extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-11-23 16:13:18 +01:00
Code Issues Packages Projects Releases Wiki Activity
14,967 Commits 104 Branches 736 Tags 55 MiB
39a3c72057
Commit Graph

3888 Commits

Author SHA1 Message Date
Tom Eastep
71fb1a8cbd
Correct error message ( s/\*/+/ ) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-27 14:32:43 -07:00
Tom Eastep
de3b05ea41
Correctly translate +INLINE(...) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-27 12:21:07 -07:00
Tom Eastep
ae9b57d854
Correct NONAT translation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-26 16:06:28 -07:00
Tom Eastep
579910fdb8
Fix MASQUERADE+ Handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-26 14:40:16 -07:00
Tom Eastep
21877d5fcb
Force a reload when enabling an interface whose IP address has changed 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-26 13:39:50 -07:00
Tom Eastep
0b9387f09c
Force address Detection on optional interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-25 14:42:03 -07:00
Tom Eastep
fdfd8b919b
Merge branch '5.0.13' 2016-10-24 12:52:01 -07:00
Tom Eastep
3d3ae81bce
Restore old wording for Version 4 ipset creation message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-24 12:51:43 -07:00
Tom Eastep
3b6b89336e
Eliminate superfluous test 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-24 11:57:56 -07:00
Tom Eastep
fc0ad7cd2e
Be sure that the 'restriction' member exists for the FORWARD chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-24 11:37:40 -07:00
Tom Eastep
c9b1b7684c
Correct handling of dest IPSET. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-24 09:06:05 -07:00
Tom Eastep
b8ec460a1a
Correct grammar in the ipset creation message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-24 08:49:51 -07:00
Tom Eastep
46b8e2e957
Avoid exception when validating 'occurs' in TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-24 08:14:12 -07:00
Tom Eastep
0ed813972b
Auto-create ipsets used in tcfilters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-23 16:44:07 -07:00
Tom Eastep
f9cfde91e5
Correctly handle ipset in tcfilter DEST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-23 16:43:49 -07:00
Tom Eastep
3df488e710
Correct handling of ipsets in tcfilters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-23 16:28:36 -07:00
Tom Eastep
0efc7a4899
Correct restriction and chain number handling in the mangle files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-23 15:36:04 -07:00
Tom Eastep
d241421630
Merge branch '5.0.13' 2016-10-23 08:34:47 -07:00
Tom Eastep
e0203bca87
Correct nill address check in handling of 'origdest=detect' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-23 08:34:24 -07:00
Tom Eastep
3874bb9fa6
Delete duplicate line of code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-22 15:41:26 -07:00
Tom Eastep
13a321726c
Fix typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-21 09:22:30 -07:00
Tom Eastep
b160845713
Avoid compiler crash when LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-20 15:22:43 -07:00
Tom Eastep
71566f0ab0
Avoid compiler crash when LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-20 14:54:01 -07:00
Tom Eastep
e4169ede4a
Merge branch '5.0.13' 2016-10-20 13:29:05 -07:00
Tom Eastep
b44628ddc8
Only specify 'counters' to ipset of IPSET_MATCH_COUNTERS is present 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-20 09:07:36 -07:00
Tom Eastep
0e7d5f3972
Support '+' in SNAT action invocation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-18 16:00:36 -07:00
Tom Eastep
ab496987e0
Prevent 'nat' and 'mangle' being specified together 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-18 15:32:05 -07:00
Tom Eastep
c92ebc3908
Make merge_inline_source_dest() a little safer 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-18 14:32:56 -07:00
Tom Eastep
bc3573fcbc
Correct handling of interface lists in masq->snat conversion 
- Also restore logic for ADD_SNAT_ALIASES
- Correct some interface-list errors in snat processing
- Restore whitespace after '--to-source'

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-18 14:19:09 -07:00
Tom Eastep
6b7beaadaf
Merge branch '5.0.13' 2016-10-18 10:16:58 -07:00
Tom Eastep
31b6e9e299
Fix another DEST bug in mangle inline action handling :-( 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-18 10:15:43 -07:00
Tom Eastep
d52a4b1c9d
Implement SNAT actions and inlines 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-18 10:09:07 -07:00
Tom Eastep
9796af5d80
Merge branch '5.0.13' 2016-10-17 10:16:30 -07:00
Tom Eastep
9fc56bb896
Correct typo in process_mangle_inline() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-17 09:29:32 -07:00
Tom Eastep
4bb942f1f9
Restrict hypen as range separator to use with integers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-16 13:29:00 -07:00
Tom Eastep
05dbfbb988
Restrict hypen as range separator to use with integers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-16 13:26:44 -07:00
Tom Eastep
69a7c78179
Merge branch '5.0.13' 2016-10-16 12:28:01 -07:00
Tom Eastep
04051454bf
Reverse bad ECN handling patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-16 12:27:45 -07:00
Tom Eastep
2ca86d9abd
Merge branch '5.0.13' 2016-10-16 10:22:12 -07:00
Tom Eastep
e6f3d429a1
Renew timeout on matched dbl entries 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-16 09:42:45 -07:00
Tom Eastep
1ca91d7ddc
Correct handling of ECN file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-16 08:41:19 -07:00
Tom Eastep
fad9dce3e6
Correct handling of ECN file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-16 08:33:01 -07:00
Tom Eastep
342f4ee0f2
Add the --exits option to ADD with timeout 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-15 16:43:44 -07:00
Tom Eastep
047b5ca6d5
Add the --exits option to ADD with timeout 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-15 16:43:04 -07:00
Tom Eastep
43fdddb438
Add 'snat' config file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-15 11:38:52 -07:00
Tom Eastep
44477d97ac
Move Masq file processing to the Rules module 
- This will enable supporting actions in the new snat file

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-14 12:42:58 -07:00
Tom Eastep
b5906812a2
Accept '-' as the separator in a port range. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-14 10:10:03 -07:00
Tom Eastep
b80d4c2320
Don't allow shell meta characters in interface names 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-11 17:01:45 -07:00
Tom Eastep
d5aaa66e0b
Detect bad characters in interface names 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-11 10:56:41 -07:00
Tom Eastep
8c522a5c4d
Correct typo in lib.private 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-09 10:58:29 -07:00
Tom Eastep
abf57a4d1f
Correct indentation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-09 09:29:04 -07:00
Tom Eastep
3058f2fb84
Delete code supporting old kernel/iproute2 IPv6 restrictions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-07 11:02:36 -07:00
Tom Eastep
eb6ae5e186
Correct handling of DYNAMIC_BLACKLIST options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-05 16:56:29 -07:00
Tom Eastep
941604ad01
Correct issue with updating DBL timeout 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-05 15:41:40 -07:00
Tom Eastep
14e8568d9e
Add the FIREWALL .conf option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-05 15:03:54 -07:00
Tom Eastep
ca7ca4bdfe
Add a 'timeout' option to DYNAMIC_BLACKLIST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-05 12:56:47 -07:00
Tom Eastep
8d731c81e4
Add 'disconnect' option to ipset-based dynamic blacklisting 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-10-04 09:09:45 -07:00
Tom Eastep
72dbb4c3c3
Handle persistent provider enable/disable correctly 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-30 16:01:04 -07:00
Tom Eastep
bc591ccee4
Don't assume that statistically balanced providers are optional 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-30 14:01:16 -07:00
Tom Eastep
156313edd2
Correctly handle down persistent interface during 'disable' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-27 11:47:37 -07:00
Tom Eastep
35bd1db7fb
Handle Down or missing interfaces in 'delete_gateway()' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-27 11:43:26 -07:00
Tom Eastep
792b3b696c
Add ZERO_MARKS option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-26 16:04:26 -07:00
Tom Eastep
fa9ee6d69e
Clear packet marks in PREROUTING and OUTPUT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-24 15:46:04 -07:00
Tom Eastep
8065e62f12
Support for the 'contiguous' option in TIME columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-22 14:22:11 -07:00
Tom Eastep
e81a4788c6
Implement DEFAULT_PAGER in shorewallrc 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-21 10:20:48 -07:00
Tom Eastep
afc212495f
Make POSTROUTING the default chain for CHECKSUM 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-18 08:57:49 -07:00
Tom Eastep
059b1c6c8c
Remove superfluous logic 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-13 11:13:19 -07:00
Tom Eastep
2f75901068
Restore 'use Shorewall::Config(shorewall)' in embedded Perl handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-13 09:29:51 -07:00
Tom Eastep
8bb7c2363b
Support '+' after a zone list in the policy files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-10 10:06:38 -07:00
Tom Eastep
2c90a8bfb5
Allow zone lists in the SOURCE and DEST columns of the policy files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-09-10 08:47:48 -07:00
Tom Eastep
bb8af36d3f
Minor cleanup in the Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-31 13:01:49 -07:00
Tom Eastep
4ec2c2087d
Delete obsolete comments 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-29 12:40:28 -07:00
Tom Eastep
31d35e0cbd
Minor cleanup of the Chains module 
- Correct typos
- Correct 'P' trace entries
- Add parens and comments to calls

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-15 09:22:11 -07:00
Tom Eastep
bcacce7ed0
Rename a variable to avoid confusion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-14 15:45:24 -07:00
Tom Eastep
646c20491a
Fix indentation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-14 15:45:00 -07:00
Tom Eastep
fa1173baaa
Correct typo in a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-14 10:24:29 -07:00
Tom Eastep
72e21be89d
Add a handle back to the flow classifier 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-04 11:03:36 -07:00
Tom Eastep
1b1e2c58f9
Allow optional provider interfaces to match a wildcard 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-08-02 15:44:19 -07:00
Tom Eastep
decf9d3b3e
Correct comment formatting in 'trace' output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-07-30 09:03:19 -07:00
Tom Eastep
a05623f49e
Don't delete duplicate COUNT rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-07-30 08:24:53 -07:00
Tom Eastep
0b9cd93769
Default DSCP rules to the POSTROUTING chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-07-27 13:59:15 -07:00
Tom Eastep
372359839b
Add 'comment' to alternative input 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-07-24 15:08:55 -07:00
Tom Eastep
a02c745a83
Avoid silly duplicate rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-30 17:49:43 -07:00
Tom Eastep
47557aa4f7
Correct additional issues with 'update' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-18 10:24:52 -07:00
Tom Eastep
93ee4432de
Allow <user>: in USER columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-18 09:44:35 -07:00
Tom Eastep
8c543ca6f8
Transfer permissions during file updates 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-16 16:04:32 -07:00
Tom Eastep
e71fb3249a
Add 'dbl' interface option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-15 16:35:41 -07:00
Tom Eastep
ea56d4ed19
Make ipset-based dynamic blacklisting work in the FORWARD chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-13 15:02:12 -07:00
Tom Eastep
c65721a139
Correct a warning message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-13 12:21:16 -07:00
Tom Eastep
cd0837beb5
Avoid run-time Perl diagnostic when validating a null log level 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-09 09:00:12 -07:00
Tom Eastep
cd01df4200
Allow more than 9 interfaces with Simple TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-07 14:43:37 -07:00
Tom Eastep
7798c52a19
Fix DOCKER=Yes when docker0 is defined and Docker isn't started. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-22 17:50:51 -07:00
Tom Eastep
82169a0bfd
Use 'date' format for compiletime rather than localtime format 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-07 13:48:16 -07:00
Tom Eastep
64fb662bb1 Verify Shorewall6 version when compiling for IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-05 15:22:47 -07:00
Tom Eastep
ce20e5592b Cross-check core and standard versions during compilation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-05 13:53:26 -07:00
Tom Eastep
590243a787 Add NFLOG as a supported mangle action 
- Also document nflog-parameters
- Correct range of nflog groups

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-03 11:27:34 -07:00
Tom Eastep
9dd0346987 Apply Paul Gear's patch for Ubuntu 16.04 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-02 07:25:37 -07:00
Tom Eastep
ccfa181a6d Tweak compile_info_command() 
- Fix comment
- use $globals{VERSION} for the version number

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-30 14:12:34 -07:00
Tom Eastep
24d40f4cc2 Add VERBOSE_MESSAGES option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-30 08:00:56 -07:00
Tom Eastep
244f2cefe5 Update comment describing info_command() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-29 15:42:48 -07:00
Tom Eastep
41923cb80e Improve compile time/date implementation 
- Rename the command from 'date' to 'info'
- Return the complete date/time/version string in the command

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-29 12:31:17 -07:00
Tom Eastep
2a40012fc4 Include compile time and date in the output of 'shorewall status' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-27 16:25:21 -07:00
Tom Eastep
a92d10f19c Merge branch '5.0.8' 2016-04-27 10:23:51 -07:00
Tom Eastep
f6b7eb4ea0 Correct handling of persistent provider with no IP address 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-25 12:27:00 -07:00
Tom Eastep
800c06e8c9 Rename lib.core to lib.runtime 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-21 08:12:41 -07:00
Tom Eastep
f16e3f1fbe Issue warning when enable/disable won't work correctly 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-19 10:42:50 -07:00
Tom Eastep
0faf3b6db1 Send INFO messages to STDERR rather than STDOUT 2016-04-18 13:59:29 -07:00
Tom Eastep
3253c882e9 Merge branch '5.0.8' 2016-04-18 12:36:28 -07:00
Tom Eastep
5212dba7cb Add an ESTABLISHED,RELATED rule for docker0 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 10:13:05 -07:00
Tom Eastep
35a22eedac Reword error message when tcclass MARK is too large 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 10:06:04 -07:00
Tom Eastep
b53de922d1 Catch 0 in the MARK column of the tcclasses file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 08:50:10 -07:00
Tom Eastep
ae852b513d Correct indentation issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-17 10:23:18 -07:00
Tom Eastep
9611b588e3 Use a uniform format for log timestamps 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:52:35 -07:00
Tom Eastep
fb8dbcf44b Use a uniform format for log timestamps 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:49:38 -07:00
Tom Eastep
335f2968f8 Implement ?INFO and ?WARNING 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:20:09 -07:00
Tom Eastep
c725372639 Correct logging of 'reloaded' message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-15 14:46:21 -07:00
Tom Eastep
524838ae47 Implement $SW_LOGGERTAG 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-15 14:29:51 -07:00
Tom Eastep
6aa0ecae4f Re-factor the code for saving/loading ipsets 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 15:15:47 -07:00
Tom Eastep
434e042494 Add the deprecated/ directories to the CONFIG_PATH 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 14:17:06 -07:00
Tom Eastep
9fa0df2fd1 Move the code that generates zap_ipsets() to after save_ipsets() generation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 09:56:48 -07:00
Tom Eastep
216bc715e8 Clean up V4/V5 ipset enforcement 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 09:00:38 -07:00
Tom Eastep
dbd42e1d5d More ipset fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-12 16:29:13 -07:00
Tom Eastep
2cf3706864 Correct handling of a zone with two interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 10:32:26 -07:00
Tom Eastep
3028dafbac Correct DBL 'src-dst' handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 09:13:17 -07:00
Tom Eastep
16a31c3d29 Make MINIUPNPD work with DOCKER 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 09:02:44 -07:00
Tom Eastep
d3f377e915 Don't double-save the dynamic blacklisting ipset 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 08:37:39 -07:00
Tom Eastep
6c00f72f44 Create ipsets with the 'counters' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-10 18:09:41 -07:00
Tom Eastep
deaaecdf1c Add 'nodbl' interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-10 16:09:39 -07:00
Tom Eastep
05e4049174 Ipset-based blacklisting 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-10 16:07:56 -07:00
Tom Eastep
5db6cb1b7d Correct load_ipsets() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-09 16:07:10 -07:00
Tom Eastep
321476fd51 Tweak terminating() implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-08 08:24:57 -07:00
Tom Eastep
bd6b32eb25 Add a progress message for REJECT_ACTION processing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 10:30:54 -07:00
Tom Eastep
4fdf54eca1 Tweak process_reject_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 10:02:48 -07:00
Tom Eastep
70bbd21b35 Ensure that the REJECT_ACTION is terminating 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 09:34:38 -07:00
Tom Eastep
87a9b95f73 Catch case where a transformed rule jumps to its own chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 08:58:50 -07:00
Tom Eastep
ecd7261365 Use -g when target is a terminating chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 08:48:36 -07:00
Tom Eastep
293cd1d66a Always go to the reject chain rather than jump to it 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-06 09:14:06 -07:00
Tom Eastep
436b5d89ce Correct comment 
- The chain will only exist if logging wasn't specified for the same
  disposition.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-06 08:50:29 -07:00
Tom Eastep
26795cf082 Correct setup of $usedactions{A_REJECT} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-06 08:18:36 -07:00
Tom Eastep
3ac3ae279f Add A_REJECT action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-05 16:38:39 -07:00
Tom Eastep
e9467326f3 Allow allow REJECT to take a parameter 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-05 11:20:44 -07:00
Tom Eastep
75df718865 Reword comment in push_action_params() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-04 09:41:28 -07:00
Tom Eastep
ae8e2f70ea Efficiency change to known_interface() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 17:34:02 -07:00
Tom Eastep
39f5b77e5f Fix known_interface() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 16:31:45 -07:00
Tom Eastep
cb5a2519f3 Keep hyphens in @chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 16:30:31 -07:00
Tom Eastep
4151f7c504 Revert change to log_[i]rule_limit 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 16:29:52 -07:00
Tom Eastep
054837aeea Use the real chain name in log messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 13:04:25 -07:00
Tom Eastep
b637d303b9 Correct use of a physical interface name in the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-02 17:27:20 -07:00
Tom Eastep
0dbf42424d Make physical name a synonym for the correcponding logical name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-02 10:04:05 -07:00
Tom Eastep
f22e8d6d55 Allow physical interface to work in the ecn file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-01 15:10:49 -07:00
Tom Eastep
d98305c6f4 Correct default for MINIUPNOD 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-01 12:20:42 -07:00
Tom Eastep
3cbfdadb32 Merge branch '5.0.7' 2016-04-01 09:46:53 -07:00
Tom Eastep
df1b1f6768 Add MINIUPNPD option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-01 08:57:08 -07:00
Tom Eastep
3881b38e02 Fix similar INTERFACE column issue in the nat and netmap files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-31 14:16:43 -07:00
Tom Eastep
8a8f3b6f59 Merge branch '5.0.7' 2016-03-31 12:55:16 -07:00
Tom Eastep
b9bed00123 Correct handling of a physical name in a masq rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-31 12:52:30 -07:00
Tom Eastep
38aa7797c4 Allow protocol and user lists in actions and macros 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-30 08:34:42 -07:00
Tom Eastep
404540ffe1 Merge branch '5.0.7' 2016-03-30 08:17:19 -07:00
Tom Eastep
dd3c0daa08 Handle inline matches correctly in the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 13:33:47 -07:00
Tom Eastep
4fddfcfba0 More complete fix for inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 13:15:01 -07:00
Tom Eastep
421d5f6043 Move Raw matches to last. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 09:31:27 -07:00
Tom Eastep
382ab380a2 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2016-03-29 07:36:49 -07:00
Tuomo Soini
2342c7cd9c Perl/Shorewall/Chains.pm: Fix warning with older perl 2016-03-29 09:58:33 +03:00
Tom Eastep
66ae4975b2 Allow :R with DIVERT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-28 15:52:49 -07:00
Tom Eastep
5b7a9db170 Correct clearing of inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-28 15:48:59 -07:00
Tom Eastep
ad87d94e33 Small efficiency change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-26 13:12:33 -07:00
Tom Eastep
f86abf9552 Eliminate @columnstack -- simple save the columns array on the call stack. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-22 10:49:40 -07:00
Tom Eastep
9fe1a34412 Tighten up editing of configuration options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-21 12:03:45 -07:00
Tom Eastep
abe533b6e3 Correct the action on ingress filters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 13:45:33 -07:00
Tom Eastep
1c3140789c Add stab to ingress qdiscs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 13:25:39 -07:00
Tom Eastep
0399a346d0 Replace a silly line of code. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 12:05:45 -07:00
Tom Eastep
6ed3861d76 Correct Mangle Action Handling for second visit to the same action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 15:25:52 -07:00
Tom Eastep
7a18847c14 Correct handling of log level in a _DEFAULT setting. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 15:25:14 -07:00
Tom Eastep
273c89a753 Implement MARK and CONNMARK in the rules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:42:58 -07:00
Tom Eastep
2bebf1c95a Make '&' and '|' work with CONNMARK 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:30:52 -07:00
Tom Eastep
18573037f9 More 'check -r' fixes around Docker 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:09:39 -07:00
Tom Eastep
818628138b Add MARK and CONNMARK to the %targets table 
- Also, sort the table entries

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 10:21:35 -07:00
Tom Eastep
2adec0eb65 Implement a filename cache for find_file() 
- Don't need to search the CONFIG_PATH for re-open of same file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 09:45:41 -07:00
Tom Eastep
6ae94767b7 Correct a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 08:31:52 -07:00
Tom Eastep
9ab2310dc8 Correct an incorrect comment in process_rules() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-17 08:47:33 -07:00
Tom Eastep
da0653cb2f Declare passed() in Shorewall::User rather than importing it from Config 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 14:16:15 -07:00
Tom Eastep
65ce6ed226 Update modules to use passed() for parameter testing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 12:06:32 -07:00
Tom Eastep
eb9dd3e485 Implement passed() in Config.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 12:00:56 -07:00
Tom Eastep
796f191d48 Don't re-stat action files in process_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 09:03:36 -07:00
Tom Eastep
71c26beab4 Remove dead code (caused by bad test) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 17:56:34 -07:00
Tom Eastep
6f04902963 Make use of 'state=' in actions a fatal error 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 17:55:54 -07:00
Tom Eastep
901c6d34f6 Correct typo in Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:56:57 -07:00
Tom Eastep
741da14789 Ignore 'state' in the actions file with a warning 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:46:29 -07:00
Tom Eastep
dd547c90a8 Implement the 'state' action option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 14:30:36 -07:00
Tom Eastep
35fac8c2ea Avoid repeated %actions lookup in process_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 12:37:45 -07:00
Tom Eastep
513b828788 Pass '$prerule' to process_inline() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:56:07 -07:00
Tom Eastep
28e0cb5335 Use filename stored in the actions table 
- Avoid a find_file call on each action invocation

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:55:39 -07:00
Tom Eastep
c631173310 Eliminate the %inlines table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:47:18 -07:00
Tom Eastep
2c14b7c9e3 Rename %actparms to %actparams 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 15:36:38 -07:00
Tom Eastep
8e7af2e95e Additional editing of audit action parameters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 15:28:49 -07:00
Tom Eastep
44c0bffcd3 Add 'audit' option to actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 14:39:46 -07:00
Tom Eastep
2c3644a510 Make Action/Inline binary options into a bitmap 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 14:15:43 -07:00
Tom Eastep
407bc8f8db More prerule fixes in expand_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 12:57:23 -07:00
Tom Eastep
2743a411ae Add a jump to DOCKER from OUTPUT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 12:51:36 -07:00
Tom Eastep
c2fd48c4c6 Include pre-rule matches when the target is a chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 10:08:17 -07:00
Tom Eastep
5f01bc75bd Better fix for $current_param in the INLINE block of process_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 18:28:27 -08:00
Tom Eastep
0e59b82503 Handle '+' in inline matches the mangle and masq files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 17:14:15 -08:00
Tom Eastep
90ace544eb Implement '+' to specify inline matches as "early" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 16:39:46 -08:00
Tom Eastep
c36cee28fb Save/Restore $current_param in process_inline() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 16:39:08 -08:00
Tom Eastep
ec2ebee0e6 Clear inline matches between calls to process_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 15:08:47 -08:00
Tom Eastep
a50c52675b Correct a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 15:08:04 -08:00
Tom Eastep
bb7b3123df Eliminate ?begin perl ... ?end Perl in many actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 12:15:07 -08:00
Tom Eastep
3960fa6e0e Performance tweak to read_a_line() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 09:05:30 -08:00
Tom Eastep
a7fda02d88 Print lines copied into the generated script when tracing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-11 15:59:49 -08:00
Tom Eastep
68a324c62c Small tweaks to read_a_line() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-11 13:56:03 -08:00
Tom Eastep
6779c8307f Optimize chain resolution in process_mangle_rule1() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 15:26:52 -08:00
Tom Eastep
147c7e284f Fix a couple of Mangle Action blunders 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 13:59:29 -08:00
Tom Eastep
8d657775af Fix 'check -r' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 13:41:59 -08:00
Tom Eastep
b14bf0e779 Remove unused globals from the Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 11:14:51 -08:00
Tom Eastep
dc286c472c More tidying up of Mangle Actions 
- Delete an inadvertently-added blank line
- Move $convert declaration back to the Tc module
- Add comments in the Tc module about key moved declarations

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 15:51:54 -08:00
Tom Eastep
87f63b7160 Allow USE_DEFAULT_RT with NetworkManager 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 14:17:40 -08:00
Tom Eastep
617218f8ea Merge branch '5.0.6' 2016-03-09 11:36:46 -08:00
Tom Eastep
09c3be0adb Correct typo that cases restart failure. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 11:18:05 -08:00
Tom Eastep
ec9148637f Inline mangle actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 10:28:02 -08:00
Tom Eastep
991d8d2d3f Move convert_tos() back to the Tc module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-08 11:17:14 -08:00
Tom Eastep
301bce5d34 Clean up mangle actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-08 09:27:43 -08:00
Tom Eastep
a4aa020a84 Add R chain designator 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-07 13:51:49 -08:00
Tom Eastep
81c16d2d67 More Mangle Action Changes 
- Move open_mangle_for_output() back to the Tc module
- Eliminate global variables in process_mangle_rule1()
- Allow creation of mangle action chains
- Minor (but needed) logic changes

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-07 13:51:28 -08:00
Tom Eastep
bbbf54f7c3 Merge branch '5.0.6' 2016-03-07 08:59:17 -08:00
Tom Eastep
c37e41ee9c Avoid duplicate route rules from 'disable' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-06 15:48:33 -08:00
Tom Eastep
ba6dc9c5c0 First cut at mangle actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-06 12:42:22 -08:00
Tom Eastep
89b2c2fb55 Move mangle processing into the Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-06 08:59:37 -08:00
Tom Eastep
2bb143b28c Save/restore nat OUTPUT jump to DOCKER 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 12:21:45 -08:00
Tom Eastep
99f83da3ab Avoid duplicate rules after reload 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 11:09:53 -08:00
Tom Eastep
89e3e959dc Revert bad change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 10:20:55 -08:00
Tom Eastep
9e41264671 Go back to generating docker0 rules when it is defined to Shorewall 
- Avoids issues after 'stop'

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 09:27:47 -08:00
Tom Eastep
3fb715740d Avoid duplicated code blocks in save_dynamic_chains() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 09:27:04 -08:00
Tom Eastep
ed6ff96aa0 Replace another $VARDIR instance 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 14:11:57 -08:00
Tom Eastep
18dac19d86 Remove dead code from save_dynamic_chains() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 14:09:55 -08:00
Tom Eastep
d5ea876e93 Replace $VARDIR with ${VARDIR} for consistency 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 11:54:14 -08:00
Tom Eastep
f7a6ad1412 Clean up formatting in define_firewall() and stop_firewall() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 09:24:43 -08:00
Tom Eastep
b279869629 Fix DOCKER issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-02 20:59:44 -08:00
Tom Eastep
c56ba534d6 Yet more PAGER fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-02 12:34:39 -08:00
Tom Eastep
90d254f0c3 Add PAGER option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-02 08:32:49 -08:00
Tom Eastep
a95de8d092 Page the output of verbose commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-01 15:12:54 -08:00
Tom Eastep
68cce5ff73 Eliminate some sillyness in normalize_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-29 11:17:15 -08:00
Tom Eastep
1c1881859f Delete untrue comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-29 08:45:47 -08:00
Tom Eastep
5b163e9bc2 Save/restore docker0 rules when it isn't defined to Shorewall 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-27 14:09:29 -08:00
Tom Eastep
71d64ab380 Add DOCKER network support 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-27 13:36:47 -08:00
Tom Eastep
36d8518562 Code compaction 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-26 13:13:56 -08:00
Tom Eastep
6c88eb6916 Add an ECN action to shorewall-mangle(8) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-26 09:33:16 -08:00
Tom Eastep
6e1cc0f1d0 Correct stop/start Docker handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-25 13:37:44 -08:00
Tom Eastep
ee5ef07035 Correct another silly typo -- this time in allowBcast() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-24 14:58:10 -08:00
Tom Eastep
3c8696b91d Correct silly typo in setup_ecn() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-24 09:35:13 -08:00
Tom Eastep
fd4de0c66a Create more compact DOCKER conditional rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-22 14:46:35 -08:00