extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-27 18:13:13 +01:00
Code Issues Packages Projects Releases Wiki Activity
12,573 Commits 104 Branches 736 Tags 55 MiB
064f9f974c
Commit Graph

2860 Commits

Author SHA1 Message Date
Tom Eastep
4d686e873b Implement 'HELPERS=none' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 10:30:56 -07:00
Tom Eastep
f55e34dd8b Don't allow options on targets that don't accept them. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 17:18:01 -07:00
Tom Eastep
668bd4a1a4 Accept complex log levels with INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 16:59:14 -07:00
Tom Eastep
5d5f168f25 Don't clone rule unconditionally in format_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 13:35:32 -07:00
Tom Eastep
938bd72844 Better handling of the matches rule member. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 10:39:32 -07:00
Tom Eastep
8b91575c9e Maintain order when multiple instances of a match are separated. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 06:52:32 -07:00
Tom Eastep
0da38cc38e Order matches in rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-12 11:37:29 -07:00
Tom Eastep
6950cd2576 Allow '-' in a match name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 18:30:02 -07:00
Tom Eastep
ff4fb21044 Require that the '-j' part of a free-form rule be known. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 18:29:45 -07:00
Tom Eastep
614c5e6155 Assume LOG if a level is specified with INLINE. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 14:16:34 -07:00
Tom Eastep
35b0b4a4f9 Support A_ACCEPT! 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 13:37:49 -07:00
Tom Eastep
c34cf333ba Allow both {...} and ';' with INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 12:57:59 -07:00
Tom Eastep
b33bdeaa02 Allow a parameter to INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 11:54:58 -07:00
Tom Eastep
38f3ae0934 Handle 'NONE' policy correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 09:35:27 -07:00
Tom Eastep
beec4a188f Implement INLINE action (again). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 09:15:59 -07:00
Tom Eastep
f85d548d40 Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 06:23:22 -07:00
Tom Eastep
ee2e85c0fb Correct generation of the blacklog chain when disposition is audited 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-10 16:43:38 -07:00
Tom Eastep
186f71fa96 Add NEW_TOS_MATCH capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 14:04:16 -07:00
Tom Eastep
477e2bc455 Additional corrections to INLINE action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 09:41:43 -07:00
Tom Eastep
273f109daf Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 09:37:12 -07:00
Tom Eastep
50494f667c Implement INLINE action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-08 17:30:00 -07:00
Tom Eastep
183a0a75a1 Implement 'builtin' actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-08 16:14:26 -07:00
Tom Eastep
9e10c38e26 Don't emit 'quantum' calculation unless the qdisc is 'htb' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-03 08:39:18 -07:00
Tom Eastep
ee66a45e2e Correct comments in the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-02 12:52:10 -07:00
Tom Eastep
c200efa6d7 Revert "Disable script generation while processing TC" 
This reverts commit 5b18ff91ca.
 2013-04-01 15:23:16 -07:00
Tom Eastep
5b18ff91ca Disable script generation while processing TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-01 09:05:12 -07:00
Tom Eastep
ef5818ce7e Merge branch '4.5.15' 2013-03-31 07:08:49 -07:00
Tom Eastep
58ef8e0ec3 Correct bounds check in do_dscp() 
- "< 0x2f" s/b "< 0x3f"

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-31 07:07:21 -07:00
Tom Eastep
8a84c1c371 Avoid 'echo' failure during 'enable'. 
- in the case where the kernel doesn't know about
  /proc/sys/net/ipv6/conf/x/accept_ra

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-31 07:02:11 -07:00
Tom Eastep
1db5741edd Merge branch '4.5.15' 
Conflicts:
	Shorewall/Perl/Shorewall/Proc.pm
 2013-03-30 18:08:17 -07:00
Tom Eastep
1139e1a09c Establish /proc/sys/net/ipv6/conf/X/forwarding during 'enable' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-30 17:26:50 -07:00
Tom Eastep
d415de1883 Add the accept_ra Shorewall6 interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-30 16:44:18 -07:00
Tom Eastep
448d957e48 Fix use of names for DSCP. 
- From Thibaut Chèze

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-30 07:20:10 -07:00
Tom Eastep
8fe7963631 Revert another replace->add change. 
- Also includes a cosmetic change.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-27 06:57:49 -07:00
Tom Eastep
6334b09653 Add a comment about why the 'id' member of builtin tables is initialized in process_providers() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 14:30:42 -07:00
Tom Eastep
e572d6ce50 Use the 'id' member in copy_and_edit_table(). 
- Also add prohibit and unreachable to the existing blackhole case.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 07:38:13 -07:00
Tom Eastep
792a19bf4b Initialize the 'id' member of reserved tables after .conf has been read. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 07:36:57 -07:00
Tom Eastep
61e21de41b Revert bad hunk from last change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 07:00:16 -07:00
Tom Eastep
43932f2bbd Cleanup of table id/number and 'route replace' erradication 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-25 07:35:30 -07:00
Tom Eastep
6e5f00062c Revert "Use 'replace' rather than 'add' for routes defined in the routes file." 
This reverts commit 215fd9e234.

Conflicts:

	Shorewall/Perl/Shorewall/Providers.pm
 2013-03-24 14:19:31 -07:00
Tom Eastep
b5ea4067e4 Implement USE_RT_NAMES 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-24 10:56:38 -07:00
Tom Eastep
0c30e7c013 Uniform handling of VLSM width. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-23 09:19:26 -07:00
Tom Eastep
536fea27a5 Detect duplicate routes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-22 14:59:35 -07:00
Tom Eastep
215fd9e234 Use 'replace' rather than 'add' for routes defined in the routes file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-22 14:55:27 -07:00
Tom Eastep
4c0a0e0ff8 Don't emit 'qt ' in the undo_x_routing files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-22 13:20:27 -07:00
Tom Eastep
9e5cf92a59 Merge branch '4.5.14' 2013-03-21 12:00:20 -07:00
Tom Eastep
3ac6835650 Handle IPv6 /32 networks correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-21 11:30:59 -07:00
Tom Eastep
1e866eac28 Implement the other forms of NULL routing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-16 08:20:52 -07:00
Tom Eastep
b10218e773 Add a 'UDPLITE Port Redirection' capability. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-10 10:07:52 -07:00
Tom Eastep
8442477224 Add Enhanced Multi-port match capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-10 09:04:47 -07:00
Tom Eastep
fd2fcc996f Don't allow port redirection with UDPLITE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-10 08:32:45 -07:00
Tom Eastep
8c4c856caa Issue a warning if the contents of the DUPLICATE column may be invalid. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-09 07:57:13 -08:00
Tom Eastep
a167e3449e Avoid Perl run-time errors when checking a provider interface. 
- Handle case where a provider interface matches a wildcard

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-09 07:56:16 -08:00
Tom Eastep
b871fc689c Merge branch 'FETCH_HEAD' into 4.5.14 2013-03-09 07:11:47 -08:00
Tom Eastep
cfe2bd11b0 Allow 'none' in the COPY column when the DUPLICATE column is empty. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 19:18:13 -08:00
Tom Eastep
bd64baa8d9 Require at least one zone for a provider 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 13:08:23 -08:00
Tom Eastep
e1f7a9dbf8 Reverse an earlier silly patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 10:38:13 -08:00
Tom Eastep
4586568649 Merge branch '4.5.14' of ssh://git.code.sf.net/p/shorewall/code 2013-03-08 08:00:43 -08:00
Tom Eastep
b4d4083513 Split large '--ports' lists across multiple rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 07:38:23 -08:00
Tom Eastep
91f5a9dec0 Make 'main' work correctly when specified in the routes file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 07:26:49 -08:00
Tom Eastep
50030bcc2d Revert "Don't allow routes to be added to non-Provider tables." 
This reverts commit 6f9a1ba29d.
 2013-03-08 06:55:12 -08:00
Tom Eastep
8eacbe287b Correction to MULTIPORT patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 18:11:59 -08:00
Tom Eastep
6f9a1ba29d Don't allow routes to be added to non-Provider tables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 17:18:57 -08:00
Tom Eastep
6ba02c4a24 Merge branch 'master' into 4.5.14 
Conflicts:
	Shorewall/Perl/Shorewall/Providers.pm
 2013-03-07 08:29:30 -08:00
Tom Eastep
c4f0be96ac Require that interfaces in the COPY column be known. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:32:56 -08:00
Tom Eastep
7da10ff923 Additional change to copy blackhole routes. 
- Add 'blackhole' to the outer case statement
- Add RFC1918 blackhole routes before starting providers.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:01:58 -08:00
Tom Eastep
ace9a49106 Allow addition of blackhole routes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:01:41 -08:00
Tom Eastep
7f2c933cb3 Copy blackhole routes to secondary tables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:01:18 -08:00
Tom Eastep
5aa731e963 Additional change to copy blackhole routes. 
- Add 'blackhole' to the outer case statement
- Add RFC1918 blackhole routes before starting providers.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 06:52:16 -08:00
Tom Eastep
06e7f297f7 Allow addition of blackhole routes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 11:48:09 -08:00
Tom Eastep
216029c3a9 Copy blackhole routes to secondary tables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 11:04:23 -08:00
Tom Eastep
e12bc47546 Remove duplicate interface names in generated case statement. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 08:28:12 -08:00
Tom Eastep
384c179dd6 Avoid duplicate echo command in generated script. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 08:28:03 -08:00
Tom Eastep
32b2030e59 Remove duplicate interface names in generated case statement. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 07:03:41 -08:00
Tom Eastep
0bb62ed290 Avoid duplicate echo command in generated script. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 06:12:43 -08:00
Tom Eastep
49918b654e Support '=' in SOURCE PORT(S) columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-04 09:56:10 -08:00
Tom Eastep
0857eb27d5 Another case of detecting invalid server IP address. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-02 09:08:13 -08:00
Tom Eastep
69f6149d4c Detect missing, NIL or ALL server IP address in a DNAT rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-02 09:00:08 -08:00
Tom Eastep
5ca3b795fc Correct IPv6 REDIRECT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-01 16:44:49 -08:00
Tom Eastep
9499a47a0d Revert "Use '--to-dest' for IPv6 rather than '--to-destination'" 
This reverts commit c9d8c22b60.
 2013-03-01 10:44:40 -08:00
Tom Eastep
c9d8c22b60 Use '--to-dest' for IPv6 rather than '--to-destination' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-01 09:03:22 -08:00
Tom Eastep
8960f72532 Handle DNAT with no port correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-01 07:58:58 -08:00
Tom Eastep
ee091d09eb Allow ports with UDPLITE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-28 06:27:51 -08:00
Tom Eastep
22c614d30b Don't allow :persistent in a MASQUERADE rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-27 12:48:27 -08:00
Tom Eastep
418034579f Support IPv6 Masquerade 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-27 09:25:26 -08:00
Tom Eastep
78babf0941 Fixes for IPv6 DNAT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-26 10:24:25 -08:00
Tom Eastep
45d53bdb1d Delete superfluous statement. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 17:50:33 -08:00
Tom Eastep
fb17de0595 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2013-02-25 17:29:49 -08:00
Tom Eastep
6ed1caedd0 Validate IPv4 port range in ADDRESSES column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 17:29:33 -08:00
Tom Eastep
1d4f189b5f Don't allow interior brackets in an address range. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 17:26:17 -08:00
Tom Eastep
7006c62892 Correct port pair handling in the snat ADDRESS column. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 15:31:36 -08:00
Tom Eastep
6b825abeb4 Catch ::<port-range> in /etc/shorewall6/snat 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 13:41:43 -08:00
Tom Eastep
f2ee46b83e Correct IPv6 address range parsing in handle_one_masq1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 13:37:22 -08:00
Tom Eastep
e873cb28f4 Correctly handle a port number/range with an address variable 
- ADDRESSES column of the masq/snat files.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 08:00:15 -08:00
Tom Eastep
de1a5a8024 Handle SNAT 'ADDRESS' without enclosing [...] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 06:42:19 -08:00
Tom Eastep
34c6013f1b Handle missing provider in a masq/snat entry. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-24 08:12:02 -08:00
Tom Eastep
82f9ba8bb7 Correct detection of IPv6 PERSISTENT_SNAT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-23 12:59:38 -08:00
Tom Eastep
6035d49ede Correct NAT capability required error message. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-23 11:57:32 -08:00
Tom Eastep
67ef1f8b93 Correct detection of IPv6 NAT_ENABLED. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-23 11:57:07 -08:00
Tom Eastep
0349a9a88c Rename the IPv6 masq file 'snat'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-19 13:05:24 -08:00