extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-01-22 05:28:59 +01:00
Code Issues Packages Projects Releases Wiki Activity

Allow TTL to be specified in the SAME action.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2015-02-17 19:11:28 -08:00
parent 361f5af3e0
commit aff8623a44
3 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -649,6 +649,7 @@ our %opttype = ( rule => CONTROL,
simple => CONTROL, simple => CONTROL,
matches => CONTROL, matches => CONTROL,
complex => CONTROL, complex => CONTROL,
t => CONTROL,
i => UNIQUE, i => UNIQUE,
s => UNIQUE, s => UNIQUE,
@ -891,6 +892,8 @@ sub set_rule_option( $$$ ) {
} }
} elsif ( $opttype == EXCLUSIVE ) { } elsif ( $opttype == EXCLUSIVE ) {
$ruleref->{$option} .= ",$value"; $ruleref->{$option} .= ",$value";
} elsif ( $opttype == CONTROL ) {
$ruleref->{$option} = $value;
} elsif ( $opttype == UNIQUE ) { } elsif ( $opttype == UNIQUE ) {
# #
# Shorewall::Rules::perl_action_tcp_helper() can produce rules that have two -p specifications. # Shorewall::Rules::perl_action_tcp_helper() can produce rules that have two -p specifications.
@ -925,7 +928,7 @@ sub transform_rule( $;\$ ) {
my $option; my $option;
my $invert = ''; my $invert = '';
if ( $input =~ s/^(!\s+)?-([psdjgiom])\s+// ) { if ( $input =~ s/^(!\s+)?-([psdjgiomt])\s+// ) {
# #
# Normal case of single-character # Normal case of single-character
$invert = '!' if $1; $invert = '!' if $1;
@ -955,7 +958,7 @@ sub transform_rule( $;\$ ) {
PARAM: PARAM:
{ {
while ( $input ne '' && $input !~ /^(?:!|-[psdjgiom])\s/ ) { while ( $input ne '' && $input !~ /^(?:!|-[psdjgiomt])\s/ ) {
last PARAM if $input =~ /^--([^\s]+)/ && $aliases{$1 || '' }; last PARAM if $input =~ /^--([^\s]+)/ && $aliases{$1 || '' };
$input =~ s/^([^\s]+)\s*//; $input =~ s/^([^\s]+)\s*//;
my $token = $1; my $token = $1;

4
Shorewall/Perl/Shorewall/Providers.pm
View File

@ -2049,7 +2049,7 @@ sub handle_stickiness( $ ) {
$rule1 = clone_irule( $_ ); $rule1 = clone_irule( $_ );
set_rule_target( $rule1, 'MARK', "--set-mark $mark" ); set_rule_target( $rule1, 'MARK', "--set-mark $mark" );
set_rule_option( $rule1, 'recent', "--name $list --update --seconds 300 --reap" ); set_rule_option( $rule1, 'recent', "--name $list --update --seconds $rule1->{t} --reap" );
$rule2 = clone_irule( $_ ); $rule2 = clone_irule( $_ );
@ -2084,7 +2084,7 @@ sub handle_stickiness( $ ) {
$rule1 = clone_irule $_; $rule1 = clone_irule $_;
set_rule_target( $rule1, 'MARK', "--set-mark $mark" ); set_rule_target( $rule1, 'MARK', "--set-mark $mark" );
set_rule_option( $rule1, 'recent', " --name $list --rdest --update --seconds 300 --reap" ); set_rule_option( $rule1, 'recent', " --name $list --rdest --update --seconds $rule1->{t} --reap" );
$rule2 = clone_irule $_; $rule2 = clone_irule $_;

11
Shorewall/Perl/Shorewall/Tc.pm
View File

@ -225,6 +225,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
my $device = ''; my $device = '';
our $cmd; our $cmd;
our $designator; our $designator;
our $ttl = 0;
my $fw = firewall_zone; my $fw = firewall_zone;
sub handle_mark_param( $$ ) { sub handle_mark_param( $$ ) {
@ -587,6 +588,13 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
$target = ( $chain == OUTPUT ? 'sticko' : 'sticky' ); $target = ( $chain == OUTPUT ? 'sticko' : 'sticky' );
$restriction = DESTIFACE_DISALLOW; $restriction = DESTIFACE_DISALLOW;
ensure_mangle_chain( $target ); ensure_mangle_chain( $target );
if (supplied $params) {
$ttl = numeric_value( $params );
fatal_error "The SAME timeout must be positive" unless $ttl;
} else {
$ttl = 300;
}
$sticky++; $sticky++;
}, },
}, },
@ -801,6 +809,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$ ) {
do_dscp( $dscp ) . do_dscp( $dscp ) .
state_match( $state ) . state_match( $state ) .
do_time( $time ) . do_time( $time ) .
( $ttl ? "-t $ttl " : '' ) .
$raw_matches , $raw_matches ,
$source , $source ,
$dest , $dest ,
@ -858,7 +867,7 @@ sub process_tc_rule1( $$$$$$$$$$$$$$$$ ) {
} , } ,
CONTINUE => { match => sub ( $ ) { $_[0] eq 'CONTINUE' }, CONTINUE => { match => sub ( $ ) { $_[0] eq 'CONTINUE' },
} , } ,
SAME => { match => sub ( $ ) { $_[0] eq 'SAME' }, SAME => { match => sub ( $ ) { $_[0] =~ /^SAME(?:\(d+\))?$/ },
} , } ,
IPMARK => { match => sub ( $ ) { $_[0] =~ /^IPMARK/ }, IPMARK => { match => sub ( $ ) { $_[0] =~ /^IPMARK/ },
} , } ,