extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-23 08:03:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Removal of SAME support

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@9774 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2009-04-01 01:31:04 +00:00
parent 35790476a3
commit dbf23f64e2
7 changed files with 12 additions and 76 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -284,7 +284,6 @@ our %builtin_target = ( ACCEPT => 1,
RETURN => 1,
COUNT => 1,
DNAT => 1,
SAME => 1,
LOG => 1,
NFLOG => 1,
QUEUE => 1,
@ -1084,8 +1083,6 @@ sub initialize_chain_table()
'QUEUE!' => STANDARD,
'NFQUEUE' => STANDARD + NFQ,
'NFQUEUE!' => STANDARD + NFQ,
'SAME' => NATRULE,
'SAME-' => NATRULE + NATONLY,
'dropBcast' => BUILTIN + ACTION,
'allowBcast' => BUILTIN + ACTION,
'dropNotSyn' => BUILTIN + ACTION,

16
Shorewall/Perl/Shorewall/Nat.pm
View File

@ -219,21 +219,7 @@ sub setup_one_masq($$$$$$$)
} else {
$addresses =~ s/:random$// and $randomize = '--random ';
if ( $addresses =~ /^SAME:nodst:/ ) {
fatal_error "':random' is not supported by the SAME target" if $randomize;
$target = '-j SAME --nodst ';
$addresses =~ s/.*://;
for my $addr ( split_list $addresses, 'address' ) {
$target .= "--to $addr ";
}
} elsif ( $addresses =~ /^SAME:/ ) {
fatal_error "':random' is not supported by the SAME target" if $randomize;
$target = '-j SAME ';
$addresses =~ s/.*://;
for my $addr ( split_list $addresses, 'address' ) {
$target .= "--to $addr ";
}
} elsif ( $addresses eq 'detect' ) {
if ( $addresses eq 'detect' ) {
my $variable = get_interface_address $interface;
$target = "-j SNAT --to-source $variable";

11
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -1275,16 +1275,7 @@ sub process_rule1 ( $$$$$$$$$$$$$ ) {
$server = join ',', @servers;
}
if ( $action eq 'SAME' ) {
fatal_error 'Port mapping not allowed in SAME rules' if $serverport;
fatal_error 'SAME not allowed with SOURCE=$FW' if $sourcezone eq firewall_zone;
fatal_error "':random' is not supported by the SAME target" if $randomize;
warning_message 'Netfilter support for SAME is being dropped in early 2008';
$target = '-j SAME ';
for my $serv ( split /,/, $server ) {
$target .= "--to $serv ";
}
} elsif ( $action eq 'DNAT' ) {
if ( $action eq 'DNAT' ) {
$target = '-j DNAT ';
$serverport = ":$serverport" if $serverport;
for my $serv ( split /,/, $server ) {

2
Shorewall/changelog.txt
View File

@ -14,6 +14,8 @@ Changes in Shorewall 4.3.8
7) Add AUTOMAKE option
8) Remove SAME support.
Changes in Shorewall 4.3.7
1) Fix forward treatment of interface options.

4
Shorewall/releasenotes.txt
View File

@ -35,6 +35,10 @@ released late in 2009.
uses the new syntax exclusively, although the old syntax
continues to be supported.
3) Support for the SAME target in /etc/shorewall/masq and
/etc/shorewall/rules has been removed, following the removal of the
underlying support in the Linux kernel.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 4 . 3 . 8
----------------------------------------------------------------------------

18
manpages/shorewall-masq.xml
View File

@ -147,9 +147,7 @@
<varlistentry>
<term><emphasis role="bold">ADDRESS</emphasis> (Optional) - [<emphasis
role="bold">-</emphasis>|<emphasis
role="bold">NONAT</emphasis>|[<emphasis
role="bold">SAME:</emphasis>[<emphasis
role="bold">nodst:</emphasis>]][<emphasis>address-or-address-range</emphasis>[,<emphasis>address-or-address-range</emphasis>]...][:<emphasis>lowport</emphasis><emphasis
role="bold">NONAT</emphasis>|[<emphasis>address-or-address-range</emphasis>[,<emphasis>address-or-address-range</emphasis>]...][:<emphasis>lowport</emphasis><emphasis
role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
role="bold">:random</emphasis>]|<emphasis
role="bold">detect</emphasis>|<emphasis
@ -197,20 +195,6 @@
<programlisting> 192.0.2.4:5000-6000
:4000-5000</programlisting>
<para>You can invoke the SAME target rather than the SNAT target by
prefixing the column contents with <option>SAME:</option>.</para>
<para>SAME works like SNAT with the exception that the same local IP
address is assigned to each connection from a local address to a
given remote address.</para>
<para>If the <option>nodst:</option> option is included, then the
same source address is used for a given internal system regardless
of which remote system is involved.<warning>
<para>Support for the SAME target is scheduled for removal from
the Linux kernel in 2008.</para>
</warning></para>
<para>If you simply place <emphasis role="bold">NONAT</emphasis> in
this column, no rewriting of the source IP address or port number
will be performed. This is useful if you want particular traffic to

34
manpages/shorewall-rules.xml
View File

@ -138,8 +138,6 @@
role="bold">REJECT</emphasis>[<option>!</option>]|<emphasis
role="bold">DNAT</emphasis>[<emphasis
role="bold">-</emphasis>]|<emphasis
role="bold">SAME</emphasis>[<emphasis
role="bold">-</emphasis>]|<emphasis
role="bold">REDIRECT</emphasis>[<emphasis
role="bold">-</emphasis>]|<emphasis
role="bold">CONTINUE</emphasis>[<option>!</option>]|<emphasis
@ -262,32 +260,6 @@
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SAME</emphasis></term>
<listitem>
<para>Similar to <emphasis role="bold">DNAT</emphasis> except
that the port may not be remapped and when multiple server
addresses are listed, all requests from a given remote system
go to the same server.<warning>
<para>Support for SAME is scheduled for removal from the
Linux kernel in 2008.</para>
</warning></para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">SAME-</emphasis></term>
<listitem>
<para>Advanced users only.</para>
<para>Like SAME but only generates the nat iptables rule and
not the companion <emphasis role="bold">ACCEPT</emphasis>
rule.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">REDIRECT</emphasis></term>
@ -449,9 +421,9 @@
REJECT:info or DNAT:debug). This causes the packet to be
logged at the specified level. Note that if the <emphasis
role="bold">ACTION</emphasis> involves destination network
address translation (DNAT, REDIRECT, SAME, etc.) then the
packet is logged <emphasis role="bold">before</emphasis> the
destination address is rewritten.</para>
address translation (DNAT, REDIRECT, etc.) then the packet is
logged <emphasis role="bold">before</emphasis> the destination
address is rewritten.</para>
<para>If the <emphasis role="bold">ACTION</emphasis> names an
<emphasis>action</emphasis> declared in <ulink