extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-26 12:42:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Eliminate ?begin perl ... ?end Perl in many actions

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2016-03-12 12:15:07 -08:00
parent 3960fa6e0e
commit bb7b3123df
9 changed files with 62 additions and 180 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
Shorewall/Perl/Shorewall/Config.pm
View File

@ -2506,10 +2506,10 @@ sub join_parts( $$$ ) {
} }
# #
# Evaluate an expression in an ?IF, ?ELSIF or ?SET directive # Evaluate an expression in an ?IF, ?ELSIF, ?SET or ?ERROR directive
# #
sub evaluate_expression( $$$ ) { sub evaluate_expression( $$$$ ) {
my ( $expression , $filename , $linenumber ) = @_; my ( $expression , $filename , $linenumber, $just_expand ) = @_;
my $val; my $val;
my $count = 0; my $count = 0;
my $chain = $actparms{chain}; my $chain = $actparms{chain};
@ -2565,7 +2565,7 @@ sub evaluate_expression( $$$ ) {
print "EXPR=> $expression\n" if $debug; print "EXPR=> $expression\n" if $debug;
if ( $expression =~ /^\d+$/ ) { if ( $just_expand || $expression =~ /^\d+$/ ) {
$val = $expression $val = $expression
} else { } else {
# #
@ -2602,7 +2602,7 @@ sub process_compiler_directive( $$$$ ) {
print "CD===> $line\n" if $debug; print "CD===> $line\n" if $debug;
directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber ) unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*)(.*)$/i; directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber ) unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+)(.*)$/i;
my ($keyword, $expression) = ( uc $1, $2 ); my ($keyword, $expression) = ( uc $1, $2 );
@ -2620,7 +2620,7 @@ sub process_compiler_directive( $$$$ ) {
my %directives = my %directives =
( IF => sub() { ( IF => sub() {
directive_error( "Missing IF expression" , $filename, $linenumber ) unless supplied $expression; directive_error( "Missing IF expression" , $filename, $linenumber ) unless supplied $expression;
my $nextomitting = $omitting || ! evaluate_expression( $expression , $filename, $linenumber ); my $nextomitting = $omitting || ! evaluate_expression( $expression , $filename, $linenumber , 0 );
push @ifstack, [ 'IF', $omitting, ! $nextomitting, $linenumber ]; push @ifstack, [ 'IF', $omitting, ! $nextomitting, $linenumber ];
$omitting = $nextomitting; $omitting = $nextomitting;
} , } ,
@ -2632,7 +2632,7 @@ sub process_compiler_directive( $$$$ ) {
# #
# We can only change to including if we were previously omitting # We can only change to including if we were previously omitting
# #
$omitting = $prioromit || ! evaluate_expression( $expression , $filename, $linenumber ); $omitting = $prioromit || ! evaluate_expression( $expression , $filename, $linenumber, 0 );
$included = ! $omitting; $included = ! $omitting;
} else { } else {
# #
@ -2671,12 +2671,14 @@ sub process_compiler_directive( $$$$ ) {
directive_error( "Shorewall variables may only be SET in the body of an action", $filename, $linenumber ) unless $actparms{0}; directive_error( "Shorewall variables may only be SET in the body of an action", $filename, $linenumber ) unless $actparms{0};
my $val = $actparms{$var} = evaluate_expression ( $expression, my $val = $actparms{$var} = evaluate_expression ( $expression,
$filename, $filename,
$linenumber ); $linenumber,
0 );
$parmsmodified = PARMSMODIFIED; $parmsmodified = PARMSMODIFIED;
} else { } else {
$variables{$2} = evaluate_expression( $expression, $variables{$2} = evaluate_expression( $expression,
$filename, $filename,
$linenumber ); $linenumber,
0 );
} }
} }
} , } ,
@ -2736,8 +2738,16 @@ sub process_compiler_directive( $$$$ ) {
directive_error ( "?COMMENT is not allowed in this file", $filename, $linenumber ); directive_error ( "?COMMENT is not allowed in this file", $filename, $linenumber );
} }
} }
} } ,
ERROR => sub() {
directive_error( evaluate_expression( $expression ,
$filename ,
$linenumber ,
1 ) ,
$filename ,
$linenumber ) unless $omitting;
}
); );
if ( my $function = $directives{$keyword} ) { if ( my $function = $directives{$keyword} ) {
@ -3436,7 +3446,7 @@ sub read_a_line($) {
# #
# Handle directives # Handle directives
# #
if ( /^\s*\?(?:IF|ELSE|ELSIF|ENDIF|SET|RESET|FORMAT|COMMENT)/i ) { if ( /^\s*\?(?:IF|ELSE|ELSIF|ENDIF|SET|RESET|FORMAT|COMMENT|ERROR)/i ) {
$omitting = process_compiler_directive( $omitting, $_, $currentfilename, $. ); $omitting = process_compiler_directive( $omitting, $_, $currentfilename, $. );
next; next;
} }

2
Shorewall/action.DNSAmp
View File

@ -30,4 +30,4 @@
DEFAULTS DROP DEFAULTS DROP
IPTABLES(@1) - - udp 53 ; -m u32 --u32 "0>>22&0x3C\@8&0xffff=0x0100 && 0>>22&0x3C\@12&0xffff0000=0x00010000" @1 - - udp 53 ;; -m u32 --u32 "0>>22&0x3C\@8&0xffff=0x0100 && 0>>22&0x3C\@12&0xffff0000=0x00010000"

30
Shorewall/action.Drop
View File

@ -28,30 +28,16 @@
# IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!! # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
# #
############################################################################### ###############################################################################
#
# The following magic provides different defaults for @2 thru @5, when @1 is
# 'audit'.
#
?begin perl;
use Shorewall::Config;
my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
if ( defined $p1 ) {
if ( $p1 eq 'audit' ) {
set_action_param( 3, 'A_DROP') unless supplied $p3;
set_action_param( 4, 'A_ACCEPT' ) unless supplied $p4;
set_action_param( 5, 'A_DROP' ) unless supplied $p5;
} else {
fatal_error "Invalid value ($p1) for first Drop parameter" if supplied $p1;
}
}
1;
?end perl;
if @1 ne '' && @1 ne '-'
?if @1 eq 'audit'
DEFAULTS -,-,A_DROP,A_ACCEPT,A_DROP
?else
?error The first parameter to Drop must be 'audit' or '-'
?endif
?else
DEFAULTS -,-,DROP,ACCEPT,DROP DEFAULTS -,-,DROP,ACCEPT,DROP
?endif
#TARGET SOURCE DEST PROTO DPORT SPORT #TARGET SOURCE DEST PROTO DPORT SPORT
# #

19
Shorewall/action.GlusterFS
View File

@ -11,20 +11,11 @@
DEFAULTS 2,0 DEFAULTS 2,0
?begin perl ?if @1 !~ /^\d+/ || ! @1 || @1 > 1024
?error Invalid value for Bricks (@1)
use Shorewall::Config qw(:DEFAULT :internal); ?elsif @2 !~ /^[01]$/
use Shorewall::Chains; ?error Invalid value for IB (@2)
use Shorewall::Rules; ?endif
use strict;
my ( $bricks, $ib ) = get_action_params( 2 );
fatal_error "Invalid value for Bricks ( $bricks )" unless $bricks =~ /^\d+$/ && $bricks > 1 && $bricks < 1024;
fatal_error "Invalid value for IB ( $ib )" unless $ib =~ /^[01]$/;
?end perl
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP

44
Shorewall/action.NotSyn
View File

@ -1,52 +1,14 @@
# #
# Shorewall 4 - NotSyn Action # Shorewall - NotSyn Action
# #
# /usr/share/shorewall/action.NotSyn # /usr/share/shorewall/action.NotSyn
# #
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2011 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# NotSyn[([<action>])] # NotSyn[([<action>])]
# #
# Default action is DROP # Default action is DROP
# #
########################################################################################## ##########################################################################################
DEFAULTS DROP,- DEFAULTS DROP
?begin perl; @1 - - tcp ;; ! --syn
use strict;
use Shorewall::IPAddrs;
use Shorewall::Config;
use Shorewall::Chains;
use Shorewall::Rules;
my ( $action, $audit ) = get_action_params( 2 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action NotSyn" if $audit ne 'audit';
$action = "A_$action";
}
perl_action_tcp_helper( $action, '-p 6 ! --syn' );
1;
?end perl;

40
Shorewall/action.RST
View File

@ -3,48 +3,12 @@
# #
# /usr/share/shorewall/action.RST # /usr/share/shorewall/action.RST
# #
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2012 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# RST[([<action>])] # RST[([<action>])]
# #
# Default action is DROP # Default action is DROP
# #
########################################################################################## ##########################################################################################
DEFAULTS DROP,- DEFAULTS DROP
?begin perl; @1 - - tcp ;; --tcp-flags RST RST
use Shorewall::Config;
use Shorewall::Chains;
use Shorewall::Rules;
my ( $action, $audit ) = get_action_params( 2 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action RST" if $audit ne 'audit';
$action = "A_$action";
}
perl_action_tcp_helper( $action, '-p 6 --tcp-flags RST RST' );
1;
?end perl;

30
Shorewall/action.Reject
View File

@ -27,30 +27,16 @@
# #
# IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!! # IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
############################################################################### ###############################################################################
#
# The following magic provides different defaults for @2 thru @5, when @1 is
# 'audit'.
#
?begin perl;
use Shorewall::Config;
my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
if ( defined $p1 ) {
if ( $p1 eq 'audit' ) {
set_action_param( 3, 'A_REJECT') unless supplied $p3;
set_action_param( 4, 'A_ACCEPT' ) unless supplied $p4;
set_action_param( 5, 'A_DROP' ) unless supplied $p5;
} else {
fatal_error "Invalid value ($p1) for first Reject parameter" if supplied $p1;
}
}
1;
?end perl;
?if @1 ne '' && @1 ne '-'
?if @1 eq 'audit'
DEFAULTS -,-,A_REJECT,A_ACCEPT,A_DROP
?else
?error The first parameter to Reject must be 'audit' or '-'
?endif
?else
DEFAULTS -,-,REJECT,ACCEPT,DROP DEFAULTS -,-,REJECT,ACCEPT,DROP
?endif
#TARGET SOURCE DEST PROTO #TARGET SOURCE DEST PROTO
# #

5
Shorewall/action.SetEvent
View File

@ -12,11 +12,6 @@
# #
# For additional information, see http://www.shorewall.net/Events.html # For additional information, see http://www.shorewall.net/Events.html
# #
#######################################################################################################
# DO NOT REMOVE THE FOLLOWING LINE
#################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP
DEFAULTS -,ACCEPT,src DEFAULTS -,ACCEPT,src

40
Shorewall/action.TCPFlags
View File

@ -10,32 +10,20 @@
# #
################################################################################# #################################################################################
DEFAULTS - ?if @1 ne '-' && @1 ne ''
?if @1 eq 'audit'
?begin perl; DEFAULTS A_DROP
use strict; ?else
use Shorewall::Config qw(:DEFAULT F_IPV4 F_IPV6); ?error "The first parameter to TCPFlags must be 'audit' or '-'
use Shorewall::Chains; ?endif
use Shorewall::Rules; ?else
DEFAULTS DROP
my $action = 'DROP'; ?endif
my ( $audit ) = get_action_params( 1 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action TCPFlags" if $audit ne 'audit';
$action = "A_DROP";
}
perl_action_tcp_helper( $action, '-p tcp --tcp-flags ALL FIN,URG,PSH' );
perl_action_tcp_helper( $action, '-p tcp --tcp-flags ALL NONE' );
perl_action_tcp_helper( $action, '-p tcp --tcp-flags SYN,RST SYN,RST' );
perl_action_tcp_helper( $action, '-p tcp --tcp-flags SYN,FIN SYN,FIN' );
perl_action_tcp_helper( $action, '-p tcp --syn --sport 0' );
?end perl;
@1 - - tcp ;; --tcp-flags ALL FIN,URG,PSH
@1 - - tcp ;; --tcp-flags ALL NONE
@1 - - tcp ;; --tcp-flags SYN,RST SYN,RST
@1 - - tcp ;; --tcp-flags SYN,FIN SYN,FIN
@1 - - tcp ;; --syn --sport 0