From e9467326f3c97f9c846d4495a8a350fc831ea343 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Tue, 5 Apr 2016 11:20:44 -0700 Subject: [PATCH] Allow allow REJECT to take a parameter Signed-off-by: Tom Eastep --- Shorewall/Perl/Shorewall/Chains.pm | 2 +- Shorewall/Perl/Shorewall/Rules.pm | 40 ++++++++++++++++++++++-- Shorewall/manpages/shorewall-rules.xml | 30 ++++++++++++++++-- Shorewall6/manpages/shorewall6-rules.xml | 30 ++++++++++++++++-- 4 files changed, 95 insertions(+), 7 deletions(-) diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm index c8d3d1662..b0c2c58a7 100644 --- a/Shorewall/Perl/Shorewall/Chains.pm +++ b/Shorewall/Perl/Shorewall/Chains.pm @@ -619,7 +619,7 @@ our %builtin_target = ( ACCEPT => STANDARD + FILTER_TABLE + NAT_TABLE + MAN RAWDNAT => STANDARD + RAW_TABLE, RAWSNAT => STANDARD + RAW_TABLE, REDIRECT => STANDARD + NAT_TABLE, - REJECT => STANDARD + FILTER_TABLE, + REJECT => STANDARD + FILTER_TABLE + OPTIONS, RETURN => STANDARD + MANGLE_TABLE + RAW_TABLE, SAME => STANDARD, SECMARK => STANDARD + MANGLE_TABLE, diff --git a/Shorewall/Perl/Shorewall/Rules.pm b/Shorewall/Perl/Shorewall/Rules.pm index 64fa409b5..1fc0a741d 100644 --- a/Shorewall/Perl/Shorewall/Rules.pm +++ b/Shorewall/Perl/Shorewall/Rules.pm @@ -243,6 +243,8 @@ our %options = ( inline => INLINE_OPT , terminating => TERMINATING_OPT , audit => AUDIT_OPT , ); + +our %reject_options; ################################################################################ # Declarations moved from the Tc module in 5.0.7 # ################################################################################ @@ -353,8 +355,27 @@ sub initialize( $ ) { if ( $family == F_IPV4 ) { @builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn allowinUPnP forwardUPnP Limit/; + %reject_options = ( 'icmp-net-unreachable' => 1, + 'icmp-host-unreachable' => 1, + 'icmp-port-unreachable' => 1, + 'icmp-proto-unreachable' => 1, + 'icmp-net-prohibited' => 1, + 'icmp-host-prohibited' => 1, + 'icmp-admin-prohibited' => 1, + 'icmp-tcp-reset' => 2, + ); + } else { @builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn/; + %reject_options = ( 'icmp6-no-route' => 1, + 'no-route' => 1, + 'icmp6-adm-prohibited' => 1, + 'adm-prohibited' => 1, + 'icmp6-addr-unreachable' => 1, + 'addr-unreach' => 1, + 'icmp6-port-unreachable' => 1, + 'tcp-reset' => 2, + ); } ############################################################################ @@ -2654,7 +2675,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) { $loglevel = supplied $loglevel ? join( ':', $action, $loglevel ) : $action; $action = 'LOG'; } elsif ( ! ( $actiontype & (ACTION | INLINE | IPTABLES | TARPIT ) ) ) { - fatal_error "'builtin' actions may only be used in INLINE rules" if $actiontype == USERBUILTIN; + fatal_error "'builtin' actions may only be used in INLINE or IP[6]TABLES rules" if $actiontype == USERBUILTIN; fatal_error "The $basictarget TARGET does not accept a parameter" unless $param eq '' || $actiontype & OPTIONS; } } @@ -2728,7 +2749,22 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) { } } , - REJECT => sub { $action = 'reject'; } , + REJECT => sub { + if ( supplied( $param ) ) { + my $option = $reject_options{$param}; + fatal_error "Invalid REJECT option ($param)" unless $option; + if ( $option == 2 ) { + # + # tcp-reset + # + fatal_error "tcp-reset may only be used with PROTO tcp" unless ( resolve_proto( $proto ) || 0 ) == TCP; + } + + $action = "REJECT --reject-with $param"; + } else { + $action = 'reject'; + } + }, CONTINUE => sub { $action = 'RETURN'; } , diff --git a/Shorewall/manpages/shorewall-rules.xml b/Shorewall/manpages/shorewall-rules.xml index 484791644..538464684 100644 --- a/Shorewall/manpages/shorewall-rules.xml +++ b/Shorewall/manpages/shorewall-rules.xml @@ -672,11 +672,37 @@ - REJECT + REJECT[(option)] disallow the request and return an icmp-unreachable or - an RST packet. + an RST packet. If no option is passed, Shorewall selects the + appropriate option based on the protocol of the packet. + + Beginning with Shorewall 5.0.8, the type of reject may + be specified in the option + paramater. Valid option values + are: + + + + + + + + + + + + + + + + + (the PROTO column + must specify TCP) + diff --git a/Shorewall6/manpages/shorewall6-rules.xml b/Shorewall6/manpages/shorewall6-rules.xml index 2e00fd145..bf99fd523 100644 --- a/Shorewall6/manpages/shorewall6-rules.xml +++ b/Shorewall6/manpages/shorewall6-rules.xml @@ -673,11 +673,37 @@ - REJECT + REJECT[(option)] disallow the request and return an icmp-unreachable or - an RST packet. + an RST packet. If no option is passed, Shorewall selects the + appropriate option based on the protocol of the packet. + + Beginning with Shorewall 5.0.8, the type of reject may + be specified in the option + paramater. Valid option values + are: + + + + + + + + + + + + + + + + + (the PROTO column must + specify TCP) +