extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-25 17:13:11 +01:00
Code Issues Packages Projects Releases Wiki Activity

Implement 'show policies' command

Browse Source
This commit is contained in:
Tom Eastep 2009-11-15 09:24:56 -08:00
parent 20ef4e584b
commit f5a019becc
9 changed files with 78 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Shorewall/Perl/Shorewall/Compiler.pm
View File

@ -459,6 +459,10 @@ sub generate_script_3($) {
dump_zone_contents;
emit_unindented '__EOF__';
emit 'cat > ${VARDIR}/policies << __EOF__';
save_policies;
emit_unindented '__EOF__';
pop_indent;
emit "fi\n";

17
Shorewall/Perl/Shorewall/Policy.pm
View File

@ -32,7 +32,7 @@ use Shorewall::Actions;
use strict;
our @ISA = qw(Exporter);
our @EXPORT = qw( validate_policy apply_policy_rules complete_standard_chain setup_syn_flood_chains );
our @EXPORT = qw( validate_policy apply_policy_rules complete_standard_chain setup_syn_flood_chains save_policies );
our @EXPORT_OK = qw( );
our $VERSION = '4.4_1';
@ -273,6 +273,21 @@ sub process_a_policy() {
}
}
sub save_policies() {
for my $zone1 ( all_zones ) {
for my $zone2 ( all_zones ) {
my $chainref = $filter_table->{ rules_chain( $zone1, $zone2 ) };
my $policyref = $filter_table->{ $chainref->{policychain} };
if ( $policyref->{referenced} ) {
emit_unindented "$zone1 \t=> $zone2 is " . $policyref->{policy} . ' using chain ' . $policyref->{name};
} else {
emit_unindented "$zone1 \t=> $zone2 is " . $policyref->{policy};
}
}
}
}
sub validate_policy()
{
our %validpolicies = (

2
Shorewall/changelog.txt
View File

@ -14,6 +14,8 @@ Changes in Shorewall 4.4.4
7) Suppress duplicate COMMENT warnings.
8) Implement 'show policies' command.
Changes in Shorewall 4.4.3
1) Move Debian INITLOG initialization to /etc/default/shorewall

6
Shorewall/lib.cli
View File

@ -560,6 +560,12 @@ show_command() {
vardir)
echo $VARDIR;
;;
policies)
[ $# -gt 1 ] && usage 1
echo "$PRODUCT $version Policies at $HOSTNAME - $(date)"
echo
[ -f ${VARDIR}/policies ] && cat ${VARDIR}/policies;
;;
*)
if [ "$PRODUCT" = Shorewall ]; then
case $1 in

12
Shorewall/releasenotes.txt
View File

@ -275,6 +275,18 @@ None.
COMMENTs ignored -- require comment support in iptables/Netfilter
6) The shorewall and shorewall6 utilities now support a 'show
policies' command. Once Shorewall or Shorewall6 has been restarted
using a script generated by this version, the 'show policies'
command will list each pair of zones and give the applicable
policy. If the policy is enforced in a chain, the name of the chain
is given.
Example:
net => loc is DROP using chain net2loc
----------------------------------------------------------------------------
N E W F E A T U R E S I N 4 . 4 . 0
----------------------------------------------------------------------------

1
Shorewall/shorewall
View File

@ -1387,6 +1387,7 @@ usage() # $1 = exit status
echo " show [ -m ] log"
echo " show macros"
echo " show [ -x ] mangle|nat|raw|routing"
echo " show policies"
echo " show tc"
echo " show vardir"
echo " show zones"

2
Shorewall6/shorewall6
View File

@ -1289,7 +1289,7 @@ usage() # $1 = exit status
echo " restart [ -n ] [ -f ] [ <directory> ]"
echo " restore [ -n ] [ <file name> ]"
echo " save [ <file name> ]"
echo " show [ -x ] [ -m ] [-f] [ -t {filter|mangle} ] [ {chain [<chain> [ <chain> ... ]|actions|capabilities|classifiers|config|connections|filters|ip|log|macros|mangle|nat|raw|routing|tc|vardir|zones} ]"
echo " show [ -x ] [ -m ] [-f] [ -t {filter|mangle} ] [ {chain [<chain> [ <chain> ... ]|actions|capabilities|classifiers|config|connections|filters|ip|log|macros|mangle|nat|policies|raw|routing|tc|vardir|zones} ]"
echo " start [ -f ] [ -n ] [ <directory> ]"
echo " stop [ -f ]"
echo " status"

21
manpages/shorewall.xml
View File

@ -498,6 +498,18 @@
<arg choice="req"><option>mangle|nat|raw</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg choice="plain"><option>policies</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall</command>
@ -1272,6 +1284,15 @@
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">policies</emphasis></term>
<listitem>
<para>Added in Shorewall 4.4.4. Displays the applicable policy
between each pair of zones.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><emphasis role="bold">raw</emphasis></term>

22
manpages6/shorewall6.xml
View File

@ -401,6 +401,18 @@
choice="req"><option>actions|classifiers|connections|config|filters|macros|zones</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6</command>
<arg choice="opt"><option>trace</option>|<option>debug</option></arg>
<arg>-<replaceable>options</replaceable></arg>
<arg choice="plain"><option>show</option></arg>
<arg choice="plain"><option>policies</option></arg>
</cmdsynopsis>
<cmdsynopsis>
<command>shorewall6</command>
@ -1081,15 +1093,11 @@
</varlistentry>
<varlistentry>
<term><emphasis role="bold">nat</emphasis></term>
<term><emphasis role="bold">policies</emphasis></term>
<listitem>
<para>Displays the Netfilter nat table using the command
<emphasis role="bold">ip6tables -t nat -L -n -v</emphasis>.The
<emphasis role="bold">-x</emphasis> option is passed directly
through to ip6tables and causes actual packet and byte counts
to be displayed. Without this option, those counts are
abbreviated.</para>
<para>Added in Shorewall 4.4.4. Displays the applicable policy
between each pair of zones.</para>
</listitem>
</varlistentry>