mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-19 17:28:35 +02:00
Rename 'Trigger' to 'Event' and document
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
3c6df56b57
commit
9535a7d7df
@ -5413,13 +5413,13 @@ sub get_configuration( $$$$ ) {
|
|||||||
}
|
}
|
||||||
|
|
||||||
#
|
#
|
||||||
# It is okay if the trigger mark is outsize of the a 32-bit integer. We check that in IfTrigger"
|
# It is okay if the event mark is outside of the a 32-bit integer. We check that in IfEvent"
|
||||||
#
|
#
|
||||||
fatal_error 'Invalid Packet Mark layout' if $config{ZONE_BITS} + $globals{ZONE_OFFSET} > 30;
|
fatal_error 'Invalid Packet Mark layout' if $config{ZONE_BITS} + $globals{ZONE_OFFSET} > 30;
|
||||||
|
|
||||||
$globals{EXCLUSION_MASK} = 1 << ( $globals{ZONE_OFFSET} + $config{ZONE_BITS} );
|
$globals{EXCLUSION_MASK} = 1 << ( $globals{ZONE_OFFSET} + $config{ZONE_BITS} );
|
||||||
$globals{TPROXY_MARK} = $globals{EXCLUSION_MASK} << 1;
|
$globals{TPROXY_MARK} = $globals{EXCLUSION_MASK} << 1;
|
||||||
$globals{TRIGGER_MARK} = $globals{TPROXY_MARK} << 1;
|
$globals{EVENT_MARK} = $globals{TPROXY_MARK} << 1;
|
||||||
$globals{PROVIDER_MIN} = 1 << $config{PROVIDER_OFFSET};
|
$globals{PROVIDER_MIN} = 1 << $config{PROVIDER_OFFSET};
|
||||||
|
|
||||||
$globals{TC_MAX} = make_mask( $config{TC_BITS} );
|
$globals{TC_MAX} = make_mask( $config{TC_BITS} );
|
||||||
|
|||||||
106
Shorewall/action.IfEvent
Normal file
106
Shorewall/action.IfEvent
Normal file
@ -0,0 +1,106 @@
|
|||||||
|
#
|
||||||
|
# Shorewall version 4 - Perform an Action based on a Event
|
||||||
|
#
|
||||||
|
# /etc/shorewall/action.IfEvent
|
||||||
|
#
|
||||||
|
# Parameters:
|
||||||
|
# Event: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||||
|
# Action: Anything that can appear in the ACTION column of a rule.
|
||||||
|
# Duration: Duration in seconds over which the event is to be tested.
|
||||||
|
# Hit Count: Number of packets seen within the duration -- default is 1
|
||||||
|
# Src or Dest: 'src' (default) or 'dst'. Determines if the event is associated with the source
|
||||||
|
# address (src) or destination address (dst)
|
||||||
|
# Command: 'check' (default) 'reset', or 'update'. If 'reset', the event will be reset before
|
||||||
|
# the Action is taken. If 'update', the timestamp associated with the event will
|
||||||
|
# be updated and the action taken if the time limit/hitcount are matched.
|
||||||
|
# If '-', the action will be taken if the limit/hitcount are matched but the
|
||||||
|
# event's timestamp will not be updated.
|
||||||
|
#
|
||||||
|
# If a duration is specified, then 'checkreap' and 'updatereap' may also
|
||||||
|
# be used. These are like 'check' and 'update' respectively, but they also
|
||||||
|
# remove any event entries for the IP address that are older than <duration>
|
||||||
|
# seconds.
|
||||||
|
# Disposition: Disposition for any event generated.
|
||||||
|
#
|
||||||
|
# For additional information, see http://www.shorewall.net/Events.html
|
||||||
|
#
|
||||||
|
#######################################################################################################
|
||||||
|
# DO NOT REMOVE THE FOLLOWING LINE
|
||||||
|
?format 2
|
||||||
|
#################################################################################################################################################################################################
|
||||||
|
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||||
|
# PORT PORT(S) DEST LIMIT GROUP
|
||||||
|
|
||||||
|
DEFAULTS -,ACCEPT,-,1,src,check,-
|
||||||
|
|
||||||
|
?begin perl
|
||||||
|
|
||||||
|
use Shorewall::Config qw(:DEFAULT :internal);
|
||||||
|
use Shorewall::Chains;
|
||||||
|
use Shorewall::Rules;
|
||||||
|
use strict;
|
||||||
|
|
||||||
|
my ( $event, $action, $duration, $hitcount, $destination, $command, $disposition ) = get_action_params( 7 );
|
||||||
|
|
||||||
|
fatal_error "An event name is required" unless supplied $event;
|
||||||
|
fatal_error "Invalid event name ($event)" unless $event =~ /^[a-zA-z][-\w]*$/;
|
||||||
|
|
||||||
|
if ( supplied $duration ) {
|
||||||
|
fatal_error "Invalid time limit ($duration)" unless $duration =~ /^\d+$/;
|
||||||
|
$duration = "--second $duration ";
|
||||||
|
} else {
|
||||||
|
$duration = '';
|
||||||
|
}
|
||||||
|
|
||||||
|
fatal_error "Invalid hit count ($hitcount)" unless $hitcount =~ /^\d+$/;
|
||||||
|
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||||
|
fatal_error "Invalid reset flag ($command)" unless $command =~ /^(?:reset|update|updatereap|check|checkreap)$/;
|
||||||
|
|
||||||
|
set_action_disposition( $disposition) if supplied $disposition;
|
||||||
|
set_action_name_to_caller;
|
||||||
|
|
||||||
|
require_capability 'RECENT_MATCH', 'Use of events', 's';
|
||||||
|
|
||||||
|
my $reap;
|
||||||
|
|
||||||
|
fatal_error "${command}reap requires a time limit" if ( $reap = $command =~ s/reap$// ? '--reap ' : '' ) && ! $duration;
|
||||||
|
|
||||||
|
$duration .= $reap;
|
||||||
|
|
||||||
|
if ( $command eq 'reset' ) {
|
||||||
|
require_capability 'MARK_ANYWHERE', 'Resetting an event', 's';
|
||||||
|
|
||||||
|
print "Resetting....\n";
|
||||||
|
|
||||||
|
my $mark = $globals{EVENT_MARK};
|
||||||
|
#
|
||||||
|
# The event mark bit must be within 32 bits
|
||||||
|
#
|
||||||
|
fatal_error "The mark layout does not permit resetting of events" unless $mark & 0xffffffff;
|
||||||
|
#
|
||||||
|
# Reset the event mark bit
|
||||||
|
#
|
||||||
|
perl_action_helper( 'INLINE', '-j MARK --and-mark '. in_hex( (~ $mark ) & 0xffffffff ) );
|
||||||
|
|
||||||
|
$mark = in_hex $mark;
|
||||||
|
#
|
||||||
|
# Mark the packet if event is armed
|
||||||
|
#
|
||||||
|
if ( $destination eq 'dst' ) {
|
||||||
|
perl_action_helper( 'INLINE', "-m recent --rcheck ${duration}--hitcount $hitcount --name $event --rdest -j MARK --or-mark $mark" );
|
||||||
|
} else {
|
||||||
|
perl_action_helper( 'INLINE', "-m recent --rcheck ${duration}--hitcount $hitcount --name $event --rsource -j MARK --or-mark $mark" );
|
||||||
|
}
|
||||||
|
#
|
||||||
|
# if the event is armed, remove it and perform the action
|
||||||
|
#
|
||||||
|
perl_action_helper( $action , "-m mark --mark $mark/$mark -m recent --remove --name $event" );
|
||||||
|
} elsif ( $command eq 'update' ) {
|
||||||
|
perl_action_helper( $action, "-m recent --update ${duration}--hitcount $hitcount --name $event" );
|
||||||
|
} else {
|
||||||
|
perl_action_helper( $action, "-m recent --rcheck ${duration}--hitcount $hitcount --name $event" );
|
||||||
|
}
|
||||||
|
|
||||||
|
1;
|
||||||
|
|
||||||
|
?end perl
|
||||||
@ -1,86 +0,0 @@
|
|||||||
#
|
|
||||||
# Shorewall version 4 - Perform an Action based on a Trigger
|
|
||||||
#
|
|
||||||
# /etc/shorewall/action.IfTrigger
|
|
||||||
#
|
|
||||||
# Parameters:
|
|
||||||
# Trigger: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
|
||||||
# Action: Anything that can appear in the ACTION column of a rule.
|
|
||||||
# Time Limit: Amount of time the trigger is to remain armed in seconds"
|
|
||||||
# Hit Count: Number of packets seen within the Timelimit -- default is 1
|
|
||||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the trigger is associated with the source
|
|
||||||
# address (src) or destination address (dst)
|
|
||||||
# Reset/update: '-' (default) 'reset', or 'update'. If 'reset', the trigger will be reset before
|
|
||||||
# the Action is taken. If 'update', the timestamp associated with the trigger will
|
|
||||||
# be updated and the action taken if the time limit/hitcount are matched.
|
|
||||||
# If '-', the action will be taken if the limit/hitcount are matched but the
|
|
||||||
# trigger's timestamp will not be updated.
|
|
||||||
# Disposition: Disposition for any event generated.
|
|
||||||
#
|
|
||||||
#######################################################################################################
|
|
||||||
# DO NOT REMOVE THE FOLLOWING LINE
|
|
||||||
?format 2
|
|
||||||
#################################################################################################################################################################################################
|
|
||||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
|
||||||
# PORT PORT(S) DEST LIMIT GROUP
|
|
||||||
|
|
||||||
DEFAULTS -,ACCEPT,60,1,src,check,-
|
|
||||||
|
|
||||||
?begin perl
|
|
||||||
|
|
||||||
use Shorewall::Config qw(:DEFAULT :internal);
|
|
||||||
use Shorewall::Chains;
|
|
||||||
use Shorewall::Rules;
|
|
||||||
use strict;
|
|
||||||
|
|
||||||
my ( $trigger, $action, $timeout, $hitcount, $destination, $reset, $disposition ) = get_action_params( 7 );
|
|
||||||
|
|
||||||
fatal_error "A trigger name is required" unless supplied $trigger;
|
|
||||||
fatal_error "Invalid trigger name ($trigger)" unless $trigger =~ /^[a-zA-z][-\w]*$/;
|
|
||||||
fatal_error "Invalid time limit ($timeout)" unless $timeout =~ /^\d+$/;
|
|
||||||
fatal_error "Invalid hit count ($hitcount)" unless $hitcount =~ /^\d+$/;
|
|
||||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
|
||||||
fatal_error "Invalid reset flag ($reset)" unless $reset =~ /^(?:reset|update|check)$/;
|
|
||||||
|
|
||||||
set_action_disposition( $disposition) if supplied $disposition;
|
|
||||||
set_action_name_to_caller;
|
|
||||||
|
|
||||||
require_capability 'RECENT_MATCH', 'Use of triggers', 's';
|
|
||||||
|
|
||||||
if ( $reset eq 'reset' ) {
|
|
||||||
require_capability 'MARK_ANYWHERE', 'Resetting a trigger', 's';
|
|
||||||
|
|
||||||
print "Resetting....\n";
|
|
||||||
|
|
||||||
my $mark = $globals{TRIGGER_MARK};
|
|
||||||
#
|
|
||||||
# The trigger mark bit must be within 32 bits
|
|
||||||
#
|
|
||||||
fatal_error "The mark layout does not permit resetting of triggers" unless $mark & 0xffffffff;
|
|
||||||
#
|
|
||||||
# Reset the trigger mark bit
|
|
||||||
#
|
|
||||||
perl_action_helper( 'INLINE', '-j MARK --and-mark '. in_hex( (~ $mark ) & 0xffffffff ) );
|
|
||||||
|
|
||||||
$mark = in_hex $mark;
|
|
||||||
#
|
|
||||||
# Mark the packet if trigger is armed
|
|
||||||
#
|
|
||||||
if ( $destination eq 'dst' ) {
|
|
||||||
perl_action_helper( 'INLINE', "-m recent --rcheck --seconds $timeout --hitcount $hitcount --name $trigger --rdest -j MARK --or-mark $mark" );
|
|
||||||
} else {
|
|
||||||
perl_action_helper( 'INLINE', "-m recent --rcheck --seconds $timeout --hitcount $hitcount --name $trigger --rsource -j MARK --or-mark $mark" );
|
|
||||||
}
|
|
||||||
#
|
|
||||||
# if the trigger is armed, remove it and perform the action
|
|
||||||
#
|
|
||||||
perl_action_helper( $action , "-m mark --mark $mark/$mark -m recent --remove --name $trigger" );
|
|
||||||
} elsif ( $reset eq 'update' ) {
|
|
||||||
perl_action_helper( $action, "-m recent --update --seconds $timeout --hitcount $hitcount --name $trigger" );
|
|
||||||
} else {
|
|
||||||
perl_action_helper( $action, "-m recent --rcheck --seconds $timeout --hitcount $hitcount --name $trigger" );
|
|
||||||
}
|
|
||||||
|
|
||||||
1;
|
|
||||||
|
|
||||||
?end perl
|
|
||||||
51
Shorewall/action.ResetEvent
Normal file
51
Shorewall/action.ResetEvent
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
#
|
||||||
|
# Shorewall version 4 - Reset an Event
|
||||||
|
#
|
||||||
|
# /etc/shorewall/action.ResetEvent
|
||||||
|
#
|
||||||
|
# Parameters:
|
||||||
|
# Event: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||||
|
# Action: Action to perform after setting the event. Default is ACCEPT
|
||||||
|
# Src or Dest: 'src' (default) or 'dst'. Determines if the event is associated with the source
|
||||||
|
# address (src) or destination address (dst)
|
||||||
|
# Disposition: Disposition for any rule generated.
|
||||||
|
#
|
||||||
|
# For additional information, see http://www.shorewall.net/Events.html
|
||||||
|
#
|
||||||
|
#######################################################################################################
|
||||||
|
# DO NOT REMOVE THE FOLLOWING LINE
|
||||||
|
?format 2
|
||||||
|
#################################################################################################################################################################################################
|
||||||
|
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||||
|
# PORT PORT(S) DEST LIMIT GROUP
|
||||||
|
|
||||||
|
DEFAULTS -,ACCEPT,src,-
|
||||||
|
|
||||||
|
?begin perl
|
||||||
|
|
||||||
|
use Shorewall::Config;
|
||||||
|
use Shorewall::Chains;
|
||||||
|
use Shorewall::Rules;
|
||||||
|
use strict;
|
||||||
|
|
||||||
|
my ( $event, $action, $destination, $disposition ) = get_action_params( 4 );
|
||||||
|
|
||||||
|
require_capability 'RECENT_MATCH', 'Use of events', 's';
|
||||||
|
require_capability 'MARK_ANYWHERE', 'Use of events', 's';
|
||||||
|
|
||||||
|
fatal_error "An event name is required" unless supplied $event;
|
||||||
|
fatal_error "Invalid event name ($event)" unless $event =~ /^[a-zA-z][-\w]*$/;
|
||||||
|
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||||
|
|
||||||
|
set_action_disposition( $disposition) if supplied $disposition;
|
||||||
|
set_action_name_to_caller;
|
||||||
|
|
||||||
|
if ( $destination eq 'dst' ) {
|
||||||
|
perl_action_helper( $action, "-m recent --name $event --remove --rdest" );
|
||||||
|
} else {
|
||||||
|
perl_action_helper( $action, "-m recent --name $event --remove --rsource" );
|
||||||
|
}
|
||||||
|
|
||||||
|
1;
|
||||||
|
|
||||||
|
?end perl
|
||||||
@ -1,49 +0,0 @@
|
|||||||
#
|
|
||||||
# Shorewall version 4 - Reset a Trigger
|
|
||||||
#
|
|
||||||
# /etc/shorewall/action.ResetTrigger
|
|
||||||
#
|
|
||||||
# Parameters:
|
|
||||||
# Trigger: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
|
||||||
# Action: Action to perform after setting the trigger. Default is ACCEPT
|
|
||||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the trigger is associated with the source
|
|
||||||
# address (src) or destination address (dst)
|
|
||||||
# Disposition: Disposition for any event generated.
|
|
||||||
#
|
|
||||||
#######################################################################################################
|
|
||||||
# DO NOT REMOVE THE FOLLOWING LINE
|
|
||||||
?format 2
|
|
||||||
#################################################################################################################################################################################################
|
|
||||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
|
||||||
# PORT PORT(S) DEST LIMIT GROUP
|
|
||||||
|
|
||||||
DEFAULTS -,ACCEPT,src,-
|
|
||||||
|
|
||||||
?begin perl
|
|
||||||
|
|
||||||
use Shorewall::Config;
|
|
||||||
use Shorewall::Chains;
|
|
||||||
use Shorewall::Rules;
|
|
||||||
use strict;
|
|
||||||
|
|
||||||
my ( $trigger, $action, $destination, $disposition ) = get_action_params( 4 );
|
|
||||||
|
|
||||||
require_capability 'RECENT_MATCH', 'Use of triggers', 's';
|
|
||||||
require_capability 'MARK_ANYWHERE', 'Use of triggers', 's';
|
|
||||||
|
|
||||||
fatal_error "A trigger name is required" unless supplied $trigger;
|
|
||||||
fatal_error "Invalid trigger name ($trigger)" unless $trigger =~ /^[a-zA-z][-\w]*$/;
|
|
||||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
|
||||||
|
|
||||||
set_action_disposition( $disposition) if supplied $disposition;
|
|
||||||
set_action_name_to_caller;
|
|
||||||
|
|
||||||
if ( $destination eq 'dst' ) {
|
|
||||||
perl_action_helper( $action, "-m recent --name $trigger --remove --rdest" );
|
|
||||||
} else {
|
|
||||||
perl_action_helper( $action, "-m recent --name $trigger --remove --rsource" );
|
|
||||||
}
|
|
||||||
|
|
||||||
1;
|
|
||||||
|
|
||||||
?end perl
|
|
||||||
51
Shorewall/action.SetEvent
Normal file
51
Shorewall/action.SetEvent
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
#
|
||||||
|
# Shorewall version 4 - Set an Event
|
||||||
|
#
|
||||||
|
# /etc/shorewall/action.SetEvent
|
||||||
|
#
|
||||||
|
# Parameters:
|
||||||
|
# Event: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||||
|
# Action: Action to perform after setting the event. Default is ACCEPT
|
||||||
|
# Src or Dest: 'src' (default) or 'dst'. Determines if the event is associated with the source
|
||||||
|
# address (src) or destination address (dst)
|
||||||
|
# Disposition: Disposition for any event generated.
|
||||||
|
#
|
||||||
|
# For additional information, see http://www.shorewall.net/Events.html
|
||||||
|
#
|
||||||
|
#######################################################################################################
|
||||||
|
# DO NOT REMOVE THE FOLLOWING LINE
|
||||||
|
?format 2
|
||||||
|
#################################################################################################################################################################################################
|
||||||
|
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||||
|
# PORT PORT(S) DEST LIMIT GROUP
|
||||||
|
|
||||||
|
DEFAULTS -,ACCEPT,src
|
||||||
|
|
||||||
|
?begin perl
|
||||||
|
|
||||||
|
use Shorewall::Config;
|
||||||
|
use Shorewall::Chains;
|
||||||
|
use Shorewall::Rules;
|
||||||
|
use strict;
|
||||||
|
|
||||||
|
my ( $event, $action, $destination, $disposition ) = get_action_params( 4 );
|
||||||
|
|
||||||
|
require_capability 'RECENT_MATCH', 'Use of events', 's';
|
||||||
|
require_capability 'MARK_ANYWHERE', 'Use of events', 's';
|
||||||
|
|
||||||
|
fatal_error "An event name is required" unless supplied $event;
|
||||||
|
fatal_error "Invalid event name ($event)" unless $event =~ /^[a-zA-z][-\w]*$/;
|
||||||
|
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||||
|
|
||||||
|
set_action_disposition( $disposition) if supplied $disposition;
|
||||||
|
set_action_name_to_caller;
|
||||||
|
|
||||||
|
if ( $destination eq 'dst' ) {
|
||||||
|
perl_action_helper( $action, "-m recent --name $event --set --rdest" );
|
||||||
|
} else {
|
||||||
|
perl_action_helper( $action, "-m recent --name $event --set --rsource" );
|
||||||
|
}
|
||||||
|
|
||||||
|
1;
|
||||||
|
|
||||||
|
?end perl
|
||||||
@ -1,49 +0,0 @@
|
|||||||
#
|
|
||||||
# Shorewall version 4 - Set a Trigger
|
|
||||||
#
|
|
||||||
# /etc/shorewall/action.SetTrigger
|
|
||||||
#
|
|
||||||
# Parameters:
|
|
||||||
# Trigger: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
|
||||||
# Action: Action to perform after setting the trigger. Default is ACCEPT
|
|
||||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the trigger is associated with the source
|
|
||||||
# address (src) or destination address (dst)
|
|
||||||
# Disposition: Disposition for any event generated.
|
|
||||||
#
|
|
||||||
#######################################################################################################
|
|
||||||
# DO NOT REMOVE THE FOLLOWING LINE
|
|
||||||
?format 2
|
|
||||||
#################################################################################################################################################################################################
|
|
||||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
|
||||||
# PORT PORT(S) DEST LIMIT GROUP
|
|
||||||
|
|
||||||
DEFAULTS -,ACCEPT,src
|
|
||||||
|
|
||||||
?begin perl
|
|
||||||
|
|
||||||
use Shorewall::Config;
|
|
||||||
use Shorewall::Chains;
|
|
||||||
use Shorewall::Rules;
|
|
||||||
use strict;
|
|
||||||
|
|
||||||
my ( $trigger, $action, $destination, $disposition ) = get_action_params( 4 );
|
|
||||||
|
|
||||||
require_capability 'RECENT_MATCH', 'Use of triggers', 's';
|
|
||||||
require_capability 'MARK_ANYWHERE', 'Use of triggers', 's';
|
|
||||||
|
|
||||||
fatal_error "A trigger name is required" unless supplied $trigger;
|
|
||||||
fatal_error "Invalid trigger name ($trigger)" unless $trigger =~ /^[a-zA-z][-\w]*$/;
|
|
||||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
|
||||||
|
|
||||||
set_action_disposition( $disposition) if supplied $disposition;
|
|
||||||
set_action_name_to_caller;
|
|
||||||
|
|
||||||
if ( $destination eq 'dst' ) {
|
|
||||||
perl_action_helper( $action, "-m recent --name $trigger --set --rdest" );
|
|
||||||
} else {
|
|
||||||
perl_action_helper( $action, "-m recent --name $trigger --set --rsource" );
|
|
||||||
}
|
|
||||||
|
|
||||||
1;
|
|
||||||
|
|
||||||
?end perl
|
|
||||||
@ -33,14 +33,14 @@ Drop # Default Action for DROP policy
|
|||||||
dropInvalid inline # Drops packets in the INVALID conntrack state
|
dropInvalid inline # Drops packets in the INVALID conntrack state
|
||||||
DropSmurfs noinline # Drop smurf packets
|
DropSmurfs noinline # Drop smurf packets
|
||||||
Established inline # Handles packets in the ESTABLISHED state
|
Established inline # Handles packets in the ESTABLISHED state
|
||||||
IfTrigger noinline # Perform an action if a trigger is set
|
IfEvent noinline # Perform an action based on an event
|
||||||
Invalid inline # Handles packets in the INVALID conntrack state
|
Invalid inline # Handles packets in the INVALID conntrack state
|
||||||
New inline # Handles packets in the NEW conntrack state
|
New inline # Handles packets in the NEW conntrack state
|
||||||
NotSyn inline # Handles TCP packets which do not have SYN=1 and ACK=0
|
NotSyn inline # Handles TCP packets which do not have SYN=1 and ACK=0
|
||||||
Reject # Default Action for REJECT policy
|
Reject # Default Action for REJECT policy
|
||||||
Related inline # Handles packets in the RELATED conntrack state
|
Related inline # Handles packets in the RELATED conntrack state
|
||||||
ResetTrigger inline # Reset a Trigger
|
ResetEvent inline # Reset an Event
|
||||||
RST inline # Handle packets with RST set
|
RST inline # Handle packets with RST set
|
||||||
SetTrigger inline # Set a trigger for the packet's source IP
|
SetEvent inline # Initialize an event
|
||||||
TCPFlags # Handle bad flag combinations.
|
TCPFlags # Handle bad flag combinations.
|
||||||
Untracked inline # Handles packets in the UNTRACKED conntrack state
|
Untracked inline # Handles packets in the UNTRACKED conntrack state
|
||||||
|
|||||||
@ -18,7 +18,7 @@
|
|||||||
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
||||||
|
|
||||||
<copyright>
|
<copyright>
|
||||||
<year>2001-2012</year>
|
<year>2001-2013</year>
|
||||||
|
|
||||||
<holder>Thomas M. Eastep</holder>
|
<holder>Thomas M. Eastep</holder>
|
||||||
</copyright>
|
</copyright>
|
||||||
@ -271,9 +271,7 @@
|
|||||||
</row>
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><ulink url="ECN.html"><ulink
|
<entry><ulink url="Events.html">Events</ulink></entry>
|
||||||
url="shorewall_extension_scripts.htm">Extension Scripts</ulink>
|
|
||||||
(User Exits)</ulink></entry>
|
|
||||||
|
|
||||||
<entry><ulink url="PacketMarking.html">Packet
|
<entry><ulink url="PacketMarking.html">Packet
|
||||||
Marking</ulink></entry>
|
Marking</ulink></entry>
|
||||||
@ -282,8 +280,9 @@
|
|||||||
</row>
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><ulink
|
<entry><ulink url="ECN.html"><ulink
|
||||||
url="fallback.htm">Fallback/Uninstall</ulink></entry>
|
url="shorewall_extension_scripts.htm">Extension Scripts</ulink>
|
||||||
|
(User Exits)</ulink></entry>
|
||||||
|
|
||||||
<entry><ulink url="PacketHandling.html">Packet Processing in a
|
<entry><ulink url="PacketHandling.html">Packet Processing in a
|
||||||
Shorewall-based Firewall</ulink></entry>
|
Shorewall-based Firewall</ulink></entry>
|
||||||
@ -292,7 +291,8 @@
|
|||||||
</row>
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><ulink url="FAQ.htm">FAQs</ulink></entry>
|
<entry><ulink
|
||||||
|
url="fallback.htm">Fallback/Uninstall</ulink></entry>
|
||||||
|
|
||||||
<entry><ulink url="ping.html">'Ping' Management</ulink></entry>
|
<entry><ulink url="ping.html">'Ping' Management</ulink></entry>
|
||||||
|
|
||||||
@ -301,8 +301,7 @@
|
|||||||
</row>
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><ulink
|
<entry><ulink url="FAQ.htm">FAQs</ulink></entry>
|
||||||
url="shorewall_features.htm">Features</ulink></entry>
|
|
||||||
|
|
||||||
<entry><ulink url="two-interface.htm#DNAT">Port
|
<entry><ulink url="two-interface.htm#DNAT">Port
|
||||||
Forwarding</ulink></entry>
|
Forwarding</ulink></entry>
|
||||||
@ -312,8 +311,8 @@
|
|||||||
</row>
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><ulink url="Multiple_Zones.html">Forwarding Traffic on the
|
<entry><ulink
|
||||||
Same Interface</ulink></entry>
|
url="shorewall_features.htm">Features</ulink></entry>
|
||||||
|
|
||||||
<entry><ulink url="ports.htm">Port Information</ulink></entry>
|
<entry><ulink url="ports.htm">Port Information</ulink></entry>
|
||||||
|
|
||||||
@ -321,11 +320,21 @@
|
|||||||
Xen Dom0</ulink></entry>
|
Xen Dom0</ulink></entry>
|
||||||
</row>
|
</row>
|
||||||
|
|
||||||
|
<row>
|
||||||
|
<entry><ulink url="Multiple_Zones.html">Forwarding Traffic on the
|
||||||
|
Same Interface</ulink></entry>
|
||||||
|
|
||||||
|
<entry><ulink url="PortKnocking.html">Port Knocking
|
||||||
|
(deprecated)</ulink></entry>
|
||||||
|
|
||||||
|
<entry></entry>
|
||||||
|
</row>
|
||||||
|
|
||||||
<row>
|
<row>
|
||||||
<entry><ulink url="FTP.html">FTP and Shorewall</ulink></entry>
|
<entry><ulink url="FTP.html">FTP and Shorewall</ulink></entry>
|
||||||
|
|
||||||
<entry><ulink url="PortKnocking.html">Port Knocking and Other Uses
|
<entry><ulink url="Events.html">Port Knocking, Auto Blacklisting
|
||||||
of the 'Recent Match'</ulink></entry>
|
and Other Uses of the 'Recent Match'</ulink></entry>
|
||||||
|
|
||||||
<entry></entry>
|
<entry></entry>
|
||||||
</row>
|
</row>
|
||||||
@ -406,8 +415,7 @@
|
|||||||
<entry><ulink url="Shorewall_and_Kazaa.html">Kazaa
|
<entry><ulink url="Shorewall_and_Kazaa.html">Kazaa
|
||||||
Filtering</ulink></entry>
|
Filtering</ulink></entry>
|
||||||
|
|
||||||
<entry><ulink url="Shorewall-init.html">Shorewall
|
<entry><ulink url="Events.html">Shorewall Events</ulink></entry>
|
||||||
Init</ulink></entry>
|
|
||||||
|
|
||||||
<entry></entry>
|
<entry></entry>
|
||||||
</row>
|
</row>
|
||||||
@ -416,8 +424,8 @@
|
|||||||
<entry><ulink url="kernel.htm">Kernel
|
<entry><ulink url="kernel.htm">Kernel
|
||||||
Configuration</ulink></entry>
|
Configuration</ulink></entry>
|
||||||
|
|
||||||
<entry><ulink url="Shorewall-Lite.html">Shorewall
|
<entry><ulink url="Shorewall-init.html">Shorewall
|
||||||
Lite</ulink></entry>
|
Init</ulink></entry>
|
||||||
|
|
||||||
<entry></entry>
|
<entry></entry>
|
||||||
</row>
|
</row>
|
||||||
@ -426,7 +434,8 @@
|
|||||||
<entry><ulink url="KVM.html">KVM (Kernel-mode Virtual
|
<entry><ulink url="KVM.html">KVM (Kernel-mode Virtual
|
||||||
Machine)</ulink></entry>
|
Machine)</ulink></entry>
|
||||||
|
|
||||||
<entry></entry>
|
<entry><ulink url="Shorewall-Lite.html">Shorewall
|
||||||
|
Lite</ulink></entry>
|
||||||
|
|
||||||
<entry></entry>
|
<entry></entry>
|
||||||
</row>
|
</row>
|
||||||
|
|||||||
509
docs/Events.xml
Normal file
509
docs/Events.xml
Normal file
@ -0,0 +1,509 @@
|
|||||||
|
<?xml version="1.0" encoding="UTF-8"?>
|
||||||
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
||||||
|
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
||||||
|
<article>
|
||||||
|
<!--$Id$-->
|
||||||
|
|
||||||
|
<articleinfo>
|
||||||
|
<title>Shorewall Events</title>
|
||||||
|
|
||||||
|
<authorgroup>
|
||||||
|
<author>
|
||||||
|
<firstname>Tom</firstname>
|
||||||
|
|
||||||
|
<surname>Eastep</surname>
|
||||||
|
</author>
|
||||||
|
</authorgroup>
|
||||||
|
|
||||||
|
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
||||||
|
|
||||||
|
<copyright>
|
||||||
|
<year>2013</year>
|
||||||
|
|
||||||
|
<holder>Thomas M. Eastep</holder>
|
||||||
|
</copyright>
|
||||||
|
|
||||||
|
<legalnotice>
|
||||||
|
<para>Permission is granted to copy, distribute and/or modify this
|
||||||
|
document under the terms of the GNU Free Documentation License, Version
|
||||||
|
1.2 or any later version published by the Free Software Foundation; with
|
||||||
|
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||||
|
Texts. A copy of the license is included in the section entitled
|
||||||
|
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
||||||
|
License</ulink></quote>.</para>
|
||||||
|
</legalnotice>
|
||||||
|
</articleinfo>
|
||||||
|
|
||||||
|
<caution>
|
||||||
|
<para>This article applies to Shorewall 4.5.19 and later and supercedes
|
||||||
|
<ulink url="PortKnocking.html">this article.</ulink></para>
|
||||||
|
</caution>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Overview</title>
|
||||||
|
|
||||||
|
<para>Shorewall events were introduced in Shorewall 4.5.19 and provide a
|
||||||
|
high-level interface to the Netfilter<firstterm> recent match</firstterm>
|
||||||
|
capability. An event is actually a list of (IP address, timestamp) pairs,
|
||||||
|
and can be tested in a number of different ways:</para>
|
||||||
|
|
||||||
|
<itemizedlist>
|
||||||
|
<listitem>
|
||||||
|
<para>Has event E ever occurred for IP address A (is the IP address in
|
||||||
|
the list)? </para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Has event E occurred M or more times for IP address A?</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Has Event E occurred in the last N seconds for IP Address A (is
|
||||||
|
there an entry for the address with a timestamp falling within the
|
||||||
|
last N seconds)?</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Has Event E occurred M or more times in the last N seconds for
|
||||||
|
IP address A (are there M or more entries for the address with
|
||||||
|
timestamps falling within the last N seconds)?</para>
|
||||||
|
</listitem>
|
||||||
|
</itemizedlist>
|
||||||
|
|
||||||
|
<para>The event interface is implemented as three parameterized Shorewall
|
||||||
|
<ulink url="Actions.html">Actions</ulink>:</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term>SetEvent</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This action initializes an event list for either the source or
|
||||||
|
destination IP address in the current packets. The list will contain
|
||||||
|
a single entry for the address that will have the current
|
||||||
|
timestamp.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>ResetEvent</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This action removes all entries for either the source or
|
||||||
|
destination IP address from an event list.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>IfEvent</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>This action tests an event in one of the ways listed above,
|
||||||
|
and performs an action based on the result.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Details</title>
|
||||||
|
|
||||||
|
<para>Because these are parameterized actions, optional parameters may be
|
||||||
|
omitted. Trailing omitted parameters may be omitted entirely while
|
||||||
|
embedded omitted parameters are represented by a hyphen ("-").</para>
|
||||||
|
|
||||||
|
<para>Each event is given a name. Event names:</para>
|
||||||
|
|
||||||
|
<itemizedlist>
|
||||||
|
<listitem>
|
||||||
|
<para>Must begin with a letter.</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>May be composed of letters, digits, hyphens ('-') or underscores
|
||||||
|
('_').</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>May be at most 29 characters in length.</para>
|
||||||
|
</listitem>
|
||||||
|
</itemizedlist>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>SetEvent</title>
|
||||||
|
|
||||||
|
<para><emphasis role="bold">SetEvent</emphasis>(
|
||||||
|
<replaceable>event</replaceable>, [ <replaceable>action</replaceable> ],
|
||||||
|
[ <replaceable>src-dst</replaceable> ], [
|
||||||
|
<replaceable>disposition</replaceable> ] )</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term>event</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Name of the event.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>action</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>An action to perform after the event is initialized. May be
|
||||||
|
any action that may appear in the ACTION column of <ulink
|
||||||
|
url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5).
|
||||||
|
If no action is to be performed, use COUNT.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>src-dst</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specifies whether the source IP address (<emphasis
|
||||||
|
role="bold">src</emphasis>) or destination IP address (<emphasis
|
||||||
|
role="bold">dst</emphasis>) is to be added to the event. The
|
||||||
|
default is <emphasis role="bold">src</emphasis>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>disposition</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>If the <replaceable>action</replaceable> involves logging,
|
||||||
|
then this parameter specifies the disposition that will appear in
|
||||||
|
the log entry prefix. If no <replaceable>disposition</replaceable>
|
||||||
|
is given, the log prefix is determines normally. The default is
|
||||||
|
ACCEPT.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>ResetEvent</title>
|
||||||
|
|
||||||
|
<para><emphasis role="bold">ResetEvent</emphasis>(
|
||||||
|
<replaceable>event</replaceable>, [ <replaceable>action</replaceable> ],
|
||||||
|
[ <replaceable>src-dst</replaceable> ], [
|
||||||
|
<replaceable>disposition</replaceable> ] )</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term>event</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Name of the event.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>action</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>An action to perform after the event is reset. May be any
|
||||||
|
action that may appear in the ACTION column of <ulink
|
||||||
|
url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5).
|
||||||
|
If no action is to be performed, use COUNT. The default is
|
||||||
|
ACCEPT.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>src-dst</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specifies whether the source IP address (<emphasis
|
||||||
|
role="bold">src</emphasis>) or destination IP address (<emphasis
|
||||||
|
role="bold">dst</emphasis>) is to be removed from the event. The
|
||||||
|
default is <emphasis role="bold">src</emphasis>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>disposition</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>If the <replaceable>action</replaceable> involves logging,
|
||||||
|
then this parameter specifies the disposition that will appear in
|
||||||
|
the log entry prefix. If no <replaceable>disposition</replaceable>
|
||||||
|
is given, the log prefix is determines normally.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>IfEvent</title>
|
||||||
|
|
||||||
|
<para><emphasis role="bold">IfEvent</emphasis>(
|
||||||
|
<replaceable>event</replaceable>, [ <replaceable>action</replaceable> ],
|
||||||
|
[ <replaceable>duration</replaceable> ], [
|
||||||
|
<replaceable>hitcount</replaceable> ], [
|
||||||
|
<replaceable>src-dst</replaceable>], [
|
||||||
|
<replaceable>command</replaceable> ], [
|
||||||
|
<replaceable>disposition</replaceable> ] )</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term>event</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Name of the event.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>action</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>An action to perform if the test succeeds. May be any action
|
||||||
|
that may appear in the ACTION column of <ulink
|
||||||
|
url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5).
|
||||||
|
The default is ACCEPT.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>duration</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Number of seconds over which the event is to be tested. If
|
||||||
|
not specified, the test is not constrained by time.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>hitcount</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specifies the minimum number of packets required for the
|
||||||
|
test to succeed. If not specified, 1 packet is assumed.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>src-dst</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Specifies whether the source IP address (<emphasis
|
||||||
|
role="bold">src</emphasis>) or destination IP address (<emphasis
|
||||||
|
role="bold">dst</emphasis>) is to be tested. The default is
|
||||||
|
<emphasis role="bold">src</emphasis>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>command</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>May be one of the following:</para>
|
||||||
|
|
||||||
|
<variablelist>
|
||||||
|
<varlistentry>
|
||||||
|
<term>check</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Simply test if the
|
||||||
|
<replaceable>duration</replaceable>/<replaceable>hitcount</replaceable>
|
||||||
|
test is satisfied. If so, the
|
||||||
|
<replaceable>action</replaceable> is performed.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>reset</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Like <emphasis role="bold">check</emphasis>. If the
|
||||||
|
test succeeds, the <replaceable>event</replaceable> will be
|
||||||
|
reset before the <replaceable>action</replaceable> is
|
||||||
|
taken.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>update</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Like <emphasis role="bold">check</emphasis>.
|
||||||
|
Regardless of whether the test succeeds, an entry with the
|
||||||
|
current time and for the <replaceable>src-dst</replaceable>
|
||||||
|
iP address will be added to the
|
||||||
|
<replaceable>event</replaceable>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>checkreap</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Requires a <replaceable>duration</replaceable>. Like
|
||||||
|
<emphasis role="bold">check</emphasis> but regardless of
|
||||||
|
whether the test succeeds, entries for the
|
||||||
|
<replaceable>src-dst</replaceable> IP address that are older
|
||||||
|
than <replaceable>duration</replaceable> seconds will be
|
||||||
|
deleted from the <replaceable>event</replaceable>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>updatereap</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Requires a <replaceable>duration</replaceable>. Like
|
||||||
|
<emphasis role="bold">update</emphasis> but regardless of
|
||||||
|
whether the test succeeds, entries for the
|
||||||
|
<replaceable>src-dst</replaceable> IP address that are older
|
||||||
|
than <replaceable>duration</replaceable> seconds will be
|
||||||
|
deleted from the <replaceable>event</replaceable>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
|
||||||
|
<para>The default is <emphasis
|
||||||
|
role="bold">check</emphasis>.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
|
||||||
|
<varlistentry>
|
||||||
|
<term>disposition</term>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>If the <replaceable>action</replaceable> involves logging,
|
||||||
|
then this parameter specifies the disposition that will appear in
|
||||||
|
the log entry prefix. If no <replaceable>disposition</replaceable>
|
||||||
|
is given, the log prefix is determines normally.</para>
|
||||||
|
</listitem>
|
||||||
|
</varlistentry>
|
||||||
|
</variablelist>
|
||||||
|
</section>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Examples</title>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Automatic Blacklisting</title>
|
||||||
|
|
||||||
|
<para>This example is taken from <ulink
|
||||||
|
url="http://www.briandowney.net/blog/2009/08/20/firewalling-brute-force-attempts-with-iptables/">this
|
||||||
|
article</ulink> which explains the nice benifits of this approach. This
|
||||||
|
example is for ssh, but it can be adapted for any application.</para>
|
||||||
|
|
||||||
|
<para>The name SSH has been changed to SSHLIMIT so as not to override
|
||||||
|
the Shorewall macro of the same name.</para>
|
||||||
|
|
||||||
|
<para><filename>/etc/shorewall/actions</filename>:</para>
|
||||||
|
|
||||||
|
<programlisting>#ACTION OPTION DESCRIPTION
|
||||||
|
SSHLIMIT #Automatically blacklist hosts who exceed SSH connection limits
|
||||||
|
SSH_BLACKLIST #Helper for SSH</programlisting>
|
||||||
|
|
||||||
|
<para><filename>/etc/shorewall/action.SSH_BLACKLIST</filename>:</para>
|
||||||
|
|
||||||
|
<programlisting>#
|
||||||
|
# Shorewall version 4 - SSH_BLACKLIST Action
|
||||||
|
#
|
||||||
|
?format 2
|
||||||
|
###############################################################################
|
||||||
|
#TARGET SOURCE DEST PROTO DPORT SPORT
|
||||||
|
#
|
||||||
|
# Log the Reject
|
||||||
|
#
|
||||||
|
LOG:$LOG:REJECT
|
||||||
|
#
|
||||||
|
# And set the SSH_COUNTER trigger for the SOURCE IP address
|
||||||
|
#
|
||||||
|
SetEvent(SSH_COUNTER,REJECT,src)</programlisting>
|
||||||
|
|
||||||
|
<para><filename>/etc/shorewall/action.SSH</filename>LIMIT:</para>
|
||||||
|
|
||||||
|
<programlisting>#
|
||||||
|
# Shorewall version 4 - SSHLIMIT Action
|
||||||
|
#
|
||||||
|
?format 2
|
||||||
|
###############################################################################
|
||||||
|
#TARGET SOURCE DEST PROTO DPORT SPORT
|
||||||
|
#
|
||||||
|
# Silently reject the client if blacklisted
|
||||||
|
#
|
||||||
|
IfEvent(SSH_COUNTER,REJECT,300,1)
|
||||||
|
#
|
||||||
|
# Blacklist if 5 attempts in the last minute
|
||||||
|
#
|
||||||
|
IfEvent(SSH,SSH_BLACKLIST,60,5,src,checkreap)
|
||||||
|
#
|
||||||
|
# Log and reject if the client has tried to connect
|
||||||
|
# in the last two seconds
|
||||||
|
#
|
||||||
|
IfEvent(SSH,REJECT:$LOG:,2,1,-,update,Added)
|
||||||
|
#
|
||||||
|
# Un-blacklist the client
|
||||||
|
#
|
||||||
|
ResetEvent(SSH_COUNTER,LOG:$LOG,-,Removed)
|
||||||
|
#
|
||||||
|
# Set the 'SSH' trigger and accept the connection
|
||||||
|
#
|
||||||
|
SetEvent(SSH,ACCEPT,src)</programlisting>
|
||||||
|
|
||||||
|
<para><filename>etc/shorewall/rules</filename>:</para>
|
||||||
|
|
||||||
|
<programlisting>#ACTION SOURCE DEST PROTO DEST
|
||||||
|
# PORT(S)
|
||||||
|
SSHLIMIT net $FW tcp 22 </programlisting>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section>
|
||||||
|
<title>Port Knocking</title>
|
||||||
|
|
||||||
|
<para>This example shows a different implementation of the one shown in
|
||||||
|
the <ulink url="PortKnocking.html">Port Knocking</ulink> article.</para>
|
||||||
|
|
||||||
|
<para>In this example:</para>
|
||||||
|
|
||||||
|
<orderedlist>
|
||||||
|
<listitem>
|
||||||
|
<para>Attempting to connect to port 1600 enables SSH access. Access
|
||||||
|
is enabled for 60 seconds.</para>
|
||||||
|
</listitem>
|
||||||
|
|
||||||
|
<listitem>
|
||||||
|
<para>Attempting to connect to port 1601 disables SSH access (note
|
||||||
|
that in the article linked above, attempting to connect to port 1599
|
||||||
|
also disables access. This is an port scan defence as explained in
|
||||||
|
the article).</para>
|
||||||
|
</listitem>
|
||||||
|
</orderedlist>
|
||||||
|
|
||||||
|
<para>To implement that approach:</para>
|
||||||
|
|
||||||
|
<para><filename>/etc/shorewall/actions</filename>:</para>
|
||||||
|
|
||||||
|
<programlisting>#ACTION OPTION DESCRIPTION
|
||||||
|
Knock #Port Knocking</programlisting>
|
||||||
|
|
||||||
|
<para><filename>/etc/shorewall/action.Knock</filename>:</para>
|
||||||
|
|
||||||
|
<programlisting>#
|
||||||
|
# Shorewall version 4 - SSH_BLACKLIST Action
|
||||||
|
#
|
||||||
|
?format 2
|
||||||
|
###############################################################################
|
||||||
|
#ACTION SOURCE DEST PROTO DEST
|
||||||
|
# PORT(S)
|
||||||
|
IfEvent(SSH,ACCEPT:info,60,1,src,reset)\
|
||||||
|
- - tcp 22
|
||||||
|
SetEvent(SSH,ACCEPT) - - tcp 1600
|
||||||
|
ResetEvent(SSH,DROP:info) </programlisting>
|
||||||
|
|
||||||
|
<para><filename>etc/shorewall/rules</filename>:</para>
|
||||||
|
|
||||||
|
<programlisting>#ACTION SOURCE DEST PROTO DEST
|
||||||
|
# PORT(S)
|
||||||
|
Knock net $FW tcp 22,1599-1601 </programlisting>
|
||||||
|
</section>
|
||||||
|
</section>
|
||||||
|
</article>
|
||||||
@ -24,6 +24,8 @@
|
|||||||
|
|
||||||
<year>2009</year>
|
<year>2009</year>
|
||||||
|
|
||||||
|
<year>2013</year>
|
||||||
|
|
||||||
<holder>Thomas M. Eastep</holder>
|
<holder>Thomas M. Eastep</holder>
|
||||||
</copyright>
|
</copyright>
|
||||||
|
|
||||||
@ -38,6 +40,11 @@
|
|||||||
</legalnotice>
|
</legalnotice>
|
||||||
</articleinfo>
|
</articleinfo>
|
||||||
|
|
||||||
|
<note>
|
||||||
|
<para>The techniques described in this article were superceded in
|
||||||
|
Shorewall 4.5.19 with the introduction of Shorewall Events.</para>
|
||||||
|
</note>
|
||||||
|
|
||||||
<note>
|
<note>
|
||||||
<para>The feature described in this article require '<ulink
|
<para>The feature described in this article require '<ulink
|
||||||
url="http://snowman.net/projects/ipt_recent/">Recent Match</ulink>' in
|
url="http://snowman.net/projects/ipt_recent/">Recent Match</ulink>' in
|
||||||
|
|||||||
@ -66,6 +66,11 @@
|
|||||||
existing connections.</para>
|
existing connections.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</orderedlist>
|
</orderedlist>
|
||||||
|
|
||||||
|
<important>
|
||||||
|
<para>For automatic blacklisting based on exceeding defined threshholds,
|
||||||
|
see <ulink url="Events.html">Events</ulink>.</para>
|
||||||
|
</important>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user