extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-05-31 15:05:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add IPv6 UPnP Support

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2017-03-24 09:54:36 -07:00
parent 0763b27b0b
commit d2392c3a9b
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
9 changed files with 71 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
Shorewall/Perl/Shorewall/Misc.pm
View File

@ -1213,55 +1213,53 @@ sub add_common_rules ( $ ) {
} }
} }
if ( $family == F_IPV4 ) { my $announced = 0;
my $announced = 0;
$list = find_interfaces_by_option 'upnp'; $list = find_interfaces_by_option 'upnp';
if ( @$list ) { if ( @$list ) {
progress_message2 "$doing UPnP"; progress_message2 "$doing UPnP";
$chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE ); $chainref = set_optflags( new_nat_chain( 'UPnP' ), DONT_OPTIMIZE );
add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' ); add_commands( $chainref, '[ -s /${VARDIR}/.UPnP ] && cat ${VARDIR}/.UPnP >&3' );
my $chainref1; my $chainref1;
if ( $config{MINIUPNPD} ) { if ( $config{MINIUPNPD} ) {
$chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE ); $chainref1 = set_optflags( new_nat_chain( 'MINIUPNPD-POSTROUTING' ), DONT_OPTIMIZE );
add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' ); add_commands( $chainref, '[ -s /${VARDIR}/.MINIUPNPD-POSTROUTING ] && cat ${VARDIR}/.MINIUPNPD-POSTROUTING >&3' );
}
$announced = 1;
for $interface ( @$list ) {
add_ijump_extended $nat_table->{PREROUTING} , j => 'UPnP', get_interface_origin($interface), imatch_source_dev ( $interface );
add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD} , imatch_dest_dev ( $interface ) if $chainref1;
}
} }
$list = find_interfaces_by_option 'upnpclient'; $announced = 1;
if ( @$list ) { for $interface ( @$list ) {
progress_message2 "$doing UPnP" unless $announced; add_ijump_extended $nat_table->{PREROUTING} , j => 'UPnP', get_interface_origin($interface), imatch_source_dev ( $interface );
add_ijump_extended $nat_table->{$globals{POSTROUTING}} , j => 'MINIUPNPD-POSTROUTING' , $origin{MINIUPNPD} , imatch_dest_dev ( $interface ) if $chainref1;
}
}
for $interface ( @$list ) { $list = find_interfaces_by_option 'upnpclient';
my $chainref = $filter_table->{input_option_chain $interface};
my $base = uc var_base get_physical $interface;
my $optional = interface_is_optional( $interface );
my $variable = get_interface_gateway( $interface, ! $optional );
my $origin = get_interface_origin( $interface );
if ( $optional ) { if ( @$list ) {
add_commands( $chainref, progress_message2 "$doing UPnP" unless $announced;
qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
incr_cmd_level( $chainref ); for $interface ( @$list ) {
add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' ); my $chainref = $filter_table->{input_option_chain $interface};
decr_cmd_level( $chainref ); my $base = uc var_base get_physical $interface;
add_commands( $chainref, 'fi' ); my $optional = interface_is_optional( $interface );
} else { my $variable = get_interface_gateway( $interface, ! $optional );
add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' ); my $origin = get_interface_origin( $interface );
}
if ( $optional ) {
add_commands( $chainref,
qq(if [ -n "SW_\$${base}_IS_USABLE" -a -n "$variable" ]; then) );
incr_cmd_level( $chainref );
add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
decr_cmd_level( $chainref );
add_commands( $chainref, 'fi' );
} else {
add_ijump_extended( $chainref, j => 'ACCEPT', $origin, imatch_source_dev( $interface ), s => $variable, p => 'udp' );
} }
} }
} }

2
Shorewall/Perl/Shorewall/Zones.pm
View File

@ -407,6 +407,8 @@ sub initialize( $$ ) {
forward => BINARY_IF_OPTION, forward => BINARY_IF_OPTION,
physical => STRING_IF_OPTION + IF_OPTION_HOST, physical => STRING_IF_OPTION + IF_OPTION_HOST,
unmanaged => SIMPLE_IF_OPTION, unmanaged => SIMPLE_IF_OPTION,
upnp => SIMPLE_IF_OPTION,
upnpclient => SIMPLE_IF_OPTION,
wait => NUMERIC_IF_OPTION + IF_OPTION_WILDOK, wait => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
); );
%validhostoptions = ( %validhostoptions = (

2
Shorewall6/Samples6/Universal/shorewall6.conf
View File

@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
MARK_IN_FORWARD_CHAIN=No MARK_IN_FORWARD_CHAIN=No
MINIUPNPD=No
MODULE_SUFFIX="ko ko.xz" MODULE_SUFFIX="ko ko.xz"
MUTEX_TIMEOUT=60 MUTEX_TIMEOUT=60

2
Shorewall6/Samples6/one-interface/shorewall6.conf
View File

@ -189,6 +189,8 @@ MANGLE_ENABLED=Yes
MARK_IN_FORWARD_CHAIN=No MARK_IN_FORWARD_CHAIN=No
MINIUPNPD=No
MODULE_SUFFIX="ko ko.xz" MODULE_SUFFIX="ko ko.xz"
MUTEX_TIMEOUT=60 MUTEX_TIMEOUT=60

2
Shorewall6/Samples6/three-interfaces/shorewall6.conf
View File

@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
MARK_IN_FORWARD_CHAIN=No MARK_IN_FORWARD_CHAIN=No
MINIUPNPD=No
MODULE_SUFFIX="ko ko.xz" MODULE_SUFFIX="ko ko.xz"
MUTEX_TIMEOUT=60 MUTEX_TIMEOUT=60

2
Shorewall6/Samples6/two-interfaces/shorewall6.conf
View File

@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
MARK_IN_FORWARD_CHAIN=No MARK_IN_FORWARD_CHAIN=No
MINIUPNPD=No
MODULE_SUFFIX="ko ko.xz" MODULE_SUFFIX="ko ko.xz"
MUTEX_TIMEOUT=60 MUTEX_TIMEOUT=60

1
Shorewall6/actions.std
View File

@ -27,6 +27,7 @@ DropDNSrep inline # Drops DNS replies
DropSmurfs noinline # Handles packets with a broadcast source address DropSmurfs noinline # Handles packets with a broadcast source address
Established inline,\ # Handles packets in the ESTABLISHED state Established inline,\ # Handles packets in the ESTABLISHED state
state=ESTABLISHED state=ESTABLISHED
forwardUPnP noinline # Allow traffic that upnpd has redirected from 'upnp' interfaces.
IfEvent noinline # Perform an action based on an event IfEvent noinline # Perform an action based on an event
Invalid inline,audit,\ # Handles packets in the INVALID conntrack state Invalid inline,audit,\ # Handles packets in the INVALID conntrack state
state=INVALID state=INVALID

2
Shorewall6/configfiles/shorewall6.conf
View File

@ -188,6 +188,8 @@ MANGLE_ENABLED=Yes
MARK_IN_FORWARD_CHAIN=No MARK_IN_FORWARD_CHAIN=No
MINIUPNPD=No
MODULE_SUFFIX=ko MODULE_SUFFIX=ko
MUTEX_TIMEOUT=60 MUTEX_TIMEOUT=60

22
Shorewall6/manpages/shorewall6.conf.xml
View File

@ -1555,6 +1555,28 @@ LOG:info:,bar net fw</programlisting>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term><emphasis role="bold">MINIUPNPD=</emphasis>[<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para>Added in Shorewall 5.1.4. If set to Yes, Shorewall will create
a chain in the nat table named MINIUPNPD-POSTROUTING and will add
jumps from POSTROUTING to that chain for each interface with the
<option>upnpd</option> option specified. Default is No.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">MARK_IN_FORWARD_CHAIN=</emphasis>[<emphasis
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
<listitem>
<para/>
</listitem>
</varlistentry>
<varlistentry> <varlistentry>
<term><emphasis role="bold">MODULE_SUFFIX=</emphasis>[<emphasis <term><emphasis role="bold">MODULE_SUFFIX=</emphasis>[<emphasis
role="bold">"</emphasis><emphasis>extension</emphasis> ...<emphasis role="bold">"</emphasis><emphasis>extension</emphasis> ...<emphasis