4021 Commits

Author	SHA1	Message	Date
Tom Eastep	306dc34b31	Correct convert_blacklist() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-13 13:22:14 -07:00
Tom Eastep	f5c6a6fe82	Correct tcrules update ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-13 13:21:51 -07:00
Tom Eastep	af2b7910bd	Port update changes from 5.0.0 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-12 12:33:09 -07:00
Tom Eastep	2ab8bd3040	More update fixes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-09 14:31:47 -07:00
Tom Eastep	0d635632e3	Add conversion of notrack to conntrack ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-08 16:46:58 -07:00
Tom Eastep	fb2d261cdb	More Fixes for update ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-08 12:42:32 -07:00
Tom Eastep	88f9a3e255	Allow zero-valued options on multi-zoned interfaces ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-07 14:30:21 -07:00
Tom Eastep	4c4c5a436a	Allow zero-valued options on multi-zoned interfaces ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-07 14:09:08 -07:00
Tom Eastep	73c8b563a1	Add -s option to update to convert the routestopped file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-07 13:46:16 -07:00
Tom Eastep	0f61bd34e6	Drop support for the 'blacklist' zone option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-03 14:45:52 -07:00
Tom Eastep	f4620606b3	Drop support for the 'blacklist' file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-03 14:35:51 -07:00
Tom Eastep	65baa7e3b8	Drop support for the tcrules file ... - The upgrade -t option is still available Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-03 12:34:22 -07:00
Tom Eastep	e5c7ded951	Drop support for the 'notrack' file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-03 11:36:54 -07:00
Tom Eastep	8bed5c9d65	Drop support for the IPSECFILE option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-08-03 10:11:52 -07:00
Tom Eastep	85648bded1	Deimplement several .conf options ... - LOGRATE/LOGBURST - EXPORTPARAMS - LEGACY_FASTSTART	2015-08-01 11:11:35 -07:00
Tom Eastep	67589cab69	More version changes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-28 10:59:11 -07:00
Tom Eastep	fa7248c58c	Add the LEGACY_RESTART option. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-27 09:19:52 -07:00
Tom Eastep	0a7c65ae0d	Allow connlimit by destination ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-26 14:26:58 -07:00
Tom Eastep	6e0fb1ab88	Correct syntax error ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-26 14:16:12 -07:00
Tom Eastep	a00bf196a3	Remove all workarounds ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-26 10:27:30 -07:00
Tom Eastep	f9ec0c6930	New 'reload' and 'restart' semantics ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-26 09:59:49 -07:00
Tom Eastep	d0fc7f6547	Add some comments to the Zones module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-13 12:57:00 -07:00
Tom Eastep	5704438a44	Second Wave of changes to make script output reproducable ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-12 15:00:41 -07:00
Tom Eastep	014ec1af1d	First phase of producing consistent scripts with Perl >= 5.18.0 ... Beginning with Perl 5.18.0, the order of elements returned by the 'keys' and 'each' iterators is no longer deterministic. This is the first wave of Shorewall changes to compensate for this irrational behavior. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-12 10:54:48 -07:00
Tom Eastep	4995456563	Clean up compiler PATH fix ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-03 14:33:20 -07:00
Tom Eastep	c6f48a77e0	Only add dhcp rule if one rpfilter interface has the 'dhcp' option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-03 12:21:04 -07:00
Tom Eastep	e7792fc868	Exempt IPv4 DHCP broadcasts from rpfilter ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-03 10:03:03 -07:00
Tom Eastep	c47abe416a	Add default PATH to current PATH in the compiler ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-07-03 09:38:06 -07:00
Tom Eastep	9f08726794	Eliminate running the script twice is some cases ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-06-26 14:32:43 -07:00
Tom Eastep	116e85e040	Cosmetic cleanup of the Compiler module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-06-08 11:27:37 -07:00
Tom Eastep	2956698298	Corrections to WORKAROUNDS implementation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-06-06 12:15:03 -07:00
Tom Eastep	eb6be0e84d	Remove old comment that now makes no sense ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-06-01 15:55:06 -07:00
Tom Eastep	019e49b481	Implement WORKAROUNDS option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-06-01 12:59:25 -07:00
Tom Eastep	9a3c43b6d3	Make NFQUEUE parsing more robust ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-30 07:01:30 -07:00
Tom Eastep	0a45c7a646	Another Tweak to the NFQUEUE parser ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-30 06:38:21 -07:00
Tom Eastep	f227250959	Fix NFQUEUE parsing and documentation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-29 18:19:35 -07:00
Tom Eastep	29a0c92918	Fix ancient bug in old parameter syntax ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-29 14:39:48 -07:00
Tuomo Soini	4edd6026f0	prog.footer: disabling already disabled inteface is not an error. ... Neither is enabling already enabled interface Signed-off-by: Tuomo Soini <tis@foobar.fi>	2015-05-29 22:15:55 +03:00
Tom Eastep	18348ef6f1	Clean up distribute_load() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-27 06:58:10 -07:00
Tom Eastep	93c7e2c2f7	Change the way in which a warning message is suppressed ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-26 15:54:41 -07:00
Tom Eastep	602315938c	Correct the load distribution algorithm ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-26 14:59:20 -07:00
Tom Eastep	ca35f565e0	Return success exit status when no ipsets are saved by the script ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-25 07:36:00 -07:00
Tom Eastep	631ebdecb8	load= enhancements ... - Normalize loads to 0.nnnnnnnn - Issue warning if the loads don't sum to 1.000000 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-23 08:05:58 -07:00
Tom Eastep	c851e03313	Don't try to use a probibility >= 1.00000000 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-23 07:06:31 -07:00
Tom Eastep	c7ca3119ef	Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code	2015-05-22 07:20:51 -07:00
Tom Eastep	ba7afcaeae	Make 'call' a supported command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-21 10:38:35 -07:00
Tom Eastep	809e56cef6	Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code	2015-05-21 09:04:35 -07:00
Tom Eastep	e3805b0ada	Implement 'call' in the compiled script ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-21 09:00:11 -07:00
Tom Eastep	f1b6e71e56	Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code	2015-05-20 10:59:06 -07:00
Tom Eastep	f77d649ac7	Make policy descriptions match what the user entered rather than what was generated by the compiler ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-20 10:58:57 -07:00
Tom Eastep	267637f139	NFQUEUE enhancements ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-20 10:55:21 -07:00
Tom Eastep	acd921cd08	Don't require a helper for ctevents and expevents ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-16 13:40:40 -07:00
Tom Eastep	9329e7c36c	Don't require a helper in the CT action. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-16 09:08:32 -07:00
Tom Eastep	50d1a719f9	Delete superfluous test ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-08 09:48:58 -07:00
Tom Eastep	3bb1f74283	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code into 4.6.9	2015-05-05 11:28:13 -07:00
Tuomo Soini	87eca92b10	lib.core: use consisten indenting	2015-05-05 20:40:17 +03:00
Tom Eastep	b58aadad01	Correct Syntax error in the generated code. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-04 08:23:42 -07:00
Tom Eastep	6dcd8174ee	Don't require interfaces on stop, clear, etc. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-04 08:23:10 -07:00
Tom Eastep	3f17a8cf24	Update the program header information in lib.core ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 13:13:06 -07:00
Tom Eastep	2cea78e6df	Add the 'reenable' command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 13:02:12 -07:00
Tom Eastep	0abd51c796	Fix module versioning ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 11:59:01 -07:00
Tom Eastep	86e053be7a	More optimization of detect_configuration() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 11:32:45 -07:00
Tom Eastep	75d18139f7	Optimize detect_configuration() for enable/disable ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-25 15:46:19 -07:00
Tom Eastep	42f75f7ba2	Correct SetEvent and ResetEvent ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-25 12:56:36 -07:00
Tom Eastep	0e8b427778	Remove false comment ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-18 14:31:07 -07:00
Tom Eastep	4fd8aa692d	Add comment to setting of TCPMSS_TARGET with old caps file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-04 09:34:23 -07:00
Tom Eastep	8c3dda80a3	Simplify previous change ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-03 16:35:50 -07:00
Tom Eastep	9f96f58a0d	Default TCPMSS_TARGET to 1 in old capabilities files. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-03 14:46:50 -07:00
Tom Eastep	7442c2189d	Implement TCPMSS_TARGET capability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-31 15:53:05 -07:00
Tom Eastep	468167f9e5	Apply nfw's fix for IP[6]TABLES in the conntrack file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-24 09:23:15 -07:00
Tom Eastep	b00a7af619	Allow a comma-separated list in the rtrules file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-18 15:16:25 -07:00
Tom Eastep	0c11870e46	Implement the 'savesets' command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-17 10:03:12 -07:00
Tom Eastep	2817060edb	Improvements to the 'open' and 'close' commands ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-06 08:13:44 -08:00
Tom Eastep	cdc2d52208	Implement ADD and DEL in the mangle file. ... - Also document the parameter to SAME Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-18 12:04:01 -08:00
Tom Eastep	18c8f1f835	Remove blank line ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-17 20:10:25 -08:00
Tom Eastep	aff8623a44	Allow TTL to be specified in the SAME action. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-17 19:11:28 -08:00
Tom Eastep	b14e7c54f9	Merge branch '4.6.6'	2015-02-07 08:29:44 -08:00
Orion Poplawski	9ad0b297e2	Supporting xz compressed kernel modules ... - I've attached a patch that adds xz support to the default MODULE_SUFFIX. - I'm wondering it wouldn't be better to not have MODULE_SUFFX=ko in various sample configs so that the default value is used instead: ./Shorewall/configfiles/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/Universal/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/three-interfaces/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/two-interfaces/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/one-interface/shorewall.conf:MODULE_SUFFIX=ko ./docs/MultiISP.xml:MODULE_SUFFIX=ko ./docs/MyNetwork.xml:MODULE_SUFFIX=ko ./Shorewall6/configfiles/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/Universal/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/three-interfaces/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/two-interfaces/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/one-interface/shorewall6.conf:MODULE_SUFFIX=ko - Is: MODULE_SUFFIX= sufficient to use the default value or does it need to be commented out? Thanks, Orion -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion@nwra.com Boulder, CO 80301 http://www.nwra.com >From f13edf8fc07c7b62825408b8665b10d6014d368d Mon Sep 17 00:00:00 2001 From: Orion Poplawski <orion@cora.nwra.com> Date: Mon, 26 Jan 2015 09:48:48 -0700 Subject: [PATCH] Support xz compressed modules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-06 12:51:00 -08:00
Tom Eastep	40104d0c86	Correct handling of +set[n] ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-26 07:53:41 -08:00
Tom Eastep	c7cd0060f0	Merge branch '4.6.6'	2015-01-23 09:07:28 -08:00
Tom Eastep	e3b96862ef	Propagate the LOCKFILE setting to the generated script. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-23 08:18:30 -08:00
Tom Eastep	a060f683cc	Correct file name in mangle 'split_line' error messages ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:34:47 -08:00
Tom Eastep	c2b6d974e7	Protect 'enable' and 'disable' with mutex ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:34:28 -08:00
Tom Eastep	7ab055e61e	Correct file name in mangle 'split_line' error messages ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:31:51 -08:00
Tom Eastep	08a184d95b	Protect 'enable' and 'disable' with mutex ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:30:05 -08:00
Tom Eastep	50a0103e89	Merge branch '4.6.6'	2015-01-20 08:11:07 -08:00
Tom Eastep	a7cacdfee3	Allow SAVE and RESTORE in the INPUT chain ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-20 08:09:09 -08:00
Tom Eastep	28ac76bde4	Add tinc tunnel support ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-13 13:28:37 -08:00
Tom Eastep	111c454193	Make leading SHELL case-sensitive ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-13 07:04:20 -08:00
Tom Eastep	97846e14de	Correct handling of ipsets in one of the PORTS columns ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-09 09:28:08 -08:00
Tom Eastep	07c21b8968	Add 'primary' provider option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-06 09:06:27 -08:00
Tom Eastep	668759edad	Catch parameter problems with TARPIT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 11:09:39 -08:00
Tom Eastep	0f1f54b57b	Tweak loopback change ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 11:00:02 -08:00
Tom Eastep	60d5a177a3	Use the 'Iface Match' capability for loopback traffic. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 09:46:39 -08:00
Tom Eastep	3ed5ced581	Correct syntax error introduced in Beta 2 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 08:35:33 -08:00
Tom Eastep	7dd9ccd06b	Add the 'loopback' interface option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-03 09:22:40 -08:00
Tom Eastep	4a4bfe77ce	Implement IFACE_MATCH capability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-02 09:05:06 -08:00
Tom Eastep	3890b8a884	Infrastructure for detecting loopback interfaces ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-02 08:49:38 -08:00
Tom Eastep	551a16d18f	Document TARPIT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-01 09:14:00 -08:00
Tom Eastep	d1b597394f	Correct typo (TARPIT_MATCH -> TARPIT_TARGET) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-30 10:22:33 -08:00
Tom Eastep	15a2fd14f9	Implement TARPIT target ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-28 15:23:30 -08:00
Tom Eastep	f96baca780	Use the readable representation of the SHA1 digest in the chain table ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-27 11:13:10 -08:00
Tom Eastep	1b5f439609	Rewrite 'process_actions' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-27 09:28:02 -08:00
Tom Eastep	1655054de2	Rename 'externalize' to 'external_name' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-27 09:19:00 -08:00
Tom Eastep	89877ed3f7	Rename 'policy_rules' to 'add_policy_rules' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-26 15:58:13 -08:00
Tom Eastep	9649107a8e	Rename 'apply_policy_rules' to 'complete_policy_chains' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-26 15:53:50 -08:00
Tom Eastep	33eb47a48a	Reorder parameters and change identifiers in set_policy_chain() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-26 15:47:50 -08:00
Tom Eastep	6a15cead52	Cosmetic/commentary changes to the Config Module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-23 15:25:20 -08:00
Tom Eastep	f925358872	Minor Compiler Reorganization ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-23 12:27:37 -08:00
Tom Eastep	35fc7b34b8	Minor code tweak ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-20 15:09:21 -08:00
Tom Eastep	79430673b8	Correct handling of duplicate states in the mangle file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-16 19:08:25 -08:00
Tom Eastep	695db284c0	Improve Mark Range Implementation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-15 11:19:23 -08:00
Tom Eastep	807b9ca627	Revert "Improve handling of mark ranges" ... This reverts commit 62f480897e.	2014-12-15 09:39:24 -08:00
Tom Eastep	62f480897e	Improve handling of mark ranges ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-14 09:13:41 -08:00
Tom Eastep	2d7025dcc3	Correct mark range handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-13 08:31:31 -08:00
Tom Eastep	a833815b31	Correct IPv6 handling of LOG_BACKEND=LOG ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-15 08:56:42 -08:00
Tom Eastep	9241552c52	Make emacs sh-mode work better with lib.core ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-14 16:28:44 -08:00
Tom Eastep	16c1809ef2	Apply Alan Barrett's dhclient patch ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-14 13:39:23 -08:00
Tom Eastep	9a6047b3c4	Correct reversed naming of SHA chains ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-06 08:18:52 -08:00
Tom Eastep	5b4e3bc07c	Accomodate new module names for LOG_BACKEND ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-05 12:51:24 -08:00
Tom Eastep	dc3f163e71	Change the names of the sha1 chains for uniqueness ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-04 17:54:38 -08:00
Tom Eastep	8c0c1bd1e0	Omit the 'shorewall' chain from .ip[6]tables-restore-input ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-02 08:16:47 -08:00
Tom Eastep	8b825c4c4c	Avoid failure of ip[6]tables-restore. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-02 07:56:05 -08:00
Tom Eastep	9598ac6fad	Correct a couple of problems with -C ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-01 10:09:04 -07:00
Tom Eastep	8fb73026c8	Replace SAVE_COUNTERS with the -C command option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-01 09:37:57 -07:00
Tom Eastep	4546cbaff7	Use chains with names derived from a digest to identify ruleset ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-31 11:36:53 -07:00
Tom Eastep	a83c146636	Cleanup ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 20:27:06 -07:00
Tom Eastep	2ffc97867c	Correct syntax error in the generated script ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 19:59:20 -07:00
Tom Eastep	f08803e293	Preserve counts on 'restart' without compilation. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 18:38:45 -07:00
Tom Eastep	3454e10525	Add SAVE_COUNTERS option. ... - Also implement recover command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 08:57:56 -07:00
Tom Eastep	edc30fcc8d	Process the params file with SHOREWALL_SHELL ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-29 12:22:00 -07:00
Tom Eastep	85e5669fc7	Rename function interface_up() to interface_enabled() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-27 18:38:22 -07:00
Tom Eastep	f5bdc9e7f4	Allow two limits in the RATE LIMIT columns ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-22 11:21:43 -07:00
Tom Eastep	3bae6e61cf	Eliminate syntax errors in the generated script ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-07 07:53:26 -07:00
Tom Eastep	5204cbc95f	Suppress 'No ipsets were saved' warning when SAVE_IPSETS=No ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-07 07:50:12 -07:00
Tom Eastep	ea1b8ac63a	Correct handling of empty LOG_BACKEND ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-07 07:34:55 -07:00
Tom Eastep	820c769499	Correct silly bug in last change ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-29 07:08:39 -07:00
Tom Eastep	e6b0666ac9	Save ipsets during normal stop (duh) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 18:43:11 -07:00
Tom Eastep	3174454300	Correct SAVE_IPSETS logic in Config.pm ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 14:38:01 -07:00
Tom Eastep	ce1c367d1d	Re-commit the fix that saves only the appropriate family ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 14:09:20 -07:00
Tom Eastep	3e2c903a41	Revert "Only save ipsets of the proper family" ... This reverts commit b053cab630.	2014-09-28 13:32:32 -07:00
Tom Eastep	b053cab630	Only save ipsets of the proper family ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 12:58:52 -07:00
Tom Eastep	6f7d063921	Remove the target file before saving ipsets in the savesets command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 11:53:52 -07:00
Tom Eastep	3858683e94	Allow saving a specified list of ipsets ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 11:19:41 -07:00
Tom Eastep	38a18ac9ac	Allow indefinite alternative to 'yes' and 'no' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-27 15:06:18 -07:00
Tom Eastep	a09484356c	Support 'yes', 'no, <other> values for simple config options ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-27 07:57:46 -07:00
Tom Eastep	bc8588a68e	Fix rule numbers in trace output ... - Don't increment $number needlessly when not tracing Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-27 07:57:09 -07:00
Tom Eastep	4989f694cd	Correct trace output ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-25 14:47:00 -07:00
Tom Eastep	053df2a5fb	Go back to original insert_irule() fix. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-25 09:21:20 -07:00
Tom Eastep	976a1f3deb	Merge branch '4.6.3' ... Conflicts: Shorewall/Perl/Shorewall/Misc.pm	2014-09-25 08:06:16 -07:00
Tom Eastep	ea40068c10	Fix ADMINISABSENTMINDED=No used with stoppedrules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-25 08:03:35 -07:00
Tom Eastep	56649e2183	Don't compile routestopped during check if there is stoppedrules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 19:24:13 -07:00
Tom Eastep	520d21c056	Another tweak to LOG_BACKEND ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 17:12:05 -07:00
Tom Eastep	540eff24aa	Correctons to LOG_BACKEND implementation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 16:35:41 -07:00
Tom Eastep	580e00dabd	Implement LOG_BACKEND option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 15:26:13 -07:00
Tom Eastep	4815f7eba3	Correct warning message in stoppedrules processing. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 11:05:15 -07:00
Tom Eastep	7481514a97	Implement the 'terminating' action option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-23 09:29:13 -07:00
Tom Eastep	1f5439257a	Revert "Implement the 'terminating' action option" ... This reverts commit 6851744cb7.	2014-09-23 07:39:25 -07:00
Tom Eastep	d97d45f4ad	Merge branch '4.6.3'	2014-09-23 07:10:17 -07:00
Tom Eastep	f9d98b74a2	Merge branch '4.6.2' into 4.6.3 ... Conflicts: Shorewall/Perl/Shorewall/Providers.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-16 08:09:20 -07:00
Tom Eastep	0d23b9c542	Don't verify required interfaces during 'stop' or 'clear'. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-14 09:29:04 -07:00
Tom Eastep	a7bdfcc47b	Refine the rule reduction fix ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-11 20:58:01 -07:00
Tom Eastep	988ee64621	Eliminate Redundant Rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-11 10:17:01 -07:00
Tom Eastep	9947f4d968	Re-enable SECTION PREROUTING in the accounting file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-10 12:53:08 -07:00
Tom Eastep	9e039e30e5	Issue warning message when /etc/iproute2/rt_tables is not writeable ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-02 08:11:33 -07:00
Tom Eastep	6851744cb7	Implement the 'terminating' action option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-01 08:16:42 -07:00
Tom Eastep	f963adccf5	Correct silly typo in Chains.pm ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-31 16:57:24 -07:00
Tom Eastep	fa8c3b3b6c	Correct typo in error messages ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-24 08:34:33 -07:00
Tom Eastep	602ecad712	Cleaner code in expand_variables() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-20 11:25:49 -07:00
Tom Eastep	6f777098d7	Add 'wildcard' member to the interface table ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-12 06:51:17 -07:00
Tom Eastep	e545329eb9	Modify the preceding fix to work with wildcard interfaces ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-12 06:50:59 -07:00
Tom Eastep	aedd9b5a76	Add 'wildcard' member to the interface table ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-11 08:30:44 -07:00
Tom Eastep	427f38109e	Some cosmetic cleanup ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-10 07:20:23 -07:00
Tom Eastep	0e1a1a3f44	Modify the preceding fix to work with wildcard interfaces ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-08 10:34:29 -07:00
Tom Eastep	b6161b8be7	Merge branch '4.6.2'	2014-08-08 08:30:04 -07:00
Tom Eastep	d3209ca624	Correct handling of a physical name in the provider INTERFACE column ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-08 08:15:26 -07:00
Tom Eastep	5ef5aa8cdb	Allow inline matches in an action file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-05 07:34:24 -07:00
Tom Eastep	0ca12bd86f	Correct syntax error caused by replacing '%%' with '??' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-03 15:29:58 -07:00
Tom Eastep	a2f1c57246	Add DNSAmp action ... - Allow escaping '@' allowing u32 in action body - Allow inline matches in actions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-03 15:11:25 -07:00
Tom Eastep	fd42fa9f74	Make 'detect_configuration' work in the 'run' command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-01 07:34:40 -07:00
Tom Eastep	e49832f4b5	Run the 'init' script in the 'run' command. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-30 10:25:00 -07:00
Tom Eastep	0bf80c15d8	Detect missing <commmand> in the generated scrip ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-29 11:35:32 -07:00
Tom Eastep	31e5aeeaea	Refine the 'run' command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-29 10:30:07 -07:00
Tom Eastep	a7b18ca875	Implement 'run' command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-28 07:04:56 -07:00
Tom Eastep	ad6c91bcbd	Allow optimize level 8 to work with Perl 5.20.0. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-25 21:03:48 -07:00
Tom Eastep	461f7b10ba	Detect Arptables JF capability when LOAD_HELPERS_ONLY = No. ... - Move detection of Header Match to its proper ordinal. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-20 07:19:02 -07:00
Tom Eastep	2c9eda9cee	Add some white space for readability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 18:33:02 -07:00
Tom Eastep	64fc3d2e43	Correct a typo that caused iset couter match to be mis-detected ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 10:27:29 -07:00
Tom Eastep	d0aed87546	Correct IPV6 ipset capabilities checking on 3.14 kernels ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 10:25:46 -07:00
Tom Eastep	56fa6bd78a	Revert "Correct ipset detection on later kernels." ... This reverts commit b207f64a85.	2014-07-19 10:22:12 -07:00
Tom Eastep	b207f64a85	Correct ipset detection on later kernels. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 08:55:02 -07:00
Tom Eastep	9f381209d5	Detect HEADER_MATCH when LOAD_MODULES_ONLY=No ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 07:20:28 -07:00
Tom Eastep	6771dc54ad	Streamline some code from the last commit ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-18 12:58:49 -07:00
Tom Eastep	417bd0138e	Correct two problems with tcrules processing: ... - SAVE and RESTORE didn't work - '|' and '&' were ignored Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-18 08:32:22 -07:00
Tom Eastep	2ed523101c	Allow specification of the MAC address of a gateway ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-06 09:54:53 -07:00
Tom Eastep	c663a14c4d	Correct TIME column handling in IPv6 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-04 08:17:19 -07:00
Tom Eastep	8bfff55ed2	Add a TIME column to the mangle file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-04 08:01:14 -07:00
Tom Eastep	b1a6ec7f03	Merge branch '4.6.1'	2014-07-02 21:41:27 -07:00
Tom Eastep	cad8443e01	Allow SAVE/RESTORE rules in the OUTPUT chain ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-02 12:38:02 -07:00
Tom Eastep	2ad81f1a81	Apply Thibaut Chèze's patch for DSCP names ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-02 12:37:50 -07:00
Tom Eastep	166e1a3df9	Allow SAVE/RESTORE rules in the OUTPUT chain ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-01 06:54:54 -07:00
Tom Eastep	84437ea689	Apply Thibaut Chèze's patch for DSCP names ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-01 06:52:58 -07:00
Tom Eastep	7fdc398a5e	Revert "Revert "Revert "Add a TIME column to the mangle file""" ... This reverts commit 1165b2689c.	2014-06-27 08:23:04 -07:00
Tom Eastep	1165b2689c	Revert "Revert "Add a TIME column to the mangle file"" ... This reverts commit 9c7fcd09fd.	2014-06-27 08:14:28 -07:00
Tom Eastep	2701b0a756	Correct number of columns in split_line2() calls. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-25 08:22:09 -07:00
Tom Eastep	9c7fcd09fd	Revert "Add a TIME column to the mangle file" ... This reverts commit 824b14b714.	2014-06-25 07:33:42 -07:00
Tom Eastep	824b14b714	Add a TIME column to the mangle file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-25 07:05:12 -07:00
Tom Eastep	122d58b122	Clear inline matches in perl_action_tcp_helper ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-21 07:58:27 -07:00
Tom Eastep	61bb73fd8c	Correct handling of matches in action_tcp_helper() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-20 14:28:17 -07:00
Tom Eastep	36e31ed839	Correct typo in error message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-08 09:40:50 -07:00
Tom Eastep	b55b6a913c	Insert the server address list into the error message in DNAT/REDIRECT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-08 09:36:18 -07:00
Tom Eastep	9c9ae04c86	Raise an error when a server list is specified in a DNAT or REDIRECT rule ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-08 08:52:41 -07:00
Tom Eastep	c898129ad6	Correct pi-rho's patch to not deal with the loopback interface ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-06 13:12:02 -07:00
Tom Eastep	2cd5c41ec0	Clean up white space in pi-rho's patch ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-06 10:44:33 -07:00
Tom Eastep	bea5434de6	Merge branch '4.5.21'	2014-06-06 10:05:02 -07:00
Tom Eastep	8657dd97f7	Apply pi-rho's patch for rpfilter. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-06 10:04:42 -07:00
Tom Eastep	954cddc37a	Enable 1:1 NAT in IPv6 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-25 12:50:00 -07:00
Tom Eastep	5a22b14947	Enable 1:1 NAT in IPv6 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-25 08:57:01 -07:00
Tom Eastep	6d3b1d80d4	Make 'update -A' convert the tcrules file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-16 14:46:15 -07:00
Tom Eastep	c6565f051e	Clean up checking for chain designators with SOURCE $FW. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-16 07:18:35 -07:00
Tom Eastep	c9b6d4a670	Correct CHECKSUM handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-16 07:18:06 -07:00
Tom Eastep	d15956feea	Deprecate FORMAT-1 actions and macros ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-08 14:30:33 -07:00
Tom Eastep	f717d097d7	Apply Tuomo Soini's Macro format patch ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-07 12:19:24 -07:00
Tom Eastep	ba3a7d0621	Do not deprecate USE_DEFAULT_RT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-19 07:53:18 -07:00
Tom Eastep	4d4e8b3df4	Do nothing when a rules file section is empty. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-18 14:13:34 -07:00
Tom Eastep	240d3d8cab	Improve interface option inheritence ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-18 13:36:06 -07:00
Tom Eastep	acda5482c4	If USE_DEFAULT_RT isn't specified, make it 'No' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-18 13:22:58 -07:00
Tom Eastep	e731ea1ca8	Revert "Always inherit interface options" ... This reverts commit 65cde3475f.	2014-04-15 11:54:58 -07:00
Tom Eastep	65cde3475f	Always inherit interface options ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-15 11:37:51 -07:00
Tom Eastep	b3cd9ab15a	Default to LOAD_HELPERS_ONLY=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-12 11:05:28 -07:00
Tom Eastep	58700b2301	Correct the behavior of rpfilter when FASTACCEPT=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-31 07:29:29 -07:00
Tom Eastep	a9ac9c274e	Correct the behavior of rpfilter when FASTACCEPT=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-31 07:28:30 -07:00
Tom Eastep	72869adcd6	Correct missing comment in trace entry. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:55 -07:00
Tom Eastep	0c8365001d	Avoid spurious comments on jumps to section chains. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:48 -07:00
Tom Eastep	6274f8444f	Correct missing comment in trace entry. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:23 -07:00
Tom Eastep	05816e94ee	Avoid spurious comments on jumps to section chains. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:00 -07:00
Tom Eastep	0561b10adb	Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code	2014-03-22 08:58:20 -07:00
Tom Eastep	db1b25b4d7	Restore small mark verification. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-22 08:38:57 -07:00
Tom Eastep	4de651ff55	Add a comment line ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-19 10:38:41 -07:00
Tom Eastep	5981ce59e3	Include -t <table> in debug_restore_input() error message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-19 10:25:37 -07:00
Tom Eastep	54a5e4af52	A couple of minor tweaks to the Chains module. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-19 10:24:30 -07:00
Tom Eastep	4bd8d9791c	Include -t <table> in debug_restore_input() error message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-18 07:28:14 -07:00
Tom Eastep	39b7527cb6	Include rule priority in delete of generated address route rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-10 08:25:59 -07:00
Tom Eastep	08d29edf1a	Include rule priority in delete of generated address route rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-10 08:24:38 -07:00
Tom Eastep	093ff580b5	Deprecate USE_DEFAULT_RT=No. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-09 07:48:05 -07:00
Tom Eastep	cea237620a	Change USE_DEFAULT_RT default to 'Yes'. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-09 07:42:22 -07:00
Tom Eastep	c9d7370fb4	Merge branch '4.5.21' ... Conflicts: Shorewall/manpages/shorewall.conf.xml Shorewall6/manpages/shorewall6.conf.xml Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-05 09:00:34 -08:00
Tom Eastep	8b4d8bfa16	Finish ADMINISABSENDMINDED change ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-05 08:57:03 -08:00
Tom Eastep	4eadec234a	Revert "Correct the behavior of ADMINISABSENTMINDED" ... This reverts commit ded747a51a.	2014-03-02 08:25:05 -08:00
Tom Eastep	2b489993ca	Revert "Correct the behavior of ADMINISABSENTMINDED" ... This reverts commit df09e0ccc5.	2014-03-02 08:23:23 -08:00
Tom Eastep	ded747a51a	Correct the behavior of ADMINISABSENTMINDED ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-28 10:14:33 -08:00
Tom Eastep	df09e0ccc5	Correct the behavior of ADMINISABSENTMINDED ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-28 10:14:08 -08:00
Tom Eastep	454e53bcfa	Reformat preceding patch and correct syntax errors. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-25 13:21:23 -08:00
Tom Eastep	66fdc9f6a7	Call directive_callback for directives without '?' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-25 12:48:25 -08:00
Tom Eastep	c74235a200	Correct typos ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-17 14:17:49 -08:00
Tom Eastep	1759fc75b0	Correctly handle alternate specification with ';' in 'update -t' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-17 14:10:17 -08:00
Tom Eastep	3e87efc82b	Document -t option ... - Also copy compiler directives to the mangle file.	2014-02-17 12:50:59 -08:00
Tom Eastep	a011ad8efe	Add raw matches to the converted mangle file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-16 09:59:13 -08:00
Tom Eastep	0e40a42729	Allow SAVE and RESTORE in the postrouting chain ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-16 09:50:43 -08:00
Tom Eastep	669d15e2cf	Implement the -t update option. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-15 09:36:13 -08:00
Tom Eastep	2dbcd36a9c	Implement BASIC_FILTERS ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 16:34:03 -08:00
Tom Eastep	0383ca7de6	Correct semantics of ipset lists in tcfilters ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 12:27:46 -08:00
Tom Eastep	7ddc65133e	Support ipset lists in the tcfilters file. ... - Also document the fact that ipset match options are not available in the tcfilters file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 12:16:35 -08:00
Tom Eastep	1d4a87a0d0	Excape an opening parehthesis. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 12:15:35 -08:00
Tom Eastep	3b3608ad65	Correct ICMP handling in basic filters. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 07:16:41 -08:00
Tom Eastep	081a387f1d	Fix some bugs in basic filter generation. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-03 14:59:27 -08:00
Tom Eastep	50fb8e3f2f	Use HEX representation for matching IPv6 addresses in basic filters. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-31 12:49:47 -08:00
Tom Eastep	f029f5b483	Correct handling of logging of a non-terminating target ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-29 08:22:31 -08:00
Tom Eastep	86f667afd4	Correct handling of logging of a non-terminating target ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-29 08:19:53 -08:00
Tom Eastep	8a63053c13	Correct defects found in unit testing ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-21 20:19:56 -08:00
Tom Eastep	62557cb98e	Correct defects found during testing of ematch. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-21 12:53:33 -08:00
Tom Eastep	9c4089fc99	Initial basic filter implementation. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-20 18:40:40 -08:00
Tom Eastep	fd28a12653	Allow DROP in the stoppedrules file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-07 13:19:49 -08:00
Tom Eastep	7e6fc3229d	Correct handling of default chain when a mark range is specified. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-07 13:15:51 -08:00
Tom Eastep	42dd8dfee9	Change license to GPLv2+ and update copyrights ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-04 09:48:27 -08:00
Tom Eastep	5a7e458104	Backout ematch stuff for now ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-03 12:01:56 -08:00
Tom Eastep	7e1a310929	Implement ipset matches in tcfilters ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-03 09:35:34 -08:00
Tom Eastep	78ecf9bdc8	Finish up ipset extensions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-03 09:23:14 -08:00
Tom Eastep	1771bb75cf	Finish ipset match option implementation. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-02 14:43:55 -08:00
Tom Eastep	b4847d6a01	New IPSET MATCH extensions ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-02 09:36:35 -08:00
Tom Eastep	48ceed9ecb	Make tcpflags the default. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 15:10:38 -08:00
Tom Eastep	1083dd8c26	Allow ?COMMENT in the mangle file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 08:02:17 -08:00
Tom Eastep	5e7cd855c2	Correct typo in Tc.pm ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:53:38 -08:00
Tom Eastep	2c2aaf262c	Add IP[6]TABLES support for the conntrack file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:18:36 -08:00
Tom Eastep	6c990a7253	Logically OR builtin definitions from the actions file if the builtin exists ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:18:00 -08:00
Tom Eastep	f7bbac6ea8	Make tcrules/mangle similar to notrack/conntrack. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:15:56 -08:00
Tom Eastep	4c1b83beef	Tweaks to the Tc.pm module. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-31 11:42:38 -08:00
Tom Eastep	ac6a506e35	Allow logging from the RAW table ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-31 11:04:43 -08:00
Tom Eastep	11e61ec6e5	Add chain information to the builtin_target table. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-31 08:22:58 -08:00
Tom Eastep	5985a6e9b3	Implement IP[6]TABLES in the rules files. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 13:46:58 -08:00
Tom Eastep	66a04e4819	Allow inline matches with IP[6]TABLES ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 10:13:00 -08:00
Tom Eastep	1634267faa	Rename JUMP to IP[6]TABLES. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 10:12:33 -08:00
Tom Eastep	c8866ef8bf	Correct handling of columns with embedded spaces ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 08:56:14 -08:00
Tom Eastep	6fe06c82c8	More switch from tcrules to mangle ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-28 15:24:05 -08:00
Tom Eastep	543446f8d7	Integrate tcrules and mangle processing. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-28 14:24:36 -08:00
Tom Eastep	a1222d10cb	change 'marks' file to 'mangle' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-28 10:03:23 -08:00
Tom Eastep	3dba1f5bee	Tested version of the marks file handler ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-27 12:38:22 -08:00
Tom Eastep	3960aaee4c	Consolidate declarations in process_mark_rule(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-24 09:49:10 -08:00
Tom Eastep	5419109880	Correct syntax errors in new mars handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-24 09:04:54 -08:00
Tom Eastep	584b0ac50e	Some small tweaks to the marks file processing ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-24 07:25:40 -08:00
Tom Eastep	4c2cedb670	Add get_target_param1() that doesn't accept the <action>/<param> syntax ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-19 09:17:11 -08:00
Tom Eastep	f32a777099	Fix INLINE in tcrles ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-18 09:19:35 -08:00
Tom Eastep	cd5be38cfb	Eliminate silly extra loop in accounting processing. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-18 09:19:16 -08:00
Tom Eastep	2894bb9656	Move INLINE processing into the Chains module. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-16 12:31:35 -08:00
Tom Eastep	fad3b42bd3	Correct line split in the Accounting module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-16 07:40:41 -08:00
Tom Eastep	4e4e7cac1d	Redefine the -i option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-15 11:23:20 -08:00
Tom Eastep	6d72cb3138	Correct update inline ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-15 09:32:09 -08:00
Tom Eastep	9abe60bc27	Implement the -i option of upgrade ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-14 17:54:10 -08:00
Tom Eastep	33c5893bdb	Implement INLINE_MATCHES ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-14 13:35:01 -08:00
Tom Eastep	2bc329aa1d	Add INLINE support to the masq file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-13 15:44:16 -08:00
Tom Eastep	95abeaea24	Finish INLINE in the tcrules file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-01 09:25:32 -08:00
Tom Eastep	75258083e3	Cleanup of column splitting change. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-01 09:24:49 -08:00
Tom Eastep	bf44e514e3	Keep parentheses balanced when splitting a line. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-30 14:13:42 -08:00
Tom Eastep	e5d250750b	Correct handling of ?SECTION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-27 07:53:33 -08:00
Tom Eastep	d63262a0cb	change ZONE2ZONE default to '-'. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-24 08:16:28 -08:00
Tom Eastep	3870157898	Issue warning on bare SECTION headings. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-24 07:58:02 -08:00
Tom Eastep	80d54ec40b	Implement ?SECTION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-18 06:57:54 -08:00
Tom Eastep	855cb6e7f4	Correct handling of HFSC classes with DMAX but no UMAX ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-16 08:07:23 -08:00
Tom Eastep	e14d92c5ac	Add DROP support in tcrules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-04 10:50:11 -08:00
Tom Eastep	ca3385d1be	Remove superfluous '[' from character set. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-21 09:28:21 -07:00
Tom Eastep	5823411091	Correct typo in a regular expression. ... - Re-enable |<mark> in the tctrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-21 07:04:23 -07:00
Tom Eastep	66c2fca2b0	Eradicate the use of 'fgrep' ... - Busybox on Leaf Bering does not have fgrep Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-14 07:15:08 -07:00
Tom Eastep	b27e3d2fff	Merge branch '4.5.21'	2013-10-08 13:17:41 -07:00
Tom Eastep	5e67808abd	Don't add host route in default table. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 11:27:41 -07:00
Tom Eastep	fa500b9ea2	Correct H323 and netbios-ns handling. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:24:52 -07:00
Tom Eastep	b6d7e9ea96	Work around emacs bug ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:24:40 -07:00
Tom Eastep	0e61c2f210	Correct H323 and netbios-ns handling. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:20:46 -07:00
Tom Eastep	3c9d984835	Correct typo ... - list_split s/b split_list Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:19:07 -07:00
Tom Eastep	4917500f12	Work around emacs bug ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 07:13:01 -07:00
Tom Eastep	50b7a81b13	Correct typo ... - list_split s/b split_list Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 06:56:16 -07:00
Tom Eastep	8c4bbf0c85	Implement REAP_OPTION capability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-07 07:54:52 -07:00
Tom Eastep	5b515f007b	Fix 'monthdays' in the TIME column. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-30 15:43:17 -07:00
Tom Eastep	d7cbd1da21	Allow actions to manipulate the current comment from Perl. ... - Added set_comment() - moved push/pop_comment() to the :DEFAULT export	2013-09-23 12:21:44 -07:00
Tom Eastep	eb75d0eef4	Add 'nohostroute' option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-18 16:49:54 -07:00
Tom Eastep	5dbcdd65e2	Force 'inline' for REJECT_ACTION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-10 07:37:53 -07:00
Tom Eastep	dc5c0dc069	Validate default log levels ... - Name the .conf option involved in error messages Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-06 16:00:15 -07:00
Tom Eastep	87ae801c15	Use the -w ip[6]tables option when available. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-04 10:16:36 -07:00
Tom Eastep	67603c5eb3	Implement REJECT_ACTION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-01 09:14:10 -07:00
Tom Eastep	1540e50cce	Remove blank line ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-31 10:07:41 -07:00
Tom Eastep	0a2f6c18cc	Correct typo in prog.footer ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-13 07:03:20 -07:00
Tom Eastep	32763e998b	Make -v work with the status command ... - Also document exit status Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-13 06:52:46 -07:00
Tom Eastep	a10aea280b	Add some abbreviations for common commands ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-06 07:05:47 -07:00
Tom Eastep	ceffc000eb	Correct Typo ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-05 08:32:17 -07:00
Tom Eastep	6615c1f736	Clarify usage of Interface Option Chains ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-04 09:01:09 -07:00
Tom Eastep	83d1aa6682	Allow OPTIMIZE=All ... - Remove use of literal 4096 from OPTIMIZATION checks. - Moved constant declarations to the Config module. - Documented that level 1 is ignored when level 4 is specified. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-29 10:08:35 -07:00
Tom Eastep	aabb22a50f	Add the TRACK_RULES option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-24 07:22:51 -07:00
Tom Eastep	7aa33c140d	Add an AutoBL action with helper AutoBLL ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-17 10:19:18 -07:00
Tom Eastep	891e3e0e1d	Use the --reap option in sticky recent rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 14:46:39 -07:00
Tom Eastep	5c7500e13e	Display the current time as an integer in 'show event[s]' output ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 09:46:08 -07:00
Tom Eastep	09240da55a	Change the external name of MARK_ANYWHERE to 'Mark in the filter table' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 09:45:20 -07:00
Tom Eastep	89f16bdb37	Include a current time event in /proc/net/xt_recent/ ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 07:14:22 -07:00
Tom Eastep	8e30831385	Resolve merge conflicts ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-11 14:20:38 -07:00
Tom Eastep	d2725fcd87	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code	2013-07-11 14:16:19 -07:00
Tom Eastep	9535a7d7df	Rename 'Trigger' to 'Event' and document ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-11 10:39:21 -07:00
Tom Eastep	3c6df56b57	Implement Triggers ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-10 13:27:58 -07:00
Tom Eastep	411ca87ec3	Allow logging rules with more than 15 ports ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-08 15:59:54 -07:00
Tom Eastep	948a7fccc2	Enhance a comment ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-07 12:52:04 -07:00
Tom Eastep	73060a3761	Correct typo in dropBcast() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-06 07:58:21 -07:00
Tom Eastep	cd83d7727c	Restore handle_original_dest(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:51:06 -07:00
Tom Eastep	5121634457	Add ihandle_original_dest() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:37:24 -07:00
Tom Eastep	131c1f432b	Add iverify_source_interface() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:07:09 -07:00
Tom Eastep	03885f71d3	Create add_expanded_ijump() that breaks long lines ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-03 15:13:48 -07:00
Tom Eastep	b735b93378	Re-factor irule generation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-03 10:59:09 -07:00
Tom Eastep	5ce5d5e607	Delete superfluous blank line ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 15:03:50 -07:00
Tom Eastep	00c5985458	Rename clone_rule() to clone_irule() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:38:16 -07:00
Tom Eastep	1a44b66656	Cleaner handling of trailing spaces from log_irule_limit. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:32:35 -07:00
Tom Eastep	b215cf379a	Generate a warning when Limit is invoked. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:31:29 -07:00
Tom Eastep	3ec6745df9	Use log_irule_limit() internally where possible. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 11:48:02 -07:00
Tom Eastep	55be5b0119	Add log_irule_limit() and log_irule() functions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 11:47:19 -07:00
Tom Eastep	42a649d093	Create $globals{LOGILIMIT} ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 09:00:36 -07:00
Tom Eastep	18e7e43b2f	Eliminate globals{STATEMATCH} ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-01 16:01:57 -07:00
Tom Eastep	6803ce5d41	Add constants for %used values. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-01 15:36:16 -07:00
Tom Eastep	565fb74795	Correct bridge detection and 'qt' implementation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 13:07:38 -07:00
Tom Eastep	fc754040d5	Avoid shell error when detecting owner name match ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 09:51:32 -07:00
Tom Eastep	cc5a59231b	Make qt() work correctly when tracing. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 07:17:15 -07:00
Tom Eastep	25f96e6a88	Reword unreachable warning (again) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-20 10:50:28 -07:00
Tom Eastep	71bcd11ab6	Make ?...shell/perl directives case insensitive ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-20 10:39:39 -07:00
Tom Eastep	4bd35a0b93	Allow 'routeback=0' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-16 08:37:53 -07:00
Tom Eastep	cb132e2421	Include the chain name in the 'unreachable' warning. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-11 06:29:07 -07:00
Tom Eastep	53f1cd40df	Add 'unmanaged' option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-10 12:36:18 -07:00
Tom Eastep	c653d9ce83	Only issue one 'unreachable' warning per chain. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-08 10:02:19 -07:00
Tom Eastep	254d2037ef	Delete unused variable. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 15:34:25 -07:00
Tom Eastep	cb8e76b1d2	Add sub get_opttype to emphasize where rule option types are used. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 12:49:20 -07:00
Tom Eastep	2b579d2dff	Small efficiency change in helper processing. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 12:48:22 -07:00
Tom Eastep	fc3e3dbf3c	Cosmetic change. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-03 10:53:33 -07:00
Tom Eastep	81acedd1b3	Reword the 'unreachable' warning. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 17:13:41 -07:00
Tom Eastep	d8f53cc0a9	Merge branch '4.5.17' ... Conflicts: Shorewall/Perl/Shorewall/Chains.pm	2013-06-02 15:31:45 -07:00
Tom Eastep	481811d29f	Merge NFACCT and EXPENSIVE matches during optimization ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 13:29:13 -07:00
Tom Eastep	3867902b27	Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 07:31:32 -07:00
Tom Eastep	adf51d0059	Revise the unreachable warning stuff. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 16:32:46 -07:00
Tom Eastep	7dbd50708b	Clear the current filename after last file is processed. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:35 -07:00
Tom Eastep	4340bcffb1	Don't optimize away a rule that includes nfacct matches. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:25 -07:00
Tom Eastep	4a05e56d6d	Disable warning on unreachable rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:16 -07:00
Tom Eastep	2d8078033c	Clear the current filename after last file is processed. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:03:10 -07:00
Tom Eastep	c5f2eeea80	Don't optimize away a rule that includes nfacct matches. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:02:39 -07:00
Tom Eastep	5343243f6b	Disable warning on unreachable rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:01:55 -07:00
Tom Eastep	4865899018	Avoid a forward jump for local zones. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-30 06:52:09 -07:00
Tom Eastep	9b68204865	Generate an 'unreachable rule(s)' warning. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-30 06:17:22 -07:00
Tom Eastep	a550dd3eed	Issue a warning when a rule is dropped do to terminated chain. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-29 21:01:07 -07:00
Tom Eastep	f0aa29222f	Correct minor IPv6 TPROXY bug ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-29 07:18:46 -07:00
Tom Eastep	eaf1d0e5c2	Another error check for hosts files and loopback zones. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 10:00:07 -07:00
Tom Eastep	446f764d19	Allow config with only local and firewall zones. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 08:03:44 -07:00
Tom Eastep	9b0b3d4b70	Correct ICMPV6 type name translation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 08:03:19 -07:00
Tom Eastep	a48a4b7a2e	Don't allow fowarding between local zones. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 06:14:44 -07:00
Tom Eastep	8743b64e00	Export 'shorewall' from the Config module. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-27 06:52:45 -07:00
Tom Eastep	2de0fbf7d0	Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 14:06:51 -07:00
Tom Eastep	f89c704d01	Disallow 'virtual' physical interfaces. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 08:47:44 -07:00
Tom Eastep	0b5a316cfc	Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 08:03:54 -07:00
Tom Eastep	31f9ea5b93	Add progess and warning messages to 'update -D' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 16:31:55 -07:00
Tom Eastep	dde1f0a779	Only enable helpers during a 'clear' operation. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 16:31:27 -07:00
Tom Eastep	60d0a50d9d	Add some warning/progress messages to help understand 'update -D' behavior. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 13:20:12 -07:00
Tom Eastep	064f9f974c	Cosmetic change. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-23 09:49:25 -07:00
Tom Eastep	fd11eb7d82	Omit fw->fw jumps when there is a local zone. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 09:19:34 -07:00
Tom Eastep	9e77bb5499	Ensure correct match ordering with trivial exclusion ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 08:46:22 -07:00
Tom Eastep	8df8fe990a	Allow 'local' zone to work with 'destonly' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 07:34:04 -07:00
Tom Eastep	ac02c484f5	Change 'local' interface option to a zone type. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-19 15:35:20 -07:00
Tom Eastep	5ec72dad6c	Add routes for standard tables when there are no providers. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 15:32:05 -07:00
Tom Eastep	f6a55bbf05	Allow the '-V' option in the CLI programs. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 14:29:36 -07:00
Tom Eastep	739f3779f5	Generate warnings for local->non-firewall and non-firewall->local rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 07:51:12 -07:00
Tom Eastep	2e293dd356	Make 'local,destonly' work correctly. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 14:36:51 -07:00
Tom Eastep	a5412cff38	Issue a warning when a rule will be optimized away due to 'destonly'. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 09:30:59 -07:00
Tom Eastep	46a6a7b258	Correct earlier optimization. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 07:27:57 -07:00
Tom Eastep	105d1db85d	Cosmetic change ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 11:24:09 -07:00
Tom Eastep	200d347ac8	Small Efficiency Change ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 10:52:04 -07:00
Tom Eastep	c8133145e6	Add support for "all+" in the policy file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 09:01:12 -07:00
Tom Eastep	9178ecbab0	Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 10:38:44 -07:00
Tom Eastep	d06a7b55b6	Add a 'destonly' option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 10:37:40 -07:00
Tom Eastep	2fb01bec8d	Don't assume 'destonly' with 'local'. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:58:37 -07:00
Tom Eastep	6551d67b2e	Call delete_chain_and_references recursively. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:29:29 -07:00
Tom Eastep	4b76d8c462	Handle optimize level 0 in the IPV6 nat table. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:28:25 -07:00
Tom Eastep	1bb5b89ee1	Add the 'local' interface option. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:27:12 -07:00
Tom Eastep	c3901f1161	Release mutex on error. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-09 09:57:09 -07:00
Tom Eastep	56318e6cc8	Try to ensure that cp doesn't copy the firewall script to itself. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-06 09:22:16 -07:00
Tom Eastep	13c90e2aef	Correct my update to Mr-4's bup patch. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 18:40:14 -07:00
Tom Eastep	fdfdb49951	Apply Mr-4's priority->perf patch ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 14:05:03 -07:00
Tom Eastep	61cb105c02	Apply Mr-4's noautosrc patch (modified) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 14:00:25 -07:00
Tom Eastep	4621dccd53	Apply Mr-4's special route handling in COPY (modified). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 13:27:34 -07:00
Tom Eastep	b83ca4812b	Include trailing space in a regular expression. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-03 08:36:38 -07:00
Tom Eastep	80efd095a8	Correct handling of INLINE without '-j' in the tcrules file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 14:52:48 -07:00
Tom Eastep	d6961c4c3b	Clean up the temporary chains sooner. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 14:48:27 -07:00
Tom Eastep	54f5aaca63	Fix handling of CT_TARGET ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 11:15:36 -07:00
Tom Eastep	1012251957	Apply Mr-4's 4a patch (modified) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-27 07:04:40 -07:00
Tom Eastep	20d38e8b52	Centralize the validation of nfacct object names. ... - Also correct a missing ' ' from the output generated by INLINE freeform input. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-26 09:09:08 -07:00
Tom Eastep	52f5ae15d1	Apply Mr-4's cosmetic patch ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-25 17:29:41 -07:00
Tom Eastep	7e830e5df4	Allow special characters in nfacct names. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-25 10:07:49 -07:00
Tom Eastep	f543c3bd1e	Finish Mr-4's NFACCT patch ... - Correct indentation - Remove '$type' argument to split_nfacct_list - Update manpages. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-23 06:55:30 -07:00
Dash Four	68c7782e7d	Shorewall 4.5.16 Beta 6 ... Tom Eastep wrote: > On 4/22/13 5:07 PM, "Dash Four" <mr.dash.four@googlemail.com> wrote: > > >> Anyway, I've just implemented individual "!" in the NFACCT statement by >> hacking your Accounting.pm - I can attach a small patch for >> review/inclusion if you are interested, but be aware that it does change >> the syntax slightly in a sense that "!" needs to be specified for each >> object within NFACCT() - "NFACCT(...)!" is no longer allowed. >> > > Sure -- send it along. > Attached - the above caveat applies though. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 21:17:59 -07:00
Tom Eastep	4faf3728f2	Implement INLINE in the tcrules file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 19:00:29 -07:00
Tom Eastep	ad70240347	Remove a blank line ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 09:36:25 -07:00
Tom Eastep	739013f248	Handle nfacct object lists in parens following an ipset name. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 07:56:56 -07:00
Tom Eastep	6d57e7a0ce	Mark a rule as complex if an option value is a reference. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-21 14:44:30 -07:00
Tom Eastep	5ad69aa650	Add CHAIN_SCRIPTS option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-21 07:30:31 -07:00
Tom Eastep	1b9fd642bb	Add INLINE to the accounting file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-20 08:02:02 -07:00
Tom Eastep	7c8f1ae020	Correct HELPERS handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 16:35:19 -07:00
Tom Eastep	1fd62e1612	Restore order in the NFACCT target. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 11:11:37 -07:00
Tom Eastep	6c2679ce75	Allow incrementing an nfacct object when an ipset matches. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 10:44:57 -07:00
Tom Eastep	610bdf1aac	Correct merge_rules() for LAST matches. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 08:40:01 -07:00
Tom Eastep	cbdca08fea	Fix for multiple nfacct patch. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 16:37:54 -07:00
Tom Eastep	b87b4b61d8	Allow multiple nfacct matches in one accounting rule. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 16:14:57 -07:00
Tom Eastep	9c010691a3	Always place 'nfacct' last ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 15:26:34 -07:00
Tom Eastep	8ef11a376b	Document 'HELPERS=none'. ... - Also make 'check -u' work correctly regarding HELPERS= Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 11:30:47 -07:00
Tom Eastep	4d686e873b	Implement 'HELPERS=none' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 10:30:56 -07:00
Tom Eastep	f55e34dd8b	Don't allow options on targets that don't accept them. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 17:18:01 -07:00
Tom Eastep	668bd4a1a4	Accept complex log levels with INLINE ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 16:59:14 -07:00
Tom Eastep	5d5f168f25	Don't clone rule unconditionally in format_rule() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 13:35:32 -07:00
Tom Eastep	938bd72844	Better handling of the matches rule member. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 10:39:32 -07:00
Tom Eastep	8b91575c9e	Maintain order when multiple instances of a match are separated. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 06:52:32 -07:00
Tom Eastep	0da38cc38e	Order matches in rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-12 11:37:29 -07:00
Tom Eastep	6950cd2576	Allow '-' in a match name. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 18:30:02 -07:00
Tom Eastep	ff4fb21044	Require that the '-j' part of a free-form rule be known. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 18:29:45 -07:00
Tom Eastep	614c5e6155	Assume LOG if a level is specified with INLINE. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 14:16:34 -07:00
Tom Eastep	35b0b4a4f9	Support A_ACCEPT! ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 13:37:49 -07:00
Tom Eastep	c34cf333ba	Allow both {...} and ';' with INLINE ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 12:57:59 -07:00
Tom Eastep	b33bdeaa02	Allow a parameter to INLINE ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 11:54:58 -07:00
Tom Eastep	38f3ae0934	Handle 'NONE' policy correctly. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 09:35:27 -07:00
Tom Eastep	beec4a188f	Implement INLINE action (again). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 09:15:59 -07:00
Tom Eastep	f85d548d40	Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 06:23:22 -07:00
Tom Eastep	ee2e85c0fb	Correct generation of the blacklog chain when disposition is audited ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-10 16:43:38 -07:00
Tom Eastep	186f71fa96	Add NEW_TOS_MATCH capability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 14:04:16 -07:00
Tom Eastep	477e2bc455	Additional corrections to INLINE action. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 09:41:43 -07:00
Tom Eastep	273f109daf	Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 09:37:12 -07:00
Tom Eastep	50494f667c	Implement INLINE action ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-08 17:30:00 -07:00
Tom Eastep	183a0a75a1	Implement 'builtin' actions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-08 16:14:26 -07:00
Tom Eastep	9e10c38e26	Don't emit 'quantum' calculation unless the qdisc is 'htb' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-03 08:39:18 -07:00
Tom Eastep	ee66a45e2e	Correct comments in the Chains module. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-02 12:52:10 -07:00
Tom Eastep	c200efa6d7	Revert "Disable script generation while processing TC" ... This reverts commit 5b18ff91ca.	2013-04-01 15:23:16 -07:00
Tom Eastep	5b18ff91ca	Disable script generation while processing TC ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-01 09:05:12 -07:00
Tom Eastep	ef5818ce7e	Merge branch '4.5.15'	2013-03-31 07:08:49 -07:00
Tom Eastep	58ef8e0ec3	Correct bounds check in do_dscp() ... - "< 0x2f" s/b "< 0x3f" Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-31 07:07:21 -07:00
Tom Eastep	8a84c1c371	Avoid 'echo' failure during 'enable'. ... - in the case where the kernel doesn't know about /proc/sys/net/ipv6/conf/x/accept_ra Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-31 07:02:11 -07:00
Tom Eastep	1db5741edd	Merge branch '4.5.15' ... Conflicts: Shorewall/Perl/Shorewall/Proc.pm	2013-03-30 18:08:17 -07:00
Tom Eastep	1139e1a09c	Establish /proc/sys/net/ipv6/conf/X/forwarding during 'enable' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 17:26:50 -07:00
Tom Eastep	d415de1883	Add the accept_ra Shorewall6 interface option. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 16:44:18 -07:00
Tom Eastep	448d957e48	Fix use of names for DSCP. ... - From Thibaut Chèze Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 07:20:10 -07:00
Tom Eastep	8fe7963631	Revert another replace->add change. ... - Also includes a cosmetic change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-27 06:57:49 -07:00
Tom Eastep	6334b09653	Add a comment about why the 'id' member of builtin tables is initialized in process_providers() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 14:30:42 -07:00
Tom Eastep	e572d6ce50	Use the 'id' member in copy_and_edit_table(). ... - Also add prohibit and unreachable to the existing blackhole case. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:38:13 -07:00
Tom Eastep	792a19bf4b	Initialize the 'id' member of reserved tables after .conf has been read. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:36:57 -07:00
Tom Eastep	61e21de41b	Revert bad hunk from last change. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:00:16 -07:00
Tom Eastep	43932f2bbd	Cleanup of table id/number and 'route replace' erradication ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-25 07:35:30 -07:00
Tom Eastep	6e5f00062c	Revert "Use 'replace' rather than 'add' for routes defined in the routes file." ... This reverts commit 215fd9e234. Conflicts: Shorewall/Perl/Shorewall/Providers.pm	2013-03-24 14:19:31 -07:00
Tom Eastep	b5ea4067e4	Implement USE_RT_NAMES ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-24 10:56:38 -07:00
Tom Eastep	0c30e7c013	Uniform handling of VLSM width. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-23 09:19:26 -07:00
Tom Eastep	536fea27a5	Detect duplicate routes. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 14:59:35 -07:00
Tom Eastep	215fd9e234	Use 'replace' rather than 'add' for routes defined in the routes file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 14:55:27 -07:00
Tom Eastep	4c0a0e0ff8	Don't emit 'qt ' in the undo_x_routing files. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 13:20:27 -07:00
Tom Eastep	9e5cf92a59	Merge branch '4.5.14'	2013-03-21 12:00:20 -07:00
Tom Eastep	3ac6835650	Handle IPv6 /32 networks correctly. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-21 11:30:59 -07:00
Tom Eastep	1e866eac28	Implement the other forms of NULL routing. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-16 08:20:52 -07:00
Tom Eastep	b10218e773	Add a 'UDPLITE Port Redirection' capability. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 10:07:52 -07:00
Tom Eastep	8442477224	Add Enhanced Multi-port match capability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 09:04:47 -07:00
Tom Eastep	fd2fcc996f	Don't allow port redirection with UDPLITE ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 08:32:45 -07:00
Tom Eastep	8c4c856caa	Issue a warning if the contents of the DUPLICATE column may be invalid. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-09 07:57:13 -08:00
Tom Eastep	a167e3449e	Avoid Perl run-time errors when checking a provider interface. ... - Handle case where a provider interface matches a wildcard Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-09 07:56:16 -08:00
Tom Eastep	b871fc689c	Merge branch 'FETCH_HEAD' into 4.5.14	2013-03-09 07:11:47 -08:00
Tom Eastep	cfe2bd11b0	Allow 'none' in the COPY column when the DUPLICATE column is empty. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 19:18:13 -08:00
Tom Eastep	bd64baa8d9	Require at least one zone for a provider ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 13:08:23 -08:00
Tom Eastep	e1f7a9dbf8	Reverse an earlier silly patch. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 10:38:13 -08:00
Tom Eastep	4586568649	Merge branch '4.5.14' of ssh://git.code.sf.net/p/shorewall/code	2013-03-08 08:00:43 -08:00
Tom Eastep	b4d4083513	Split large '--ports' lists across multiple rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 07:38:23 -08:00
Tom Eastep	91f5a9dec0	Make 'main' work correctly when specified in the routes file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 07:26:49 -08:00
Tom Eastep	50030bcc2d	Revert "Don't allow routes to be added to non-Provider tables." ... This reverts commit 6f9a1ba29d.	2013-03-08 06:55:12 -08:00
Tom Eastep	8eacbe287b	Correction to MULTIPORT patch ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 18:11:59 -08:00
Tom Eastep	6f9a1ba29d	Don't allow routes to be added to non-Provider tables. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 17:18:57 -08:00
Tom Eastep	6ba02c4a24	Merge branch 'master' into 4.5.14 ... Conflicts: Shorewall/Perl/Shorewall/Providers.pm	2013-03-07 08:29:30 -08:00
Tom Eastep	c4f0be96ac	Require that interfaces in the COPY column be known. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:32:56 -08:00
Tom Eastep	7da10ff923	Additional change to copy blackhole routes. ... - Add 'blackhole' to the outer case statement - Add RFC1918 blackhole routes before starting providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:58 -08:00
Tom Eastep	ace9a49106	Allow addition of blackhole routes. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:41 -08:00
Tom Eastep	7f2c933cb3	Copy blackhole routes to secondary tables. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:18 -08:00
Tom Eastep	5aa731e963	Additional change to copy blackhole routes. ... - Add 'blackhole' to the outer case statement - Add RFC1918 blackhole routes before starting providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 06:52:16 -08:00
Tom Eastep	06e7f297f7	Allow addition of blackhole routes. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 11:48:09 -08:00
Tom Eastep	216029c3a9	Copy blackhole routes to secondary tables. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 11:04:23 -08:00
Tom Eastep	e12bc47546	Remove duplicate interface names in generated case statement. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 08:28:12 -08:00
Tom Eastep	384c179dd6	Avoid duplicate echo command in generated script. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 08:28:03 -08:00
Tom Eastep	32b2030e59	Remove duplicate interface names in generated case statement. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 07:03:41 -08:00
Tom Eastep	0bb62ed290	Avoid duplicate echo command in generated script. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 06:12:43 -08:00
Tom Eastep	49918b654e	Support '=' in SOURCE PORT(S) columns ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-04 09:56:10 -08:00
Tom Eastep	0857eb27d5	Another case of detecting invalid server IP address. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-02 09:08:13 -08:00
Tom Eastep	69f6149d4c	Detect missing, NIL or ALL server IP address in a DNAT rule. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-02 09:00:08 -08:00
Tom Eastep	5ca3b795fc	Correct IPv6 REDIRECT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 16:44:49 -08:00
Tom Eastep	9499a47a0d	Revert "Use '--to-dest' for IPv6 rather than '--to-destination'" ... This reverts commit c9d8c22b60.	2013-03-01 10:44:40 -08:00
Tom Eastep	c9d8c22b60	Use '--to-dest' for IPv6 rather than '--to-destination' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 09:03:22 -08:00
Tom Eastep	8960f72532	Handle DNAT with no port correctly. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 07:58:58 -08:00
Tom Eastep	ee091d09eb	Allow ports with UDPLITE ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-28 06:27:51 -08:00
Tom Eastep	22c614d30b	Don't allow :persistent in a MASQUERADE rule. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-27 12:48:27 -08:00
Tom Eastep	418034579f	Support IPv6 Masquerade ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-27 09:25:26 -08:00
Tom Eastep	78babf0941	Fixes for IPv6 DNAT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-26 10:24:25 -08:00
Tom Eastep	45d53bdb1d	Delete superfluous statement. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:50:33 -08:00
Tom Eastep	fb17de0595	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code	2013-02-25 17:29:49 -08:00
Tom Eastep	6ed1caedd0	Validate IPv4 port range in ADDRESSES column ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:29:33 -08:00
Tom Eastep	1d4f189b5f	Don't allow interior brackets in an address range. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:26:17 -08:00
Tom Eastep	7006c62892	Correct port pair handling in the snat ADDRESS column. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 15:31:36 -08:00
Tom Eastep	6b825abeb4	Catch ::<port-range> in /etc/shorewall6/snat ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 13:41:43 -08:00
Tom Eastep	f2ee46b83e	Correct IPv6 address range parsing in handle_one_masq1 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 13:37:22 -08:00
Tom Eastep	e873cb28f4	Correctly handle a port number/range with an address variable ... - ADDRESSES column of the masq/snat files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 08:00:15 -08:00
Tom Eastep	de1a5a8024	Handle SNAT 'ADDRESS' without enclosing [...] ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 06:42:19 -08:00
Tom Eastep	34c6013f1b	Handle missing provider in a masq/snat entry. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-24 08:12:02 -08:00
Tom Eastep	82f9ba8bb7	Correct detection of IPv6 PERSISTENT_SNAT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 12:59:38 -08:00
Tom Eastep	6035d49ede	Correct NAT capability required error message. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 11:57:32 -08:00
Tom Eastep	67ef1f8b93	Correct detection of IPv6 NAT_ENABLED. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 11:57:07 -08:00
Tom Eastep	0349a9a88c	Rename the IPv6 masq file 'snat'. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 13:05:24 -08:00
Tom Eastep	2591a17946	Cosmetic change to the output with the '-r' option. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 11:59:57 -08:00
Tom Eastep	b562f7f311	Allow specification of destination addresses in Shorewall6 masq. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 08:34:03 -08:00
Tom Eastep	ce28c70c60	SNAT and DNAT support for IPv6. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 07:08:08 -08:00
Tom Eastep	d0b2d05d5b	Add optional argument to have_capability(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-18 15:15:26 -08:00
Tom Eastep	088fc1a3a3	Report used/required capabilities ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-18 08:48:18 -08:00
Tom Eastep	6d92d293b8	Use 'here documents' in the usage() function. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-17 07:44:10 -08:00
Tom Eastep	7859267539	Eliminate $globals{CONFDIR} ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-14 17:24:49 -08:00
Tom Eastep	c68513672d	Comments and documentation. ... - Removes the Actions-4.5 article Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-14 08:48:45 -08:00
Tom Eastep	93b3fd9be5	Correct IPv6 address checking (again) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 13:37:26 -08:00
Tom Eastep	138638cb1a	Effectively use the specified directory as the CONFIG_PATH til .conf is read ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 07:45:24 -08:00
Tom Eastep	c5bb16ac26	Another fix for IPv6 address lists. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 07:44:19 -08:00
Tom Eastep	f44becdee1	Rename BLACKLIST_LOGLEVEL to BLACKLIST_LOG_LEVEL for consistent naming. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-12 07:47:02 -08:00
Tom Eastep	84c5822c20	Correct IPv6 List Handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-11 16:45:03 -08:00
Tom Eastep	b4977db5b2	Add %section_states that maps sections to their related state(s). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-11 14:59:48 -08:00
Tom Eastep	8d0a80a7e2	Merge branch '4.5.13'	2013-02-11 06:40:11 -08:00
Tom Eastep	b9d5b92f1b	Correct handling of expressions consisting of a single number. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 15:19:30 -08:00
Tom Eastep	b349cc0f22	A better fix for inline default action with parameters. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:29:30 -08:00
Tom Eastep	a312bfbb42	Add a section => name function map ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:27:43 -08:00
Tom Eastep	c35e753b1d	A better fix for inline default action with parameters. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:16:18 -08:00
Tom Eastep	8b4349b356	Merge branch '4.5.13'	2013-02-10 09:05:41 -08:00
Tom Eastep	54c43396f0	Correct default action handling: ... - isolate basic target before testing for action/inline - delete the action chain if appropriate. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:00:13 -08:00
Tom Eastep	f9dc89dc61	Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 07:56:04 -08:00
Tom Eastep	60e3f1015e	Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 07:51:35 -08:00
Tom Eastep	8e0a90e077	Merge branch '4.5.13'	2013-02-09 17:54:06 -08:00
Tom Eastep	cadf2747fe	Correct reset_optflags() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 17:53:40 -08:00
Tom Eastep	810ebe32ce	Merge branch '4.5.13'	2013-02-09 13:15:44 -08:00
Tom Eastep	c04c61b314	Correct typos in check_rules(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 11:42:54 -08:00
Tom Eastep	a8fdfa4e48	Create an ESTABLISHED chain ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 09:32:12 -08:00
Tom Eastep	a4297381e9	Don't ACCEPT untracked packets unless UNTRACKED_DISPOSITION=ACCEPT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 09:15:05 -08:00
Tom Eastep	eaa6d72a4f	Allow parameters to be omitted in action invocations. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 07:07:01 -08:00
Tom Eastep	62a567b550	Treat each -m conntrack subtype as a separate match ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-08 10:08:23 -08:00
Tom Eastep	e4f1c62e71	Improve handling of nested state actions ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-08 09:09:20 -08:00
Tom Eastep	b9e504683e	Prevent a state action from invoking another one. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-07 16:52:06 -08:00
Tom Eastep	aae6e001fe	Convert dropInvalid and allowInvalid to inline actions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-07 11:21:13 -08:00
Tom Eastep	aa528dd075	Revert "Convert allowInvalid and dropInvalid into macros" ... This reverts commit 272e1d330c.	2013-02-07 09:09:56 -08:00
Tom Eastep	e4ae242123	Another tweak to check_state() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 12:07:51 -08:00
Tom Eastep	272e1d330c	Convert allowInvalid and dropInvalid into macros ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 09:54:12 -08:00
Tom Eastep	a66256b25b	Additional refinements of check_state() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 08:16:42 -08:00
Tom Eastep	11b976fb36	Correct reference type in check_state() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-05 19:55:22 -08:00
Tom Eastep	a6ccd53fe0	Unconditionally use '-j' to branch to a state chain or DISPOSITION. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:17:49 -08:00
Tom Eastep	b22b63b1c3	Don't use '-g' when DISPOSITION is CONTINUE. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:09:17 -08:00
Tom Eastep	615df6ab8f	Handle 'RETURN' in state chain with terminating disposition. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:08:20 -08:00
Tom Eastep	d8214885f2	Assume that the conntrack state value in a rule is not a reference. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 08:29:50 -08:00
Tom Eastep	475942deb9	Normalize rules prior to combine_state tests. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 18:14:14 -08:00
Tom Eastep	f1707d2ace	More state rule check fixes. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 18:02:02 -08:00
Tom Eastep	30d96afb69	Push/pop $actionresult. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 12:43:28 -08:00
Tom Eastep	014b4ddc50	Combine adjacent rules differing only in conntrack state match. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 09:03:22 -08:00
Tom Eastep	5b9d1a6159	Handle UNTRACKED_DISPOSITION=ACCEPT correctly. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 07:59:47 -08:00
Tom Eastep	752463bfab	Fix TCPFlags ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 22:19:13 -08:00
Tom Eastep	ebef29e161	Handle port numbers being passed to one of the tcp-specific actions ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 12:48:54 -08:00
Tom Eastep	9b30f48ba0	Correct handling of actions when @chain is altered. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 10:57:08 -08:00
Tom Eastep	8249831e6d	Detect some state conflicts ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 09:32:57 -08:00
Tom Eastep	cc1054be66	Correct handling of audited dispositions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 09:30:25 -08:00
Tom Eastep	c68d4c6e27	Simplify Perl from actions even further. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 15:55:39 -08:00
Tom Eastep	752e960f2f	Allow specification of the action type via perl_action_helper(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 12:59:48 -08:00
Tom Eastep	a5d3b1f470	Remove requirement that matches and proto end with a space in perl helper API. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 12:29:30 -08:00
Tom Eastep	abca3a2024	Improve maintainability of @colums vis a vis @rulecolumns. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 10:47:40 -08:00
Tom Eastep	755d605578	Make %statetable global ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:26:47 -08:00
Tom Eastep	78db4abef5	Remove some redundant local variables from finish_chain_section() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:02:23 -08:00
Tom Eastep	fc73c3934b	Replace BLACKLISTNEWONLY with BLACKLIST ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:00:47 -08:00
Tom Eastep	75fb164234	Don't issue fatal error if a proto other than tcp is passed to a tcp-only inline ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 10:31:20 -08:00
Tom Eastep	27c5e67632	Rename process_rule to process_raw_rule and process_rule1 to process_rule ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 10:13:48 -08:00
Tom Eastep	61d8f704f9	Correct rule-generation detection in perl_action_helper ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 09:43:12 -08:00
Tom Eastep	f33e36b61e	Raise an error if a protocol other than TCP is passed to a TCP-only inline ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 07:46:50 -08:00
Tom Eastep	670931c987	Initialize the columns array to '-'s. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 07:46:07 -08:00
Tom Eastep	316b67473e	Merge branch 'master' into 4.5.13 ... Conflicts: Shorewall/Perl/Shorewall/Rules.pm Shorewall/action.Established Shorewall/actions.std	2013-01-29 07:30:52 -08:00
Tom Eastep	42f46ea5e7	Accurately determine if an inline action generates a rule. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 20:46:20 -08:00
Tom Eastep	49166efdca	Make the TCP standard actions inline ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 18:01:08 -08:00
Tom Eastep	5a2c1792cb	Inline the conntrack state actions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 16:55:54 -08:00
Tom Eastep	a70c441458	Add CONTINUE as a possible setting for RELATED_DISPOSITION. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 11:47:45 -08:00
Tom Eastep	519861d7b2	Add CONTINUE as a possible setting for RELATED_DISPOSITION. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:58:03 -08:00
Tom Eastep	2e8eeff416	Correct error messages that include the section name. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:52 -08:00
Tom Eastep	2217f89902	Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:45 -08:00
Tom Eastep	5c63444c14	Correct error messages that include the section name. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:09 -08:00
Tom Eastep	cfa5d86f5c	Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:40:26 -08:00
Tom Eastep	b3b074fb61	More infrastructure ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 15:37:23 -08:00
Tom Eastep	cbbcfe355e	Infrastructure for more powerful action handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 12:37:10 -08:00
Tom Eastep	2a2e23cb17	Merge branch '4.5.13'	2013-01-27 11:26:59 -08:00
Tom Eastep	1b94c3651d	Always handle ESTABLISHED before the other connection states. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:56:41 -08:00
Tom Eastep	b1b2aa910e	Correct section handling: ... - Correct typo (' INVALID' -> 'INVALID' ) - Don't jump to non-existent target in finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:14:27 -08:00
Tom Eastep	aa609b87a9	Allow arbitrary actions for the various states. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:10:24 -08:00
Tom Eastep	a3a90d8d2e	Correct section handling: ... - Correct typo (' INVALID' -> 'INVALID' ) - Don't jump to non-existent target in finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:08:02 -08:00
Tom Eastep	6c8761c7dd	Add a "matches" argument to process_rule1 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:21:30 -08:00
Tom Eastep	9194165e89	Handle explicit CONTINUE value for UNTRACKED_DISPOSITION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:17:09 -08:00
Tom Eastep	6306103991	Clean up fix for optimize 8 performance issue ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:13:27 -08:00
Tom Eastep	749773f89a	Handle explicit CONTINUE value for UNTRACKED_DISPOSITION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:12:49 -08:00
Tom Eastep	5db317b6f7	Clean up fix for optimize 8 performance issue ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 07:55:55 -08:00
Tom Eastep	380d427a5d	Dramatically reduce the CPU cost of optimize 8. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 17:46:31 -08:00
Tom Eastep	6ce392b08e	Correct handling of handle_first_entry() to avoid runaway recursion. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 12:18:17 -08:00
Tom Eastep	5fa01728ad	Pass UNTRACKED packets through the blacklist chain when BLACKLISTNEWONLY=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 09:18:20 -08:00
Tom Eastep	7bc66da663	Call handle_first_entry in the warning/error-message generators. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 07:30:50 -08:00
Tom Eastep	b8cc9c5a6a	Drop chain-ending rules whose target is 'RETURN'. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-25 14:03:04 -08:00
Tom Eastep	b7273d6999	Favor low-numbered less complex synonym chains in optimization 8. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-25 13:55:04 -08:00
Tom Eastep	e12b919dc1	Prefer shorter action chain names in optimize level 8. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 17:25:11 -08:00
Tom Eastep	18c0956374	Fix two bugs in the UNTRACKED section implementation. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 16:41:18 -08:00
Tom Eastep	6403f4959d	Implement UNTRACKED SECTION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 15:42:01 -08:00
Tom Eastep	0ca93c1ac9	Unify handling of the RELATED and INVALID sections within finish_chain_section() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 14:38:02 -08:00
Tom Eastep	a40c74ddec	Eliminate forward declaration of finish_chain_section() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 09:04:50 -08:00
Tom Eastep	c2bc74cdfe	Add INVALID section to the rules file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 08:33:59 -08:00
Tom Eastep	7fe2027229	Eliminate superfluous ESTABLISHED,RELATED rule ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 16:17:19 -08:00
Tom Eastep	8fe36422b5	Delete stale comment ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 10:44:12 -08:00
Tom Eastep	f61f5a8183	Don't copy a chain that has a single RETURN rule. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 09:07:07 -08:00
Tom Eastep	4ed5c5fdfe	Sort the chain list in optimize_level8. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 16:00:32 -08:00
Tom Eastep	25d6164f21	Try to avoid ~combN chains when dealing with action chains. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 11:51:33 -08:00
Tom Eastep	32c475193f	Another fix for RELATED_DISPOSITION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 11:50:46 -08:00
Tom Eastep	982fabc96f	Delete $caller argument from process_default_action() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:45:54 -08:00
Tom Eastep	5beae475f5	Make optimize 8 a multi-pass operation. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:12:42 -08:00
Tom Eastep	c820c54f41	Correctly handle audited RELATED_DISPOSITION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:03:27 -08:00
Tom Eastep	4a354ba5a2	Avoid internal error during standard chain completion ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 08:02:50 -08:00
Tom Eastep	e23876b582	Rename '$inline' to '$action' in policy_rules() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 07:36:50 -08:00
Tom Eastep	64e76599e0	Correct handling of default actions that set Shorewall variables. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 16:15:04 -08:00
Tom Eastep	c4a2f3d386	Set caller when possible in policy chains. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 14:51:16 -08:00
Tom Eastep	bc882af6c5	Allow RESET of Shorewall variables ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 07:32:34 -08:00
Tom Eastep	d31221b03c	Fix variable assignment. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 07:26:10 -08:00
Tom Eastep	f403420926	Allow setting chain variables ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-19 10:52:11 -08:00
Tom Eastep	b31c76cc50	Proper job of fixing DEFER_DNS_RESOLUTION=No ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 17:18:29 -08:00
Tom Eastep	1307770178	Allow setting action parameters ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 15:05:14 -08:00
Tom Eastep	95aab78c0d	Add infrastructure to delete the %usedactions entry for an action chain if ... the chain parameters are modified. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 14:54:57 -08:00
Tom Eastep	4587430e4a	Move get_action_logging() to the Config Module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 13:06:55 -08:00
Tom Eastep	8ccd1ab52b	Handle exclusion correctly when DEFER_DNS_RESOLUTION=No ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 12:09:54 -08:00
Tom Eastep	89a09f0256	Implement DEFER_DNS_RESOLUTION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 17:00:14 -08:00
Tom Eastep	54dbbaaa2d	Don't resolve DNS names at compile time. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 10:34:31 -08:00
Tom Eastep	90bd19feb9	Convert DNS names into ip addresses in validate_net(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 07:39:27 -08:00
Tom Eastep	853b9ce916	Enable DNS names without an interface name. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-12 14:38:26 -08:00
Tom Eastep	c61d51363d	Correct generation of rules in the ESTABLISHED section of the rules file. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-12 06:49:32 -08:00
Tom Eastep	af83989465	Update copyright dates. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 16:01:10 -08:00
Tom Eastep	b53fd39b49	Avoid a fatal Perl error in Config::cleanup when an fatal error occurs ... while compiling a default action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 15:50:23 -08:00
Tom Eastep	38097bef5d	Correct an optimizer bug. ... - delete_chain_and_references() was only deleting the downward references and not the upward ones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 14:55:43 -08:00
Tom Eastep	76a63fb7e8	Don't flush 'noarp' ARP entries ... = doing so kills the loopback interface Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-10 17:14:40 -08:00
Tom Eastep	15ca9edf8a	Allow delete_tc1() to work on devices which an @ suffix in their reported names. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-09 14:09:07 -08:00
Tom Eastep	199bce925f	Don't add chains with RETURNs to %terminating. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-09 12:54:29 -08:00
Tom Eastep	1fd3a6a522	Detect terminating chains ... - no RETURN Rules - last rule is terminating Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 16:32:24 -08:00
Tom Eastep	011dd2c901	Add a RETURNS flag to optflags indicating that there is RETURN in the chain. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 15:25:53 -08:00
Tom Eastep	e54563d9c1	Don't append rules that can't be matched. ... Also, delete chains whose only rule is a -j RETURN Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 13:53:03 -08:00
Tom Eastep	f8c1b02dba	Correct test for optimization in 'check -r' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 09:51:32 -08:00
Tom Eastep	dece73f7b6	Another fix for *C actions in arprules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:59:24 -08:00
Tom Eastep	eb3b47ae24	Correctly handle *C actions in arprules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:29:41 -08:00
Tom Eastep	c157228f7d	Correct handling of unknown ACTION in arprules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:21:58 -08:00
Tom Eastep	a7af052d91	Correct issue with generating ESTABLISHED rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 16:07:24 -08:00
Tom Eastep	414a74d23c	Support protocol lists in most files. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 16:06:54 -08:00
Tom Eastep	0526863e66	Make $section numeric ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 13:39:49 -08:00
Tom Eastep	5dbe2aa9ec	Optimize a test in finish_chain_section(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 07:00:15 -08:00
Tom Eastep	ca202ca10b	Flush the arp cache after applying the arprules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 17:46:40 -08:00
Tom Eastep	de4e0898b5	Catch protocol lists in contexts that don't allow them. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 17:23:14 -08:00
Tom Eastep	edc0a84e5d	Optimize RELATED rules. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 16:48:37 -08:00
Tom Eastep	d4c9885c09	Change interpretation of the log tag when LOGTAGONLY=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 13:10:18 -08:00
Tom Eastep	c41b9e596d	Don't add --cstate to dropInvalid rule. ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 09:42:55 -08:00
Tom Eastep	9fd7933b5d	Make inline actions work in sections other than NEW. ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 09:32:50 -08:00
Tom Eastep	f223e3584c	Make '+' optional in the ADD and DEL statements. ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 07:37:11 -08:00
Tom Eastep	3f24416f37	Add a warning for opcode inversion when not arptables_jf. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-05 13:14:32 -08:00
Tom Eastep	38aa7f3857	Correct opcode inversion when not ARPTABLES_JF ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:26:46 -08:00
Tom Eastep	7f6430a383	Correct address inversion in match_arp_net() ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:20:51 -08:00
Tom Eastep	4fc0dba26d	Correct two-interface check in process_arprule. ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:17:53 -08:00
Tom Eastep	0c7e10dbfa	Add a comment to the Zones file ... - define the {bridge} member.	2013-01-05 08:15:56 -08:00
Tom Eastep	97009bad79	Correct arptables_jf MAC handling. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 17:27:16 -08:00
Tom Eastep	af7b7195d2	Fix MAC handling in the ARP module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 15:55:52 -08:00
Tom Eastep	a732f6e538	Add some comments to the ARP module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 15:07:51 -08:00
Tom Eastep	38657d9f98	Support for arptables. ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-04 09:17:57 -08:00
Tom Eastep	90e0c8b717	Don't update mtime on shorewall.conf during update that doesn't change the file ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-02 15:03:07 -08:00
Tom Eastep	aca3ce3c21	Delete blank line ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-01 08:29:02 -08:00
Tom Eastep	34f8125416	Correct a couple of issues with update -D ... - shorewall.conf.bak is no longer unlinked - The mtime of all unaltered files is no longer updated	2012-12-31 12:43:02 -08:00
Tom Eastep	87715e5f0b	Correct Typo ... Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2012-12-31 10:36:27 -08:00
Tom Eastep	5848d7cab7	Correct helper validation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-30 13:20:56 -08:00
Tom Eastep	5dfc27355e	Correct a comment ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-29 11:34:12 -08:00
Tom Eastep	6d9cca1cff	fq_codel ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-29 10:58:11 -08:00
Tom Eastep	51deec115b	Correct handling of wildcard interfaces ... - chain_base[1] renamed var_base[1] - $chain replaced by $var in renamed functions - replace trailing '+' by '_plus' to provide uniqueness - add sub chain_base() to the Chains module as an identity mapper Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 10:39:19 -08:00
Tom Eastep	643f419264	Merge branch '4.5.11' ... Conflicts: Shorewall/Perl/Shorewall/Rules.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 09:02:33 -08:00
Tom Eastep	2009a66bb5	Avoid invalid function name for starting an optional interface ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 08:04:06 -08:00
Tom Eastep	ebe4267c49	Rename IGNOREOLDCAPVERSIONS to WARNOLDCAPVERSION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-27 09:58:45 -08:00
Tom Eastep	8b92a59821	Ignore '-m comment' when detecting duplicate rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-27 09:51:33 -08:00
Tom Eastep	ef0102e9f1	Add the 'IGNOREOLDCAPS' option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 15:48:08 -08:00
Tom Eastep	14bbda14a2	Add some comments describing Config.pm globals ... - Also changed $shell from 'my' to 'our'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 10:55:13 -08:00
Tom Eastep	bfeea76cf2	Disallow ?FORMAT when $max_format == 1 ... Signed-off-by: Tom Eastep <teastep@shorewall.net> Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-26 07:37:23 -08:00
Tom Eastep	100e03cf93	Don't set $nocomment in in-line action ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 07:06:29 -08:00
Tom Eastep	84cc78c58e	Eliminate @comments ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-25 17:00:24 -08:00
Tom Eastep	3f28af80d2	Disallow ?FORMAT when $max_format == 1 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-25 08:10:48 -08:00
Tom Eastep	6126ae67e6	Don't apply AUTOCOMMENT or comment continuation to inline actions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:50:26 -08:00
Tom Eastep	575020c851	More comment handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:35:42 -08:00
Tom Eastep	1c212e878f	Restore SECTION handling in Accounting File ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:33:44 -08:00
Tom Eastep	4393a6c603	Eliminate redundant calls to clear_comment. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 12:35:08 -08:00
Tom Eastep	fca5b75c5b	Merge branch '4.5.11'	2012-12-24 10:30:43 -08:00
Tom Eastep	c942a95d3c	Allow ?COMMENT in accounting. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 10:15:23 -08:00
Tom Eastep	89ea37e088	Correct nested comments. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 10:11:53 -08:00
Tom Eastep	14f8947012	Remove old COMMENT/FORMAT handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 09:31:20 -08:00
Tom Eastep	15817078b8	Use 'our' for globals to aid debugging. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 13:16:54 -08:00
Tom Eastep	0acd93a032	Ensure that action and macro files always allow comment directives. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 12:19:30 -08:00
Tom Eastep	4d2379f542	Implement update -D ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 10:50:31 -08:00
Tom Eastep	c9eccaf3b8	Implement ?COMMENT directive ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 10:49:32 -08:00
Tom Eastep	44a4f6d77d	Move COMMENT handling to the Config module. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 13:51:24 -08:00
Tom Eastep	e4e61c4193	A more uniform way of handling $max_format ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 11:57:25 -08:00
Tom Eastep	0cd0675c98	Always push $file_format and $max_format onto the include stack. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 08:15:46 -08:00
Tom Eastep	bc230c00a3	Optimizations in process_compiler_directive() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 08:14:46 -08:00
Tom Eastep	10108b2d6a	Convert file processors to use ?FORMAT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:49:28 -08:00
Tom Eastep	35aeaf340f	Implement ?FORMAT directive ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:31:42 -08:00
Tom Eastep	0eb041d2d1	Correct ?SET error message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:23:26 -08:00
Tom Eastep	a5debe793f	Add $file_format exported variable and handle in the include stack. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:14:23 -08:00
Tom Eastep	df7785f2e9	Implement user-defined address variables. ... - Also correct handling of ${0} & ${chain} in a SWITCH column. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-18 17:58:20 -08:00
Tom Eastep	2869a9a94d	Rename add_quotes to join_parts ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-15 16:12:03 -08:00
Tom Eastep	b6e699ca5c	Factor some common code into a function. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-13 06:46:57 -08:00
Tom Eastep	743478614b	Make @0 work correctly again. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 13:13:17 -08:00
Tom Eastep	5944b4fc7b	Make @chain (@{chain}) a synonym for @0 (@{0}) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:55:04 -08:00
Tom Eastep	8a0abab4cc	Rename 'ALLOWUNKNOWNVARIABLES' to 'IGNOREUNKNOWNVARIABLES' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:51:31 -08:00
Tom Eastep	5da7db3d5f	Implement @-variables. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:46:38 -08:00
Tom Eastep	14cdaf21fc	Handle nested params in push_action_params() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-09 10:45:29 -08:00
Tom Eastep	88d4814209	Merge branch '4.5.10' ... Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-08 20:54:33 -08:00
Tom Eastep	6ab5cfd63a	Use split_list2 in isolate_basic_target() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-06 19:12:44 -08:00
Tom Eastep	7190cd1265	Handle nested parens when pushing action parameters. ... - Add an optional argument to split_list1 that causes parens to be retained. Signed-off-by: Tom Eastep <teastep@shorewall.net> Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-06 15:20:10 -08:00
Tom Eastep	5f48e4e531	Handle nested parens when pushing action parameters. ... - Add an optional argument to split_list1 that causes parens to be retained. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-06 15:13:14 -08:00
Tom Eastep	fdadb57e82	Minor readability improvement ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 19:41:18 -08:00
Tom Eastep	8139f2ad91	Rename process_conditional() to process_compiler_directive() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 14:53:03 -08:00
Tom Eastep	189cd59650	Improve expression evaluation ... - Only quote values when there is not an odd number of preceding quotes - Make address family test return a numeric value - Unconditionally trace the generated expression if debugging is set. - Convert an empty expression into '' rather than generate an error. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 08:37:50 -08:00
Tom Eastep	4ec47783f1	Detect missing target in merge_levels() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:52:07 -08:00
Tom Eastep	2875fbb521	Cosmetic change (add a blank line). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:51:41 -08:00
Tom Eastep	25c53f5a60	Detect missing target in merge_levels() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:51:21 -08:00
Tom Eastep	c61c9ba7eb	Make expression evaluation more deterministic. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 18:10:19 -08:00
Tom Eastep	2fbbc70e83	Only do SET and RESET when we aren't omitting. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 16:27:18 -08:00
Tom Eastep	c18996b6f5	Implement ?set and ?reset directives ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 14:28:03 -08:00
Tom Eastep	fb2d876683	Rename $loglevel and $logtag to $_loglevel and $_logtag respectively. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 08:49:59 -08:00
Tom Eastep	a25b3c68ee	Rename %symbols to %variables ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 08:49:25 -08:00
Tom Eastep	314632f1f4	Unified symbol table for shell variables. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 17:18:21 -08:00
Tom Eastep	409f5f2aab	Expand variables from the shorewallrc1 then shorewallrc hashes	2012-12-03 15:33:33 -08:00
Tom Eastep	fb0035bdf3	Add ALLOWUNKNOWNVARIABLES option. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 14:43:35 -08:00
Tom Eastep	72aabef0fa	Add $logaction and $logtag as variables usable within actions ... - Also make action variables usable in ?if and ?elsif expressions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 12:31:47 -08:00
Tom Eastep	fc3606a489	Prepare for multiple options in actions files ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 08:17:55 -08:00
Tom Eastep	ad4709cb6d	Small effeciency improvement ... - Don't check for 'bad match' until it is known that the matches are the same. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 06:54:44 -08:00
Tom Eastep	c0abdc1fe8	Add some comments in and around delete_duplicates() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 17:31:13 -08:00
Tom Eastep	cd5e9be467	Carefully suppress duplicate rules in all tables ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 12:20:24 -08:00
Tom Eastep	c05c928c6c	Delete adjacent duplicate rules in tables other than 'raw' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 09:21:04 -08:00
Tom Eastep	a33cf5cc91	Fix AUTOCOMMENT=No ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 08:26:54 -08:00
Tom Eastep	65676cb865	Support passing log levels inside parameters. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 15:06:51 -08:00
Tom Eastep	8ebbdee20f	Only look for numerics if a shell variable begins with a number. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 12:52:26 -08:00
Tom Eastep	6c1a5b8051	Be more agressive about detecting action recursion. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 12:10:06 -08:00
Tom Eastep	b9adc2ebec	Remove another vestage of CONDITION_INIT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 09:33:01 -08:00
Tom Eastep	44f00cd0aa	Restore original $actionfile logic in process_actions() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 08:09:20 -08:00
Tom Eastep	ae5680401f	Remove questionable autocreate of an action in createlogactionchain() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 08:04:29 -08:00
Tom Eastep	8cbe26e32c	Ignore 'inline' for certain actions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 07:54:42 -08:00
Tom Eastep	146402d9be	Yet another correction to the same line :-( ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 09:55:24 -08:00
Tom Eastep	70f26d8bb2	Correct line in prior commit. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 09:30:27 -08:00
Tom Eastep	893d054cb8	Reduce the block levels in define_firewall() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 08:46:49 -08:00