Tom Eastep
7aa7cd54c2
Convert Providers.pm to use the new rules interface.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 07:43:25 -07:00
Tom Eastep
3c60f107b7
Convert generate_matrix() to use the new rules interface
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 07:24:21 -07:00
Tom Eastep
2efa2796d3
More new rule interface calls in the Misc module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 15:12:58 -07:00
Tom Eastep
b2305ca9cf
Convert Tunnels file to use irules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 11:33:01 -07:00
Tom Eastep
a211f8fd0f
Infrastructure for new rule interface
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 10:37:15 -07:00
Tom Eastep
f3f535abac
POC of new rule interface
...
Also removed FAKE_AUDIT option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 08:35:09 -07:00
Tom Eastep
950c32d46b
Convert add_commands() calls to the equivalent add_rule() calls.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 16:31:29 -07:00
Tom Eastep
03913019d8
Mark DHCP rules for the convenience of move_rules().
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 15:34:57 -07:00
Tom Eastep
27621fa0f9
Impose some structure on setting rule options
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 14:46:34 -07:00
Tom Eastep
0f742187ae
Implement intermediate rule representation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 09:41:53 -07:00
Tom Eastep
d1b8d7b953
Make perl modules version-neutral
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-10 15:10:27 -07:00
Tom Eastep
11c580de54
Fix exclusion in IPv6 hosts file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 17:27:09 -07:00
Tom Eastep
e21ff03339
Fix ipsets in IPv6 hosts file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 16:17:35 -07:00
Tom Eastep
fbeddca6a4
Another IPv6 ipset issue (z:!+set in the DEST column)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 15:40:18 -07:00
Tom Eastep
a998476d00
Correct Accounting module version
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 07:08:47 -07:00
Tom Eastep
6c802d3353
Tighten up source and dest checking in expand_rule()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 07:08:39 -07:00
Tom Eastep
1f30976790
Correct change that tightened editing of IPv6 addresses
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 18:34:33 -07:00
Tom Eastep
22f1d1ba89
Another fix for IPv6 and IPSETs
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 16:31:35 -07:00
Tom Eastep
a8daff0008
Correct handling of <interface>:+<ipset> in Shorewall6.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 15:57:08 -07:00
Tom Eastep
7fa59706c5
Correct TPROXY/IPv6 address fix
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-07 14:50:44 -07:00
Tom Eastep
3f903fe3f1
Allow IPv6 Address as the third argument to TPROXY
...
- also update the manpages to describe TPROXY
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-07 06:43:16 -07:00
Tom Eastep
e1d8d71348
Version to 4.4.22 Beta 1
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 09:36:54 -07:00
Tom Eastep
6be8c08673
Create action chain without leading % when possible
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 07:48:52 -07:00
Tom Eastep
1536ff4b92
Corrections to dropBcast/allowBcast
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 15:58:19 -07:00
Tom Eastep
24deabb03f
Merge branch '4.4.21'
2011-07-03 08:48:27 -07:00
Tom Eastep
9691a8ceb3
Don't collapse '-' and '--' in @actparms
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 08:47:53 -07:00
Tom Eastep
029ac610fe
Merge branch '4.4.21'
2011-07-03 07:23:09 -07:00
Tom Eastep
d31e2d67ba
DEFAULTS directive enforces max number of parameters
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 07:22:29 -07:00
Tom Eastep
62c62441bb
Eliminate duplicate function definitions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 07:04:52 -07:00
Tom Eastep
d99090978d
Merge branch '4.4.21'
2011-07-03 06:40:08 -07:00
Tom Eastep
5b06e88b3d
Push/Pop comment during action processing
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 06:37:41 -07:00
Tom Eastep
7e3f97c154
Prepare for more parameterized actions
...
- Export add_commands, incr_cmd_level and decr_cmd_level by default
- Move ensure_audit_chain and require_audit from Rules.pm to Chains.pm
- Add get_action_logging() function
- Export require_capability and have_capability by default
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 06:22:51 -07:00
Tom Eastep
ad71faacaa
Correct push_action_params()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 17:02:39 -07:00
Tom Eastep
42aa3724af
Trace system calls when debugging
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 08:37:57 -07:00
Tom Eastep
4ea8a65cd9
Trace system calls when debugging
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 08:27:17 -07:00
Tom Eastep
afa5ea3fd2
Minor tweaks to Config.pm
...
- Look for unprintable gunk in lines processed by split_line1()
- Modify a comment
- replace awkward close/assert statement
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 08:10:43 -07:00
Tom Eastep
bd9bf3d43a
Rename & export get_actionchain() -> get_action_chain()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 07:02:18 -07:00
Tom Eastep
c309ca3075
Revert "Simplify push_action_params()"
...
This reverts commit 89ee25dde2
.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-01 16:23:39 -07:00
Tom Eastep
8ab45b4de3
Save current action chain along with params. Add get_action_chain()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-01 16:21:36 -07:00
Tom Eastep
89ee25dde2
Simplify push_action_params()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-01 15:38:39 -07:00
Tom Eastep
ea22d79aeb
Update the version of Providers.pm
2011-06-30 18:40:48 -07:00
Tom Eastep
6ff02dbaa3
Make 'fallback' and 'balance' mutually exclusive
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-30 10:00:01 -07:00
Tom Eastep
f09d286738
Correct script generation problem with TPROXY
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-29 20:05:27 -07:00
Tom Eastep
cbeebb6bf8
Bump version to 4.4.21.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-29 11:36:04 -07:00
Tom Eastep
ea038bcecb
Correct regular expression in process_shorewall_conf()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-28 06:42:41 -07:00
Tom Eastep
05103bacd0
Don't expand single-quoted .conf option values
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-26 07:45:09 -07:00
Tom Eastep
0b431aa8c1
Minor tweaks to Config.pm
...
- Add/revise comments
- Rename $line -> $lineref in expand_variables()
- Collapse 3 lines into one in process_shorewall_conf()
2011-06-26 06:50:22 -07:00
Tom Eastep
7507c81882
Remove some whitespace
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-25 21:55:49 -07:00
Tom Eastep
9f37f09b28
Clean up variable expansion:
...
1) Centralize code in function expand_variables()
2) Eliminate %rawconfig
3) Correct logic in update_config_file() - the defect was not observable
but the code was clearly silly
2011-06-25 21:08:32 -07:00
Tom Eastep
47c759d93c
Convert %actparms to an array
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-25 11:39:13 -07:00
Tom Eastep
5740b69dc6
Fix another empty parameter list issue
2011-06-25 09:46:58 -07:00
Tom Eastep
19c1f388a7
Modify Debian test in update
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 15:01:25 -07:00
Tom Eastep
fb2085b0c3
Support 'update' on Debian
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 13:40:32 -07:00
Tom Eastep
ca9276fd7e
Add quotes on deprecated and obsolete options if appropriate
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 11:47:34 -07:00
Tom Eastep
129d1739d1
Cosmetic changes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 07:58:46 -07:00
Tom Eastep
7583a5c7a3
Use updated values in configuration verification
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 07:22:41 -07:00
Tom Eastep
11b847f3a4
Correct spelling in an error message (FOREWARD -> FORWARD)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 06:22:16 -07:00
Tom Eastep
6f68ed5508
Initiate 4.4.21 RC 1
2011-06-23 16:23:52 -07:00
Tom Eastep
ba9a0016a8
Move update_config_file() to before process_shorewall_conf()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-23 06:37:21 -07:00
Tom Eastep
de7d95e7ff
Rename 'ipset v4' -> 'ipset v5'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-23 06:36:35 -07:00
Tom Eastep
04d551d8ca
Detect ipset V4 and use its syntax
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 16:43:42 -07:00
Tom Eastep
7ef7490cd6
Change the compiler's default for LEGACY_FASTSTART
...
- No visible effect since the compiler doesn't use this option
2011-06-22 13:56:17 -07:00
Tom Eastep
1b3d7947b8
Update the .conf file before validating ('update' command)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 12:31:58 -07:00
Tom Eastep
ba7d5fd720
Avoid two-stage processing of shorewall.conf when not updating.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 10:56:25 -07:00
Tom Eastep
106ba52362
Change signature of get_action_params
...
- Accepts a number of parameters rather than a list
- Change action.Drop and action.Reject accordingly
- Define correct number of parameter variables in action.Drop and action.Reject
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 08:27:01 -07:00
Tom Eastep
62a75cb98d
Fix parameterization of standard default actions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 07:51:42 -07:00
Tom Eastep
b43bee2c62
Streamline PERL in action.Drop and action.Reject
...
- Rename read_action_param => get_action_params
- Allow it to accept a list of indexes and to return a list
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 06:53:15 -07:00
Tom Eastep
bbf853bd1d
Cleaner handling of DEFAULTS in a non-action context
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 06:11:20 -07:00
Tom Eastep
ece598288f
Disallow DEFAULTS in the rules file
2011-06-21 21:00:08 -07:00
Tom Eastep
d51ca478bd
Reverse one hunk from empty-parameter fix
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-21 11:45:32 -07:00
Tom Eastep
063e21e69f
Allow an empty parameter list in an action (e.g., "Action()")
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 19:45:01 -07:00
Tom Eastep
71d88b93a0
Make IPv6 Dynamic Zone set names unique
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 17:22:34 -07:00
Tom Eastep
39e74911d8
Improve generated code
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 14:34:26 -07:00
Tom Eastep
44cbfd8f27
Correct defects found while unit testing IPv6 Dynamic Zones
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 13:33:25 -07:00
Tom Eastep
119d38c92b
Enable dynamic zones for IPv6
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 10:41:29 -07:00
Tom Eastep
785de281b5
More IPv6 ipset fixes
...
- use 'family inet6' rather than 'family ipv6'
- Correct one more case of 'iphash' vs 'hash:ip family inet6'
- Encapsulate ipset -N into an 'ensure_ipset()' function
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 07:43:32 -07:00
Tom Eastep
4c2f12e645
Some whitespace changes
2011-06-19 19:08:32 -07:00
Tom Eastep
e4bcc12301
Use 'here documents' rather than single quotes.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 18:33:10 -07:00
Tom Eastep
2097d0f4a0
Accomodate new syntax of ipset saved commands
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 14:06:42 -07:00
Tom Eastep
46d64e39d1
Use correct syntax to create IPv6 ipsets.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 14:04:53 -07:00
Tom Eastep
be6b08f835
Be sure to detect IPSET_MATCH before OLD_IPSET_MATCH.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 13:29:10 -07:00
Tom Eastep
7753f798b0
Bump Version to Beta 3
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 10:09:53 -07:00
Tom Eastep
c264aaae6b
Update module versions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 07:41:26 -07:00
Tom Eastep
4916610033
Rename upgrade => update
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 07:14:27 -07:00
Tom Eastep
55242d1ed6
Add a few comments
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 16:55:00 -07:00
Tom Eastep
d66c7d478e
Eliminate expansion of shell variables in the upgraded config file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 16:33:41 -07:00
Tom Eastep
380443f26d
Eliminate %defaults
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 15:44:07 -07:00
Tom Eastep
faeb2da2ba
Corrections to Defaults
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 15:38:08 -07:00
Tom Eastep
f93ac02bfc
Provide default values for added entries
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 14:50:07 -07:00
Tom Eastep
96f6dc3558
More defined => supplied changes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 13:08:26 -07:00
Tom Eastep
6f2cc31dde
Implement .conf file upgrade
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 13:03:55 -07:00
Tom Eastep
d23f932ebe
Don't generate INPUT hairpin rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 06:21:36 -07:00
Tom Eastep
f9ee8c494d
Exempt wildcard interfaces from sfilter
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-14 06:45:22 -07:00
Tom Eastep
9aedd407cc
Quell compiler warnings from Perl 5.14.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-13 06:40:03 -07:00
Tom Eastep
9ab901927f
Use supplied() where appropriate
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 16:14:31 -07:00
Tom Eastep
774aac1228
Add a supplied() function
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 15:40:55 -07:00
Tom Eastep
a60fe6e665
Allow parameters to be specified to Default Actions in the policy file
...
and in shorewall.conf.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 14:58:54 -07:00
Tom Eastep
3dd363677c
Implement set_action_param
...
Export both set_action_params and read_action_param by default
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 08:33:21 -07:00
Tom Eastep
8b6a7a7053
Implement read_action_param()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 07:49:57 -07:00
Tom Eastep
f278d05637
Rename action param functions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 07:46:54 -07:00
Tom Eastep
2549982528
Fix DEFAULTS
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 07:23:41 -07:00
Tom Eastep
6e6be468a9
Support for DEFAULT statements in actions
2011-06-10 17:05:09 -07:00
Tom Eastep
32c7d36cd0
Make zones with multiple interfaces complex
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-10 15:37:26 -07:00
Tom Eastep
dbd30f981c
Set the interface routeback option if there are any IP host groups with 'routeback'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-10 15:37:09 -07:00
Tom Eastep
8a7ad569e4
Don't leave unused sfilter chains in the config
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 17:22:48 -07:00
Tom Eastep
3e9a54d404
Couple of tweaks
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 17:22:34 -07:00
Tom Eastep
a0b0c5bdac
Jump (don't go) to sfilter1
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 14:24:44 -07:00
Tom Eastep
1399a8ffde
Don't move rules from a chain with references
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 14:24:38 -07:00
Tom Eastep
9555a552c2
Fix FORWARD with ipsec dest
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 14:24:08 -07:00
Tom Eastep
71177c3ca3
Exempt ipsec from sfilter
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 07:27:06 -07:00
Tom Eastep
fa2746d469
Apply sfilter to INPUT as well as FORWARD
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-08 09:40:28 -07:00
Tom Eastep
35d1586672
Correct sfq handle assignment
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 13:58:45 -07:00
Tom Eastep
a3968beb7e
Add fix inadvertently dropped from 4.4.19.4
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 13:57:52 -07:00
Tom Eastep
0e839f3d7b
Initiate 4.4.21
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 09:54:35 -07:00
Tom Eastep
9c2c562bf5
Correct autorepeat wart
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 06:45:50 -07:00
Tom Eastep
cf0275a049
Make FAKE_AUDIT work again
2011-06-06 16:08:29 -07:00
Tom Eastep
642319d706
Change annotated documentation default
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 15:40:21 -07:00
Tom Eastep
cfb3d6a801
Merge branch '4.4.20'
2011-06-06 14:09:26 -07:00
Tom Eastep
6136e986cf
Update version to 4.4.20.1
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 14:08:25 -07:00
Tom Eastep
aabefe91f1
Merge branch '4.4.20'
2011-06-04 08:46:40 -07:00
Tom Eastep
f1cbfab7ac
More blacklist/audit fixes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-04 08:45:23 -07:00
Tom Eastep
653a61a04a
Merge branch '4.4.20'
2011-06-04 07:44:24 -07:00
Tom Eastep
a9c0824a30
Correct BLACKLIST_DISPOSITION=A_xxx with BLACKLIST_LOG_LEVEL
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-04 07:44:07 -07:00
Tom Eastep
aa86b65ec3
Merge branch '4.4.20'
2011-06-02 11:44:15 -07:00
Tom Eastep
254e1ed784
Add 'I' STATE to secmarks
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 11:43:55 -07:00
Tom Eastep
c3b56c1e73
Merge branch '4.4.20'
2011-06-02 10:07:03 -07:00
Tom Eastep
561d461a25
Add 'NI' STATE setting in secmarks.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 10:06:27 -07:00
Tom Eastep
1e883c2fdf
Merge branch '4.4.20'
2011-06-02 06:47:09 -07:00
Tom Eastep
f9c5b8b0d5
Improve some comments
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 06:23:37 -07:00
Tom Eastep
36aee407ef
Merge branch '4.4.20'
2011-06-01 13:01:27 -07:00
Tom Eastep
5f08605adc
Delete some cruft
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-01 12:26:05 -07:00
Tom Eastep
243a09783c
Merge branch '4.4.20'
2011-05-31 15:45:09 -07:00
Tom Eastep
7bf74bb8c9
Add new builtin targets to %builtin_target
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 15:43:42 -07:00
Tom Eastep
468ff6efab
First cut at IPSET/Dynamic-zone support in Shorewall6
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 11:23:43 -07:00
Tom Eastep
8df470b5f5
Version to 4.4.20
2011-05-31 09:30:18 -07:00
Tom Eastep
2f6c5fd260
Set 'bridge-nf-call-ip6?tables' if bridges are configured.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 06:59:43 -07:00
Tom Eastep
4f296b62ae
Another fix for auditone
2011-05-30 16:37:56 -07:00
Tom Eastep
e6275ba31d
Fix a bug in auditing
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 15:28:00 -07:00
Tom Eastep
d89a915f26
Load IPv6 libraries when processing /etc/shorewall6/params
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 13:24:36 -07:00
Tom Eastep
26d08b92c0
Correct use of null value as a hash
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 11:38:49 -07:00
Tom Eastep
b0447b8bd3
Remove another MACLIST defect
2011-05-30 08:49:41 -07:00
Tom Eastep
60d33740f6
Fix MACLIST_DISPOSITION defect introduced earlier in this release
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 07:59:44 -07:00
Tom Eastep
11c209c55f
Restore access to $Shorewall::Rules::family
2011-05-29 17:22:36 -07:00
Tom Eastep
2852cdeb53
Another attempt at the IPMARK fix
2011-05-29 14:42:23 -07:00
Tom Eastep
a71136fd5a
Rework configuration files for Shorewall and Shorewall6
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-29 14:34:18 -07:00
Tom Eastep
243e8f1dbe
Fix check for unreferenced 'sfilter' chain
2011-05-28 08:31:36 -07:00
Tom Eastep
a37dbf76dc
Delete 'sfilter' chain if it isn't referenced
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 19:56:54 -07:00
Tom Eastep
1a2c9a08e1
Don't include comment in audit chain rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 19:56:04 -07:00
Tom Eastep
bac640e731
Get changes from 4.5.0 branch
2011-05-27 19:42:09 -07:00
Tom Eastep
586a3537bf
Delete 'sfiter' chain if it doesn't have referenes
2011-05-27 19:38:03 -07:00
Tom Eastep
790c96c90a
Version to RC 1
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 09:11:47 -07:00
Tom Eastep
c6e9de65f1
Prevent duplicate 'filter' rules when combining two interface chains
...
into the same zone forwarding chain.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 06:43:47 -07:00
Tom Eastep
fbfe7b9f93
Don't create 'reject' and AUDIT' in the 'stopped' case.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-26 14:11:36 -07:00
Tom Eastep
0287d96aa2
Finish filtering implementation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-26 13:38:44 -07:00
Tom Eastep
6c3163cc27
Routeback corrections
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-25 10:45:57 -07:00
Tom Eastep
e4d667ca6a
Add routeback protection
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 17:07:31 -07:00
Tom Eastep
bbe165c3cf
Bump version to Beta 5
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 11:40:11 -07:00
Tom Eastep
84b844ae79
Implement -T option for compile and check
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 10:21:49 -07:00
Tom Eastep
ee98772349
Add -c to the start command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 09:13:02 -07:00
Tom Eastep
f464ec5624
Fixes for AUDIT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 20:59:33 -07:00
Tom Eastep
c050b29985
Factor some similar code
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 14:20:14 -07:00
Tom Eastep
15e9e3182d
Update copyrights
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 10:06:56 -07:00
Tom Eastep
e95003b82a
Add FAKE_AUDIT option
2011-05-22 17:42:50 -07:00
Tom Eastep
5d04c93a16
Implement LEGACY_FASTSTART option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-22 15:36:29 -07:00
Tom Eastep
981b503fa4
Bump version to Beta 4
2011-05-22 11:05:22 -07:00
Tom Eastep
529e256856
Assigned unused dev numbers
2011-05-22 10:18:26 -07:00
Tom Eastep
83cdf78b18
Replace A_* builtin actions with builtin targets
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-21 15:02:04 -07:00
Tom Eastep
71ef1f48e2
Allow auditing of the builtin actions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-21 10:38:25 -07:00
Tom Eastep
82d6a00c9e
Implement some extentions to AUDIT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-21 09:25:58 -07:00
Tom Eastep
61b5dbbb95
Eliminate cruft left over from when Action.pm and Policy.pm were folded into Rules.pm - Phase II
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:48:28 -07:00
Tom Eastep
f64e171c19
Eliminate cruft left over from when Action.pm and Policy.pm were folded into Rules.pm
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:46:18 -07:00
Tom Eastep
ac2e9cce64
Shrink process_actions2 further.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:28:30 -07:00
Tom Eastep
676af32ebc
Simplify a loop in process_actions2()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:11:23 -07:00
Tom Eastep
7cbf113ba0
Simplify an RE
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 08:33:36 -07:00
Tom Eastep
d15475efae
Cleanup of AUDIT before Beta 3
...
- Correct merge snafus
- Rename the new actions (e.g., ADROP->A_DROP)
- Correct MACLIST_DISPOSITION logic
2011-05-20 07:47:35 -07:00
Tom Eastep
e9df13a42b
Resolve merge conflicts
2011-05-19 15:10:22 -07:00
Tom Eastep
5e68dbfa9a
Complete first attempt at AUDIT support
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-19 12:06:43 -07:00
Tom Eastep
814494e277
More AUDIT changes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-19 08:35:40 -07:00
Tom Eastep
d2ab27c071
More AUDIT changes
2011-05-18 21:25:57 -07:00
Tom Eastep
ce8df2f66c
Revert "Bump version to Beta 3"
...
This reverts commit 465e729288
.
2011-05-18 17:50:12 -07:00
Tom Eastep
465e729288
Bump version to Beta 3
2011-05-18 17:08:07 -07:00
Tom Eastep
314921f766
Revert "Set quantum in subordinate SFQ class to the MTU for HFSC parents."
...
This reverts commit 5ab6f8e0e5
.
2011-05-18 11:13:50 -07:00
Tom Eastep
166d27f6d4
Minor tweak to blacklisting
...
Reverse order of tests for 'from' and 'src'.
Use equivalent logic for generating unknown option error
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-18 11:13:03 -07:00
Tom Eastep
5ab6f8e0e5
Set quantum in subordinate SFQ class to the MTU for HFSC parents.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-18 10:34:46 -07:00
Tom Eastep
568e54b50d
Update version to Beta 2
2011-05-18 09:58:35 -07:00
Tom Eastep
e940f5018e
Implement whitelisting.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-18 08:30:01 -07:00
Tom Eastep
cec07a6be5
Don't apply HTB quantum to HFSC
2011-05-17 18:34:41 -07:00
Tom Eastep
495aa9b9ac
Implement NFLOG accounting action.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-17 13:42:13 -07:00
Tom Eastep
fd70e73d34
Add ACCOUNTING_TABLE option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-17 12:51:33 -07:00
Tom Eastep
680ca519ed
Correct deletion of ipv6 'shorewall' chain
2011-05-17 11:33:56 -07:00
Tom Eastep
11ff245697
Don't generate refresh rules unless the command is 'refresh'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-16 13:08:32 -07:00
Tom Eastep
ffe7a1b777
Avoid inconsistencies and errors in refresh
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-16 11:34:41 -07:00
Tom Eastep
30f2fbff60
Issue warning on missing IPSET
2011-05-15 11:48:34 -07:00
Tom Eastep
72a330cba2
Don't emit degenerate tcfilters
2011-05-15 10:57:02 -07:00
Tom Eastep
e459fbf997
Don't allow non-leaf default class
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-15 10:56:46 -07:00
Tom Eastep
3f90f00081
Issue warnings and ignore non-leaf class in tcfilters and tcrules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-15 10:56:31 -07:00
Tom Eastep
7d25f6356b
Augment a comment
2011-05-15 08:45:41 -07:00
Tom Eastep
c247140063
Restore 'our' to a couple of exported variables in the Config module
2011-05-14 14:18:22 -07:00
Tom Eastep
00add745b7
Use -o when copying routing tables
2011-05-14 13:56:39 -07:00
Tom Eastep
05e385a748
Only use 'our' when required
2011-05-14 13:21:31 -07:00
Tom Eastep
0626594cda
Restore accuracy of tcclasses diagram
2011-05-14 09:27:51 -07:00
Tom Eastep
539e42aa2e
Correct earlier patch
2011-05-09 16:34:31 -07:00
Tom Eastep
bbab1c9682
Ensure USER/GROUP is only specified when SOURCE in $FW
2011-05-09 16:33:34 -07:00
Tom Eastep
359de906ca
Refinement to fix for double exclusion
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-09 16:28:53 -07:00
Tom Eastep
1a48dd3eb9
Correct last merged patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-08 05:51:58 -07:00
Tom Eastep
93d8b538eb
Ensure route to gateway in the main table
2011-05-08 05:43:53 -07:00
Tom Eastep
a1bd664447
Fix issues with 'gawk'
2011-05-08 05:39:07 -07:00
Tom Eastep
afed909e52
Simplify the fix for double exclusion in ipset lists
2011-05-07 06:38:08 -07:00
Tom Eastep
0c59e0231d
Correct double-exclusion fix
2011-05-07 06:37:37 -07:00
Tom Eastep
58c25e8517
Let tcfilters deal correctly with hex device numbers
2011-05-05 10:12:20 -07:00
Tom Eastep
59ea511201
Complain if there is no default class defined
2011-05-05 10:12:14 -07:00
Tom Eastep
91d8f39f2e
Enforce limits on device and class numbers
2011-05-05 10:11:47 -07:00
Tom Eastep
349960294c
Detect double exclusion in ipset expressions
2011-05-05 10:11:30 -07:00
Tom Eastep
368fe46932
Correct Comment
2011-05-05 10:11:22 -07:00
Tom Eastep
d8c2845085
Back out part of TC change
2011-05-05 10:11:13 -07:00
Tom Eastep
9a95bad17e
Don't require '0x' on devnum > 10 in tcclasses
2011-05-05 10:06:55 -07:00
Tom Eastep
4300ef3ee2
Fix another couple of bugs with device numbers > 9
2011-05-05 10:06:41 -07:00
Tom Eastep
222c5dbf46
Normalize hex numbers before using them in string comparisons
2011-05-02 10:08:36 -07:00
Tom Eastep
e66d491f11
Correct patch for > 9 interfaces with tcfilters
2011-05-02 10:08:19 -07:00
Tom Eastep
bf10e104b7
Fix bug in tcfilters with device numbers > 9
2011-05-02 07:25:21 -07:00
Tom Eastep
d2407cb7a0
Don't allow IFB classes in tcrules
2011-05-02 07:23:28 -07:00
Tom Eastep
a0b00b4bd6
More fixes for TC
2011-05-01 21:24:52 -07:00
Tom Eastep
61c654634b
Correct some TC issues
2011-05-01 06:40:14 -07:00
Tom Eastep
e2b1069c1c
Support ipsets in the ORIGINAL DEST column for DNAT and REDIRECT rules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-28 12:22:26 -07:00
Tom Eastep
59024ff49d
Delete some blank lines
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-24 08:29:28 -07:00
Tom Eastep
67e920eb53
Use del/add for provider ipv6 routes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-19 10:56:59 -07:00
Tom Eastep
1bcba8bbc7
Update version of changed Perl modules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-19 10:02:29 -07:00
Tom Eastep
ec8bb8049a
Delete/Add routes for NDP rather than replace
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-19 09:40:24 -07:00
Tom Eastep
1a0388080f
Initiate 4.4.20
...
Update versions
Update release documents
Apply Togan Muftuoglu's change to increase installation flexibility
2011-04-16 08:31:46 -07:00
Tom Eastep
4f5970b5f2
Use 'ip route list' rather than 'ip route ls' for busybox compatability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-15 11:15:32 -07:00
Tom Eastep
d42a65fd11
Correct one more default route save/restore defect
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-15 07:09:34 -07:00
Tom Eastep
dff405683c
Correct default route save/restore
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-14 12:25:33 -07:00
Tom Eastep
96af7bfed6
Fix the prior commit
2011-04-13 17:56:15 -07:00
Tom Eastep
9a8f411531
Update version to 4.4.19.1 and document corrected problems
2011-04-13 17:22:07 -07:00
Tom Eastep
9008cd960c
Fix a silly masq bug
2011-04-13 17:01:22 -07:00
Tom Eastep
16276b9900
Don't assume that all nexthop routes are default routes
2011-04-13 13:57:22 -07:00
Tom Eastep
a0b16e2803
Delete duplicate rule
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-13 06:56:17 -07:00
Tom Eastep
5919c234f4
Update version of IPAddrs.pm
2011-04-12 07:21:24 -07:00
Tom Eastep
53571043c0
Fix another proto editing defect
2011-04-11 17:18:39 -07:00
Tom Eastep
18f4b11b09
Don't allow '\!0' in the PROTO column
2011-04-11 16:25:19 -07:00
Tom Eastep
73754521b1
Correct Perl module versions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-04-11 15:05:18 -07:00
Tom Eastep
ca46052410
Fix file name in split_line error message for proxyndp file
2011-04-10 13:19:42 -07:00
Tom Eastep
512008170d
Revert "Fold some long lines"
...
This reverts commit 3674cfd387
.
2011-04-10 11:20:50 -07:00
Tom Eastep
3674cfd387
Fold some long lines
2011-04-10 10:10:00 -07:00
Tom Eastep
8abc78331b
Two minor cosmetic changes
2011-04-10 09:52:00 -07:00
Tom Eastep
1be89edb49
Version to 4.4.19
2011-04-09 07:58:13 -07:00
Tom Eastep
92611d6789
A couple of tweaks before releasing RC1
2011-04-08 07:50:54 -07:00
Tom Eastep
7ab55f4217
Ensure that the PREROUTING->dnat jump is added when a wildcard interface is present
2011-04-06 15:14:39 -07:00
Tom Eastep
755c3cfd80
Quote param values that include shell metacharacters
2011-04-06 14:52:32 -07:00
Tom Eastep
6626ef06fb
Fix yet another optimizer bug
2011-04-06 10:10:42 -07:00