shorewall_code

mirror of https://gitlab.com/shorewall/code.git synced 2024-12-14 02:10:55 +01:00

Author	SHA1	Message	Date
Tom Eastep	267637f139	NFQUEUE enhancements Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-20 10:55:21 -07:00
Tom Eastep	acd921cd08	Don't require a helper for ctevents and expevents Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-16 13:40:40 -07:00
Tom Eastep	9329e7c36c	Don't require a helper in the CT action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-16 09:08:32 -07:00
Tom Eastep	50d1a719f9	Delete superfluous test Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-08 09:48:58 -07:00
Tom Eastep	3bb1f74283	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code into 4.6.9	2015-05-05 11:28:13 -07:00
Tuomo Soini	87eca92b10	lib.core: use consisten indenting	2015-05-05 20:40:17 +03:00
Tom Eastep	b58aadad01	Correct Syntax error in the generated code. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-04 08:23:42 -07:00
Tom Eastep	6dcd8174ee	Don't require interfaces on stop, clear, etc. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-05-04 08:23:10 -07:00
Tom Eastep	3f17a8cf24	Update the program header information in lib.core Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 13:13:06 -07:00
Tom Eastep	2cea78e6df	Add the 'reenable' command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 13:02:12 -07:00
Tom Eastep	0abd51c796	Fix module versioning Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 11:59:01 -07:00
Tom Eastep	86e053be7a	More optimization of detect_configuration() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-28 11:32:45 -07:00
Tom Eastep	75d18139f7	Optimize detect_configuration() for enable/disable Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-25 15:46:19 -07:00
Tom Eastep	42f75f7ba2	Correct SetEvent and ResetEvent Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-25 12:56:36 -07:00
Tom Eastep	0e8b427778	Remove false comment Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-18 14:31:07 -07:00
Tom Eastep	4fd8aa692d	Add comment to setting of TCPMSS_TARGET with old caps file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-04 09:34:23 -07:00
Tom Eastep	8c3dda80a3	Simplify previous change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-03 16:35:50 -07:00
Tom Eastep	9f96f58a0d	Default TCPMSS_TARGET to 1 in old capabilities files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-04-03 14:46:50 -07:00
Tom Eastep	7442c2189d	Implement TCPMSS_TARGET capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-31 15:53:05 -07:00
Tom Eastep	468167f9e5	Apply nfw's fix for IP[6]TABLES in the conntrack file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-24 09:23:15 -07:00
Tom Eastep	b00a7af619	Allow a comma-separated list in the rtrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-18 15:16:25 -07:00
Tom Eastep	0c11870e46	Implement the 'savesets' command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-17 10:03:12 -07:00
Tom Eastep	2817060edb	Improvements to the 'open' and 'close' commands Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-03-06 08:13:44 -08:00
Tom Eastep	cdc2d52208	Implement ADD and DEL in the mangle file. - Also document the parameter to SAME Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-18 12:04:01 -08:00
Tom Eastep	18c8f1f835	Remove blank line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-17 20:10:25 -08:00
Tom Eastep	aff8623a44	Allow TTL to be specified in the SAME action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-17 19:11:28 -08:00
Tom Eastep	b14e7c54f9	Merge branch '4.6.6'	2015-02-07 08:29:44 -08:00
Orion Poplawski	9ad0b297e2	Supporting xz compressed kernel modules - I've attached a patch that adds xz support to the default MODULE_SUFFIX. - I'm wondering it wouldn't be better to not have MODULE_SUFFX=ko in various sample configs so that the default value is used instead: ./Shorewall/configfiles/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/Universal/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/three-interfaces/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/two-interfaces/shorewall.conf:MODULE_SUFFIX=ko ./Shorewall/Samples/one-interface/shorewall.conf:MODULE_SUFFIX=ko ./docs/MultiISP.xml:MODULE_SUFFIX=ko ./docs/MyNetwork.xml:MODULE_SUFFIX=ko ./Shorewall6/configfiles/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/Universal/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/three-interfaces/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/two-interfaces/shorewall6.conf:MODULE_SUFFIX=ko ./Shorewall6/Samples6/one-interface/shorewall6.conf:MODULE_SUFFIX=ko - Is: MODULE_SUFFIX= sufficient to use the default value or does it need to be commented out? Thanks, Orion -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion@nwra.com Boulder, CO 80301 http://www.nwra.com >From f13edf8fc07c7b62825408b8665b10d6014d368d Mon Sep 17 00:00:00 2001 From: Orion Poplawski <orion@cora.nwra.com> Date: Mon, 26 Jan 2015 09:48:48 -0700 Subject: [PATCH] Support xz compressed modules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-02-06 12:51:00 -08:00
Tom Eastep	40104d0c86	Correct handling of +set[n] Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-26 07:53:41 -08:00
Tom Eastep	c7cd0060f0	Merge branch '4.6.6'	2015-01-23 09:07:28 -08:00
Tom Eastep	e3b96862ef	Propagate the LOCKFILE setting to the generated script. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-23 08:18:30 -08:00
Tom Eastep	a060f683cc	Correct file name in mangle 'split_line' error messages Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:34:47 -08:00
Tom Eastep	c2b6d974e7	Protect 'enable' and 'disable' with mutex Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:34:28 -08:00
Tom Eastep	7ab055e61e	Correct file name in mangle 'split_line' error messages Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:31:51 -08:00
Tom Eastep	08a184d95b	Protect 'enable' and 'disable' with mutex Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-22 08:30:05 -08:00
Tom Eastep	50a0103e89	Merge branch '4.6.6'	2015-01-20 08:11:07 -08:00
Tom Eastep	a7cacdfee3	Allow SAVE and RESTORE in the INPUT chain Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-20 08:09:09 -08:00
Tom Eastep	28ac76bde4	Add tinc tunnel support Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-13 13:28:37 -08:00
Tom Eastep	111c454193	Make leading SHELL case-sensitive Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-13 07:04:20 -08:00
Tom Eastep	97846e14de	Correct handling of ipsets in one of the PORTS columns Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-09 09:28:08 -08:00
Tom Eastep	07c21b8968	Add 'primary' provider option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-06 09:06:27 -08:00
Tom Eastep	668759edad	Catch parameter problems with TARPIT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 11:09:39 -08:00
Tom Eastep	0f1f54b57b	Tweak loopback change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 11:00:02 -08:00
Tom Eastep	60d5a177a3	Use the 'Iface Match' capability for loopback traffic. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 09:46:39 -08:00
Tom Eastep	3ed5ced581	Correct syntax error introduced in Beta 2 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-04 08:35:33 -08:00
Tom Eastep	7dd9ccd06b	Add the 'loopback' interface option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-03 09:22:40 -08:00
Tom Eastep	4a4bfe77ce	Implement IFACE_MATCH capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-02 09:05:06 -08:00
Tom Eastep	3890b8a884	Infrastructure for detecting loopback interfaces Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-02 08:49:38 -08:00
Tom Eastep	551a16d18f	Document TARPIT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2015-01-01 09:14:00 -08:00
Tom Eastep	d1b597394f	Correct typo (TARPIT_MATCH -> TARPIT_TARGET) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-30 10:22:33 -08:00
Tom Eastep	15a2fd14f9	Implement TARPIT target Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-28 15:23:30 -08:00
Tom Eastep	f96baca780	Use the readable representation of the SHA1 digest in the chain table Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-27 11:13:10 -08:00
Tom Eastep	1b5f439609	Rewrite 'process_actions' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-27 09:28:02 -08:00
Tom Eastep	1655054de2	Rename 'externalize' to 'external_name' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-27 09:19:00 -08:00
Tom Eastep	89877ed3f7	Rename 'policy_rules' to 'add_policy_rules' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-26 15:58:13 -08:00
Tom Eastep	9649107a8e	Rename 'apply_policy_rules' to 'complete_policy_chains' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-26 15:53:50 -08:00
Tom Eastep	33eb47a48a	Reorder parameters and change identifiers in set_policy_chain() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-26 15:47:50 -08:00
Tom Eastep	6a15cead52	Cosmetic/commentary changes to the Config Module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-23 15:25:20 -08:00
Tom Eastep	f925358872	Minor Compiler Reorganization Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-23 12:27:37 -08:00
Tom Eastep	35fc7b34b8	Minor code tweak Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-20 15:09:21 -08:00
Tom Eastep	79430673b8	Correct handling of duplicate states in the mangle file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-16 19:08:25 -08:00
Tom Eastep	695db284c0	Improve Mark Range Implementation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-15 11:19:23 -08:00
Tom Eastep	807b9ca627	Revert "Improve handling of mark ranges" This reverts commit `62f480897e`.	2014-12-15 09:39:24 -08:00
Tom Eastep	62f480897e	Improve handling of mark ranges Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-14 09:13:41 -08:00
Tom Eastep	2d7025dcc3	Correct mark range handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-12-13 08:31:31 -08:00
Tom Eastep	a833815b31	Correct IPv6 handling of LOG_BACKEND=LOG Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-15 08:56:42 -08:00
Tom Eastep	9241552c52	Make emacs sh-mode work better with lib.core Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-14 16:28:44 -08:00
Tom Eastep	16c1809ef2	Apply Alan Barrett's dhclient patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-14 13:39:23 -08:00
Tom Eastep	9a6047b3c4	Correct reversed naming of SHA chains Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-06 08:18:52 -08:00
Tom Eastep	5b4e3bc07c	Accomodate new module names for LOG_BACKEND Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-05 12:51:24 -08:00
Tom Eastep	dc3f163e71	Change the names of the sha1 chains for uniqueness Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-04 17:54:38 -08:00
Tom Eastep	8c0c1bd1e0	Omit the 'shorewall' chain from .ip[6]tables-restore-input Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-02 08:16:47 -08:00
Tom Eastep	8b825c4c4c	Avoid failure of ip[6]tables-restore. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-02 07:56:05 -08:00
Tom Eastep	9598ac6fad	Correct a couple of problems with -C Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-01 10:09:04 -07:00
Tom Eastep	8fb73026c8	Replace SAVE_COUNTERS with the -C command option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-11-01 09:37:57 -07:00
Tom Eastep	4546cbaff7	Use chains with names derived from a digest to identify ruleset Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-31 11:36:53 -07:00
Tom Eastep	a83c146636	Cleanup Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 20:27:06 -07:00
Tom Eastep	2ffc97867c	Correct syntax error in the generated script Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 19:59:20 -07:00
Tom Eastep	f08803e293	Preserve counts on 'restart' without compilation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 18:38:45 -07:00
Tom Eastep	3454e10525	Add SAVE_COUNTERS option. - Also implement recover command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-30 08:57:56 -07:00
Tom Eastep	edc30fcc8d	Process the params file with SHOREWALL_SHELL Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-29 12:22:00 -07:00
Tom Eastep	85e5669fc7	Rename function interface_up() to interface_enabled() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-27 18:38:22 -07:00
Tom Eastep	f5bdc9e7f4	Allow two limits in the RATE LIMIT columns Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-22 11:21:43 -07:00
Tom Eastep	3bae6e61cf	Eliminate syntax errors in the generated script Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-07 07:53:26 -07:00
Tom Eastep	5204cbc95f	Suppress 'No ipsets were saved' warning when SAVE_IPSETS=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-07 07:50:12 -07:00
Tom Eastep	ea1b8ac63a	Correct handling of empty LOG_BACKEND Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-10-07 07:34:55 -07:00
Tom Eastep	820c769499	Correct silly bug in last change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-29 07:08:39 -07:00
Tom Eastep	e6b0666ac9	Save ipsets during normal stop (duh) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 18:43:11 -07:00
Tom Eastep	3174454300	Correct SAVE_IPSETS logic in Config.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 14:38:01 -07:00
Tom Eastep	ce1c367d1d	Re-commit the fix that saves only the appropriate family Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 14:09:20 -07:00
Tom Eastep	3e2c903a41	Revert "Only save ipsets of the proper family" This reverts commit `b053cab630`.	2014-09-28 13:32:32 -07:00
Tom Eastep	b053cab630	Only save ipsets of the proper family Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 12:58:52 -07:00
Tom Eastep	6f7d063921	Remove the target file before saving ipsets in the savesets command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 11:53:52 -07:00
Tom Eastep	3858683e94	Allow saving a specified list of ipsets Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-28 11:19:41 -07:00
Tom Eastep	38a18ac9ac	Allow indefinite alternative to 'yes' and 'no' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-27 15:06:18 -07:00
Tom Eastep	a09484356c	Support 'yes', 'no, <other> values for simple config options Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-27 07:57:46 -07:00
Tom Eastep	bc8588a68e	Fix rule numbers in trace output - Don't increment $number needlessly when not tracing Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-27 07:57:09 -07:00
Tom Eastep	4989f694cd	Correct trace output Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-25 14:47:00 -07:00
Tom Eastep	053df2a5fb	Go back to original insert_irule() fix. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-25 09:21:20 -07:00
Tom Eastep	976a1f3deb	Merge branch '4.6.3' Conflicts: Shorewall/Perl/Shorewall/Misc.pm	2014-09-25 08:06:16 -07:00
Tom Eastep	ea40068c10	Fix ADMINISABSENTMINDED=No used with stoppedrules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-25 08:03:35 -07:00
Tom Eastep	56649e2183	Don't compile routestopped during check if there is stoppedrules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 19:24:13 -07:00
Tom Eastep	520d21c056	Another tweak to LOG_BACKEND Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 17:12:05 -07:00
Tom Eastep	540eff24aa	Correctons to LOG_BACKEND implementation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 16:35:41 -07:00
Tom Eastep	580e00dabd	Implement LOG_BACKEND option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 15:26:13 -07:00
Tom Eastep	4815f7eba3	Correct warning message in stoppedrules processing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-24 11:05:15 -07:00
Tom Eastep	7481514a97	Implement the 'terminating' action option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-23 09:29:13 -07:00
Tom Eastep	1f5439257a	Revert "Implement the 'terminating' action option" This reverts commit `6851744cb7`.	2014-09-23 07:39:25 -07:00
Tom Eastep	d97d45f4ad	Merge branch '4.6.3'	2014-09-23 07:10:17 -07:00
Tom Eastep	f9d98b74a2	Merge branch '4.6.2' into 4.6.3 Conflicts: Shorewall/Perl/Shorewall/Providers.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-16 08:09:20 -07:00
Tom Eastep	0d23b9c542	Don't verify required interfaces during 'stop' or 'clear'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-14 09:29:04 -07:00
Tom Eastep	a7bdfcc47b	Refine the rule reduction fix Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-11 20:58:01 -07:00
Tom Eastep	988ee64621	Eliminate Redundant Rules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-11 10:17:01 -07:00
Tom Eastep	9947f4d968	Re-enable SECTION PREROUTING in the accounting file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-10 12:53:08 -07:00
Tom Eastep	9e039e30e5	Issue warning message when /etc/iproute2/rt_tables is not writeable Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-02 08:11:33 -07:00
Tom Eastep	6851744cb7	Implement the 'terminating' action option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-09-01 08:16:42 -07:00
Tom Eastep	f963adccf5	Correct silly typo in Chains.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-31 16:57:24 -07:00
Tom Eastep	fa8c3b3b6c	Correct typo in error messages Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-24 08:34:33 -07:00
Tom Eastep	602ecad712	Cleaner code in expand_variables() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-20 11:25:49 -07:00
Tom Eastep	6f777098d7	Add 'wildcard' member to the interface table Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-12 06:51:17 -07:00
Tom Eastep	e545329eb9	Modify the preceding fix to work with wildcard interfaces Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-12 06:50:59 -07:00
Tom Eastep	aedd9b5a76	Add 'wildcard' member to the interface table Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-11 08:30:44 -07:00
Tom Eastep	427f38109e	Some cosmetic cleanup Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-10 07:20:23 -07:00
Tom Eastep	0e1a1a3f44	Modify the preceding fix to work with wildcard interfaces Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-08 10:34:29 -07:00
Tom Eastep	b6161b8be7	Merge branch '4.6.2'	2014-08-08 08:30:04 -07:00
Tom Eastep	d3209ca624	Correct handling of a physical name in the provider INTERFACE column Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-08 08:15:26 -07:00
Tom Eastep	5ef5aa8cdb	Allow inline matches in an action file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-05 07:34:24 -07:00
Tom Eastep	0ca12bd86f	Correct syntax error caused by replacing '%%' with '??' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-03 15:29:58 -07:00
Tom Eastep	a2f1c57246	Add DNSAmp action - Allow escaping '@' allowing u32 in action body - Allow inline matches in actions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-03 15:11:25 -07:00
Tom Eastep	fd42fa9f74	Make 'detect_configuration' work in the 'run' command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-08-01 07:34:40 -07:00
Tom Eastep	e49832f4b5	Run the 'init' script in the 'run' command. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-30 10:25:00 -07:00
Tom Eastep	0bf80c15d8	Detect missing <commmand> in the generated scrip Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-29 11:35:32 -07:00
Tom Eastep	31e5aeeaea	Refine the 'run' command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-29 10:30:07 -07:00
Tom Eastep	a7b18ca875	Implement 'run' command Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-28 07:04:56 -07:00
Tom Eastep	ad6c91bcbd	Allow optimize level 8 to work with Perl 5.20.0. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-25 21:03:48 -07:00
Tom Eastep	461f7b10ba	Detect Arptables JF capability when LOAD_HELPERS_ONLY = No. - Move detection of Header Match to its proper ordinal. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-20 07:19:02 -07:00
Tom Eastep	2c9eda9cee	Add some white space for readability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 18:33:02 -07:00
Tom Eastep	64fc3d2e43	Correct a typo that caused iset couter match to be mis-detected Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 10:27:29 -07:00
Tom Eastep	d0aed87546	Correct IPV6 ipset capabilities checking on 3.14 kernels Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 10:25:46 -07:00
Tom Eastep	56fa6bd78a	Revert "Correct ipset detection on later kernels." This reverts commit `b207f64a85`.	2014-07-19 10:22:12 -07:00
Tom Eastep	b207f64a85	Correct ipset detection on later kernels. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 08:55:02 -07:00
Tom Eastep	9f381209d5	Detect HEADER_MATCH when LOAD_MODULES_ONLY=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-19 07:20:28 -07:00
Tom Eastep	6771dc54ad	Streamline some code from the last commit Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-18 12:58:49 -07:00
Tom Eastep	417bd0138e	Correct two problems with tcrules processing: - SAVE and RESTORE didn't work - '\|' and '&' were ignored Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-18 08:32:22 -07:00
Tom Eastep	2ed523101c	Allow specification of the MAC address of a gateway Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-06 09:54:53 -07:00
Tom Eastep	c663a14c4d	Correct TIME column handling in IPv6 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-04 08:17:19 -07:00
Tom Eastep	8bfff55ed2	Add a TIME column to the mangle file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-04 08:01:14 -07:00
Tom Eastep	b1a6ec7f03	Merge branch '4.6.1'	2014-07-02 21:41:27 -07:00
Tom Eastep	cad8443e01	Allow SAVE/RESTORE rules in the OUTPUT chain Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-02 12:38:02 -07:00
Tom Eastep	2ad81f1a81	Apply Thibaut Chèze's patch for DSCP names Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-02 12:37:50 -07:00
Tom Eastep	166e1a3df9	Allow SAVE/RESTORE rules in the OUTPUT chain Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-01 06:54:54 -07:00
Tom Eastep	84437ea689	Apply Thibaut Chèze's patch for DSCP names Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-07-01 06:52:58 -07:00
Tom Eastep	7fdc398a5e	Revert "Revert "Revert "Add a TIME column to the mangle file""" This reverts commit `1165b2689c`.	2014-06-27 08:23:04 -07:00
Tom Eastep	1165b2689c	Revert "Revert "Add a TIME column to the mangle file"" This reverts commit `9c7fcd09fd`.	2014-06-27 08:14:28 -07:00
Tom Eastep	2701b0a756	Correct number of columns in split_line2() calls. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-25 08:22:09 -07:00
Tom Eastep	9c7fcd09fd	Revert "Add a TIME column to the mangle file" This reverts commit `824b14b714`.	2014-06-25 07:33:42 -07:00
Tom Eastep	824b14b714	Add a TIME column to the mangle file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-25 07:05:12 -07:00
Tom Eastep	122d58b122	Clear inline matches in perl_action_tcp_helper Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-21 07:58:27 -07:00
Tom Eastep	61bb73fd8c	Correct handling of matches in action_tcp_helper() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-20 14:28:17 -07:00
Tom Eastep	36e31ed839	Correct typo in error message Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-08 09:40:50 -07:00
Tom Eastep	b55b6a913c	Insert the server address list into the error message in DNAT/REDIRECT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-08 09:36:18 -07:00
Tom Eastep	9c9ae04c86	Raise an error when a server list is specified in a DNAT or REDIRECT rule Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-08 08:52:41 -07:00
Tom Eastep	c898129ad6	Correct pi-rho's patch to not deal with the loopback interface Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-06 13:12:02 -07:00
Tom Eastep	2cd5c41ec0	Clean up white space in pi-rho's patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-06 10:44:33 -07:00
Tom Eastep	bea5434de6	Merge branch '4.5.21'	2014-06-06 10:05:02 -07:00
Tom Eastep	8657dd97f7	Apply pi-rho's patch for rpfilter. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-06-06 10:04:42 -07:00
Tom Eastep	954cddc37a	Enable 1:1 NAT in IPv6 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-25 12:50:00 -07:00
Tom Eastep	5a22b14947	Enable 1:1 NAT in IPv6 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-25 08:57:01 -07:00
Tom Eastep	6d3b1d80d4	Make 'update -A' convert the tcrules file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-16 14:46:15 -07:00
Tom Eastep	c6565f051e	Clean up checking for chain designators with SOURCE $FW. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-16 07:18:35 -07:00
Tom Eastep	c9b6d4a670	Correct CHECKSUM handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-16 07:18:06 -07:00
Tom Eastep	d15956feea	Deprecate FORMAT-1 actions and macros Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-08 14:30:33 -07:00
Tom Eastep	f717d097d7	Apply Tuomo Soini's Macro format patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-05-07 12:19:24 -07:00
Tom Eastep	ba3a7d0621	Do not deprecate USE_DEFAULT_RT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-19 07:53:18 -07:00
Tom Eastep	4d4e8b3df4	Do nothing when a rules file section is empty. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-18 14:13:34 -07:00
Tom Eastep	240d3d8cab	Improve interface option inheritence Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-18 13:36:06 -07:00
Tom Eastep	acda5482c4	If USE_DEFAULT_RT isn't specified, make it 'No' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-18 13:22:58 -07:00
Tom Eastep	e731ea1ca8	Revert "Always inherit interface options" This reverts commit `65cde3475f`.	2014-04-15 11:54:58 -07:00
Tom Eastep	65cde3475f	Always inherit interface options Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-15 11:37:51 -07:00
Tom Eastep	b3cd9ab15a	Default to LOAD_HELPERS_ONLY=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-04-12 11:05:28 -07:00
Tom Eastep	58700b2301	Correct the behavior of rpfilter when FASTACCEPT=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-31 07:29:29 -07:00
Tom Eastep	a9ac9c274e	Correct the behavior of rpfilter when FASTACCEPT=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-31 07:28:30 -07:00
Tom Eastep	72869adcd6	Correct missing comment in trace entry. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:55 -07:00
Tom Eastep	0c8365001d	Avoid spurious comments on jumps to section chains. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:48 -07:00
Tom Eastep	6274f8444f	Correct missing comment in trace entry. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:23 -07:00
Tom Eastep	05816e94ee	Avoid spurious comments on jumps to section chains. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-28 08:55:00 -07:00
Tom Eastep	0561b10adb	Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code	2014-03-22 08:58:20 -07:00
Tom Eastep	db1b25b4d7	Restore small mark verification. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-22 08:38:57 -07:00
Tom Eastep	4de651ff55	Add a comment line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-19 10:38:41 -07:00
Tom Eastep	5981ce59e3	Include -t <table> in debug_restore_input() error message Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-19 10:25:37 -07:00
Tom Eastep	54a5e4af52	A couple of minor tweaks to the Chains module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-19 10:24:30 -07:00
Tom Eastep	4bd8d9791c	Include -t <table> in debug_restore_input() error message Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-18 07:28:14 -07:00
Tom Eastep	39b7527cb6	Include rule priority in delete of generated address route rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-10 08:25:59 -07:00
Tom Eastep	08d29edf1a	Include rule priority in delete of generated address route rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-10 08:24:38 -07:00
Tom Eastep	093ff580b5	Deprecate USE_DEFAULT_RT=No. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-09 07:48:05 -07:00
Tom Eastep	cea237620a	Change USE_DEFAULT_RT default to 'Yes'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-09 07:42:22 -07:00
Tom Eastep	c9d7370fb4	Merge branch '4.5.21' Conflicts: Shorewall/manpages/shorewall.conf.xml Shorewall6/manpages/shorewall6.conf.xml Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-05 09:00:34 -08:00
Tom Eastep	8b4d8bfa16	Finish ADMINISABSENDMINDED change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-03-05 08:57:03 -08:00
Tom Eastep	4eadec234a	Revert "Correct the behavior of ADMINISABSENTMINDED" This reverts commit `ded747a51a`.	2014-03-02 08:25:05 -08:00
Tom Eastep	2b489993ca	Revert "Correct the behavior of ADMINISABSENTMINDED" This reverts commit `df09e0ccc5`.	2014-03-02 08:23:23 -08:00
Tom Eastep	ded747a51a	Correct the behavior of ADMINISABSENTMINDED Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-28 10:14:33 -08:00
Tom Eastep	df09e0ccc5	Correct the behavior of ADMINISABSENTMINDED Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-28 10:14:08 -08:00
Tom Eastep	454e53bcfa	Reformat preceding patch and correct syntax errors. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-25 13:21:23 -08:00
Tom Eastep	66fdc9f6a7	Call directive_callback for directives without '?' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-25 12:48:25 -08:00
Tom Eastep	c74235a200	Correct typos Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-17 14:17:49 -08:00
Tom Eastep	1759fc75b0	Correctly handle alternate specification with ';' in 'update -t' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-17 14:10:17 -08:00
Tom Eastep	3e87efc82b	Document -t option - Also copy compiler directives to the mangle file.	2014-02-17 12:50:59 -08:00
Tom Eastep	a011ad8efe	Add raw matches to the converted mangle file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-16 09:59:13 -08:00
Tom Eastep	0e40a42729	Allow SAVE and RESTORE in the postrouting chain Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-16 09:50:43 -08:00
Tom Eastep	669d15e2cf	Implement the -t update option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-15 09:36:13 -08:00
Tom Eastep	2dbcd36a9c	Implement BASIC_FILTERS Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 16:34:03 -08:00
Tom Eastep	0383ca7de6	Correct semantics of ipset lists in tcfilters Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 12:27:46 -08:00
Tom Eastep	7ddc65133e	Support ipset lists in the tcfilters file. - Also document the fact that ipset match options are not available in the tcfilters file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 12:16:35 -08:00
Tom Eastep	1d4a87a0d0	Excape an opening parehthesis. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 12:15:35 -08:00
Tom Eastep	3b3608ad65	Correct ICMP handling in basic filters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-04 07:16:41 -08:00
Tom Eastep	081a387f1d	Fix some bugs in basic filter generation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-02-03 14:59:27 -08:00
Tom Eastep	50fb8e3f2f	Use HEX representation for matching IPv6 addresses in basic filters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-31 12:49:47 -08:00
Tom Eastep	f029f5b483	Correct handling of logging of a non-terminating target Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-29 08:22:31 -08:00
Tom Eastep	86f667afd4	Correct handling of logging of a non-terminating target Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-29 08:19:53 -08:00
Tom Eastep	8a63053c13	Correct defects found in unit testing Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-21 20:19:56 -08:00
Tom Eastep	62557cb98e	Correct defects found during testing of ematch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-21 12:53:33 -08:00
Tom Eastep	9c4089fc99	Initial basic filter implementation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-20 18:40:40 -08:00
Tom Eastep	fd28a12653	Allow DROP in the stoppedrules file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-07 13:19:49 -08:00
Tom Eastep	7e6fc3229d	Correct handling of default chain when a mark range is specified. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-07 13:15:51 -08:00
Tom Eastep	42dd8dfee9	Change license to GPLv2+ and update copyrights Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-04 09:48:27 -08:00
Tom Eastep	5a7e458104	Backout ematch stuff for now Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-03 12:01:56 -08:00
Tom Eastep	7e1a310929	Implement ipset matches in tcfilters Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-03 09:35:34 -08:00
Tom Eastep	78ecf9bdc8	Finish up ipset extensions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-03 09:23:14 -08:00
Tom Eastep	1771bb75cf	Finish ipset match option implementation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-02 14:43:55 -08:00
Tom Eastep	b4847d6a01	New IPSET MATCH extensions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-02 09:36:35 -08:00
Tom Eastep	48ceed9ecb	Make tcpflags the default. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 15:10:38 -08:00
Tom Eastep	1083dd8c26	Allow ?COMMENT in the mangle file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 08:02:17 -08:00
Tom Eastep	5e7cd855c2	Correct typo in Tc.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:53:38 -08:00
Tom Eastep	2c2aaf262c	Add IP[6]TABLES support for the conntrack file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:18:36 -08:00
Tom Eastep	6c990a7253	Logically OR builtin definitions from the actions file if the builtin exists Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:18:00 -08:00
Tom Eastep	f7bbac6ea8	Make tcrules/mangle similar to notrack/conntrack. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2014-01-01 07:15:56 -08:00
Tom Eastep	4c1b83beef	Tweaks to the Tc.pm module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-31 11:42:38 -08:00
Tom Eastep	ac6a506e35	Allow logging from the RAW table Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-31 11:04:43 -08:00
Tom Eastep	11e61ec6e5	Add chain information to the builtin_target table. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-31 08:22:58 -08:00
Tom Eastep	5985a6e9b3	Implement IP[6]TABLES in the rules files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 13:46:58 -08:00
Tom Eastep	66a04e4819	Allow inline matches with IP[6]TABLES Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 10:13:00 -08:00
Tom Eastep	1634267faa	Rename JUMP to IP[6]TABLES. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 10:12:33 -08:00
Tom Eastep	c8866ef8bf	Correct handling of columns with embedded spaces Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-29 08:56:14 -08:00
Tom Eastep	6fe06c82c8	More switch from tcrules to mangle Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-28 15:24:05 -08:00
Tom Eastep	543446f8d7	Integrate tcrules and mangle processing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-28 14:24:36 -08:00
Tom Eastep	a1222d10cb	change 'marks' file to 'mangle' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-28 10:03:23 -08:00
Tom Eastep	3dba1f5bee	Tested version of the marks file handler Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-27 12:38:22 -08:00
Tom Eastep	3960aaee4c	Consolidate declarations in process_mark_rule(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-24 09:49:10 -08:00
Tom Eastep	5419109880	Correct syntax errors in new mars handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-24 09:04:54 -08:00
Tom Eastep	584b0ac50e	Some small tweaks to the marks file processing Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-24 07:25:40 -08:00
Tom Eastep	4c2cedb670	Add get_target_param1() that doesn't accept the <action>/<param> syntax Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-19 09:17:11 -08:00
Tom Eastep	f32a777099	Fix INLINE in tcrles Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-18 09:19:35 -08:00
Tom Eastep	cd5be38cfb	Eliminate silly extra loop in accounting processing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-18 09:19:16 -08:00
Tom Eastep	2894bb9656	Move INLINE processing into the Chains module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-16 12:31:35 -08:00
Tom Eastep	fad3b42bd3	Correct line split in the Accounting module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-16 07:40:41 -08:00
Tom Eastep	4e4e7cac1d	Redefine the -i option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-15 11:23:20 -08:00
Tom Eastep	6d72cb3138	Correct update inline Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-15 09:32:09 -08:00
Tom Eastep	9abe60bc27	Implement the -i option of upgrade Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-14 17:54:10 -08:00
Tom Eastep	33c5893bdb	Implement INLINE_MATCHES Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-14 13:35:01 -08:00
Tom Eastep	2bc329aa1d	Add INLINE support to the masq file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-13 15:44:16 -08:00
Tom Eastep	95abeaea24	Finish INLINE in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-01 09:25:32 -08:00
Tom Eastep	75258083e3	Cleanup of column splitting change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-12-01 09:24:49 -08:00
Tom Eastep	bf44e514e3	Keep parentheses balanced when splitting a line. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-30 14:13:42 -08:00
Tom Eastep	e5d250750b	Correct handling of ?SECTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-27 07:53:33 -08:00
Tom Eastep	d63262a0cb	change ZONE2ZONE default to '-'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-24 08:16:28 -08:00
Tom Eastep	3870157898	Issue warning on bare SECTION headings. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-24 07:58:02 -08:00
Tom Eastep	80d54ec40b	Implement ?SECTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-18 06:57:54 -08:00
Tom Eastep	855cb6e7f4	Correct handling of HFSC classes with DMAX but no UMAX Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-16 08:07:23 -08:00
Tom Eastep	e14d92c5ac	Add DROP support in tcrules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-04 10:50:11 -08:00
Tom Eastep	ca3385d1be	Remove superfluous '[' from character set. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-21 09:28:21 -07:00
Tom Eastep	5823411091	Correct typo in a regular expression. - Re-enable \|<mark> in the tctrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-21 07:04:23 -07:00
Tom Eastep	66c2fca2b0	Eradicate the use of 'fgrep' - Busybox on Leaf Bering does not have fgrep Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-14 07:15:08 -07:00
Tom Eastep	b27e3d2fff	Merge branch '4.5.21'	2013-10-08 13:17:41 -07:00
Tom Eastep	5e67808abd	Don't add host route in default table. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 11:27:41 -07:00
Tom Eastep	fa500b9ea2	Correct H323 and netbios-ns handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:24:52 -07:00
Tom Eastep	b6d7e9ea96	Work around emacs bug Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:24:40 -07:00
Tom Eastep	0e61c2f210	Correct H323 and netbios-ns handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:20:46 -07:00
Tom Eastep	3c9d984835	Correct typo - list_split s/b split_list Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:19:07 -07:00
Tom Eastep	4917500f12	Work around emacs bug Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 07:13:01 -07:00
Tom Eastep	50b7a81b13	Correct typo - list_split s/b split_list Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 06:56:16 -07:00
Tom Eastep	8c4bbf0c85	Implement REAP_OPTION capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-07 07:54:52 -07:00
Tom Eastep	5b515f007b	Fix 'monthdays' in the TIME column. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-30 15:43:17 -07:00
Tom Eastep	d7cbd1da21	Allow actions to manipulate the current comment from Perl. - Added set_comment() - moved push/pop_comment() to the :DEFAULT export	2013-09-23 12:21:44 -07:00
Tom Eastep	eb75d0eef4	Add 'nohostroute' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-18 16:49:54 -07:00
Tom Eastep	5dbcdd65e2	Force 'inline' for REJECT_ACTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-10 07:37:53 -07:00
Tom Eastep	dc5c0dc069	Validate default log levels - Name the .conf option involved in error messages Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-06 16:00:15 -07:00
Tom Eastep	87ae801c15	Use the -w ip[6]tables option when available. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-04 10:16:36 -07:00
Tom Eastep	67603c5eb3	Implement REJECT_ACTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-01 09:14:10 -07:00
Tom Eastep	1540e50cce	Remove blank line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-31 10:07:41 -07:00
Tom Eastep	0a2f6c18cc	Correct typo in prog.footer Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-13 07:03:20 -07:00
Tom Eastep	32763e998b	Make -v work with the status command - Also document exit status Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-13 06:52:46 -07:00
Tom Eastep	a10aea280b	Add some abbreviations for common commands Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-06 07:05:47 -07:00
Tom Eastep	ceffc000eb	Correct Typo Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-05 08:32:17 -07:00
Tom Eastep	6615c1f736	Clarify usage of Interface Option Chains Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-04 09:01:09 -07:00
Tom Eastep	83d1aa6682	Allow OPTIMIZE=All - Remove use of literal 4096 from OPTIMIZATION checks. - Moved constant declarations to the Config module. - Documented that level 1 is ignored when level 4 is specified. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-29 10:08:35 -07:00
Tom Eastep	aabb22a50f	Add the TRACK_RULES option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-24 07:22:51 -07:00
Tom Eastep	7aa33c140d	Add an AutoBL action with helper AutoBLL Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-17 10:19:18 -07:00
Tom Eastep	891e3e0e1d	Use the --reap option in sticky recent rules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 14:46:39 -07:00
Tom Eastep	5c7500e13e	Display the current time as an integer in 'show event[s]' output Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 09:46:08 -07:00
Tom Eastep	09240da55a	Change the external name of MARK_ANYWHERE to 'Mark in the filter table' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 09:45:20 -07:00
Tom Eastep	89f16bdb37	Include a current time event in /proc/net/xt_recent/ Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 07:14:22 -07:00
Tom Eastep	8e30831385	Resolve merge conflicts Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-11 14:20:38 -07:00
Tom Eastep	d2725fcd87	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code	2013-07-11 14:16:19 -07:00
Tom Eastep	9535a7d7df	Rename 'Trigger' to 'Event' and document Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-11 10:39:21 -07:00
Tom Eastep	3c6df56b57	Implement Triggers Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-10 13:27:58 -07:00
Tom Eastep	411ca87ec3	Allow logging rules with more than 15 ports Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-08 15:59:54 -07:00
Tom Eastep	948a7fccc2	Enhance a comment Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-07 12:52:04 -07:00
Tom Eastep	73060a3761	Correct typo in dropBcast() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-06 07:58:21 -07:00
Tom Eastep	cd83d7727c	Restore handle_original_dest(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:51:06 -07:00
Tom Eastep	5121634457	Add ihandle_original_dest() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:37:24 -07:00
Tom Eastep	131c1f432b	Add iverify_source_interface() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:07:09 -07:00
Tom Eastep	03885f71d3	Create add_expanded_ijump() that breaks long lines Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-03 15:13:48 -07:00
Tom Eastep	b735b93378	Re-factor irule generation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-03 10:59:09 -07:00
Tom Eastep	5ce5d5e607	Delete superfluous blank line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 15:03:50 -07:00
Tom Eastep	00c5985458	Rename clone_rule() to clone_irule() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:38:16 -07:00
Tom Eastep	1a44b66656	Cleaner handling of trailing spaces from log_irule_limit. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:32:35 -07:00
Tom Eastep	b215cf379a	Generate a warning when Limit is invoked. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:31:29 -07:00
Tom Eastep	3ec6745df9	Use log_irule_limit() internally where possible. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 11:48:02 -07:00
Tom Eastep	55be5b0119	Add log_irule_limit() and log_irule() functions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 11:47:19 -07:00
Tom Eastep	42a649d093	Create $globals{LOGILIMIT} Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 09:00:36 -07:00
Tom Eastep	18e7e43b2f	Eliminate globals{STATEMATCH} Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-01 16:01:57 -07:00
Tom Eastep	6803ce5d41	Add constants for %used values. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-01 15:36:16 -07:00
Tom Eastep	565fb74795	Correct bridge detection and 'qt' implementation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 13:07:38 -07:00
Tom Eastep	fc754040d5	Avoid shell error when detecting owner name match Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 09:51:32 -07:00
Tom Eastep	cc5a59231b	Make qt() work correctly when tracing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 07:17:15 -07:00
Tom Eastep	25f96e6a88	Reword unreachable warning (again) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-20 10:50:28 -07:00
Tom Eastep	71bcd11ab6	Make ?...shell/perl directives case insensitive Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-20 10:39:39 -07:00
Tom Eastep	4bd35a0b93	Allow 'routeback=0' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-16 08:37:53 -07:00
Tom Eastep	cb132e2421	Include the chain name in the 'unreachable' warning. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-11 06:29:07 -07:00
Tom Eastep	53f1cd40df	Add 'unmanaged' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-10 12:36:18 -07:00
Tom Eastep	c653d9ce83	Only issue one 'unreachable' warning per chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-08 10:02:19 -07:00
Tom Eastep	254d2037ef	Delete unused variable. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 15:34:25 -07:00
Tom Eastep	cb8e76b1d2	Add sub get_opttype to emphasize where rule option types are used. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 12:49:20 -07:00
Tom Eastep	2b579d2dff	Small efficiency change in helper processing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 12:48:22 -07:00
Tom Eastep	fc3e3dbf3c	Cosmetic change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-03 10:53:33 -07:00
Tom Eastep	81acedd1b3	Reword the 'unreachable' warning. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 17:13:41 -07:00
Tom Eastep	d8f53cc0a9	Merge branch '4.5.17' Conflicts: Shorewall/Perl/Shorewall/Chains.pm	2013-06-02 15:31:45 -07:00
Tom Eastep	481811d29f	Merge NFACCT and EXPENSIVE matches during optimization Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 13:29:13 -07:00
Tom Eastep	3867902b27	Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 07:31:32 -07:00
Tom Eastep	adf51d0059	Revise the unreachable warning stuff. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 16:32:46 -07:00
Tom Eastep	7dbd50708b	Clear the current filename after last file is processed. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:35 -07:00
Tom Eastep	4340bcffb1	Don't optimize away a rule that includes nfacct matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:25 -07:00
Tom Eastep	4a05e56d6d	Disable warning on unreachable rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:16 -07:00
Tom Eastep	2d8078033c	Clear the current filename after last file is processed. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:03:10 -07:00
Tom Eastep	c5f2eeea80	Don't optimize away a rule that includes nfacct matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:02:39 -07:00
Tom Eastep	5343243f6b	Disable warning on unreachable rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:01:55 -07:00
Tom Eastep	4865899018	Avoid a forward jump for local zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-30 06:52:09 -07:00
Tom Eastep	9b68204865	Generate an 'unreachable rule(s)' warning. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-30 06:17:22 -07:00
Tom Eastep	a550dd3eed	Issue a warning when a rule is dropped do to terminated chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-29 21:01:07 -07:00
Tom Eastep	f0aa29222f	Correct minor IPv6 TPROXY bug Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-29 07:18:46 -07:00
Tom Eastep	eaf1d0e5c2	Another error check for hosts files and loopback zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 10:00:07 -07:00
Tom Eastep	446f764d19	Allow config with only local and firewall zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 08:03:44 -07:00
Tom Eastep	9b0b3d4b70	Correct ICMPV6 type name translation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 08:03:19 -07:00
Tom Eastep	a48a4b7a2e	Don't allow fowarding between local zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 06:14:44 -07:00
Tom Eastep	8743b64e00	Export 'shorewall' from the Config module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-27 06:52:45 -07:00
Tom Eastep	2de0fbf7d0	Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 14:06:51 -07:00
Tom Eastep	f89c704d01	Disallow 'virtual' physical interfaces. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 08:47:44 -07:00
Tom Eastep	0b5a316cfc	Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 08:03:54 -07:00
Tom Eastep	31f9ea5b93	Add progess and warning messages to 'update -D' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 16:31:55 -07:00
Tom Eastep	dde1f0a779	Only enable helpers during a 'clear' operation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 16:31:27 -07:00
Tom Eastep	60d0a50d9d	Add some warning/progress messages to help understand 'update -D' behavior. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 13:20:12 -07:00
Tom Eastep	064f9f974c	Cosmetic change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-23 09:49:25 -07:00
Tom Eastep	fd11eb7d82	Omit fw->fw jumps when there is a local zone. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 09:19:34 -07:00
Tom Eastep	9e77bb5499	Ensure correct match ordering with trivial exclusion Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 08:46:22 -07:00
Tom Eastep	8df8fe990a	Allow 'local' zone to work with 'destonly' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 07:34:04 -07:00
Tom Eastep	ac02c484f5	Change 'local' interface option to a zone type. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-19 15:35:20 -07:00
Tom Eastep	5ec72dad6c	Add routes for standard tables when there are no providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 15:32:05 -07:00
Tom Eastep	f6a55bbf05	Allow the '-V' option in the CLI programs. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 14:29:36 -07:00
Tom Eastep	739f3779f5	Generate warnings for local->non-firewall and non-firewall->local rules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 07:51:12 -07:00
Tom Eastep	2e293dd356	Make 'local,destonly' work correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 14:36:51 -07:00
Tom Eastep	a5412cff38	Issue a warning when a rule will be optimized away due to 'destonly'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 09:30:59 -07:00
Tom Eastep	46a6a7b258	Correct earlier optimization. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 07:27:57 -07:00
Tom Eastep	105d1db85d	Cosmetic change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 11:24:09 -07:00
Tom Eastep	200d347ac8	Small Efficiency Change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 10:52:04 -07:00
Tom Eastep	c8133145e6	Add support for "all+" in the policy file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 09:01:12 -07:00
Tom Eastep	9178ecbab0	Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 10:38:44 -07:00
Tom Eastep	d06a7b55b6	Add a 'destonly' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 10:37:40 -07:00
Tom Eastep	2fb01bec8d	Don't assume 'destonly' with 'local'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:58:37 -07:00
Tom Eastep	6551d67b2e	Call delete_chain_and_references recursively. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:29:29 -07:00
Tom Eastep	4b76d8c462	Handle optimize level 0 in the IPV6 nat table. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:28:25 -07:00
Tom Eastep	1bb5b89ee1	Add the 'local' interface option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:27:12 -07:00
Tom Eastep	c3901f1161	Release mutex on error. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-09 09:57:09 -07:00
Tom Eastep	56318e6cc8	Try to ensure that cp doesn't copy the firewall script to itself. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-06 09:22:16 -07:00
Tom Eastep	13c90e2aef	Correct my update to Mr-4's bup patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 18:40:14 -07:00
Tom Eastep	fdfdb49951	Apply Mr-4's priority->perf patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 14:05:03 -07:00
Tom Eastep	61cb105c02	Apply Mr-4's noautosrc patch (modified) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 14:00:25 -07:00
Tom Eastep	4621dccd53	Apply Mr-4's special route handling in COPY (modified). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 13:27:34 -07:00
Tom Eastep	b83ca4812b	Include trailing space in a regular expression. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-03 08:36:38 -07:00
Tom Eastep	80efd095a8	Correct handling of INLINE without '-j' in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 14:52:48 -07:00
Tom Eastep	d6961c4c3b	Clean up the temporary chains sooner. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 14:48:27 -07:00
Tom Eastep	54f5aaca63	Fix handling of CT_TARGET Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 11:15:36 -07:00
Tom Eastep	1012251957	Apply Mr-4's 4a patch (modified) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-27 07:04:40 -07:00
Tom Eastep	20d38e8b52	Centralize the validation of nfacct object names. - Also correct a missing ' ' from the output generated by INLINE freeform input. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-26 09:09:08 -07:00
Tom Eastep	52f5ae15d1	Apply Mr-4's cosmetic patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-25 17:29:41 -07:00
Tom Eastep	7e830e5df4	Allow special characters in nfacct names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-25 10:07:49 -07:00
Tom Eastep	f543c3bd1e	Finish Mr-4's NFACCT patch - Correct indentation - Remove '$type' argument to split_nfacct_list - Update manpages. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-23 06:55:30 -07:00
Dash Four	68c7782e7d	Shorewall 4.5.16 Beta 6 Tom Eastep wrote: > On 4/22/13 5:07 PM, "Dash Four" <mr.dash.four@googlemail.com> wrote: > > >> Anyway, I've just implemented individual "!" in the NFACCT statement by >> hacking your Accounting.pm - I can attach a small patch for >> review/inclusion if you are interested, but be aware that it does change >> the syntax slightly in a sense that "!" needs to be specified for each >> object within NFACCT() - "NFACCT(...)!" is no longer allowed. >> > > Sure -- send it along. > Attached - the above caveat applies though. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 21:17:59 -07:00
Tom Eastep	4faf3728f2	Implement INLINE in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 19:00:29 -07:00
Tom Eastep	ad70240347	Remove a blank line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 09:36:25 -07:00
Tom Eastep	739013f248	Handle nfacct object lists in parens following an ipset name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 07:56:56 -07:00
Tom Eastep	6d57e7a0ce	Mark a rule as complex if an option value is a reference. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-21 14:44:30 -07:00
Tom Eastep	5ad69aa650	Add CHAIN_SCRIPTS option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-21 07:30:31 -07:00
Tom Eastep	1b9fd642bb	Add INLINE to the accounting file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-20 08:02:02 -07:00
Tom Eastep	7c8f1ae020	Correct HELPERS handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 16:35:19 -07:00
Tom Eastep	1fd62e1612	Restore order in the NFACCT target. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 11:11:37 -07:00
Tom Eastep	6c2679ce75	Allow incrementing an nfacct object when an ipset matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 10:44:57 -07:00
Tom Eastep	610bdf1aac	Correct merge_rules() for LAST matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 08:40:01 -07:00
Tom Eastep	cbdca08fea	Fix for multiple nfacct patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 16:37:54 -07:00
Tom Eastep	b87b4b61d8	Allow multiple nfacct matches in one accounting rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 16:14:57 -07:00
Tom Eastep	9c010691a3	Always place 'nfacct' last Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 15:26:34 -07:00
Tom Eastep	8ef11a376b	Document 'HELPERS=none'. - Also make 'check -u' work correctly regarding HELPERS= Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 11:30:47 -07:00
Tom Eastep	4d686e873b	Implement 'HELPERS=none' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 10:30:56 -07:00
Tom Eastep	f55e34dd8b	Don't allow options on targets that don't accept them. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 17:18:01 -07:00
Tom Eastep	668bd4a1a4	Accept complex log levels with INLINE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 16:59:14 -07:00
Tom Eastep	5d5f168f25	Don't clone rule unconditionally in format_rule() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 13:35:32 -07:00
Tom Eastep	938bd72844	Better handling of the matches rule member. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 10:39:32 -07:00
Tom Eastep	8b91575c9e	Maintain order when multiple instances of a match are separated. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 06:52:32 -07:00
Tom Eastep	0da38cc38e	Order matches in rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-12 11:37:29 -07:00
Tom Eastep	6950cd2576	Allow '-' in a match name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 18:30:02 -07:00
Tom Eastep	ff4fb21044	Require that the '-j' part of a free-form rule be known. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 18:29:45 -07:00
Tom Eastep	614c5e6155	Assume LOG if a level is specified with INLINE. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 14:16:34 -07:00
Tom Eastep	35b0b4a4f9	Support A_ACCEPT! Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 13:37:49 -07:00
Tom Eastep	c34cf333ba	Allow both {...} and ';' with INLINE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 12:57:59 -07:00
Tom Eastep	b33bdeaa02	Allow a parameter to INLINE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 11:54:58 -07:00
Tom Eastep	38f3ae0934	Handle 'NONE' policy correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 09:35:27 -07:00
Tom Eastep	beec4a188f	Implement INLINE action (again). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 09:15:59 -07:00
Tom Eastep	f85d548d40	Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 06:23:22 -07:00
Tom Eastep	ee2e85c0fb	Correct generation of the blacklog chain when disposition is audited Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-10 16:43:38 -07:00
Tom Eastep	186f71fa96	Add NEW_TOS_MATCH capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 14:04:16 -07:00
Tom Eastep	477e2bc455	Additional corrections to INLINE action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 09:41:43 -07:00
Tom Eastep	273f109daf	Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 09:37:12 -07:00
Tom Eastep	50494f667c	Implement INLINE action Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-08 17:30:00 -07:00
Tom Eastep	183a0a75a1	Implement 'builtin' actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-08 16:14:26 -07:00
Tom Eastep	9e10c38e26	Don't emit 'quantum' calculation unless the qdisc is 'htb' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-03 08:39:18 -07:00
Tom Eastep	ee66a45e2e	Correct comments in the Chains module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-02 12:52:10 -07:00
Tom Eastep	c200efa6d7	Revert "Disable script generation while processing TC" This reverts commit `5b18ff91ca`.	2013-04-01 15:23:16 -07:00
Tom Eastep	5b18ff91ca	Disable script generation while processing TC Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-01 09:05:12 -07:00
Tom Eastep	ef5818ce7e	Merge branch '4.5.15'	2013-03-31 07:08:49 -07:00
Tom Eastep	58ef8e0ec3	Correct bounds check in do_dscp() - "< 0x2f" s/b "< 0x3f" Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-31 07:07:21 -07:00
Tom Eastep	8a84c1c371	Avoid 'echo' failure during 'enable'. - in the case where the kernel doesn't know about /proc/sys/net/ipv6/conf/x/accept_ra Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-31 07:02:11 -07:00
Tom Eastep	1db5741edd	Merge branch '4.5.15' Conflicts: Shorewall/Perl/Shorewall/Proc.pm	2013-03-30 18:08:17 -07:00
Tom Eastep	1139e1a09c	Establish /proc/sys/net/ipv6/conf/X/forwarding during 'enable' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 17:26:50 -07:00
Tom Eastep	d415de1883	Add the accept_ra Shorewall6 interface option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 16:44:18 -07:00
Tom Eastep	448d957e48	Fix use of names for DSCP. - From Thibaut Chèze Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 07:20:10 -07:00
Tom Eastep	8fe7963631	Revert another replace->add change. - Also includes a cosmetic change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-27 06:57:49 -07:00
Tom Eastep	6334b09653	Add a comment about why the 'id' member of builtin tables is initialized in process_providers() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 14:30:42 -07:00
Tom Eastep	e572d6ce50	Use the 'id' member in copy_and_edit_table(). - Also add prohibit and unreachable to the existing blackhole case. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:38:13 -07:00
Tom Eastep	792a19bf4b	Initialize the 'id' member of reserved tables after .conf has been read. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:36:57 -07:00
Tom Eastep	61e21de41b	Revert bad hunk from last change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:00:16 -07:00
Tom Eastep	43932f2bbd	Cleanup of table id/number and 'route replace' erradication Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-25 07:35:30 -07:00
Tom Eastep	6e5f00062c	Revert "Use 'replace' rather than 'add' for routes defined in the routes file." This reverts commit `215fd9e234`. Conflicts: Shorewall/Perl/Shorewall/Providers.pm	2013-03-24 14:19:31 -07:00
Tom Eastep	b5ea4067e4	Implement USE_RT_NAMES Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-24 10:56:38 -07:00
Tom Eastep	0c30e7c013	Uniform handling of VLSM width. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-23 09:19:26 -07:00
Tom Eastep	536fea27a5	Detect duplicate routes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 14:59:35 -07:00
Tom Eastep	215fd9e234	Use 'replace' rather than 'add' for routes defined in the routes file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 14:55:27 -07:00
Tom Eastep	4c0a0e0ff8	Don't emit 'qt ' in the undo_x_routing files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 13:20:27 -07:00
Tom Eastep	9e5cf92a59	Merge branch '4.5.14'	2013-03-21 12:00:20 -07:00
Tom Eastep	3ac6835650	Handle IPv6 /32 networks correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-21 11:30:59 -07:00
Tom Eastep	1e866eac28	Implement the other forms of NULL routing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-16 08:20:52 -07:00
Tom Eastep	b10218e773	Add a 'UDPLITE Port Redirection' capability. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 10:07:52 -07:00
Tom Eastep	8442477224	Add Enhanced Multi-port match capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 09:04:47 -07:00
Tom Eastep	fd2fcc996f	Don't allow port redirection with UDPLITE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 08:32:45 -07:00
Tom Eastep	8c4c856caa	Issue a warning if the contents of the DUPLICATE column may be invalid. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-09 07:57:13 -08:00
Tom Eastep	a167e3449e	Avoid Perl run-time errors when checking a provider interface. - Handle case where a provider interface matches a wildcard Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-09 07:56:16 -08:00
Tom Eastep	b871fc689c	Merge branch 'FETCH_HEAD' into 4.5.14	2013-03-09 07:11:47 -08:00
Tom Eastep	cfe2bd11b0	Allow 'none' in the COPY column when the DUPLICATE column is empty. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 19:18:13 -08:00
Tom Eastep	bd64baa8d9	Require at least one zone for a provider Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 13:08:23 -08:00
Tom Eastep	e1f7a9dbf8	Reverse an earlier silly patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 10:38:13 -08:00
Tom Eastep	4586568649	Merge branch '4.5.14' of ssh://git.code.sf.net/p/shorewall/code	2013-03-08 08:00:43 -08:00
Tom Eastep	b4d4083513	Split large '--ports' lists across multiple rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 07:38:23 -08:00
Tom Eastep	91f5a9dec0	Make 'main' work correctly when specified in the routes file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 07:26:49 -08:00
Tom Eastep	50030bcc2d	Revert "Don't allow routes to be added to non-Provider tables." This reverts commit `6f9a1ba29d`.	2013-03-08 06:55:12 -08:00
Tom Eastep	8eacbe287b	Correction to MULTIPORT patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 18:11:59 -08:00
Tom Eastep	6f9a1ba29d	Don't allow routes to be added to non-Provider tables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 17:18:57 -08:00
Tom Eastep	6ba02c4a24	Merge branch 'master' into 4.5.14 Conflicts: Shorewall/Perl/Shorewall/Providers.pm	2013-03-07 08:29:30 -08:00
Tom Eastep	c4f0be96ac	Require that interfaces in the COPY column be known. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:32:56 -08:00
Tom Eastep	7da10ff923	Additional change to copy blackhole routes. - Add 'blackhole' to the outer case statement - Add RFC1918 blackhole routes before starting providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:58 -08:00
Tom Eastep	ace9a49106	Allow addition of blackhole routes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:41 -08:00
Tom Eastep	7f2c933cb3	Copy blackhole routes to secondary tables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:18 -08:00
Tom Eastep	5aa731e963	Additional change to copy blackhole routes. - Add 'blackhole' to the outer case statement - Add RFC1918 blackhole routes before starting providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 06:52:16 -08:00
Tom Eastep	06e7f297f7	Allow addition of blackhole routes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 11:48:09 -08:00
Tom Eastep	216029c3a9	Copy blackhole routes to secondary tables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 11:04:23 -08:00
Tom Eastep	e12bc47546	Remove duplicate interface names in generated case statement. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 08:28:12 -08:00
Tom Eastep	384c179dd6	Avoid duplicate echo command in generated script. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 08:28:03 -08:00
Tom Eastep	32b2030e59	Remove duplicate interface names in generated case statement. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 07:03:41 -08:00
Tom Eastep	0bb62ed290	Avoid duplicate echo command in generated script. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 06:12:43 -08:00
Tom Eastep	49918b654e	Support '=' in SOURCE PORT(S) columns Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-04 09:56:10 -08:00
Tom Eastep	0857eb27d5	Another case of detecting invalid server IP address. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-02 09:08:13 -08:00
Tom Eastep	69f6149d4c	Detect missing, NIL or ALL server IP address in a DNAT rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-02 09:00:08 -08:00
Tom Eastep	5ca3b795fc	Correct IPv6 REDIRECT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 16:44:49 -08:00
Tom Eastep	9499a47a0d	Revert "Use '--to-dest' for IPv6 rather than '--to-destination'" This reverts commit `c9d8c22b60`.	2013-03-01 10:44:40 -08:00
Tom Eastep	c9d8c22b60	Use '--to-dest' for IPv6 rather than '--to-destination' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 09:03:22 -08:00
Tom Eastep	8960f72532	Handle DNAT with no port correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 07:58:58 -08:00
Tom Eastep	ee091d09eb	Allow ports with UDPLITE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-28 06:27:51 -08:00
Tom Eastep	22c614d30b	Don't allow :persistent in a MASQUERADE rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-27 12:48:27 -08:00
Tom Eastep	418034579f	Support IPv6 Masquerade Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-27 09:25:26 -08:00
Tom Eastep	78babf0941	Fixes for IPv6 DNAT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-26 10:24:25 -08:00
Tom Eastep	45d53bdb1d	Delete superfluous statement. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:50:33 -08:00
Tom Eastep	fb17de0595	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code	2013-02-25 17:29:49 -08:00
Tom Eastep	6ed1caedd0	Validate IPv4 port range in ADDRESSES column Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:29:33 -08:00
Tom Eastep	1d4f189b5f	Don't allow interior brackets in an address range. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:26:17 -08:00
Tom Eastep	7006c62892	Correct port pair handling in the snat ADDRESS column. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 15:31:36 -08:00
Tom Eastep	6b825abeb4	Catch ::<port-range> in /etc/shorewall6/snat Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 13:41:43 -08:00
Tom Eastep	f2ee46b83e	Correct IPv6 address range parsing in handle_one_masq1 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 13:37:22 -08:00
Tom Eastep	e873cb28f4	Correctly handle a port number/range with an address variable - ADDRESSES column of the masq/snat files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 08:00:15 -08:00
Tom Eastep	de1a5a8024	Handle SNAT 'ADDRESS' without enclosing [...] Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 06:42:19 -08:00
Tom Eastep	34c6013f1b	Handle missing provider in a masq/snat entry. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-24 08:12:02 -08:00
Tom Eastep	82f9ba8bb7	Correct detection of IPv6 PERSISTENT_SNAT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 12:59:38 -08:00
Tom Eastep	6035d49ede	Correct NAT capability required error message. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 11:57:32 -08:00
Tom Eastep	67ef1f8b93	Correct detection of IPv6 NAT_ENABLED. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 11:57:07 -08:00
Tom Eastep	0349a9a88c	Rename the IPv6 masq file 'snat'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 13:05:24 -08:00
Tom Eastep	2591a17946	Cosmetic change to the output with the '-r' option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 11:59:57 -08:00
Tom Eastep	b562f7f311	Allow specification of destination addresses in Shorewall6 masq. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 08:34:03 -08:00
Tom Eastep	ce28c70c60	SNAT and DNAT support for IPv6. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 07:08:08 -08:00
Tom Eastep	d0b2d05d5b	Add optional argument to have_capability(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-18 15:15:26 -08:00
Tom Eastep	088fc1a3a3	Report used/required capabilities Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-18 08:48:18 -08:00
Tom Eastep	6d92d293b8	Use 'here documents' in the usage() function. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-17 07:44:10 -08:00
Tom Eastep	7859267539	Eliminate $globals{CONFDIR} Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-14 17:24:49 -08:00
Tom Eastep	c68513672d	Comments and documentation. - Removes the Actions-4.5 article Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-14 08:48:45 -08:00
Tom Eastep	93b3fd9be5	Correct IPv6 address checking (again) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 13:37:26 -08:00
Tom Eastep	138638cb1a	Effectively use the specified directory as the CONFIG_PATH til .conf is read Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 07:45:24 -08:00
Tom Eastep	c5bb16ac26	Another fix for IPv6 address lists. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 07:44:19 -08:00
Tom Eastep	f44becdee1	Rename BLACKLIST_LOGLEVEL to BLACKLIST_LOG_LEVEL for consistent naming. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-12 07:47:02 -08:00
Tom Eastep	84c5822c20	Correct IPv6 List Handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-11 16:45:03 -08:00
Tom Eastep	b4977db5b2	Add %section_states that maps sections to their related state(s). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-11 14:59:48 -08:00
Tom Eastep	8d0a80a7e2	Merge branch '4.5.13'	2013-02-11 06:40:11 -08:00
Tom Eastep	b9d5b92f1b	Correct handling of expressions consisting of a single number. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 15:19:30 -08:00
Tom Eastep	b349cc0f22	A better fix for inline default action with parameters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:29:30 -08:00
Tom Eastep	a312bfbb42	Add a section => name function map Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:27:43 -08:00
Tom Eastep	c35e753b1d	A better fix for inline default action with parameters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:16:18 -08:00
Tom Eastep	8b4349b356	Merge branch '4.5.13'	2013-02-10 09:05:41 -08:00
Tom Eastep	54c43396f0	Correct default action handling: - isolate basic target before testing for action/inline - delete the action chain if appropriate. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:00:13 -08:00
Tom Eastep	f9dc89dc61	Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 07:56:04 -08:00
Tom Eastep	60e3f1015e	Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 07:51:35 -08:00
Tom Eastep	8e0a90e077	Merge branch '4.5.13'	2013-02-09 17:54:06 -08:00
Tom Eastep	cadf2747fe	Correct reset_optflags() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 17:53:40 -08:00
Tom Eastep	810ebe32ce	Merge branch '4.5.13'	2013-02-09 13:15:44 -08:00
Tom Eastep	c04c61b314	Correct typos in check_rules(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 11:42:54 -08:00
Tom Eastep	a8fdfa4e48	Create an ESTABLISHED chain Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 09:32:12 -08:00
Tom Eastep	a4297381e9	Don't ACCEPT untracked packets unless UNTRACKED_DISPOSITION=ACCEPT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 09:15:05 -08:00
Tom Eastep	eaa6d72a4f	Allow parameters to be omitted in action invocations. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 07:07:01 -08:00
Tom Eastep	62a567b550	Treat each -m conntrack subtype as a separate match Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-08 10:08:23 -08:00
Tom Eastep	e4f1c62e71	Improve handling of nested state actions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-08 09:09:20 -08:00
Tom Eastep	b9e504683e	Prevent a state action from invoking another one. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-07 16:52:06 -08:00
Tom Eastep	aae6e001fe	Convert dropInvalid and allowInvalid to inline actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-07 11:21:13 -08:00
Tom Eastep	aa528dd075	Revert "Convert allowInvalid and dropInvalid into macros" This reverts commit `272e1d330c`.	2013-02-07 09:09:56 -08:00
Tom Eastep	e4ae242123	Another tweak to check_state() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 12:07:51 -08:00
Tom Eastep	272e1d330c	Convert allowInvalid and dropInvalid into macros Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 09:54:12 -08:00
Tom Eastep	a66256b25b	Additional refinements of check_state() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 08:16:42 -08:00
Tom Eastep	11b976fb36	Correct reference type in check_state() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-05 19:55:22 -08:00
Tom Eastep	a6ccd53fe0	Unconditionally use '-j' to branch to a state chain or DISPOSITION. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:17:49 -08:00
Tom Eastep	b22b63b1c3	Don't use '-g' when DISPOSITION is CONTINUE. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:09:17 -08:00
Tom Eastep	615df6ab8f	Handle 'RETURN' in state chain with terminating disposition. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:08:20 -08:00
Tom Eastep	d8214885f2	Assume that the conntrack state value in a rule is not a reference. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 08:29:50 -08:00
Tom Eastep	475942deb9	Normalize rules prior to combine_state tests. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 18:14:14 -08:00
Tom Eastep	f1707d2ace	More state rule check fixes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 18:02:02 -08:00
Tom Eastep	30d96afb69	Push/pop $actionresult. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 12:43:28 -08:00
Tom Eastep	014b4ddc50	Combine adjacent rules differing only in conntrack state match. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 09:03:22 -08:00
Tom Eastep	5b9d1a6159	Handle UNTRACKED_DISPOSITION=ACCEPT correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 07:59:47 -08:00
Tom Eastep	752463bfab	Fix TCPFlags Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 22:19:13 -08:00
Tom Eastep	ebef29e161	Handle port numbers being passed to one of the tcp-specific actions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 12:48:54 -08:00
Tom Eastep	9b30f48ba0	Correct handling of actions when @chain is altered. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 10:57:08 -08:00
Tom Eastep	8249831e6d	Detect some state conflicts Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 09:32:57 -08:00
Tom Eastep	cc1054be66	Correct handling of audited dispositions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 09:30:25 -08:00
Tom Eastep	c68d4c6e27	Simplify Perl from actions even further. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 15:55:39 -08:00
Tom Eastep	752e960f2f	Allow specification of the action type via perl_action_helper(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 12:59:48 -08:00
Tom Eastep	a5d3b1f470	Remove requirement that matches and proto end with a space in perl helper API. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 12:29:30 -08:00
Tom Eastep	abca3a2024	Improve maintainability of @colums vis a vis @rulecolumns. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 10:47:40 -08:00
Tom Eastep	755d605578	Make %statetable global Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:26:47 -08:00
Tom Eastep	78db4abef5	Remove some redundant local variables from finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:02:23 -08:00
Tom Eastep	fc73c3934b	Replace BLACKLISTNEWONLY with BLACKLIST Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:00:47 -08:00
Tom Eastep	75fb164234	Don't issue fatal error if a proto other than tcp is passed to a tcp-only inline Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 10:31:20 -08:00
Tom Eastep	27c5e67632	Rename process_rule to process_raw_rule and process_rule1 to process_rule Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 10:13:48 -08:00
Tom Eastep	61d8f704f9	Correct rule-generation detection in perl_action_helper Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 09:43:12 -08:00
Tom Eastep	f33e36b61e	Raise an error if a protocol other than TCP is passed to a TCP-only inline Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 07:46:50 -08:00
Tom Eastep	670931c987	Initialize the columns array to '-'s. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 07:46:07 -08:00
Tom Eastep	316b67473e	Merge branch 'master' into 4.5.13 Conflicts: Shorewall/Perl/Shorewall/Rules.pm Shorewall/action.Established Shorewall/actions.std	2013-01-29 07:30:52 -08:00
Tom Eastep	42f46ea5e7	Accurately determine if an inline action generates a rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 20:46:20 -08:00
Tom Eastep	49166efdca	Make the TCP standard actions inline Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 18:01:08 -08:00
Tom Eastep	5a2c1792cb	Inline the conntrack state actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 16:55:54 -08:00
Tom Eastep	a70c441458	Add CONTINUE as a possible setting for RELATED_DISPOSITION. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 11:47:45 -08:00
Tom Eastep	519861d7b2	Add CONTINUE as a possible setting for RELATED_DISPOSITION. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:58:03 -08:00
Tom Eastep	2e8eeff416	Correct error messages that include the section name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:52 -08:00
Tom Eastep	2217f89902	Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:45 -08:00
Tom Eastep	5c63444c14	Correct error messages that include the section name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:09 -08:00
Tom Eastep	cfa5d86f5c	Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:40:26 -08:00
Tom Eastep	b3b074fb61	More infrastructure Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 15:37:23 -08:00
Tom Eastep	cbbcfe355e	Infrastructure for more powerful action handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 12:37:10 -08:00
Tom Eastep	2a2e23cb17	Merge branch '4.5.13'	2013-01-27 11:26:59 -08:00
Tom Eastep	1b94c3651d	Always handle ESTABLISHED before the other connection states. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:56:41 -08:00
Tom Eastep	b1b2aa910e	Correct section handling: - Correct typo (' INVALID' -> 'INVALID' ) - Don't jump to non-existent target in finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:14:27 -08:00
Tom Eastep	aa609b87a9	Allow arbitrary actions for the various states. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:10:24 -08:00
Tom Eastep	a3a90d8d2e	Correct section handling: - Correct typo (' INVALID' -> 'INVALID' ) - Don't jump to non-existent target in finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:08:02 -08:00
Tom Eastep	6c8761c7dd	Add a "matches" argument to process_rule1 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:21:30 -08:00
Tom Eastep	9194165e89	Handle explicit CONTINUE value for UNTRACKED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:17:09 -08:00
Tom Eastep	6306103991	Clean up fix for optimize 8 performance issue Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:13:27 -08:00
Tom Eastep	749773f89a	Handle explicit CONTINUE value for UNTRACKED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:12:49 -08:00
Tom Eastep	5db317b6f7	Clean up fix for optimize 8 performance issue Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 07:55:55 -08:00
Tom Eastep	380d427a5d	Dramatically reduce the CPU cost of optimize 8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 17:46:31 -08:00
Tom Eastep	6ce392b08e	Correct handling of handle_first_entry() to avoid runaway recursion. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 12:18:17 -08:00
Tom Eastep	5fa01728ad	Pass UNTRACKED packets through the blacklist chain when BLACKLISTNEWONLY=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 09:18:20 -08:00
Tom Eastep	7bc66da663	Call handle_first_entry in the warning/error-message generators. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 07:30:50 -08:00
Tom Eastep	b8cc9c5a6a	Drop chain-ending rules whose target is 'RETURN'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-25 14:03:04 -08:00
Tom Eastep	b7273d6999	Favor low-numbered less complex synonym chains in optimization 8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-25 13:55:04 -08:00
Tom Eastep	e12b919dc1	Prefer shorter action chain names in optimize level 8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 17:25:11 -08:00
Tom Eastep	18c0956374	Fix two bugs in the UNTRACKED section implementation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 16:41:18 -08:00
Tom Eastep	6403f4959d	Implement UNTRACKED SECTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 15:42:01 -08:00
Tom Eastep	0ca93c1ac9	Unify handling of the RELATED and INVALID sections within finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 14:38:02 -08:00
Tom Eastep	a40c74ddec	Eliminate forward declaration of finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 09:04:50 -08:00
Tom Eastep	c2bc74cdfe	Add INVALID section to the rules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 08:33:59 -08:00
Tom Eastep	7fe2027229	Eliminate superfluous ESTABLISHED,RELATED rule Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 16:17:19 -08:00
Tom Eastep	8fe36422b5	Delete stale comment Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 10:44:12 -08:00
Tom Eastep	f61f5a8183	Don't copy a chain that has a single RETURN rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 09:07:07 -08:00
Tom Eastep	4ed5c5fdfe	Sort the chain list in optimize_level8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 16:00:32 -08:00
Tom Eastep	25d6164f21	Try to avoid ~combN chains when dealing with action chains. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 11:51:33 -08:00
Tom Eastep	32c475193f	Another fix for RELATED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 11:50:46 -08:00
Tom Eastep	982fabc96f	Delete $caller argument from process_default_action() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:45:54 -08:00
Tom Eastep	5beae475f5	Make optimize 8 a multi-pass operation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:12:42 -08:00
Tom Eastep	c820c54f41	Correctly handle audited RELATED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:03:27 -08:00
Tom Eastep	4a354ba5a2	Avoid internal error during standard chain completion Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 08:02:50 -08:00
Tom Eastep	e23876b582	Rename '$inline' to '$action' in policy_rules() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 07:36:50 -08:00
Tom Eastep	64e76599e0	Correct handling of default actions that set Shorewall variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 16:15:04 -08:00
Tom Eastep	c4a2f3d386	Set caller when possible in policy chains. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 14:51:16 -08:00
Tom Eastep	bc882af6c5	Allow RESET of Shorewall variables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 07:32:34 -08:00
Tom Eastep	d31221b03c	Fix variable assignment. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 07:26:10 -08:00
Tom Eastep	f403420926	Allow setting chain variables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-19 10:52:11 -08:00
Tom Eastep	b31c76cc50	Proper job of fixing DEFER_DNS_RESOLUTION=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 17:18:29 -08:00
Tom Eastep	1307770178	Allow setting action parameters Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 15:05:14 -08:00
Tom Eastep	95aab78c0d	Add infrastructure to delete the %usedactions entry for an action chain if the chain parameters are modified. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 14:54:57 -08:00
Tom Eastep	4587430e4a	Move get_action_logging() to the Config Module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 13:06:55 -08:00
Tom Eastep	8ccd1ab52b	Handle exclusion correctly when DEFER_DNS_RESOLUTION=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 12:09:54 -08:00
Tom Eastep	89a09f0256	Implement DEFER_DNS_RESOLUTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 17:00:14 -08:00
Tom Eastep	54dbbaaa2d	Don't resolve DNS names at compile time. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 10:34:31 -08:00
Tom Eastep	90bd19feb9	Convert DNS names into ip addresses in validate_net(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 07:39:27 -08:00
Tom Eastep	853b9ce916	Enable DNS names without an interface name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-12 14:38:26 -08:00
Tom Eastep	c61d51363d	Correct generation of rules in the ESTABLISHED section of the rules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-12 06:49:32 -08:00
Tom Eastep	af83989465	Update copyright dates. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 16:01:10 -08:00
Tom Eastep	b53fd39b49	Avoid a fatal Perl error in Config::cleanup when an fatal error occurs while compiling a default action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 15:50:23 -08:00
Tom Eastep	38097bef5d	Correct an optimizer bug. - delete_chain_and_references() was only deleting the downward references and not the upward ones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 14:55:43 -08:00
Tom Eastep	76a63fb7e8	Don't flush 'noarp' ARP entries = doing so kills the loopback interface Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-10 17:14:40 -08:00
Tom Eastep	15ca9edf8a	Allow delete_tc1() to work on devices which an @ suffix in their reported names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-09 14:09:07 -08:00
Tom Eastep	199bce925f	Don't add chains with RETURNs to %terminating. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-09 12:54:29 -08:00
Tom Eastep	1fd3a6a522	Detect terminating chains - no RETURN Rules - last rule is terminating Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 16:32:24 -08:00
Tom Eastep	011dd2c901	Add a RETURNS flag to optflags indicating that there is RETURN in the chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 15:25:53 -08:00
Tom Eastep	e54563d9c1	Don't append rules that can't be matched. Also, delete chains whose only rule is a -j RETURN Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 13:53:03 -08:00
Tom Eastep	f8c1b02dba	Correct test for optimization in 'check -r' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 09:51:32 -08:00
Tom Eastep	dece73f7b6	Another fix for *C actions in arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:59:24 -08:00
Tom Eastep	eb3b47ae24	Correctly handle *C actions in arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:29:41 -08:00
Tom Eastep	c157228f7d	Correct handling of unknown ACTION in arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:21:58 -08:00
Tom Eastep	a7af052d91	Correct issue with generating ESTABLISHED rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 16:07:24 -08:00
Tom Eastep	414a74d23c	Support protocol lists in most files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 16:06:54 -08:00
Tom Eastep	0526863e66	Make $section numeric Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 13:39:49 -08:00
Tom Eastep	5dbe2aa9ec	Optimize a test in finish_chain_section(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 07:00:15 -08:00
Tom Eastep	ca202ca10b	Flush the arp cache after applying the arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 17:46:40 -08:00
Tom Eastep	de4e0898b5	Catch protocol lists in contexts that don't allow them. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 17:23:14 -08:00
Tom Eastep	edc0a84e5d	Optimize RELATED rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 16:48:37 -08:00
Tom Eastep	d4c9885c09	Change interpretation of the log tag when LOGTAGONLY=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 13:10:18 -08:00
Tom Eastep	c41b9e596d	Don't add --cstate to dropInvalid rule. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 09:42:55 -08:00
Tom Eastep	9fd7933b5d	Make inline actions work in sections other than NEW. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 09:32:50 -08:00
Tom Eastep	f223e3584c	Make '+' optional in the ADD and DEL statements. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 07:37:11 -08:00
Tom Eastep	3f24416f37	Add a warning for opcode inversion when not arptables_jf. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-05 13:14:32 -08:00
Tom Eastep	38aa7f3857	Correct opcode inversion when not ARPTABLES_JF Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:26:46 -08:00
Tom Eastep	7f6430a383	Correct address inversion in match_arp_net() Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:20:51 -08:00
Tom Eastep	4fc0dba26d	Correct two-interface check in process_arprule. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:17:53 -08:00
Tom Eastep	0c7e10dbfa	Add a comment to the Zones file - define the {bridge} member.	2013-01-05 08:15:56 -08:00
Tom Eastep	97009bad79	Correct arptables_jf MAC handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 17:27:16 -08:00
Tom Eastep	af7b7195d2	Fix MAC handling in the ARP module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 15:55:52 -08:00
Tom Eastep	a732f6e538	Add some comments to the ARP module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 15:07:51 -08:00
Tom Eastep	38657d9f98	Support for arptables. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-04 09:17:57 -08:00
Tom Eastep	90e0c8b717	Don't update mtime on shorewall.conf during update that doesn't change the file Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-02 15:03:07 -08:00
Tom Eastep	aca3ce3c21	Delete blank line Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-01 08:29:02 -08:00
Tom Eastep	34f8125416	Correct a couple of issues with update -D - shorewall.conf.bak is no longer unlinked - The mtime of all unaltered files is no longer updated	2012-12-31 12:43:02 -08:00
Tom Eastep	87715e5f0b	Correct Typo Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2012-12-31 10:36:27 -08:00
Tom Eastep	5848d7cab7	Correct helper validation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-30 13:20:56 -08:00
Tom Eastep	5dfc27355e	Correct a comment Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-29 11:34:12 -08:00
Tom Eastep	6d9cca1cff	fq_codel Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-29 10:58:11 -08:00
Tom Eastep	51deec115b	Correct handling of wildcard interfaces - chain_base[1] renamed var_base[1] - $chain replaced by $var in renamed functions - replace trailing '+' by '_plus' to provide uniqueness - add sub chain_base() to the Chains module as an identity mapper Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 10:39:19 -08:00
Tom Eastep	643f419264	Merge branch '4.5.11' Conflicts: Shorewall/Perl/Shorewall/Rules.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 09:02:33 -08:00
Tom Eastep	2009a66bb5	Avoid invalid function name for starting an optional interface Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 08:04:06 -08:00
Tom Eastep	ebe4267c49	Rename IGNOREOLDCAPVERSIONS to WARNOLDCAPVERSION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-27 09:58:45 -08:00
Tom Eastep	8b92a59821	Ignore '-m comment' when detecting duplicate rules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-27 09:51:33 -08:00
Tom Eastep	ef0102e9f1	Add the 'IGNOREOLDCAPS' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 15:48:08 -08:00
Tom Eastep	14bbda14a2	Add some comments describing Config.pm globals - Also changed $shell from 'my' to 'our'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 10:55:13 -08:00
Tom Eastep	bfeea76cf2	Disallow ?FORMAT when $max_format == 1 Signed-off-by: Tom Eastep <teastep@shorewall.net> Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-26 07:37:23 -08:00
Tom Eastep	100e03cf93	Don't set $nocomment in in-line action Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 07:06:29 -08:00
Tom Eastep	84cc78c58e	Eliminate @comments Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-25 17:00:24 -08:00
Tom Eastep	3f28af80d2	Disallow ?FORMAT when $max_format == 1 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-25 08:10:48 -08:00
Tom Eastep	6126ae67e6	Don't apply AUTOCOMMENT or comment continuation to inline actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:50:26 -08:00
Tom Eastep	575020c851	More comment handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:35:42 -08:00
Tom Eastep	1c212e878f	Restore SECTION handling in Accounting File Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:33:44 -08:00
Tom Eastep	4393a6c603	Eliminate redundant calls to clear_comment. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 12:35:08 -08:00
Tom Eastep	fca5b75c5b	Merge branch '4.5.11'	2012-12-24 10:30:43 -08:00
Tom Eastep	c942a95d3c	Allow ?COMMENT in accounting. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 10:15:23 -08:00
Tom Eastep	89ea37e088	Correct nested comments. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 10:11:53 -08:00
Tom Eastep	14f8947012	Remove old COMMENT/FORMAT handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 09:31:20 -08:00
Tom Eastep	15817078b8	Use 'our' for globals to aid debugging. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 13:16:54 -08:00
Tom Eastep	0acd93a032	Ensure that action and macro files always allow comment directives. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 12:19:30 -08:00
Tom Eastep	4d2379f542	Implement update -D Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 10:50:31 -08:00
Tom Eastep	c9eccaf3b8	Implement ?COMMENT directive Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 10:49:32 -08:00
Tom Eastep	44a4f6d77d	Move COMMENT handling to the Config module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 13:51:24 -08:00
Tom Eastep	e4e61c4193	A more uniform way of handling $max_format Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 11:57:25 -08:00
Tom Eastep	0cd0675c98	Always push $file_format and $max_format onto the include stack. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 08:15:46 -08:00
Tom Eastep	bc230c00a3	Optimizations in process_compiler_directive() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 08:14:46 -08:00
Tom Eastep	10108b2d6a	Convert file processors to use ?FORMAT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:49:28 -08:00
Tom Eastep	35aeaf340f	Implement ?FORMAT directive Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:31:42 -08:00
Tom Eastep	0eb041d2d1	Correct ?SET error message Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:23:26 -08:00
Tom Eastep	a5debe793f	Add $file_format exported variable and handle in the include stack. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:14:23 -08:00
Tom Eastep	df7785f2e9	Implement user-defined address variables. - Also correct handling of ${0} & ${chain} in a SWITCH column. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-18 17:58:20 -08:00
Tom Eastep	2869a9a94d	Rename add_quotes to join_parts Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-15 16:12:03 -08:00
Tom Eastep	b6e699ca5c	Factor some common code into a function. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-13 06:46:57 -08:00
Tom Eastep	743478614b	Make @0 work correctly again. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 13:13:17 -08:00
Tom Eastep	5944b4fc7b	Make @chain (@{chain}) a synonym for @0 (@{0}) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:55:04 -08:00
Tom Eastep	8a0abab4cc	Rename 'ALLOWUNKNOWNVARIABLES' to 'IGNOREUNKNOWNVARIABLES' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:51:31 -08:00
Tom Eastep	5da7db3d5f	Implement @-variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:46:38 -08:00
Tom Eastep	14cdaf21fc	Handle nested params in push_action_params() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-09 10:45:29 -08:00
Tom Eastep	88d4814209	Merge branch '4.5.10' Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-08 20:54:33 -08:00
Tom Eastep	6ab5cfd63a	Use split_list2 in isolate_basic_target() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-06 19:12:44 -08:00
Tom Eastep	7190cd1265	Handle nested parens when pushing action parameters. - Add an optional argument to split_list1 that causes parens to be retained. Signed-off-by: Tom Eastep <teastep@shorewall.net> Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-06 15:20:10 -08:00
Tom Eastep	5f48e4e531	Handle nested parens when pushing action parameters. - Add an optional argument to split_list1 that causes parens to be retained. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-06 15:13:14 -08:00
Tom Eastep	fdadb57e82	Minor readability improvement Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 19:41:18 -08:00
Tom Eastep	8139f2ad91	Rename process_conditional() to process_compiler_directive() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 14:53:03 -08:00
Tom Eastep	189cd59650	Improve expression evaluation - Only quote values when there is not an odd number of preceding quotes - Make address family test return a numeric value - Unconditionally trace the generated expression if debugging is set. - Convert an empty expression into '' rather than generate an error. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 08:37:50 -08:00
Tom Eastep	4ec47783f1	Detect missing target in merge_levels() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:52:07 -08:00
Tom Eastep	2875fbb521	Cosmetic change (add a blank line). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:51:41 -08:00
Tom Eastep	25c53f5a60	Detect missing target in merge_levels() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:51:21 -08:00
Tom Eastep	c61c9ba7eb	Make expression evaluation more deterministic. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 18:10:19 -08:00
Tom Eastep	2fbbc70e83	Only do SET and RESET when we aren't omitting. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 16:27:18 -08:00
Tom Eastep	c18996b6f5	Implement ?set and ?reset directives Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 14:28:03 -08:00
Tom Eastep	fb2d876683	Rename $loglevel and $logtag to $_loglevel and $_logtag respectively. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 08:49:59 -08:00
Tom Eastep	a25b3c68ee	Rename %symbols to %variables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 08:49:25 -08:00
Tom Eastep	314632f1f4	Unified symbol table for shell variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 17:18:21 -08:00
Tom Eastep	409f5f2aab	Expand variables from the shorewallrc1 then shorewallrc hashes	2012-12-03 15:33:33 -08:00
Tom Eastep	fb0035bdf3	Add ALLOWUNKNOWNVARIABLES option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 14:43:35 -08:00
Tom Eastep	72aabef0fa	Add $logaction and $logtag as variables usable within actions - Also make action variables usable in ?if and ?elsif expressions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 12:31:47 -08:00
Tom Eastep	fc3606a489	Prepare for multiple options in actions files Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 08:17:55 -08:00
Tom Eastep	ad4709cb6d	Small effeciency improvement - Don't check for 'bad match' until it is known that the matches are the same. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 06:54:44 -08:00
Tom Eastep	c0abdc1fe8	Add some comments in and around delete_duplicates() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 17:31:13 -08:00
Tom Eastep	cd5e9be467	Carefully suppress duplicate rules in all tables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 12:20:24 -08:00
Tom Eastep	c05c928c6c	Delete adjacent duplicate rules in tables other than 'raw' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 09:21:04 -08:00
Tom Eastep	a33cf5cc91	Fix AUTOCOMMENT=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 08:26:54 -08:00
Tom Eastep	65676cb865	Support passing log levels inside parameters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 15:06:51 -08:00
Tom Eastep	8ebbdee20f	Only look for numerics if a shell variable begins with a number. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 12:52:26 -08:00
Tom Eastep	6c1a5b8051	Be more agressive about detecting action recursion. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 12:10:06 -08:00
Tom Eastep	b9adc2ebec	Remove another vestage of CONDITION_INIT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 09:33:01 -08:00
Tom Eastep	44f00cd0aa	Restore original $actionfile logic in process_actions() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 08:09:20 -08:00
Tom Eastep	ae5680401f	Remove questionable autocreate of an action in createlogactionchain() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 08:04:29 -08:00
Tom Eastep	8cbe26e32c	Ignore 'inline' for certain actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 07:54:42 -08:00
Tom Eastep	146402d9be	Yet another correction to the same line :-( Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 09:55:24 -08:00
Tom Eastep	70f26d8bb2	Correct line in prior commit. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 09:30:27 -08:00
Tom Eastep	893d054cb8	Reduce the block levels in define_firewall() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 08:46:49 -08:00
Tom Eastep	53fd0e7c8c	Don't require functions called from Shorewall::Compiler::compiler to know the current indentation. Also, add an optional 'times' parameter to push_indent() and pop_indent(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 07:49:42 -08:00
Tom Eastep	6702bb1989	Revert condition initialization patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 07:31:29 -08:00
Tom Eastep	e60369728a	Only initialize switches that survived optimization - Also use push_indent to make things more readable Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 15:25:28 -08:00
Tom Eastep	7d4bc568d8	Include initialization in condition match if supported Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 14:54:09 -08:00
Tom Eastep	11d4e92a29	Correct check for leading zeros in action variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 14:39:02 -08:00
Tom Eastep	409c427134	Add support for future condition initial values. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 12:15:15 -08:00
Tom Eastep	7bdce1bc97	Disallow superfluous leading zeros in action parameter numbers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 08:29:20 -08:00
Tom Eastep	e1524763ad	Also substute the chain name for '@0'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 08:28:52 -08:00
Tom Eastep	15121e0743	Also substitute the chain name for '@0' in SWITCH names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 08:05:49 -08:00
Tom Eastep	9c0d8a2533	Use '@{0}' as the chain name surrogate in SWITCH columns Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 07:17:13 -08:00
Tom Eastep	bff91cd325	Allow overriding 'inline' on some standard actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-28 15:03:08 -08:00
Tom Eastep	8006d150f1	Allow switch initialization. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 16:17:43 -08:00
Tom Eastep	e44acdc6af	Corrections to in-line actions. - Avoid reference to uninitialized variable. - Remove another vestage of multi-parameter macros. - Correct a typo. - Correct handling of SOURCE and DEST in an in-line action body. - Correct a comment. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 12:56:14 -08:00
Tom Eastep	e2297f2582	Remove meaningless type from an error message. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 12:53:47 -08:00
Tom Eastep	d7096ae52e	Back out default-action macros and document in-line actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 10:53:18 -08:00
Tom Eastep	6bf996d4b8	Implement inline actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 10:32:48 -08:00
Tom Eastep	85a46690c0	Improve optimize level 16 fix. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 15:11:07 -08:00
Tom Eastep	a4dcd1071a	Revert change to macro level merging. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 13:41:12 -08:00
Tom Eastep	78ba8bac50	Replace '@' by the chain name in SWITCH columns. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 13:28:23 -08:00
Tom Eastep	bf75b2b919	$0 expands to the current action chain name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 13:23:20 -08:00
Tom Eastep	7673b1ac4b	Support multiple parameters in macros. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 11:04:19 -08:00
Tom Eastep	fc87576005	Back out silly change for output interfaces in the conntrack file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 09:47:42 -08:00
Tom Eastep	3f550622bd	Only use routing table for OUTPUT interface in the raw table. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 07:51:55 -08:00
Tom Eastep	e7dee420ee	Allow interfaces in the DEST column of the conntrack file when the chain is OUTPUT. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 18:37:23 -08:00
Tom Eastep	e45fe53705	Correct another optimizer defect. - Don't declare command-mode rules as duplicates. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 18:00:26 -08:00
Tom Eastep	697fc001c3	Return to zone-based handling of 'all'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 16:31:05 -08:00
Tom Eastep	642f192b3d	Disallow destination interface in the OUTPUT chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 15:37:53 -08:00
Tom Eastep	7b0578fa84	Fix AUDIT on IPv6. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 12:09:18 -08:00
Tom Eastep	5acf0f60e7	Only apply log level to bare LOG rules in default-action macro. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 10:17:03 -08:00
Tom Eastep	fb3194d96b	Correct handling of default-action macro when specified as "macro.Name" Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 10:16:43 -08:00
Tom Eastep	066a017420	Correct typo in Raw.pm - The OUTPUT chain designator test was using '0' (zero) rather than 'O'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 08:52:33 -08:00
Tom Eastep	1870c281a9	Make AUDIT support params again. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 08:26:44 -08:00
Tom Eastep	dbfc805707	Add 'IU' state in secmarks Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 08:10:53 -08:00
Tom Eastep	b7e2b28562	Transfer tag when merging into an NFLOG/ULOG rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-24 09:04:56 -08:00
Tom Eastep	67e1e6cf91	Allow WHITELIST in IPv6 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 14:19:14 -08:00
Tom Eastep	cd2854cad0	Fix NFLOG/ULOG implementation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 13:49:43 -08:00
Tom Eastep	75c148a2dd	Enable 'debug' on the try, stop and clear commands. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 11:46:14 -08:00
Tom Eastep	71bbc632ce	Handle 'fw' correctly in the SOURCE column of the stoppedrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 08:35:51 -08:00
Tom Eastep	b6a1a7d538	Make NFLOG and ULOG built-ins. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 08:14:24 -08:00
Tom Eastep	30de211bda	Implement format-3 conntrack files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 20:56:56 -08:00
Tom Eastep	3f7425b6a0	Purge %renamed before each table is processed. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 17:27:09 -08:00
Tom Eastep	26dee73895	Support the audited targets on IPv6 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 08:24:51 -08:00
Tom Eastep	df7ce1a7d1	Add the AUDIT built-in and delete the Audit action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 08:24:33 -08:00
Tom Eastep	4a05571e7e	Add forward prototype for process_macro() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 08:00:15 -08:00
Tom Eastep	b89e05740d	Insure that nested zone exclusions go in the proper place in raw PREROUTING Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 14:49:21 -08:00
Tom Eastep	3040156981	Add SWITCH column to the conntrack file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 14:20:56 -08:00
Tom Eastep	54dadcc546	Ensure that zone-specific rules come before 'all' rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 14:20:30 -08:00
Tom Eastep	952aed225d	Improve handling of 'all' in the conntrack file. - Also added 'all-' to represent all off-firewall zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 13:07:01 -08:00
Tom Eastep	1efd47a7e9	Apply Tuomo Soini's fix for RHEL5 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 10:34:00 -08:00
Tom Eastep	374489c3cf	Revert "Fix RHEL5 issue with route marking." This reverts commit `77f342b0e0`.	2012-11-21 10:19:24 -08:00
Tom Eastep	77f342b0e0	Fix RHEL5 issue with route marking. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 09:08:15 -08:00
Tom Eastep	8f52c9744e	Correct some issues with default action macros. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 08:29:35 -08:00
Tom Eastep	1957af04fd	Don't create a _weight file for an optional non-provider interface. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 16:10:30 -08:00
Tom Eastep	a0faba2a03	Correct interface/provider handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 13:27:15 -08:00
Tom Eastep	c798200b20	Another correction to CHECKSUM detection. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 10:09:28 -08:00
Tom Eastep	67ae9df0f8	Correct handling of unknown interfaces in TC. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 08:07:42 -08:00
Tom Eastep	ebb4e1f6e4	Don't generate start/stop functions for wildcard optional interfaces Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 07:06:27 -08:00
Tom Eastep	f458e99390	Correct the compiler's CHECKSUM detection Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 06:59:40 -08:00
Tom Eastep	5b049d7e9e	Improve readability in Rules module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 06:59:13 -08:00
Tom Eastep	3b20c0db54	Allow Macros to be used as Default Actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 16:52:10 -08:00
Tom Eastep	0d8931e49f	Don't use ':' as a join character in contatenated macro ACTION expansion. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 12:58:29 -08:00
Tom Eastep	47791add99	Fix formatting of a line of code. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 12:30:25 -08:00
Tom Eastep	be587726f4	Merge branch '4.5.9'	2012-11-19 08:22:05 -08:00
Tom Eastep	b25ece75de	Don't leave temporary chain in the raw table when LOAD_HELPERS_ONLY=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 08:18:32 -08:00
Tom Eastep	0db7b6c58a	Don't require a parameter with '&' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 15:45:58 -08:00
Tom Eastep	57e913d86e	Merge branch '4.5.9'	2012-11-18 15:02:46 -08:00
Tom Eastep	a4294658b6	Add a capability to use log levels as a target. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 14:50:59 -08:00
Tom Eastep	65e1b1c9e7	Allow NFLOG as a target Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 13:15:24 -08:00
Tom Eastep	a07cfb0885	Allow NFLOG as a target Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 13:13:43 -08:00
Tom Eastep	c6ffdd67e2	Add DROP target to the conntrack file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 11:35:40 -08:00
Tom Eastep	5265cd5bb7	Add UNTRACKED match to the secmarks file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 11:01:49 -08:00
Tom Eastep	5712438bcb	Eliminate Shell syntax error when a provider and its interface have the same name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-16 09:50:36 -08:00
Tom Eastep	a2b14c37ed	Treat optional interfaces as pseudo-providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-16 09:48:21 -08:00
Tom Eastep	b1ffcd8628	Apply provider mask in 'routemark' chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-14 11:20:30 -08:00
Tom Eastep	34e3e4bf82	Merge branch '4.5.9'	2012-11-14 11:17:18 -08:00
Tom Eastep	06a4994488	Make exclusion work correctly with TPROXY. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-14 11:16:52 -08:00
Tom Eastep	391113dfe3	Apply provider mask in 'routemark' chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-13 06:55:59 -08:00
Tom Eastep	3c58d2180d	Improve the efficiency of tcrule processing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-13 06:55:35 -08:00
Tom Eastep	32c9e4274f	Rename 'mysplit' to 'split_host_list' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-11 08:42:01 -08:00
Tom Eastep	896d874aab	Set VARLIB in the script's initialize() function. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-09 12:29:19 -08:00
Tom Eastep	5fcdfd779c	Don't default IPSET to 'ipset'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-09 08:54:54 -08:00
Tom Eastep	860ee6de27	Eliminate nonsensical warning message. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-06 07:36:36 -08:00
Tom Eastep	ec17ea1dee	Remove superfluous check Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-03 08:19:46 -07:00
Tom Eastep	2e211bc2b6	Correct handling of wildcard interfaces in rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-03 07:24:41 -07:00
Tom Eastep	5f0b85b5b9	Replace a couple of more hard-coded directory names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-30 09:49:53 -07:00
Tom Eastep	3f1aeb33be	Correct mark range with shifted mask. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-26 12:41:06 -07:00
Tom Eastep	e177916c12	Implement statistical marking in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-26 07:10:26 -07:00
Tom Eastep	0387b16983	Implement CHECKSUM action in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-22 15:42:13 -07:00
Tom Eastep	6af16e0cda	Allow quotes in parameter to run_iptables() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-14 13:26:08 -07:00
Tom Eastep	ab7975539c	Correct typo in get_params() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-14 09:30:27 -07:00
Tom Eastep	dfd0692176	Omit IPv6-specific code from checkkernelversion() in IPv4 script Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-13 07:28:37 -07:00
Tom Eastep	8b650358d6	Don't shout in compiler directives Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-13 07:14:51 -07:00
Tom Eastep	cc90a06958	Add RESTORE_ROUTEMARKS option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-11 07:34:57 -07:00
Tom Eastep	54e066ec3a	Re-order logic in add_group_to_zone - Need to normalize the address prior to comparing it with ALLIP Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-08 08:54:54 -07:00
Tom Eastep	620f88b339	Merge branch '4.5.8'	2012-10-07 17:41:01 -07:00
Tom Eastep	b7e6b1aa41	Allow IP range in the hosts file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 17:40:42 -07:00
Tom Eastep	c84603cdc6	Merge branch '4.5.8' Conflicts: Shorewall/Perl/Shorewall/Zones.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 17:04:27 -07:00
Tom Eastep	e2b029b0ba	More hosts file corrections. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 17:00:35 -07:00
Tom Eastep	0efc0451c1	Allow IP range in the hosts file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 15:59:30 -07:00
Tom Eastep	9dd66fc6ff	Allow IP range in the hosts file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 15:55:00 -07:00

... 15 16 17 18 19 ...

4021 Commits