actions to the target table and create those actions
# #
$targets{$_} = new_action( $_ , ACTION + BUILTIN ) for @builtins; $targets{$_} = new_action( $_ , ACTION + BUILTIN, 1 ) for @builtins;
for my $file ( qw/actions actions.std/ ) { for my $file ( qw/actions.std actions/ ) {
open_file $file; open_file $file;
while ( read_a_line( NORMAL_READ ) ) { while ( read_a_line( NORMAL_READ ) ) {
my ( $action, $options ) = split_line 'action file' , { action => 0, options => 1 }; my ( $action, $options ) = split_line 'action file' , { action => 0, options => 1 };
my $type = ACTION; my $type = ACTION;
my $noinline = 0;
if ( $action =~ /:/ ) { if ( $action =~ /:/ ) {
warning_message 'Default Actions are now specified in /etc/shorewall/shorewall.conf'; warning_message 'Default Actions are now specified in /etc/shorewall/shorewall.conf';
@ -1492,20 +1493,34 @@ sub process_actions() {
fatal_error "Invalid Action Name ($action)" unless $action =~ /^[a-zA-Z][\w-]*$/; fatal_error "Invalid Action Name ($action)" unless $action =~ /^[a-zA-Z][\w-]*$/;
if ( $targets{$action} ) {
warning_message "Duplicate Action Name ($action) Ignored" unless $targets{$action} & ( ACTION | INLINE );
next;
}
if ( $options eq 'inline' ) { if ( $options eq 'inline' ) {
$type = INLINE; $type = INLINE;
} elsif ( $options eq 'noinline' ) {
$noinline = 1;
} else { } else {
fatal_error "Invalid option($options)" unless $options eq '-'; fatal_error "Invalid option($options)" unless $options eq '-';
} }
new_action $action, $type; my $actionfile;
my $actionfile = find_file "action.$action"; if ( my $actiontype = $targets{$action} ) {
if ( ( $actiontype & ACTION ) && ( $type == INLINE ) ) {
if ( $actions{$action}->{noinline} ) {
warning_message "'inline' option ignored on action $action -- that action may not be in-lined";
next;
}
delete $actions{$action};
delete $targets{$action};
} else {
warning_message "Duplicate Action Name ($action) Ignored" unless $actiontype & ( ACTION | INLINE );
next;
}
}
new_action $action, $type, $noinline;
$actionfile = find_file( "action.$action" ) unless $actionfile;
fatal_error "Missing Action File ($actionfile)" unless -f $actionfile; fatal_error "Missing Action File ($actionfile)" unless -f $actionfile;

12
Shorewall/actions.std
View File

@ -35,11 +35,11 @@
#ACTION #ACTION
A_Drop # Audited Default Action for DROP policy A_Drop # Audited Default Action for DROP policy
A_Reject # Audited Default action for REJECT policy A_Reject # Audited Default action for REJECT policy
Broadcast # Handles Broadcast/Multicast/Anycast Broadcast noinline # Handles Broadcast/Multicast/Anycast
Drop # Default Action for DROP policy Drop # Default Action for DROP policy
DropSmurfs # Drop smurf packets DropSmurfs noinline # Drop smurf packets
Invalid # Handles packets in the INVALID conntrack state Invalid noinline # Handles packets in the INVALID conntrack state
NotSyn # Handles TCP packets which do not have SYN=1 and ACK=0 NotSyn noinline # Handles TCP packets which do not have SYN=1 and ACK=0
Reject # Default Action for REJECT policy Reject # Default Action for REJECT policy
RST # Handle packets with RST set RST noinline # Handle packets with RST set
TCPFlags # Handle bad flag combinations. TCPFlags noinline # Handle bad flag combinations.

14
Shorewall/manpages/shorewall-actions.xml
View File

@ -62,8 +62,9 @@
<caution> <caution>
<para>Some of the Shorewall standard actions cannot be used <para>Some of the Shorewall standard actions cannot be used
in-line and will generate a compiler error if you try to use in-line and will generate a warning and the compiler will
them that way:</para> ignore <option>inline</option> if you try to use them that
way:</para>
<simplelist> <simplelist>
<member>Broadcast</member> <member>Broadcast</member>
@ -81,6 +82,15 @@
</caution> </caution>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term>noinline</term>
<listitem>
<para>Reverses the effect of any previous
<option>inline</option> option for the same action.</para>
</listitem>
</varlistentry>
</variablelist> </variablelist>
</listitem> </listitem>
</varlistentry> </varlistentry>

10
Shorewall6/actions.std
View File

@ -23,11 +23,11 @@ A_Drop # Audited Default Action for DROP policy
A_Reject # Audited Default Action for REJECT policy A_Reject # Audited Default Action for REJECT policy
A_AllowICMPs # Audited Accept needed ICMP6 types A_AllowICMPs # Audited Accept needed ICMP6 types
AllowICMPs # Accept needed ICMP6 types AllowICMPs # Accept needed ICMP6 types
Broadcast # Handles Broadcast/Multicast/Anycast Broadcast noinline # Handles Broadcast/Multicast/Anycast
Drop # Default Action for DROP policy Drop # Default Action for DROP policy
DropSmurfs # Handles packets with a broadcast source address DropSmurfs noinline # Handles packets with a broadcast source address
Invalid # Handles packets in the INVALID conntrack state Invalid noinline # Handles packets in the INVALID conntrack state
NotSyn # Handles TCP packets that do not have SYN=1 and ACK=0 NotSyn noinline # Handles TCP packets that do not have SYN=1 and ACK=0
Reject # Default Action for REJECT policy Reject # Default Action for REJECT policy
TCPFlags # Handles bad flags combinations TCPFlags noinline # Handles bad flags combinations

14
Shorewall6/manpages/shorewall6-actions.xml
View File

@ -62,8 +62,9 @@
<caution> <caution>
<para>Some of the Shorewall standard actions cannot be used <para>Some of the Shorewall standard actions cannot be used
in-line and will generate a compiler error if you try to use in-line and will generate a warning and the compiler will
them that way:</para> ignore <option>inline</option> if you try to use them that
way:</para>
<simplelist> <simplelist>
<member>Broadcast</member> <member>Broadcast</member>
@ -81,6 +82,15 @@
</caution> </caution>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term>noinline</term>
<listitem>
<para>Reverses the effect of any previous
<option>inline</option> option for the same action.</para>
</listitem>
</varlistentry>
</variablelist> </variablelist>
</listitem> </listitem>
</varlistentry> </varlistentry>