extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-22 07:33:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

Prevent a state action from invoking another one.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-02-07 16:52:06 -08:00
parent aae6e001fe
commit b9e504683e
7 changed files with 41 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -95,6 +95,7 @@ our @EXPORT = ( qw(
HELPER
INLINE
TERMINATING
STATEMATCH
%chain_table
%targets
@ -362,6 +363,7 @@ use constant { STANDARD => 0x1, #defined by Netfilter
HELPER => 0x2000, #CT:helper
NFLOG => 0x4000, #NFLOG or ULOG
INLINE => 0x8000, #Inline action
STATEMATCH => 0x10000, #action.Invalid, action.Related, etc.
};
#
# Valid Targets -- value is a combination of one or more of the above

31
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -1664,7 +1664,7 @@ sub process_actions() {
}
sub process_rule ( $$$$$$$$$$$$$$$$$$$$ );
sub process_rule ( $$$$$$$$$$$$$$$$$$$ );
#
# Populate an action invocation chain. As new action tuples are encountered,
@ -1720,7 +1720,6 @@ sub process_action($$) {
process_rule( $chainref,
'',
0,
$nolog ? $target : merge_levels( join(':', @actparms{'chain','loglevel','logtag'}), $target ),
'',
$source,
@ -1866,7 +1865,6 @@ sub process_macro ($$$$$$$$$$$$$$$$$$$$) {
$generated |= process_rule(
$chainref,
$matches,
0,
$mtarget,
$param,
$msource,
@ -1986,7 +1984,6 @@ sub process_inline ($$$$$$$$$$$$$$$$$$$$$) {
$generated |= process_rule(
$chainref,
$matches,
0,
$mtarget,
$param,
$msource,
@ -2039,10 +2036,9 @@ sub verify_audit($;$$) {
# reference is also passed when rules are being generated during processing of a macro used as a default action.
#
sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
sub process_rule ( $$$$$$$$$$$$$$$$$$$ ) {
my ( $chainref, #reference to Action Chain if we are being called from process_action(); undef otherwise
$rule, #Matches
$actiontype,
$target,
$current_param,
$source,
@ -2064,6 +2060,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
my ( $action, $loglevel) = split_action $target;
my ( $basictarget, $param ) = get_target_param $action;
my $optimize = $wildcard ? ( $basictarget =~ /!$/ ? 0 : $config{OPTIMIZE} & 5 ) : 0;
my $actiontype;
my $inaction = ''; # Set to true when we are process rules in an action file
my $inchain = ''; # Set to true when a chain reference is passed.
my $normalized_target;
@ -2080,7 +2077,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
#
# Determine the validity of the action
#
$actiontype = ( $targets{$basictarget} || find_macro ( $basictarget ) ) unless $actiontype;
$actiontype = ( $targets{$basictarget} || find_macro ( $basictarget ) );
if ( $config{ MAPOLDACTIONS } ) {
( $basictarget, $actiontype , $param ) = map_old_actions( $basictarget ) unless $actiontype || supplied $param;
@ -2755,26 +2752,33 @@ sub merge_target( $$ ) {
# May be called by Perl code in action bodies (regular and inline) to generate a rule.
#
sub perl_action_helper($$;$) {
my ( $target, $matches, $actiontype ) = @_;
my ( $target, $matches, $isstatematch ) = @_;
my $action = $actparms{action};
my $chainref = $actparms{0};
my $result;
our $statematch;
assert( $chainref );
$matches .= ' ' unless $matches =~ /^(?:.+\s)?$/;
if ( $isstatematch ) {
return if $statematch;
$statematch = 1;
}
if ( my $ref = $inlines{$action} ) {
$result = &process_rule( $chainref,
$matches,
$actiontype || 0,
merge_target( $ref, $target ),
'', # CurrentParam
@columns );
} else {
assert $actions{$action};
$result = process_rule( $chainref,
$matches,
$actiontype || 0,
merge_target( $actions{$action}, $target ),
'', # Current Param
'-', # Source
@ -2799,6 +2803,8 @@ sub perl_action_helper($$;$) {
# Record that we generated a rule to avoid bogus warning
#
$actionresult ||= $result;
$statematch = 0 if $isstatematch;
}
#
@ -2822,7 +2828,6 @@ sub perl_action_tcp_helper($$) {
if ( my $ref = $inlines{$action} ) {
$result = &process_rule( $chainref,
$proto,
0,
merge_target( $ref, $target ),
'',
@columns[0,1],
@ -2832,7 +2837,6 @@ sub perl_action_tcp_helper($$) {
} else {
$result = process_rule( $chainref,
$proto,
0,
merge_target( $actions{$action}, $target ),
'', # Current Param
'-', # Source
@ -2991,6 +2995,8 @@ sub process_raw_rule ( ) {
my @users = split_list1 $users, 'USER/GROUP';
my $generated = 0;
our $statematch = 0;
fatal_error "Invalid or missing ACTION ($target)" unless defined $action;
if ( @protos > 1 ) {
@ -3007,7 +3013,6 @@ sub process_raw_rule ( ) {
for my $user ( @users ) {
if ( process_rule( undef,
'',
0,
$target,
'',
$source,

2
Shorewall/action.Established
View File

@ -41,7 +41,7 @@ use Shorewall::Rules;
my ( $action ) = get_action_params( 1 );
if ( my $check = check_state( 'ESTABLISHED' ) ) {
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} ESTABLISHED" : '' );
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} ESTABLISHED" : '', 1 );
}
1;

2
Shorewall/action.Invalid
View File

@ -46,7 +46,7 @@ if ( supplied $audit ) {
}
if ( my $check = check_state( 'INVALID' ) ) {
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} INVALID" : '' );
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} INVALID" : '' , 1 );
}
1;

2
Shorewall/action.Related
View File

@ -42,7 +42,7 @@ use Shorewall::Rules;
my ( $action ) = get_action_params( 1 );
if ( my $check = check_state( 'RELATED' ) ) {
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} RELATED" : '' );
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} RELATED" : '', 1 );
}
1;

2
Shorewall/action.Untracked
View File

@ -41,7 +41,7 @@ use Shorewall::Rules;
my ( $action ) = get_action_params( 1 );
if ( my $check = check_state( 'UNTRACKED' ) ) {
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} UNTRACKED" : '' );
perl_action_helper( $action, $check == 1 ? "$globals{STATEMATCH} UNTRACKED" : '' , 1 );
}
1;