extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-19 08:07:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Clean up logging and variable naming

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1510 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-07-30 00:09:15 +00:00
parent 015546c84f
commit a786066304
3 changed files with 96 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Shorewall2/bogons
View File

@ -22,6 +22,7 @@
# #
############################################################################### ###############################################################################
#SUBNET TARGET #SUBNET TARGET
0.0.0.0 RETURN # Stop the DHCP whining
255.255.255.255 RETURN # We need to allow limited broadcast 255.255.255.255 RETURN # We need to allow limited broadcast
169.254.0.0/16 DROP # DHCP autoconfig 169.254.0.0/16 DROP # DHCP autoconfig
192.0.2.0/24 logdrop # Example addresses (RFC 3330) 192.0.2.0/24 logdrop # Example addresses (RFC 3330)

156
Shorewall2/firewall
View File

@ -2571,21 +2571,21 @@ add_an_action()
for serv1 in $(separate_list $serv); do for serv1 in $(separate_list $serv); do
for srv in $(ip_range $serv1); do for srv in $(ip_range $serv1); do
if [ -n "$loglevel" ]; then if [ -n "$loglevel" ]; then
log_rule_limit $loglevel $action $action $logtarget "$ratelimit" "$logtag" $userandgroup \ log_rule_limit $loglevel $chain $action $logtarget "$ratelimit" "$logtag" $userandgroup \
$(fix_bang $proto $sports $multiport $cli -d $srv $dports) $(fix_bang $proto $sports $multiport $cli -d $srv $dports)
fi fi
run_iptables2 -A $action $proto $multiport $cli $sports \ run_iptables2 -A $chain $proto $multiport $cli $sports \
-d $srv $dports $ratelimit $userandgroup -j $target -d $srv $dports $ratelimit $userandgroup -j $target
done done
done done
else else
if [ -n "$loglevel" ]; then if [ -n "$loglevel" ]; then
log_rule_limit $loglevel $action $action $logtarget "$ratelimit" "$logtag" $userandgroup \ log_rule_limit $loglevel $chain $action $logtarget "$ratelimit" "$logtag" $userandgroup \
$(fix_bang $proto $sports $multiport $cli $dest_interface $dports) $(fix_bang $proto $sports $multiport $cli $dest_interface $dports)
fi fi
run_iptables2 -A $action $proto $multiport $cli $dest_interface $sports \ run_iptables2 -A $chain $proto $multiport $cli $dest_interface $sports \
$dports $ratelimit $userandgroup -j $target $dports $ratelimit $userandgroup -j $target
fi fi
fi fi
@ -2594,25 +2594,27 @@ add_an_action()
# #
# Process a record from an action file for the 'start', 'restart' or 'check' commands # Process a record from an action file for the 'start', 'restart' or 'check' commands
# #
process_action() # $1 = action process_action() # $1 = chain
# $2 = target # $2 = action
# $3 = clients # $3 = target
# $4 = servers # $4 = clients
# $5 = protocol # $5 = servers
# $6 = ports # $6 = protocol
# $7 = cports # $7 = ports
# $8 = ratelimit # $8 = cports
# $9 = userspec # $9 = ratelimit
# $10 = userspec
{ {
local action="$1" local chain="$1"
local target="$2" local action="$2"
local clients="$3" local target="$3"
local servers="$4" local clients="$4"
local protocol="$5" local servers="$5"
local ports="$6" local protocol="$6"
local cports="$7" local ports="$7"
local ratelimit="$8" local cports="$8"
local userspec="$9" local ratelimit="$9"
local userspec="${10}"
local userandgroup= local userandgroup=
local logtag= local logtag=
@ -2758,22 +2760,34 @@ process_action() # $1 = action
# set CHAIN to the name of the iptables chain where rules are to be added. # set CHAIN to the name of the iptables chain where rules are to be added.
# Similarly, LEVEL and TAG contain the log level and log tag respectively. # Similarly, LEVEL and TAG contain the log level and log tag respectively.
# #
# For each <action>, we maintain two variables:
#
# <action>_actchain - The action chain number.
# <action>_chains - List of ( level[:tag] , chainname ) pairs
#
createlogactionchain() # $1 = Action Name, $2 = Log Level [: Log Tag ] createlogactionchain() # $1 = Action Name, $2 = Log Level [: Log Tag ]
{ {
local actchain= action=$1 level=$2 local actchain= action=$1 level=$2
eval actchain=\${${action}_actchain-1} eval actchain=\${${action}_actchain-1}
case ${#action} in case ${#action} in
11) 10|11)
CHAIN=$(echo $action | cut -b -10)${actchain} CHAIN=$(echo $action | cut -b -9)
;; ;;
*) *)
CHAIN=${action}${actchain} CHAIN=${action}
;; ;;
esac esac
[ "$COMMAND" != check ] && while chain_exists ${CHAIN}%${actchain}; do
actchain=$(($actchain + 1))
done
CHAIN=${CHAIN}%${actchain}
eval ${action}_actchain=$(($actchain + 1)) eval ${action}_actchain=$(($actchain + 1))
if [ $COMMAND != check ]; then if [ $COMMAND != check ]; then
@ -2785,8 +2799,6 @@ createlogactionchain() # $1 = Action Name, $2 = Log Level [: Log Tag ]
eval ${action}_chains=\"\$${action}_chains $level $CHAIN\" eval ${action}_chains=\"\$${action}_chains $level $CHAIN\"
# echo " *** Action $1:$2 is $CHAIN ***"
} }
# #
@ -2843,9 +2855,7 @@ find_logactionchain() # $1 = Action, including log level and tag if any
shift;shift shift;shift
done done
createlogactionchain $action $level fatal_error "Fatal error in find_logactionchain"
echo $CHAIN
} }
@ -3005,8 +3015,8 @@ process_actions2() {
if [ "${ysourcezone}" != "${ydestzone}" ] ; then if [ "${ysourcezone}" != "${ydestzone}" ] ; then
eval ypolicy=\$${ysourcezone}2${ydestzone}_policy eval ypolicy=\$${ysourcezone}2${ydestzone}_policy
if [ "$ypolicy" != NONE ] ; then if [ "$ypolicy" != NONE ] ; then
rule="$(echo $origtarget $yclients $yservers $xprotocol $xports $xcports $xratelimit $xuserspec)" rule="$(echo $xtarget $yclients $yservers $xprotocol $xports $xcports $xratelimit $xuserspec)"
process_action $xaction $xtarget $yclients $yservers $xprotocol $xports $xcports $xratelimit $xuserspec process_action $xchain $xaction1 $xaction2 $yclients $yservers $xprotocol $xports $xcports $xratelimit $xuserspec
fi fi
fi fi
done done
@ -3031,8 +3041,8 @@ process_actions2() {
continue continue
fi fi
rule="$(echo $origtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec)" rule="$(echo $xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec)"
process_action $xaction $xtarget $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec process_action $xchain $xaction1 $xaction2 $xclients $xservers $xprotocol $xports $xcports $xratelimit $xuserspec
} }
drop_broadcasts() { drop_broadcasts() {
@ -3049,10 +3059,11 @@ process_actions2() {
run_iptables -A $xchain -d $address -j DROP run_iptables -A $xchain -d $address -j DROP
done done
} }
#
# B O D Y S T A R T S H E R E
#
progress_message " Generating Transitive Closure of Used-action List..."
#
# Generate the transitive closure of $USEDACTIONS
#
changed=Yes changed=Yes
while [ -n "$changed" ]; do while [ -n "$changed" ]; do
@ -3061,11 +3072,11 @@ process_actions2() {
eval required=\"\$requiredby_${xaction%%:*}\" eval required=\"\$requiredby_${xaction%%:*}\"
for action in $required; do for xaction1 in $required; do
action1=$(evaluate_levels $xaction $action) xaction2=$(evaluate_levels $xaction $xaction1)
if ! list_search $action1 $USEDACTIONS; then if ! list_search $xaction2 $USEDACTIONS; then
USEDACTIONS="$USEDACTIONS $action1" USEDACTIONS="$USEDACTIONS $xaction2"
createactionchain $action1 createactionchain $xaction2
changed=Yes changed=Yes
fi fi
done done
@ -3074,15 +3085,23 @@ process_actions2() {
# #
# Now process the relevant action files -- they were already stripped in process_actions1() above. # Now process the relevant action files -- they were already stripped in process_actions1() above.
# #
for xaction1 in $USEDACTIONS; do for xaction in $USEDACTIONS; do
xchain=$(find_logactionchain $xaction1) #
# Find the chain associated with this action:level:tag
set -- $(split $xaction1) #
xchain=$(find_logactionchain $xaction)
#
# Split the action:level:tag
#
set -- $(split $xaction)
xaction1=$1
xlevel=$2 xlevel=$2
xtag=$3 xtag=$3
#
case ${xaction1%%:*} in # Handle Builtin actions
#
case $xaction1 in
dropBcast) dropBcast)
if [ "$COMMAND" != check ]; then if [ "$COMMAND" != check ]; then
if [ -n "$PKTTYPE" ]; then if [ -n "$PKTTYPE" ]; then
@ -3111,7 +3130,6 @@ process_actions2() {
if [ "$COMMAND" != check ]; then if [ "$COMMAND" != check ]; then
[ -n "$xlevel" ] && \ [ -n "$xlevel" ] && \
log_rule_limit ${xlevel%\!} $xchain dropBcast $2 "" "$xtag" -p tcp ! --syn log_rule_limit ${xlevel%\!} $xchain dropBcast $2 "" "$xtag" -p tcp ! --syn
run_iptables -A $xchain -p tcp ! --syn -j DROP run_iptables -A $xchain -p tcp ! --syn -j DROP
fi fi
;; ;;
@ -3120,41 +3138,51 @@ process_actions2() {
if [ "$COMMAND" != check ]; then if [ "$COMMAND" != check ]; then
[ -n "$xlevel" ] && \ [ -n "$xlevel" ] && \
log_rule_limit ${xlevel%\!} $xchain dropNotSyn $2 "" "$xtag" -p tcp ! --syn log_rule_limit ${xlevel%\!} $xchain dropNotSyn $2 "" "$xtag" -p tcp ! --syn
run_iptables -A dropNotSyn -p tcp ! --syn -j DROP run_iptables -A $xchain -p tcp ! --syn -j DROP
fi fi
;; ;;
rejNotSyn) rejNotSyn)
if [ "$COMMAND" != check ]; then if [ "$COMMAND" != check ]; then
[ -n "$xlevel" ] && \ [ -n "$xlevel" ] && \
log_rule_limit ${xlevel%\!} $xchain rejNotSyn $2 "" "$xtag" -p tcp ! --syn log_rule_limit ${xlevel%\!} $xchain rejNotSyn $2 "" "$xtag" -p tcp ! --syn
run_iptables -A rejectNotSyn -p tcp ! --syn -j REJECT --reject-with tcp-reset run_iptables -A $xchain -p tcp ! --syn -j REJECT --reject-with tcp-reset
fi fi
;; ;;
dropInvalid) dropInvalid)
if [ "$COMMAND" != check ]; then if [ "$COMMAND" != check ]; then
[ -n "$xlevel" ] && \ [ -n "$xlevel" ] && \
log_rule_limit ${xlevel%\!} $xchain dropNotSyn $2 "" "$xtag" -m state --state INVALID log_rule_limit ${xlevel%\!} $xchain dropNotSyn $2 "" "$xtag" -m state --state INVALID
run_iptables -A dropInvalid -m state --state INVALID -j DROP run_iptables -A $xchain -m state --state INVALID -j DROP
fi fi
;; ;;
*) *)
f=action.${xaction1%%:*} #
# Not a buildin -- the following is so much noise just to report the correct file name
#
f=action.$xaction1
fn=$(find_file $f) fn=$(find_file $f)
echo "Processing $fn for Chain $xchain..."
xaction=$(find_logactionchain $xaction1) while read xtarget xclients xservers xprotocol xports xcports xratelimit $xuserspec; do
expandv xtarget
echo "Processing $fn for Action $xaction..." #
# Generate the target:level:tag to pass to process_action()
while read origtarget xclients xservers xprotocol xports xcports xratelimit $xuserspec; do #
expandv origtarget xaction2=$(evaluate_levels $xaction $xtarget)
xtarget=$(evaluate_levels $xaction1 $origtarget)
case ${xtarget%%:*} in case ${xaction2%%:*} in
ACCEPT|DROP|REJECT|LOG|QUEUE|CONTINUE) ACCEPT|DROP|REJECT|LOG|QUEUE|CONTINUE)
;; ;;
*) *)
origtarget=$xtarget #
xtarget=$(find_logactionchain $xtarget) # Not a builtin target -- Replace the target from the file
# -- with the one generated above
xtarget=$xaction2
#
# And locate the chain for that action:level:tag
#
xaction2=$(find_logactionchain $xtarget)
;; ;;
esac esac

3
Shorewall2/functions
View File

@ -704,6 +704,9 @@ chain_base() #$1 = interface
*-*) *-*)
c="${c%-*}_${c##*-}" c="${c%-*}_${c##*-}"
;; ;;
*%*)
c="${c%\%*}_${c##*%}"
;;
*) *)
echo ${c:=common} echo ${c:=common}
return return