mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-01 23:45:53 +02:00
Modularlize Proxy ARP
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@4455 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
44b8b78bf1
commit
dd7bd174be
@ -641,112 +641,6 @@ disable_critical_hosts()
|
|||||||
done
|
done
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
|
||||||
# Setup Proxy ARP
|
|
||||||
#
|
|
||||||
setup_proxy_arp() {
|
|
||||||
|
|
||||||
local setlist= resetlist=
|
|
||||||
|
|
||||||
print_error() {
|
|
||||||
error_message "Invalid value for HAVEROUTE - ($haveroute)"
|
|
||||||
error_message "Entry \"$address $interface $external $haveroute\" ignored"
|
|
||||||
}
|
|
||||||
|
|
||||||
print_error1() {
|
|
||||||
error_message "Invalid value for PERSISTENT - ($persistent)"
|
|
||||||
error_message "Entry \"$address $interface $external $haveroute $persistent\" ignored"
|
|
||||||
}
|
|
||||||
|
|
||||||
print_warning() {
|
|
||||||
error_message "PERSISTENT setting ignored - ($persistent)"
|
|
||||||
error_message "Entry \"$address $interface $external $haveroute $persistent\""
|
|
||||||
}
|
|
||||||
|
|
||||||
setup_one_proxy_arp() {
|
|
||||||
|
|
||||||
case $haveroute in
|
|
||||||
[Nn][Oo])
|
|
||||||
haveroute=
|
|
||||||
;;
|
|
||||||
[Yy][Ee][Ss])
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
if [ -n "$haveroute" ]; then
|
|
||||||
print_error
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
case $persistent in
|
|
||||||
[Nn][Oo])
|
|
||||||
persistent=
|
|
||||||
;;
|
|
||||||
[Yy][Ee][Ss])
|
|
||||||
[ -z "$haveroute" ] || print_warning
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
if [ -n "$persistent" ]; then
|
|
||||||
print_error1
|
|
||||||
return
|
|
||||||
fi
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
if [ -z "$haveroute" ]; then
|
|
||||||
save_command "[ -n \"\$NOROUTES\" ] || run_ip route replace $address dev $interface"
|
|
||||||
[ -n "$persistent" ] && haveroute=yes
|
|
||||||
fi
|
|
||||||
|
|
||||||
indent >&3 << __EOF__
|
|
||||||
if ! arp -i $external -Ds $address $external pub; then
|
|
||||||
fatal_error "Command \"arp -i $external -Ds $address $external pub\" failed"
|
|
||||||
fi
|
|
||||||
|
|
||||||
progress_message " Host $address connected to $interface added to ARP on $external"
|
|
||||||
|
|
||||||
__EOF__
|
|
||||||
echo $address $interface $external $haveroute >> $STATEDIR/proxyarp
|
|
||||||
|
|
||||||
progress_message " Host $address connected to $interface added to ARP on $external"
|
|
||||||
}
|
|
||||||
|
|
||||||
> $STATEDIR/proxyarp
|
|
||||||
|
|
||||||
save_progress_message "Setting up Proxy ARP..."
|
|
||||||
|
|
||||||
while read address interface external haveroute persistent; do
|
|
||||||
expandv address interface external haveroute persistent
|
|
||||||
list_search $interface $setlist || setlist="$setlist $interface"
|
|
||||||
list_search $external $resetlist || list_search $external $setlist || resetlist="$resetlist $external"
|
|
||||||
setup_one_proxy_arp
|
|
||||||
done < $TMP_DIR/proxyarp
|
|
||||||
|
|
||||||
for interface in $resetlist; do
|
|
||||||
list_search $interface $setlist || \
|
|
||||||
save_command "echo 0 > /proc/sys/net/ipv4/conf/$interface/proxy_arp"
|
|
||||||
done
|
|
||||||
|
|
||||||
for interface in $setlist; do
|
|
||||||
save_command "echo 1 > /proc/sys/net/ipv4/conf/$interface/proxy_arp"
|
|
||||||
done
|
|
||||||
|
|
||||||
interfaces=$(find_interfaces_by_option proxyarp)
|
|
||||||
|
|
||||||
for interface in $interfaces; do
|
|
||||||
indent >&3 << __EOF__
|
|
||||||
if [ -f /proc/sys/net/ipv4/conf/$interface/proxy_arp ] ; then
|
|
||||||
echo 1 > /proc/sys/net/ipv4/conf/$interface/proxy_arp
|
|
||||||
else
|
|
||||||
error_message "WARNING: Unable to enable proxy ARP on $interface"
|
|
||||||
fi
|
|
||||||
|
|
||||||
__EOF__
|
|
||||||
done
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
#
|
||||||
# Set up MAC Verification
|
# Set up MAC Verification
|
||||||
#
|
#
|
||||||
@ -4442,7 +4336,6 @@ initialize_netfilter () {
|
|||||||
#
|
#
|
||||||
|
|
||||||
strip_file rules
|
strip_file rules
|
||||||
strip_file proxyarp
|
|
||||||
strip_file maclist
|
strip_file maclist
|
||||||
|
|
||||||
progress_message2 "Pre-processing Actions..."
|
progress_message2 "Pre-processing Actions..."
|
||||||
@ -6054,7 +5947,13 @@ __EOF__
|
|||||||
|
|
||||||
initialize_netfilter
|
initialize_netfilter
|
||||||
|
|
||||||
progress_message2 "$DOING Proxy ARP"; setup_proxy_arp
|
if strip_file_and_lib_load proxyarp proxyarp; then
|
||||||
|
progress_message2 "$DOING Proxy ARP"
|
||||||
|
setup_proxy_arp
|
||||||
|
else
|
||||||
|
> $STATEDIR/proxyarp
|
||||||
|
fi
|
||||||
|
|
||||||
#
|
#
|
||||||
# [re]-Establish routing
|
# [re]-Establish routing
|
||||||
#
|
#
|
||||||
@ -6113,8 +6012,7 @@ __EOF__
|
|||||||
progress_message2 "$DOING $(find_file policy)..."; apply_policy_rules
|
progress_message2 "$DOING $(find_file policy)..."; apply_policy_rules
|
||||||
|
|
||||||
if strip_file_and_lib_load masq nat; then
|
if strip_file_and_lib_load masq nat; then
|
||||||
masq=$(find_file masq)
|
setup_masq $(find_file masq)
|
||||||
setup_masq $masq
|
|
||||||
fi
|
fi
|
||||||
|
|
||||||
if [ -n "$MANGLE_ENABLED" ]; then
|
if [ -n "$MANGLE_ENABLED" ]; then
|
||||||
|
|||||||
128
Shorewall/lib.proxyarp
Normal file
128
Shorewall/lib.proxyarp
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
#
|
||||||
|
# Shorewall 3.2 -- /usr/share/shorewall/lib.proxyarp
|
||||||
|
#
|
||||||
|
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||||
|
#
|
||||||
|
# (c) 1999,2000,2001,2002,2003,2004,2005,2006 - Tom Eastep (teastep@shorewall.net)
|
||||||
|
#
|
||||||
|
# Complete documentation is available at http://shorewall.net
|
||||||
|
#
|
||||||
|
# This program is free software; you can redistribute it and/or modify
|
||||||
|
# it under the terms of Version 2 of the GNU General Public License
|
||||||
|
# as published by the Free Software Foundation.
|
||||||
|
#
|
||||||
|
# This program is distributed in the hope that it will be useful,
|
||||||
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||||
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||||
|
# GNU General Public License for more details.
|
||||||
|
#
|
||||||
|
# You should have received a copy of the GNU General Public License
|
||||||
|
# along with this program; if not, write to the Free Software
|
||||||
|
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||||
|
|
||||||
|
#
|
||||||
|
# Setup Proxy ARP
|
||||||
|
#
|
||||||
|
setup_proxy_arp() {
|
||||||
|
|
||||||
|
local setlist= resetlist=
|
||||||
|
|
||||||
|
print_error() {
|
||||||
|
error_message "Invalid value for HAVEROUTE - ($haveroute)"
|
||||||
|
error_message "Entry \"$address $interface $external $haveroute\" ignored"
|
||||||
|
}
|
||||||
|
|
||||||
|
print_error1() {
|
||||||
|
error_message "Invalid value for PERSISTENT - ($persistent)"
|
||||||
|
error_message "Entry \"$address $interface $external $haveroute $persistent\" ignored"
|
||||||
|
}
|
||||||
|
|
||||||
|
print_warning() {
|
||||||
|
error_message "PERSISTENT setting ignored - ($persistent)"
|
||||||
|
error_message "Entry \"$address $interface $external $haveroute $persistent\""
|
||||||
|
}
|
||||||
|
|
||||||
|
setup_one_proxy_arp() {
|
||||||
|
|
||||||
|
case $haveroute in
|
||||||
|
[Nn][Oo])
|
||||||
|
haveroute=
|
||||||
|
;;
|
||||||
|
[Yy][Ee][Ss])
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
if [ -n "$haveroute" ]; then
|
||||||
|
print_error
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
case $persistent in
|
||||||
|
[Nn][Oo])
|
||||||
|
persistent=
|
||||||
|
;;
|
||||||
|
[Yy][Ee][Ss])
|
||||||
|
[ -z "$haveroute" ] || print_warning
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
if [ -n "$persistent" ]; then
|
||||||
|
print_error1
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
if [ -z "$haveroute" ]; then
|
||||||
|
save_command "[ -n \"\$NOROUTES\" ] || run_ip route replace $address dev $interface"
|
||||||
|
[ -n "$persistent" ] && haveroute=yes
|
||||||
|
fi
|
||||||
|
|
||||||
|
indent >&3 << __EOF__
|
||||||
|
if ! arp -i $external -Ds $address $external pub; then
|
||||||
|
fatal_error "Command \"arp -i $external -Ds $address $external pub\" failed"
|
||||||
|
fi
|
||||||
|
|
||||||
|
progress_message " Host $address connected to $interface added to ARP on $external"
|
||||||
|
|
||||||
|
__EOF__
|
||||||
|
echo $address $interface $external $haveroute >> $STATEDIR/proxyarp
|
||||||
|
|
||||||
|
progress_message " Host $address connected to $interface added to ARP on $external"
|
||||||
|
}
|
||||||
|
|
||||||
|
> $STATEDIR/proxyarp
|
||||||
|
|
||||||
|
save_progress_message "Setting up Proxy ARP..."
|
||||||
|
|
||||||
|
while read address interface external haveroute persistent; do
|
||||||
|
expandv address interface external haveroute persistent
|
||||||
|
list_search $interface $setlist || setlist="$setlist $interface"
|
||||||
|
list_search $external $resetlist || list_search $external $setlist || resetlist="$resetlist $external"
|
||||||
|
setup_one_proxy_arp
|
||||||
|
done < $TMP_DIR/proxyarp
|
||||||
|
|
||||||
|
for interface in $resetlist; do
|
||||||
|
list_search $interface $setlist || \
|
||||||
|
save_command "echo 0 > /proc/sys/net/ipv4/conf/$interface/proxy_arp"
|
||||||
|
done
|
||||||
|
|
||||||
|
for interface in $setlist; do
|
||||||
|
save_command "echo 1 > /proc/sys/net/ipv4/conf/$interface/proxy_arp"
|
||||||
|
done
|
||||||
|
|
||||||
|
interfaces=$(find_interfaces_by_option proxyarp)
|
||||||
|
|
||||||
|
for interface in $interfaces; do
|
||||||
|
indent >&3 << __EOF__
|
||||||
|
if [ -f /proc/sys/net/ipv4/conf/$interface/proxy_arp ] ; then
|
||||||
|
echo 1 > /proc/sys/net/ipv4/conf/$interface/proxy_arp
|
||||||
|
else
|
||||||
|
error_message "WARNING: Unable to enable proxy ARP on $interface"
|
||||||
|
fi
|
||||||
|
|
||||||
|
__EOF__
|
||||||
|
done
|
||||||
|
|
||||||
|
}
|
||||||
Loading…
x
Reference in New Issue
Block a user