extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-23 14:48:51 +01:00
Code Issues Packages Projects Releases Wiki Activity

Implement support for logging in the SNAT file

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2017-11-02 12:43:49 -07:00
parent 2b5613026a
commit ef8b85fc3e
No known key found for this signature in database
GPG Key ID: 96E6B3F2423A4D10
2 changed files with 151 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -1751,6 +1751,14 @@ sub process_action(\$\$$) {
fatal_error "Action $action may not be used in the mangle file" if $chainref->{table} eq 'mangle';
}
if ( $type & NAT_TABLE ) {
fatal_error "Action $action may only be used in the snat file" unless $chainref->{table} eq 'nat';
} else {
fatal_error "Action $action may not be used in the snat file" if $chainref->{table} eq 'nat';
}
$param = $1 if $param =~ /^.*\|(.*)$/; #Strip interface name off of the parameters
my $actionfile = $actionref->{file};
progress_message2 "$doing $actionfile for chain $chainref->{name}...";
@ -1939,7 +1947,7 @@ sub process_action(\$\$$) {
for my $proto (split_list( $protos, 'Protocol' ) ) {
process_snat1( $chainref,
$action,
$nolog ? $action : merge_levels( join(':', @actparams{'chain','loglevel','logtag'}), $action ),
$source,
$dest,
$proto,
@ -5253,18 +5261,23 @@ sub process_mangle_rule( $ ) {
}
}
sub process_snat_inline( $$$$$$$$$$$$$ ) {
my ($inline, $chainref, $params, $source, $dest, $protos, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) = @_;
sub process_snat_inline( $$$$$$$$$$$$$$ ) {
my ($inline, $chainref, $params, $loglevel, $source, $dest, $protos, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) = @_;
my ( $level,
$tag ) = split( ':', $loglevel, 2 );
my $oldparms = push_action_params( $inline,
$chainref,
$params,
'none',
'' ,
supplied $level ? $level : 'none',
defined $tag ? $tag : '' ,
$chainref->{name} );
my $inlinefile = $actions{$inline}{file};
my $matches = fetch_inline_matches;
my $actionref = $actions{$inline};
my $inlinefile = $actionref->{file};
my $options = $actionref->{options};
my $nolog = $options & NOLOG_OPT;
my $matches = fetch_inline_matches;
progress_message "..Expanding inline action $inlinefile...";
@ -5298,6 +5311,8 @@ sub process_snat_inline( $$$$$$$$$$$$$ ) {
next;
}
$maction = merge_levels( join(':', @actparams{'chain','loglevel','logtag'}), $maction ) unless $nolog;
$msource = $source if $msource eq '-';
if ( $mdest eq '-' ) {
@ -5342,7 +5357,7 @@ sub process_snat_inline( $$$$$$$$$$$$$ ) {
# Process a record in the snat file
#
sub process_snat1( $$$$$$$$$$$$ ) {
my ( $chainref, $action, $source, $dest, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) = @_;
my ( $chainref, $origaction, $source, $dest, $proto, $ports, $ipsec, $mark, $user, $condition, $origdest, $probability ) = @_;
my $inchain;
my $inaction;
@ -5359,6 +5374,9 @@ sub process_snat1( $$$$$$$$$$$$ ) {
my $actiontype;
my $interfaces;
my $normalized_action;
my ( $action, $loglevel ) = split_action( $origaction );
my $logaction;
my $param;
if ( $action =~ /^MASQUERADE(\+)?(?:\((.+)\))?$/ ) {
$target = 'MASQUERADE';
@ -5367,6 +5385,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
$addresses = ( $2 || '' );
$options = 'random' if $addresses =~ s/:?random$//;
$add_snat_aliases = '';
$logaction = 'MASQ';
} elsif ( $action =~ /^SNAT(\+)?\((.+)\)$/ ) {
$pre_nat = $1;
$addresses = $2;
@ -5375,13 +5394,16 @@ sub process_snat1( $$$$$$$$$$$$ ) {
$options .= ':persistent' if $addresses =~ s/:persistent//;
$options .= ':random' if $addresses =~ s/:random//;
$options =~ s/^://;
$logaction = 'SNAT';
} elsif ( $action =~ /^CONTINUE(\+)?$/ ) {
$add_snat_aliases = 0;
$actiontype = $builtin_target{$target = 'RETURN'};
$pre_nat = $1;
$logaction = 'RETURN';
} elsif ( $action eq 'MASQUERADE' ) {
$actiontype = $builtin_target{$target = 'MASQUERADE'};
$add_snat_aliases = '';
$logaction = 'MASQ';
} else {
( $target , $params ) = get_target_param1( $action );
@ -5389,11 +5411,24 @@ sub process_snat1( $$$$$$$$$$$$ ) {
$actiontype = ( $targets{$target} || 0 );
fatal_error "Invalid ACTION ($action)" unless $actiontype & ( ACTION | INLINE );
if ( $actiontype & LOGRULE ) {
$logaction = 'LOG';
if ( $target eq 'LOG' ) {
fatal_error 'LOG requires a log level' unless supplied $loglevel;
} else {
$target = "$target($params)";
validate_level( $action );
$loglevel = supplied $loglevel ? join( ':', $target, $loglevel ) : $target;
$target = 'LOG';
}
} else {
fatal_error "Invalid ACTION ($action)" unless $actiontype & ( ACTION | INLINE );
$logaction = '';
}
}
if ( $inchain = defined $chainref ) {
( $inaction, undef, $interfaces, undef, undef ) = split /:/, $normalized_action = $chainref->{action}, 5 if $chainref->{action};
( $inaction, undef,undef,undef,$param ) = split( /:/, $normalized_action = $chainref->{action}) if $chainref->{action};
fatal_error q('+' is not allowed within an action body) if $pre_nat;
}
#
@ -5401,6 +5436,8 @@ sub process_snat1( $$$$$$$$$$$$ ) {
#
if ( $inaction ) {
$destnets = $dest;
assert( $param =~ /^(.*)|/ );
$interfaces=$1;
} elsif ( $family == F_IPV4 ) {
if ( $dest =~ /^([^:]+)::([^:]*)$/ ) {
$add_snat_aliases = 0;
@ -5642,6 +5679,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
process_snat_inline( $target,
$chainref,
$params,
$loglevel,
$source,
supplied $destnets && $destnets ne '-' ? $inaction ? $destnets : join( ':', $interface, $destnets ) : $inaction ? '-' : $interface,
$proto,
@ -5659,7 +5697,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
# Create the action:level:tag:param tuple. Since we don't allow logging out of nat POSTROUTING, we store
# the interface name in the log tag
#
my $normalized_target = normalize_action( $target, "none:$interface", $params );
my $normalized_target = normalize_action( $target, "$loglevel", "$interface|$params" );
fatal_error( "Action $target invoked Recursively (" . join( '->', map( external_name( $_ ), @actionstack , $normalized_target ) ) . ')' ) if $active{$target};
my $ref = use_action( 'nat', $normalized_target );
@ -5669,9 +5707,6 @@ sub process_snat1( $$$$$$$$$$$$ ) {
# First reference to this tuple - process_action may modify both $normalized_target and $ref!!!
#
process_action( $normalized_target, $ref, $chainref->{name} );
#
# Capture the name of the action chain
#
} else {
#
# We've seen this tuple before
@ -5680,6 +5715,12 @@ sub process_snat1( $$$$$$$$$$$$ ) {
}
$target = $ref->{name};
if ( $actions{$target}{options} & LOGJUMP_OPT ) {
$logaction = $target;
} else {
$loglevel = '';
}
} else {
for my $option ( split_list2( $options , 'option' ) ) {
if ( $option eq 'random' ) {
@ -5708,8 +5749,8 @@ sub process_snat1( $$$$$$$$$$$$ ) {
$destnets ,
$origdest ,
$target ,
'' ,
'' ,
$loglevel ,
$logaction ,
$exceptionrule ,
'' )
unless unreachable_warning( 0, $chainref );

113
Shorewall/manpages/shorewall-snat.xml
View File

@ -52,12 +52,52 @@
<term><emphasis role="bold">ACTION</emphasis></term>
<listitem>
<para>Defines the type of rule to generate. Choices are:</para>
<para>Defines the type of rule to generate. Beginning with Shorewall
5.1.9, with the exception of NFLOG and ULOG, the action may be
followed by a colon (":") and a <replaceable>log level</replaceable>
(see <ulink
url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>).</para>
<para>Choices for ACTION are:</para>
<variablelist>
<varlistentry>
<term><emphasis
role="bold">MASQUERADE[+]</emphasis>[([<replaceable>lowport</replaceable>-<replaceable>highport</replaceable>][<option>random</option>])]</term>
role="bold"><replaceable>action</replaceable></emphasis>[+][(<replaceable>parameter</replaceable>,...)][:<replaceable>level</replaceable>]</term>
<listitem>
<para>where <replaceable>action</replaceable> is an action
declared in <ulink
url="/manpages/shorewall-actions.html">shorewall-actions(5)</ulink>
with the <option>nat</option> option. See <ulink
url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
further information.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">CONTINUE</emphasis>[+]:<replaceable>level</replaceable></term>
<listitem>
<para>Causes matching packets to be exempted from any
following rules in the file.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">LOG:<replaceable>level</replaceable></emphasis></term>
<listitem>
<para>Added in Shorewall 5.1.9. Simply log the packet and
continue with the next rule.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">MASQUERADE[+]</emphasis>[([<replaceable>lowport</replaceable>-<replaceable>highport</replaceable>][<option>random</option>])][:<replaceable>level</replaceable>]</term>
<listitem>
<para>Causes matching outgoing packages to have their source
@ -73,12 +113,52 @@
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">NFLOG</emphasis>[(<replaceable>nflog-parameters</replaceable>)]</term>
<listitem>
<para>Added in Shorewall 5.1.9. Queues matching packets to a
back end logging daemon via a netlink socket then continues to
the next rule. See <ulink
url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
<para>The <replaceable>nflog-parameters</replaceable> are a
comma-separated list of up to 3 numbers:</para>
<itemizedlist>
<listitem>
<para>The first number specifies the netlink group
(0-65535). If omitted (e.g., NFLOG(,0,10)) then a value of
0 is assumed.</para>
</listitem>
<listitem>
<para>The second number specifies the maximum number of
bytes to copy. If omitted, 0 (no limit) is assumed.</para>
</listitem>
<listitem>
<para>The third number specifies the number of log
messages that should be buffered in the kernel before they
are sent to user space. The default is 1.</para>
</listitem>
</itemizedlist>
<para>NFLOG is similar to<emphasis role="bold">
LOG:NFLOG</emphasis>[(<replaceable>nflog-parameters</replaceable>)],
except that the log level is not changed when this ACTION is
used in an action or macro body and the invocation of that
action or macro specifies a log level.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold">SNAT[+]</emphasis>([<emphasis>address-or-address-range</emphasis>][:<emphasis>lowport</emphasis><emphasis
role="bold">-</emphasis><emphasis>highport</emphasis>][<emphasis
role="bold">:random</emphasis>][:<option>persistent</option>]|<emphasis
role="bold">detect</emphasis>)</term>
role="bold">detect</emphasis>)[:<replaceable>level</replaceable>]</term>
<listitem>
<para>If you specify an address here, matching packets will
@ -132,26 +212,21 @@
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">CONTINUE</emphasis>[+]</term>
<listitem>
<para>Causes matching packets to be exempted from any
following rules in the file.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis
role="bold"><replaceable>action</replaceable></emphasis>[+][(<replaceable>parameter</replaceable>,...)]</term>
role="bold">ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)]</term>
<listitem>
<para>where <replaceable>action</replaceable> is an action
declared in <ulink
url="/manpages/shorewall-actions.html">shorewall-actions(5)</ulink>
with the <option>nat</option> option. See <ulink
url="/Actions.html">www.shorewall.net/Actions.html</ulink> for
further information.</para>
<para>IPv4 only. Added in Shorewall 5.1.9. Queues matching
packets to a back end logging daemon via a netlink socket then
continues to the next rule. See <ulink
url="/shorewall_logging.html">http://www.shorewall.net/shorewall_logging.html</ulink>.</para>
<para>Similar to<emphasis role="bold">
LOG:ULOG</emphasis>[(<replaceable>ulog-parameters</replaceable>)],
except that the log level is not changed when this ACTION is
used in an action or macro body and the invocation of that
action or macro specifies a log level.</para>
</listitem>
</varlistentry>
</variablelist>