mirror of
https://gitlab.com/shorewall/code.git
synced 2025-06-20 09:47:51 +02:00
Break up generate_matrix()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
49050e61de
commit
fe7d0730d5
@ -1443,6 +1443,396 @@ sub add_interface_jumps {
|
|||||||
handle_loopback_traffic;
|
handle_loopback_traffic;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Do the initial matrix processing for a complex zone
|
||||||
|
#
|
||||||
|
sub handle_complex_zone( $$ ) {
|
||||||
|
my ( $zone, $zoneref ) = @_;
|
||||||
|
|
||||||
|
our %input_jump_added;
|
||||||
|
our %output_jump_added;
|
||||||
|
our %forward_jump_added;
|
||||||
|
our %ipsec_jump_added;
|
||||||
|
#
|
||||||
|
# Complex zone or we have more than two off-firewall zones -- Shorewall::Rules::classic_blacklist created a zone forwarding chain
|
||||||
|
#
|
||||||
|
my $frwd_ref = $filter_table->{zone_forward_chain( $zone )};
|
||||||
|
|
||||||
|
assert( $frwd_ref, $zone );
|
||||||
|
#
|
||||||
|
# Add Zone mark if any
|
||||||
|
#
|
||||||
|
add_ijump( $frwd_ref , j => 'MARK --set-mark ' . in_hex( $zoneref->{mark} ) . '/' . in_hex( $globals{ZONE_MASK} ) ) if $zoneref->{mark};
|
||||||
|
|
||||||
|
if ( have_ipsec ) {
|
||||||
|
#
|
||||||
|
# Prior to KLUDGEFREE, policy match could only match an 'in' or an 'out' policy (but not both), so we place the
|
||||||
|
# '--pol ipsec --dir in' rules at the front of the (interface) forwarding chains. Otherwise, decrypted packets
|
||||||
|
# can match '--pol none --dir out' rules and send the packets down the wrong rules chain.
|
||||||
|
#
|
||||||
|
my $type = $zoneref->{type};
|
||||||
|
my $source_ref = ( $zoneref->{hosts}{ipsec} ) || {};
|
||||||
|
|
||||||
|
for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$source_ref ) {
|
||||||
|
my $sourcechainref = $filter_table->{forward_chain $interface};
|
||||||
|
my @interfacematch;
|
||||||
|
my $interfaceref = find_interface $interface;
|
||||||
|
|
||||||
|
if ( use_forward_chain( $interface, $sourcechainref ) ) {
|
||||||
|
if ( $interfaceref->{ports} && $interfaceref->{options}{bridge} ) {
|
||||||
|
@interfacematch = imatch_source_dev $interface;
|
||||||
|
copy_rules( $sourcechainref, $frwd_ref, 1 ) unless $ipsec_jump_added{$zone}++;
|
||||||
|
$sourcechainref = $filter_table->{FORWARD};
|
||||||
|
} elsif ( $interfaceref->{options}{port} ) {
|
||||||
|
#
|
||||||
|
# The forwarding chain for a bridge with ports is always used
|
||||||
|
#
|
||||||
|
add_ijump( $filter_table->{ forward_chain $interfaceref->{bridge} } ,
|
||||||
|
j => $sourcechainref ,
|
||||||
|
imatch_source_dev( $interface , 1 ) )
|
||||||
|
unless $forward_jump_added{$interface}++;
|
||||||
|
} else {
|
||||||
|
add_ijump $filter_table->{FORWARD} , j => $sourcechainref, imatch_source_dev( $interface ) unless $forward_jump_added{$interface}++;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
if ( $interfaceref->{options}{port} ) {
|
||||||
|
#
|
||||||
|
# The forwarding chain for a bridge with ports is always used
|
||||||
|
#
|
||||||
|
$sourcechainref = $filter_table->{ forward_chain $interfaceref->{bridge} };
|
||||||
|
@interfacematch = imatch_source_dev $interface, 1;
|
||||||
|
} else {
|
||||||
|
$sourcechainref = $filter_table->{FORWARD};
|
||||||
|
@interfacematch = imatch_source_dev $interface;
|
||||||
|
}
|
||||||
|
|
||||||
|
move_rules( $filter_table->{forward_chain $interface} , $frwd_ref );
|
||||||
|
}
|
||||||
|
|
||||||
|
my $arrayref = $source_ref->{$interface};
|
||||||
|
|
||||||
|
for my $hostref ( @{$arrayref} ) {
|
||||||
|
my @ipsec_match = match_ipsec_in $zone , $hostref;
|
||||||
|
for my $net ( @{$hostref->{hosts}} ) {
|
||||||
|
add_ijump(
|
||||||
|
$sourcechainref,
|
||||||
|
@{$zoneref->{parents}} ? 'j' : 'g' => source_exclusion( $hostref->{exclusions}, $frwd_ref ),
|
||||||
|
@interfacematch ,
|
||||||
|
imatch_source_net( $net ),
|
||||||
|
@ipsec_match
|
||||||
|
);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# The passed zone is a sub-zone. We need to determine if
|
||||||
|
#
|
||||||
|
# a) A parent zone defines DNAT/REDIRECT or notrack rules; and
|
||||||
|
# b) The current zone has a CONTINUE policy to some other zone.
|
||||||
|
#
|
||||||
|
# If a) but not b), then we must avoid sending packets from this
|
||||||
|
# zone through the DNAT/REDIRECT or notrack chain for the parent.
|
||||||
|
#
|
||||||
|
sub handle_nested_zone( $$ ) {
|
||||||
|
my ( $zone, $zoneref ) = @_;
|
||||||
|
#
|
||||||
|
# Function returns this 3-tuple
|
||||||
|
#
|
||||||
|
my ( $nested, $parenthasnat, $parenthasnotrack ) = ( 1, 0, 0 );
|
||||||
|
|
||||||
|
for my $parent ( @{$zoneref->{parents}} ) {
|
||||||
|
my $ref1 = $nat_table->{dnat_chain $parent} || {};
|
||||||
|
my $ref2 = $raw_table->{notrack_chain $parent} || {};
|
||||||
|
$parenthasnat = 1 if $ref1->{referenced};
|
||||||
|
$parenthasnotrack = 1 if $ref2->{referenced};
|
||||||
|
last if $parenthasnat && $parenthasnotrack;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( $parenthasnat || $parenthasnotrack ) {
|
||||||
|
for my $zone1 ( all_zones ) {
|
||||||
|
if ( $filter_table->{rules_chain( ${zone}, ${zone1} )}->{policy} eq 'CONTINUE' ) {
|
||||||
|
#
|
||||||
|
# This zone has a continue policy to another zone. We must
|
||||||
|
# send packets from this zone through the parent's DNAT/REDIRECT/NOTRACK chain.
|
||||||
|
#
|
||||||
|
$nested = 0;
|
||||||
|
last;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
#
|
||||||
|
# No parent has DNAT or notrack so there is nothing to worry about. Don't bother to generate needless RETURN rules in the 'dnat' or 'notrack' chain.
|
||||||
|
#
|
||||||
|
$nested = 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
( $nested, $parenthasnat, $parenthasnotrack );
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Generate the PREROUTING, INPUT and OUTPUT jumps for the passed ($zone:$typeref:$interface)
|
||||||
|
#
|
||||||
|
sub handle_pio_jumps( $$$$$$$$ ) {
|
||||||
|
my ( $zone,
|
||||||
|
$zoneref,
|
||||||
|
$typeref,
|
||||||
|
$interface,
|
||||||
|
$nested,
|
||||||
|
$parenthasnat,
|
||||||
|
$parenthasnotrack,
|
||||||
|
$frwd_ref,
|
||||||
|
) = @_;
|
||||||
|
|
||||||
|
our @vservers;
|
||||||
|
our %input_jump_added;
|
||||||
|
our %output_jump_added;
|
||||||
|
our %forward_jump_added;
|
||||||
|
|
||||||
|
my $arrayref = $typeref->{$interface};
|
||||||
|
my $interfaceref = find_interface $interface;
|
||||||
|
my $isport = $interfaceref->{options}{port};
|
||||||
|
my $bridge = $interfaceref->{bridge};
|
||||||
|
my $notrackref = ensure_chain 'raw' , notrack_chain( $zone );
|
||||||
|
my $chain1 = rules_target firewall_zone , $zone;
|
||||||
|
my $chain2 = rules_target $zone, firewall_zone;
|
||||||
|
|
||||||
|
for my $hostref ( @$arrayref ) {
|
||||||
|
my @ipsec_in_match = match_ipsec_in $zone , $hostref;
|
||||||
|
my @ipsec_out_match = match_ipsec_out $zone , $hostref;
|
||||||
|
my $exclusions = $hostref->{exclusions};
|
||||||
|
|
||||||
|
for my $net ( @{$hostref->{hosts}} ) {
|
||||||
|
my @dest = imatch_dest_net $net;
|
||||||
|
#
|
||||||
|
# OUTPUT
|
||||||
|
#
|
||||||
|
if ( $chain1 && ! ( zone_type( $zone) & BPORT ) ) {
|
||||||
|
#
|
||||||
|
# Policy from the firewall to this zone is not 'CONTINUE' and this isn't a bport zone
|
||||||
|
#
|
||||||
|
my $chain1ref = $filter_table->{$chain1};
|
||||||
|
my $nextchain = dest_exclusion( $exclusions, $chain1 );
|
||||||
|
my $outputref;
|
||||||
|
my $interfacechainref = $filter_table->{output_chain $interface};
|
||||||
|
my @interfacematch;
|
||||||
|
my $use_output = 0;
|
||||||
|
|
||||||
|
if ( @vservers || use_output_chain( $interface, $interfacechainref ) || ( @{$interfacechainref->{rules}} && ! $chain1ref ) ) {
|
||||||
|
$outputref = $interfacechainref;
|
||||||
|
|
||||||
|
if ( $isport ) {
|
||||||
|
add_ijump( $filter_table->{ output_chain $bridge },
|
||||||
|
j => $outputref ,
|
||||||
|
imatch_dest_dev( $interface, 1 ) )
|
||||||
|
unless $output_jump_added{$interface}++;
|
||||||
|
} else {
|
||||||
|
add_ijump $filter_table->{OUTPUT}, j => $outputref, imatch_dest_dev( $interface ) unless $output_jump_added{$interface}++;
|
||||||
|
}
|
||||||
|
|
||||||
|
$use_output = 1;
|
||||||
|
|
||||||
|
unless ( lc $net eq IPv6_LINKLOCAL ) {
|
||||||
|
for my $vzone ( vserver_zones ) {
|
||||||
|
generate_source_rules ( $outputref, $vzone, $zone, @dest );
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} elsif ( $isport ) {
|
||||||
|
$outputref = $filter_table->{ output_chain $bridge };
|
||||||
|
@interfacematch = imatch_dest_dev $interface, 1;
|
||||||
|
} else {
|
||||||
|
$outputref = $filter_table->{OUTPUT};
|
||||||
|
@interfacematch = imatch_dest_dev $interface;
|
||||||
|
}
|
||||||
|
|
||||||
|
add_ijump $outputref , j => $nextchain, @interfacematch, @dest, @ipsec_out_match;
|
||||||
|
|
||||||
|
add_ijump( $outputref , j => $nextchain, @interfacematch, d => '255.255.255.255' , @ipsec_out_match )
|
||||||
|
if $family == F_IPV4 && $hostref->{options}{broadcast};
|
||||||
|
|
||||||
|
move_rules( $interfacechainref , $chain1ref ) unless $use_output;
|
||||||
|
}
|
||||||
|
|
||||||
|
clearrule;
|
||||||
|
|
||||||
|
unless( $hostref->{options}{destonly} ) {
|
||||||
|
#
|
||||||
|
# PREROUTING
|
||||||
|
#
|
||||||
|
my $dnatref = ensure_chain 'nat' , dnat_chain( $zone );
|
||||||
|
my $preroutingref = ensure_chain 'nat', 'dnat';
|
||||||
|
|
||||||
|
my @source = imatch_source_net $net;
|
||||||
|
|
||||||
|
if ( $dnatref->{referenced} ) {
|
||||||
|
#
|
||||||
|
# There are DNAT/REDIRECT rules with this zone as the source.
|
||||||
|
# Add a jump from this source network to this zone's DNAT/REDIRECT chain
|
||||||
|
#
|
||||||
|
add_ijump( $preroutingref,
|
||||||
|
j => source_exclusion( $exclusions, $dnatref),
|
||||||
|
imatch_source_dev( $interface),
|
||||||
|
@source,
|
||||||
|
@ipsec_in_match );
|
||||||
|
|
||||||
|
if ( get_physical( $interface ) eq '+' ) {
|
||||||
|
#
|
||||||
|
# The jump from the PREROUTING chain to dnat may not have been added above
|
||||||
|
#
|
||||||
|
addnatjump 'PREROUTING', 'dnat' unless $preroutingref->{references}{PREROUTING};
|
||||||
|
}
|
||||||
|
|
||||||
|
check_optimization( $dnatref ) if @source;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( $notrackref->{referenced} ) {
|
||||||
|
#
|
||||||
|
# There are notrack rules with this zone as the source.
|
||||||
|
# Add a jump from this source network to this zone's notrack chain
|
||||||
|
#
|
||||||
|
add_ijump $raw_table->{PREROUTING}, j => source_exclusion( $exclusions, $notrackref), imatch_source_dev( $interface), @source, @ipsec_in_match;
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# If this zone has parents with DNAT/REDIRECT or notrack rules and there are no CONTINUE polcies with this zone as the source
|
||||||
|
# then add a RETURN jump for this source network.
|
||||||
|
#
|
||||||
|
if ( $nested ) {
|
||||||
|
add_ijump $preroutingref, j => 'RETURN', imatch_source_dev( $interface), @source, @ipsec_in_match if $parenthasnat;
|
||||||
|
add_ijump $raw_table->{PREROUTING}, j => 'RETURN', imatch_source_dev( $interface), @source, @ipsec_in_match if $parenthasnotrack;
|
||||||
|
}
|
||||||
|
#
|
||||||
|
# INPUT
|
||||||
|
#
|
||||||
|
my $chain2ref = $filter_table->{$chain2};
|
||||||
|
my $inputchainref;
|
||||||
|
my $interfacechainref = $filter_table->{input_chain $interface};
|
||||||
|
my @interfacematch;
|
||||||
|
my $use_input;
|
||||||
|
|
||||||
|
if ( @vservers || use_input_chain( $interface, $interfacechainref ) || ! $chain2 || ( @{$interfacechainref->{rules}} && ! $chain2ref ) ) {
|
||||||
|
$inputchainref = $interfacechainref;
|
||||||
|
|
||||||
|
if ( $isport ) {
|
||||||
|
add_ijump( $filter_table->{ input_chain $bridge },
|
||||||
|
j => $inputchainref ,
|
||||||
|
imatch_source_dev($interface, 1) )
|
||||||
|
unless $input_jump_added{$interface}++;
|
||||||
|
} else {
|
||||||
|
add_ijump $filter_table->{INPUT}, j => $inputchainref, imatch_source_dev($interface) unless $input_jump_added{$interface}++;
|
||||||
|
}
|
||||||
|
|
||||||
|
$use_input = 1;
|
||||||
|
|
||||||
|
unless ( lc $net eq IPv6_LINKLOCAL ) {
|
||||||
|
for my $vzone ( @vservers ) {
|
||||||
|
my $target = rules_target( $zone, $vzone );
|
||||||
|
generate_dest_rules( $inputchainref, $target, $vzone, @source, @ipsec_in_match ) if $target;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} elsif ( $isport ) {
|
||||||
|
$inputchainref = $filter_table->{ input_chain $bridge };
|
||||||
|
@interfacematch = imatch_source_dev $interface, 1;
|
||||||
|
} else {
|
||||||
|
$inputchainref = $filter_table->{INPUT};
|
||||||
|
@interfacematch = imatch_source_dev $interface;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( $chain2 ) {
|
||||||
|
add_ijump $inputchainref, j => source_exclusion( $exclusions, $chain2 ), @interfacematch, @source, @ipsec_in_match;
|
||||||
|
move_rules( $interfacechainref , $chain2ref ) unless $use_input;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( $frwd_ref && $hostref->{ipsec} ne 'ipsec' ) {
|
||||||
|
my $ref = source_exclusion( $exclusions, $frwd_ref );
|
||||||
|
my $forwardref = $filter_table->{forward_chain $interface};
|
||||||
|
|
||||||
|
if ( use_forward_chain $interface, $forwardref ) {
|
||||||
|
add_ijump $forwardref , j => $ref, @source, @ipsec_in_match;
|
||||||
|
|
||||||
|
if ( $isport ) {
|
||||||
|
add_ijump( $filter_table->{ forward_chain $bridge } ,
|
||||||
|
j => $forwardref ,
|
||||||
|
imatch_source_dev( $interface , 1 ) )
|
||||||
|
unless $forward_jump_added{$interface}++;
|
||||||
|
} else {
|
||||||
|
add_ijump $filter_table->{FORWARD} , j => $forwardref, imatch_source_dev( $interface ) unless $forward_jump_added{$interface}++;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
if ( $isport ) {
|
||||||
|
add_ijump( $filter_table->{ forward_chain $bridge } ,
|
||||||
|
j => $ref ,
|
||||||
|
imatch_source_dev( $interface, 1 ) ,
|
||||||
|
@source,
|
||||||
|
@ipsec_in_match );
|
||||||
|
} else {
|
||||||
|
add_ijump $filter_table->{FORWARD} , j => $ref, imatch_source_dev( $interface ) , @source, @ipsec_in_match;
|
||||||
|
}
|
||||||
|
|
||||||
|
move_rules ( $forwardref , $frwd_ref );
|
||||||
|
}
|
||||||
|
} # Complex non-IPSEC host group
|
||||||
|
} # Not a destonly host group
|
||||||
|
} # Network Loop
|
||||||
|
} # Host Group Loop
|
||||||
|
}
|
||||||
|
|
||||||
|
#
|
||||||
|
# Generate the list of destination zones from the passed source zone when optimization level 1 is selected
|
||||||
|
#
|
||||||
|
sub optimize1_zones( $$@ ) {
|
||||||
|
my $zone = shift;
|
||||||
|
my $zoneref = shift;
|
||||||
|
my $last_chain = '';
|
||||||
|
my @dest_zones;
|
||||||
|
my @temp_zones;
|
||||||
|
|
||||||
|
for my $zone1 ( @_ ) {
|
||||||
|
my $zone1ref = find_zone( $zone1 );
|
||||||
|
my $policy = $filter_table->{rules_chain( ${zone}, ${zone1} )}->{policy};
|
||||||
|
|
||||||
|
next if $policy eq 'NONE';
|
||||||
|
|
||||||
|
my $chain = rules_target $zone, $zone1;
|
||||||
|
|
||||||
|
next unless $chain;
|
||||||
|
|
||||||
|
if ( $zone eq $zone1 ) {
|
||||||
|
next if ( scalar ( keys( %{ $zoneref->{interfaces}} ) ) < 2 ) && ! $zoneref->{options}{in_out}{routeback};
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( $zone1ref->{type} & BPORT ) {
|
||||||
|
next unless $zoneref->{bridge} eq $zone1ref->{bridge};
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( $chain =~ /(2all|-all)$/ ) {
|
||||||
|
if ( $chain ne $last_chain ) {
|
||||||
|
$last_chain = $chain;
|
||||||
|
push @dest_zones, @temp_zones;
|
||||||
|
@temp_zones = ( $zone1 );
|
||||||
|
} elsif ( $policy eq 'ACCEPT' ) {
|
||||||
|
push @temp_zones , $zone1;
|
||||||
|
} else {
|
||||||
|
$last_chain = $chain;
|
||||||
|
@temp_zones = ( $zone1 );
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
push @dest_zones, @temp_zones, $zone1;
|
||||||
|
@temp_zones = ();
|
||||||
|
$last_chain = '';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ( $last_chain && @temp_zones == 1 ) {
|
||||||
|
push @dest_zones, @temp_zones;
|
||||||
|
$last_chain = '';
|
||||||
|
}
|
||||||
|
|
||||||
|
( $last_chain, @dest_zones );
|
||||||
|
}
|
||||||
|
|
||||||
# Generate the rules matrix.
|
# Generate the rules matrix.
|
||||||
#
|
#
|
||||||
# Stealing a comment from the Burroughs B6700 MCP Operating System source, "generate_matrix makes a sow's ear out of a silk purse".
|
# Stealing a comment from the Burroughs B6700 MCP Operating System source, "generate_matrix makes a sow's ear out of a silk purse".
|
||||||
@ -1458,20 +1848,15 @@ sub generate_matrix() {
|
|||||||
#
|
#
|
||||||
# Should this be the real PREROUTING chain?
|
# Should this be the real PREROUTING chain?
|
||||||
#
|
#
|
||||||
my $preroutingref = ensure_chain 'nat', 'dnat';
|
my @zones = off_firewall_zones;
|
||||||
|
our @vservers = vserver_zones;
|
||||||
|
|
||||||
my $fw = firewall_zone;
|
|
||||||
my @zones = off_firewall_zones;
|
|
||||||
my @vservers = vserver_zones;
|
|
||||||
|
|
||||||
my $notrackref = $raw_table->{notrack_chain $fw};
|
|
||||||
my @state = $config{BLACKLISTNEWONLY} ? $globals{UNTRACKED} ? state_imatch 'NEW,INVALID,UNTRACKED' : state_imatch 'NEW,INVALID' : ();
|
|
||||||
my $interface_jumps_added = 0;
|
my $interface_jumps_added = 0;
|
||||||
|
|
||||||
our %input_jump_added = ();
|
our %input_jump_added = ();
|
||||||
our %output_jump_added = ();
|
our %output_jump_added = ();
|
||||||
our %forward_jump_added = ();
|
our %forward_jump_added = ();
|
||||||
my %ipsec_jump_added = ();
|
our %ipsec_jump_added = ();
|
||||||
|
|
||||||
progress_message2 'Generating Rule Matrix...';
|
progress_message2 'Generating Rule Matrix...';
|
||||||
progress_message ' Handling complex zones...';
|
progress_message ' Handling complex zones...';
|
||||||
@ -1481,86 +1866,14 @@ sub generate_matrix() {
|
|||||||
#
|
#
|
||||||
for my $zone ( @zones ) {
|
for my $zone ( @zones ) {
|
||||||
my $zoneref = find_zone( $zone );
|
my $zoneref = find_zone( $zone );
|
||||||
|
handle_complex_zone( $zone, $zoneref ) if @zones > 2 || $zoneref->{complex};
|
||||||
next if @zones <= 2 && ! $zoneref->{complex};
|
|
||||||
#
|
|
||||||
# Complex zone or we have more than two off-firewall zones -- Shorewall::Rules::classic_blacklist created a zone forwarding chain
|
|
||||||
#
|
|
||||||
my $frwd_ref = $filter_table->{zone_forward_chain( $zone )};
|
|
||||||
|
|
||||||
assert( $frwd_ref, $zone );
|
|
||||||
#
|
|
||||||
# Add Zone mark if any
|
|
||||||
#
|
|
||||||
add_ijump( $frwd_ref , j => 'MARK --set-mark ' . in_hex( $zoneref->{mark} ) . '/' . in_hex( $globals{ZONE_MASK} ) ) if $zoneref->{mark};
|
|
||||||
|
|
||||||
if ( have_ipsec ) {
|
|
||||||
#
|
|
||||||
# Prior to KLUDGEFREE, policy match could only match an 'in' or an 'out' policy (but not both), so we place the
|
|
||||||
# '--pol ipsec --dir in' rules at the front of the (interface) forwarding chains. Otherwise, decrypted packets
|
|
||||||
# can match '--pol none --dir out' rules and send the packets down the wrong rules chain.
|
|
||||||
#
|
|
||||||
my $type = $zoneref->{type};
|
|
||||||
my $source_ref = ( $zoneref->{hosts}{ipsec} ) || {};
|
|
||||||
|
|
||||||
for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$source_ref ) {
|
|
||||||
my $sourcechainref = $filter_table->{forward_chain $interface};
|
|
||||||
my @interfacematch;
|
|
||||||
my $interfaceref = find_interface $interface;
|
|
||||||
|
|
||||||
if ( use_forward_chain( $interface, $sourcechainref ) ) {
|
|
||||||
if ( $interfaceref->{ports} && $interfaceref->{options}{bridge} ) {
|
|
||||||
@interfacematch = imatch_source_dev $interface;
|
|
||||||
copy_rules( $sourcechainref, $frwd_ref, 1 ) unless $ipsec_jump_added{$zone}++;
|
|
||||||
$sourcechainref = $filter_table->{FORWARD};
|
|
||||||
} elsif ( $interfaceref->{options}{port} ) {
|
|
||||||
#
|
|
||||||
# The forwarding chain for a bridge with ports is always used
|
|
||||||
#
|
|
||||||
add_ijump( $filter_table->{ forward_chain $interfaceref->{bridge} } ,
|
|
||||||
j => $sourcechainref ,
|
|
||||||
imatch_source_dev( $interface , 1 ) )
|
|
||||||
unless $forward_jump_added{$interface}++;
|
|
||||||
} else {
|
|
||||||
add_ijump $filter_table->{FORWARD} , j => $sourcechainref, imatch_source_dev( $interface ) unless $forward_jump_added{$interface}++;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
if ( $interfaceref->{options}{port} ) {
|
|
||||||
#
|
|
||||||
# The forwarding chain for a bridge with ports is always used
|
|
||||||
#
|
|
||||||
$sourcechainref = $filter_table->{ forward_chain $interfaceref->{bridge} };
|
|
||||||
@interfacematch = imatch_source_dev $interface, 1;
|
|
||||||
} else {
|
|
||||||
$sourcechainref = $filter_table->{FORWARD};
|
|
||||||
@interfacematch = imatch_source_dev $interface;
|
|
||||||
}
|
|
||||||
|
|
||||||
move_rules( $filter_table->{forward_chain $interface} , $frwd_ref );
|
|
||||||
}
|
|
||||||
|
|
||||||
my $arrayref = $source_ref->{$interface};
|
|
||||||
|
|
||||||
for my $hostref ( @{$arrayref} ) {
|
|
||||||
my @ipsec_match = match_ipsec_in $zone , $hostref;
|
|
||||||
for my $net ( @{$hostref->{hosts}} ) {
|
|
||||||
add_ijump(
|
|
||||||
$sourcechainref,
|
|
||||||
@{$zoneref->{parents}} ? 'j' : 'g' => source_exclusion( $hostref->{exclusions}, $frwd_ref ),
|
|
||||||
@interfacematch ,
|
|
||||||
imatch_source_net( $net ),
|
|
||||||
@ipsec_match
|
|
||||||
);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
#
|
||||||
# NOTRACK from firewall
|
# NOTRACK from firewall
|
||||||
#
|
#
|
||||||
add_ijump $raw_table->{OUTPUT}, j => $notrackref if $notrackref->{referenced};
|
if ( ( my $notrackref = $raw_table->{notrack_chain(firewall_zone)}) ) {
|
||||||
|
add_ijump $raw_table->{OUTPUT}, j => $notrackref if $notrackref->{referenced};
|
||||||
|
}
|
||||||
#
|
#
|
||||||
# Main source-zone matrix-generation loop
|
# Main source-zone matrix-generation loop
|
||||||
#
|
#
|
||||||
@ -1569,63 +1882,17 @@ sub generate_matrix() {
|
|||||||
for my $zone ( @zones ) {
|
for my $zone ( @zones ) {
|
||||||
my $zoneref = find_zone( $zone );
|
my $zoneref = find_zone( $zone );
|
||||||
my $source_hosts_ref = $zoneref->{hosts};
|
my $source_hosts_ref = $zoneref->{hosts};
|
||||||
my $chain1 = rules_target firewall_zone , $zone;
|
|
||||||
my $chain2 = rules_target $zone, firewall_zone;
|
|
||||||
my $type = $zoneref->{type};
|
|
||||||
my $frwd_ref = $filter_table->{zone_forward_chain $zone};
|
my $frwd_ref = $filter_table->{zone_forward_chain $zone};
|
||||||
my $chain = 0;
|
|
||||||
my $dnatref = ensure_chain 'nat' , dnat_chain( $zone );
|
|
||||||
my $notrackref = ensure_chain 'raw' , notrack_chain( $zone );
|
|
||||||
my $nested = @{$zoneref->{parents}};
|
my $nested = @{$zoneref->{parents}};
|
||||||
my $parenthasnat = 0;
|
my $parenthasnat = 0;
|
||||||
my $parenthasnotrack = 0;
|
my $parenthasnotrack = 0;
|
||||||
|
|
||||||
if ( $nested ) {
|
( $nested, $parenthasnat, $parenthasnotrack) = handle_nested_zone( $zone, $zoneref ) if $nested;
|
||||||
#
|
|
||||||
# This is a sub-zone. We need to determine if
|
|
||||||
#
|
|
||||||
# a) A parent zone defines DNAT/REDIRECT or notrack rules; and
|
|
||||||
# b) The current zone has a CONTINUE policy to some other zone.
|
|
||||||
#
|
|
||||||
# If a) but not b), then we must avoid sending packets from this
|
|
||||||
# zone through the DNAT/REDIRECT or notrack chain for the parent.
|
|
||||||
#
|
|
||||||
for my $parent ( @{$zoneref->{parents}} ) {
|
|
||||||
my $ref1 = $nat_table->{dnat_chain $parent} || {};
|
|
||||||
my $ref2 = $raw_table->{notrack_chain $parent} || {};
|
|
||||||
$parenthasnat = 1 if $ref1->{referenced};
|
|
||||||
$parenthasnotrack = 1 if $ref2->{referenced};
|
|
||||||
last if $parenthasnat && $parenthasnotrack;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $parenthasnat || $parenthasnotrack ) {
|
|
||||||
for my $zone1 ( all_zones ) {
|
|
||||||
if ( $filter_table->{rules_chain( ${zone}, ${zone1} )}->{policy} eq 'CONTINUE' ) {
|
|
||||||
#
|
|
||||||
# This zone has a continue policy to another zone. We must
|
|
||||||
# send packets from this zone through the parent's DNAT/REDIRECT/NOTRACK chain.
|
|
||||||
#
|
|
||||||
$nested = 0;
|
|
||||||
last;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
#
|
|
||||||
# No parent has DNAT or notrack so there is nothing to worry about. Don't bother to generate needless RETURN rules in the 'dnat' or 'notrack' chain.
|
|
||||||
#
|
|
||||||
$nested = 0;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
#
|
#
|
||||||
# Take care of PREROUTING, INPUT and OUTPUT jumps
|
# Take care of PREROUTING, INPUT and OUTPUT jumps
|
||||||
#
|
#
|
||||||
for my $typeref ( values %$source_hosts_ref ) {
|
for my $typeref ( values %$source_hosts_ref ) {
|
||||||
for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
|
for my $interface ( sort { interface_number( $a ) <=> interface_number( $b ) } keys %$typeref ) {
|
||||||
my $arrayref = $typeref->{$interface};
|
|
||||||
my $interfaceref = find_interface $interface;
|
|
||||||
my $isport = $interfaceref->{options}{port};
|
|
||||||
my $bridge = $interfaceref->{bridge};
|
|
||||||
|
|
||||||
if ( get_physical( $interface ) eq '+' ) {
|
if ( get_physical( $interface ) eq '+' ) {
|
||||||
#
|
#
|
||||||
# Insert the interface-specific jumps before this one which is not interface-specific
|
# Insert the interface-specific jumps before this one which is not interface-specific
|
||||||
@ -1633,174 +1900,17 @@ sub generate_matrix() {
|
|||||||
add_interface_jumps(@interfaces) unless $interface_jumps_added++;
|
add_interface_jumps(@interfaces) unless $interface_jumps_added++;
|
||||||
}
|
}
|
||||||
|
|
||||||
for my $hostref ( @$arrayref ) {
|
handle_pio_jumps( $zone,
|
||||||
my @ipsec_in_match = match_ipsec_in $zone , $hostref;
|
$zoneref,
|
||||||
my @ipsec_out_match = match_ipsec_out $zone , $hostref;
|
$typeref,
|
||||||
my $exclusions = $hostref->{exclusions};
|
$interface,
|
||||||
|
$nested,
|
||||||
for my $net ( @{$hostref->{hosts}} ) {
|
$parenthasnat,
|
||||||
my @dest = imatch_dest_net $net;
|
$parenthasnotrack,
|
||||||
|
$frwd_ref,
|
||||||
if ( $chain1 && ! ( zone_type( $zone) & BPORT ) ) {
|
);
|
||||||
my $chain1ref = $filter_table->{$chain1};
|
|
||||||
my $nextchain = dest_exclusion( $exclusions, $chain1 );
|
|
||||||
my $outputref;
|
|
||||||
my $interfacechainref = $filter_table->{output_chain $interface};
|
|
||||||
my @interfacematch;
|
|
||||||
my $use_output = 0;
|
|
||||||
|
|
||||||
if ( @vservers || use_output_chain( $interface, $interfacechainref ) || ( @{$interfacechainref->{rules}} && ! $chain1ref ) ) {
|
|
||||||
$outputref = $interfacechainref;
|
|
||||||
|
|
||||||
if ( $isport ) {
|
|
||||||
add_ijump( $filter_table->{ output_chain $bridge },
|
|
||||||
j => $outputref ,
|
|
||||||
imatch_dest_dev( $interface, 1 ) )
|
|
||||||
unless $output_jump_added{$interface}++;
|
|
||||||
} else {
|
|
||||||
add_ijump $filter_table->{OUTPUT}, j => $outputref, imatch_dest_dev( $interface ) unless $output_jump_added{$interface}++;
|
|
||||||
}
|
|
||||||
|
|
||||||
$use_output = 1;
|
|
||||||
|
|
||||||
unless ( lc $net eq IPv6_LINKLOCAL ) {
|
|
||||||
for my $vzone ( vserver_zones ) {
|
|
||||||
generate_source_rules ( $outputref, $vzone, $zone, @dest );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} elsif ( $isport ) {
|
|
||||||
$outputref = $filter_table->{ output_chain $bridge };
|
|
||||||
@interfacematch = imatch_dest_dev $interface, 1;
|
|
||||||
} else {
|
|
||||||
$outputref = $filter_table->{OUTPUT};
|
|
||||||
@interfacematch = imatch_dest_dev $interface;
|
|
||||||
}
|
|
||||||
|
|
||||||
add_ijump $outputref , j => $nextchain, @interfacematch, @dest, @ipsec_out_match;
|
|
||||||
|
|
||||||
add_ijump( $outputref , j => $nextchain, @interfacematch, d => '255.255.255.255' , @ipsec_out_match )
|
|
||||||
if $family == F_IPV4 && $hostref->{options}{broadcast};
|
|
||||||
|
|
||||||
move_rules( $interfacechainref , $chain1ref ) unless $use_output;
|
|
||||||
}
|
|
||||||
|
|
||||||
clearrule;
|
|
||||||
|
|
||||||
next if $hostref->{options}{destonly};
|
|
||||||
|
|
||||||
my @source = imatch_source_net $net;
|
|
||||||
|
|
||||||
if ( $dnatref->{referenced} ) {
|
|
||||||
#
|
|
||||||
# There are DNAT/REDIRECT rules with this zone as the source.
|
|
||||||
# Add a jump from this source network to this zone's DNAT/REDIRECT chain
|
|
||||||
#
|
|
||||||
add_ijump( $preroutingref,
|
|
||||||
j => source_exclusion( $exclusions, $dnatref),
|
|
||||||
imatch_source_dev( $interface),
|
|
||||||
@source,
|
|
||||||
@ipsec_in_match );
|
|
||||||
|
|
||||||
if ( get_physical( $interface ) eq '+' ) {
|
|
||||||
#
|
|
||||||
# The jump from the PREROUTING chain to dnat may not have been added above
|
|
||||||
#
|
|
||||||
addnatjump 'PREROUTING', 'dnat' unless $preroutingref->{references}{PREROUTING};
|
|
||||||
}
|
|
||||||
|
|
||||||
check_optimization( $dnatref ) if @source;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $notrackref->{referenced} ) {
|
|
||||||
#
|
|
||||||
# There are notrack rules with this zone as the source.
|
|
||||||
# Add a jump from this source network to this zone's notrack chain
|
|
||||||
#
|
|
||||||
add_ijump $raw_table->{PREROUTING}, j => source_exclusion( $exclusions, $notrackref), imatch_source_dev( $interface), @source, @ipsec_in_match;
|
|
||||||
}
|
|
||||||
|
|
||||||
#
|
|
||||||
# If this zone has parents with DNAT/REDIRECT or notrack rules and there are no CONTINUE polcies with this zone as the source
|
|
||||||
# then add a RETURN jump for this source network.
|
|
||||||
#
|
|
||||||
if ( $nested ) {
|
|
||||||
add_ijump $preroutingref, j => 'RETURN', imatch_source_dev( $interface), @source, @ipsec_in_match if $parenthasnat;
|
|
||||||
add_ijump $raw_table->{PREROUTING}, j => 'RETURN', imatch_source_dev( $interface), @source, @ipsec_in_match if $parenthasnotrack;
|
|
||||||
}
|
|
||||||
|
|
||||||
my $chain2ref = $filter_table->{$chain2};
|
|
||||||
my $inputchainref;
|
|
||||||
my $interfacechainref = $filter_table->{input_chain $interface};
|
|
||||||
my @interfacematch;
|
|
||||||
my $use_input;
|
|
||||||
|
|
||||||
if ( @vservers || use_input_chain( $interface, $interfacechainref ) || ! $chain2 || ( @{$interfacechainref->{rules}} && ! $chain2ref ) ) {
|
|
||||||
$inputchainref = $interfacechainref;
|
|
||||||
|
|
||||||
if ( $isport ) {
|
|
||||||
add_ijump( $filter_table->{ input_chain $bridge },
|
|
||||||
j => $inputchainref ,
|
|
||||||
imatch_source_dev($interface, 1) )
|
|
||||||
unless $input_jump_added{$interface}++;
|
|
||||||
} else {
|
|
||||||
add_ijump $filter_table->{INPUT}, j => $inputchainref, imatch_source_dev($interface) unless $input_jump_added{$interface}++;
|
|
||||||
}
|
|
||||||
|
|
||||||
$use_input = 1;
|
|
||||||
|
|
||||||
unless ( lc $net eq IPv6_LINKLOCAL ) {
|
|
||||||
for my $vzone ( @vservers ) {
|
|
||||||
my $target = rules_target( $zone, $vzone );
|
|
||||||
generate_dest_rules( $inputchainref, $target, $vzone, @source, @ipsec_in_match ) if $target;
|
|
||||||
}
|
|
||||||
}
|
|
||||||
} elsif ( $isport ) {
|
|
||||||
$inputchainref = $filter_table->{ input_chain $bridge };
|
|
||||||
@interfacematch = imatch_source_dev $interface, 1;
|
|
||||||
} else {
|
|
||||||
$inputchainref = $filter_table->{INPUT};
|
|
||||||
@interfacematch = imatch_source_dev $interface;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $chain2 ) {
|
|
||||||
add_ijump $inputchainref, j => source_exclusion( $exclusions, $chain2 ), @interfacematch, @source, @ipsec_in_match;
|
|
||||||
move_rules( $interfacechainref , $chain2ref ) unless $use_input;
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $frwd_ref && $hostref->{ipsec} ne 'ipsec' ) {
|
|
||||||
my $ref = source_exclusion( $exclusions, $frwd_ref );
|
|
||||||
my $forwardref = $filter_table->{forward_chain $interface};
|
|
||||||
|
|
||||||
if ( use_forward_chain $interface, $forwardref ) {
|
|
||||||
add_ijump $forwardref , j => $ref, @source, @ipsec_in_match;
|
|
||||||
|
|
||||||
if ( $isport ) {
|
|
||||||
add_ijump( $filter_table->{ forward_chain $bridge } ,
|
|
||||||
j => $forwardref ,
|
|
||||||
imatch_source_dev( $interface , 1 ) )
|
|
||||||
unless $forward_jump_added{$interface}++;
|
|
||||||
} else {
|
|
||||||
add_ijump $filter_table->{FORWARD} , j => $forwardref, imatch_source_dev( $interface ) unless $forward_jump_added{$interface}++;
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
if ( $isport ) {
|
|
||||||
add_ijump( $filter_table->{ forward_chain $bridge } ,
|
|
||||||
j => $ref ,
|
|
||||||
imatch_source_dev( $interface, 1 ) ,
|
|
||||||
@source,
|
|
||||||
@ipsec_in_match );
|
|
||||||
} else {
|
|
||||||
add_ijump $filter_table->{FORWARD} , j => $ref, imatch_source_dev( $interface ) , @source, @ipsec_in_match;
|
|
||||||
}
|
|
||||||
|
|
||||||
move_rules ( $forwardref , $frwd_ref );
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
#
|
||||||
# F O R W A R D I N G
|
# F O R W A R D I N G
|
||||||
#
|
#
|
||||||
@ -1808,48 +1918,7 @@ sub generate_matrix() {
|
|||||||
my $last_chain = '';
|
my $last_chain = '';
|
||||||
|
|
||||||
if ( $config{OPTIMIZE} & 1 ) {
|
if ( $config{OPTIMIZE} & 1 ) {
|
||||||
my @temp_zones;
|
( $last_chain , @dest_zones ) = optimize1_zones($zone, $zoneref, @zones );
|
||||||
|
|
||||||
for my $zone1 ( @zones ) {
|
|
||||||
my $zone1ref = find_zone( $zone1 );
|
|
||||||
my $policy = $filter_table->{rules_chain( ${zone}, ${zone1} )}->{policy};
|
|
||||||
|
|
||||||
next if $policy eq 'NONE';
|
|
||||||
|
|
||||||
my $chain = rules_target $zone, $zone1;
|
|
||||||
|
|
||||||
next unless $chain;
|
|
||||||
|
|
||||||
if ( $zone eq $zone1 ) {
|
|
||||||
next if ( scalar ( keys( %{ $zoneref->{interfaces}} ) ) < 2 ) && ! $zoneref->{options}{in_out}{routeback};
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $zone1ref->{type} & BPORT ) {
|
|
||||||
next unless $zoneref->{bridge} eq $zone1ref->{bridge};
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $chain =~ /(2all|-all)$/ ) {
|
|
||||||
if ( $chain ne $last_chain ) {
|
|
||||||
$last_chain = $chain;
|
|
||||||
push @dest_zones, @temp_zones;
|
|
||||||
@temp_zones = ( $zone1 );
|
|
||||||
} elsif ( $policy eq 'ACCEPT' ) {
|
|
||||||
push @temp_zones , $zone1;
|
|
||||||
} else {
|
|
||||||
$last_chain = $chain;
|
|
||||||
@temp_zones = ( $zone1 );
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
push @dest_zones, @temp_zones, $zone1;
|
|
||||||
@temp_zones = ();
|
|
||||||
$last_chain = '';
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if ( $last_chain && @temp_zones == 1 ) {
|
|
||||||
push @dest_zones, @temp_zones;
|
|
||||||
$last_chain = '';
|
|
||||||
}
|
|
||||||
} else {
|
} else {
|
||||||
@dest_zones = @zones ;
|
@dest_zones = @zones ;
|
||||||
}
|
}
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user