extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2025-06-22 02:31:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

Correct Broadcast Actions

Browse Source 
- Delete --dst-type BROADCAST from IPv6
- Suppress superfluous multicast rule

Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-11-12 08:41:58 -08:00
parent 3b5c1ad601
commit ea21d61f39
2 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Shorewall/action.Broadcast
View File

@ -64,10 +64,10 @@ if ( have_capability( 'ADDRTYPE' ) ) {
add_jump $chainref, $target, 0, "-d \$address "; add_jump $chainref, $target, 0, "-d \$address ";
decr_cmd_level $chainref; decr_cmd_level $chainref;
add_commands $chainref, 'done'; add_commands $chainref, 'done';
}
log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d 224.0.0.0/4 ' if $level ne ''; log_rule_limit $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', ' -d 224.0.0.0/4 ' if $level ne '';
add_jump $chainref, $target, 0, '-d 224.0.0.0/4 '; add_jump $chainref, $target, 0, '-d 224.0.0.0/4 ';
}
1; 1;

9
Shorewall6/action.Broadcast
View File

@ -1,5 +1,5 @@
# #
# Shorewall 4 - Broadcast Action # Shorewall 4 - Multicast/Anycast Action
# #
# /usr/share/shorewall/action.Broadcast # /usr/share/shorewall/action.Broadcast
# #
@ -46,7 +46,6 @@ fatal_error "Invalid parameter to action Broadcast" if supplied $audit && $aud
if ( have_capability( 'ADDRTYPE' ) ) { if ( have_capability( 'ADDRTYPE' ) ) {
if ( $level ne '' ) { if ( $level ne '' ) {
log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type BROADCAST ';
log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST '; log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type MULTICAST ';
log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST '; log_rule_limit $level, $chainref, 'dropBcast' , $action, '', $tag, 'add', ' -m addrtype --dst-type ANYCAST ';
} }
@ -61,10 +60,10 @@ if ( have_capability( 'ADDRTYPE' ) ) {
add_jump $chainref, $target, 0, "-d \$address "; add_jump $chainref, $target, 0, "-d \$address ";
decr_cmd_level $chainref; decr_cmd_level $chainref;
add_commands $chainref, 'done'; add_commands $chainref, 'done';
}
log_rule_limit( $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', join( ' ', '-d', IPv6_MULTICAST . ' ' ) ) if $level ne ''; log_rule_limit( $level, $chainref, 'Broadcast' , $action, '', $tag, 'add', join( ' ', '-d', IPv6_MULTICAST . ' ' ) ) if $level ne '';
add_jump $chainref, $target, 0, join( ' ', '-d', IPv6_MULTICAST . ' ' ); add_jump $chainref, $target, 0, join( ' ', '-d', IPv6_MULTICAST . ' ' );
}
1; 1;