extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-20 09:47:51 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add 'noupdate' DYNAMIC_BLACKLIST option

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2020-06-06 10:14:32 -07:00
parent 07160c5ed1
commit aa47554604
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
4 changed files with 32 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
Shorewall-core/lib.cli
View File

@ -3926,6 +3926,15 @@ setup_dbl() {
;; ;;
esac esac
case $DYNAMIC_BLACKLIST in
ipset*,noupdate*)
#
# This utility doesn't use this option
#
DYNAMIC_BLACKLIST=$(echo $DYNAMIC_BLACKLIST | sed 's/,noupdate//')
;;
esac
case $DYNAMIC_BLACKLIST in case $DYNAMIC_BLACKLIST in
ipset*,timeout*) ipset*,timeout*)
# #

2
Shorewall/Perl/Shorewall/Config.pm
View File

@ -6695,7 +6695,7 @@ sub get_configuration( $$$ ) {
if ( supplied( $val = $config{DYNAMIC_BLACKLIST} ) ) { if ( supplied( $val = $config{DYNAMIC_BLACKLIST} ) ) {
if ( $val =~ /^ipset/ ) { if ( $val =~ /^ipset/ ) {
my %simple_options = ( 'src-dst' => 1, 'disconnect' => 1, 'log' => 1 ); my %simple_options = ( 'src-dst' => 1, 'disconnect' => 1, 'log' => 1, 'noupdate' => 1, );
my ( $key, $set, $level, $tag, $rest ) = split( ':', $val , 5 ); my ( $key, $set, $level, $tag, $rest ) = split( ':', $val , 5 );

12
Shorewall/Perl/Shorewall/Misc.pm
View File

@ -735,6 +735,7 @@ sub add_common_rules ( $ ) {
my $dbl_tag; my $dbl_tag;
my $dbl_src_target; my $dbl_src_target;
my $dbl_dst_target; my $dbl_dst_target;
my $dbl_options;
if ( $config{REJECT_ACTION} ) { if ( $config{REJECT_ACTION} ) {
process_reject_action; process_reject_action;
@ -796,9 +797,10 @@ sub add_common_rules ( $ ) {
if ( $dbl_ipset ) { if ( $dbl_ipset ) {
if ( $val = $globals{DBL_TIMEOUT} ) { if ( $val = $globals{DBL_TIMEOUT} ) {
$dbl_src_target = $globals{DBL_OPTIONS} =~ /src-dst/ ? 'dbl_src' : 'dbl_log'; $dbl_options = $globals{DBL_OPTIONS};
$dbl_src_target = $dbl_options =~ /src-dst/ ? 'dbl_src' : 'dbl_log';
my $chainref = set_optflags( new_standard_chain( $dbl_src_target ) , DONT_OPTIMIZE | DONT_DELETE ); my $chainref = new_standard_chain( $dbl_src_target );
log_rule_limit( $dbl_level, log_rule_limit( $dbl_level,
$chainref, $chainref,
@ -809,11 +811,11 @@ sub add_common_rules ( $ ) {
'add', 'add',
'', '',
$origin{DYNAMIC_BLACKLIST} ) if $dbl_level; $origin{DYNAMIC_BLACKLIST} ) if $dbl_level;
add_ijump_extended( $chainref, j => "SET --add-set $dbl_ipset src --exist --timeout $val", $origin{DYNAMIC_BLACKLIST} ); add_ijump_extended( $chainref, j => "SET --add-set $dbl_ipset src --exist --timeout $val", $origin{DYNAMIC_BLACKLIST} ) unless $dbl_options =~ /noupdate/;
add_ijump_extended( $chainref, j => 'DROP', $origin{DYNAMIC_BLACKLIST} ); add_ijump_extended( $chainref, j => 'DROP', $origin{DYNAMIC_BLACKLIST} );
if ( $dbl_src_target eq 'dbl_src' ) { if ( $dbl_src_target eq 'dbl_src' ) {
$chainref = set_optflags( new_standard_chain( $dbl_dst_target = 'dbl_dst' ) , DONT_OPTIMIZE | DONT_DELETE ); $chainref = new_standard_chain( $dbl_dst_target = 'dbl_dst' );
log_rule_limit( $dbl_level, log_rule_limit( $dbl_level,
$chainref, $chainref,
@ -830,7 +832,7 @@ sub add_common_rules ( $ ) {
$dbl_dst_target = $dbl_src_target; $dbl_dst_target = $dbl_src_target;
} }
} elsif ( $dbl_level ) { } elsif ( $dbl_level ) {
my $chainref = set_optflags( new_standard_chain( $dbl_src_target = $dbl_dst_target = 'dbl_log' ) , DONT_OPTIMIZE | DONT_DELETE ); my $chainref = new_standard_chain( $dbl_src_target = $dbl_dst_target = 'dbl_log' );
log_rule_limit( $dbl_level, log_rule_limit( $dbl_level,
$chainref, $chainref,

15
Shorewall/manpages/shorewall.conf.xml
View File

@ -951,6 +951,21 @@
system log.</para> system log.</para>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term>noupdate</term>
<listitem>
<para>Added in Shorewall 5.2.5. Normally, once an address has
been blacklisted, each time that a packet is received from the
packet, the ipset's entry for the address is updated to reset
the timeout to the value specifyed in the
<option>timeout</option> option above. Setting the
<option>noupdate</option> option, inhibits this resetting of
the entry's timeout. This option is ignored when the
<option>timeout</option> option is not specified.</para>
</listitem>
</varlistentry>
</variablelist> </variablelist>
<para>When ipset-based dynamic blacklisting is enabled, the contents <para>When ipset-based dynamic blacklisting is enabled, the contents