extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-02 20:44:11 +01:00
Code Issues Packages Projects Releases Wiki Activity
15,698 Commits 104 Branches 736 Tags 55 MiB
39d3312f17
Commit Graph

4216 Commits

Author SHA1 Message Date
Tom Eastep
6120eba8f9
Correct generation of code for 'noanycast' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-09-09 11:51:38 -07:00
Tom Eastep
4253f23d6b
Add 'noanycast' interface option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-09-07 13:47:56 -07:00
Tom Eastep
0b80856eb6
Correct IPv6 ACK handling in Simple TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-08-01 17:10:00 -07:00
Tom Eastep
ac221348c0
Add an SPORT column to the tcpri file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-09 14:15:03 -07:00
Tom Eastep
4b3f9ae1e7
Clean up the connmark implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-07 18:23:39 -07:00
Tom Eastep
89201bd294
Add TC connmark support 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-07 16:44:20 -07:00
Tom Eastep
b617c8d224
Rodrigo Araujo's tc connmark patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-07 14:28:21 -07:00
Tom Eastep
4469ddb861
Don't apply the deprecated directory more than once 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-06 15:38:28 -07:00
Tom Eastep
cd5409d633
Take care of '$LOG_LEVEL' during update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-06 15:38:01 -07:00
Tom Eastep
2f58d4e368
Don't create a zone forwarding chain for local zones 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-06 09:06:03 -07:00
Tom Eastep
628f5f0903
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2020-07-05 15:31:03 -07:00
Tom Eastep
ce73c783dc
Avoid Perl diagnostic when updating shorewall[6].conf 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-05 15:29:34 -07:00
Tom Eastep
e7318459f1
Avoid double colons in the CONFIG_PATH 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-05 15:27:47 -07:00
Tom Eastep
467d41f0cc
Merge branch '5.2.6' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-05 13:23:48 -07:00
Tom Eastep
b761a6eaa0
Call optimize_policy_chains() after doing other ruleset optimization 
- This insures that ACCEPT policy chains are optimized when EXPAND_POLICIES=No

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-04 10:40:43 -07:00
Tom Eastep
f8b7815375
Call optimize_policy_chains() after doing other ruleset optimization 
- This insures that ACCEPT policy chains are optimized when EXPAND_POLICIES=No

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-07-04 09:49:28 -07:00
Tom Eastep
3dc14e3575
Work around for Centos 7 iptables bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-29 11:27:14 -07:00
Tom Eastep
7ba6ac71e3
Delete blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-28 20:41:21 -07:00
Tom Eastep
10aef23ab1
Correct handling of ";;+" in the snat file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-28 11:03:04 -07:00
Tom Eastep
e3f139bbdb
Add SPORT column to the snat file (FORMAT 2) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-27 14:50:23 -07:00
Tom Eastep
43ac903085
Correct action dport implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-26 16:55:39 -07:00
Tom Eastep
bac493c2c5
Merge branch '5.2.5' 2020-06-26 15:31:51 -07:00
Tom Eastep
3ed1cdec94
Rename the snat PORT column to DPORT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-26 14:44:00 -07:00
Tom Eastep
e2aeed898d
Add the 'dport' option to the actions file(s) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-15 13:12:06 -07:00
Tom Eastep
2eb1c88555
Omit superfluous test 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-14 15:00:49 -07:00
Tom Eastep
117e9ba5bd
Change kern.err to daemon.err in logger params 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-13 14:29:48 -07:00
Tom Eastep
3ce04a8ef3
Add "zone name too long" error 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-12 12:57:31 -07:00
Tom Eastep
220e89755e
Omit STATE-orientated rules in wildcard policy chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-07 20:57:55 -07:00
Tom Eastep
aa47554604
Add 'noupdate' DYNAMIC_BLACKLIST option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-06 10:14:32 -07:00
Tom Eastep
527533ecb6
Add 'log' option to DYNAMIC_BLACKLIST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-03 14:28:08 -07:00
Tom Eastep
4ac64a545c
Change log facility to 'daemon' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-03 13:49:10 -07:00
Tom Eastep
6612ea6b8c
Store the exported configuration paramaters in a named array 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-03 11:50:27 -07:00
Tom Eastep
ffb6ac178e
Shorten the disposition in ADD/DEL log messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-06-01 09:36:00 -07:00
Tom Eastep
5af7dce96b
Merge branch 'master' of ssh://gitlab.com/shorewall/code 2020-05-31 14:03:23 -07:00
Tom Eastep
eb5bc3d8a4
Create DBL ipset with 'timeout 0' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-05-31 12:37:42 -07:00
Tom Eastep
67b421dc00
Correct a comment in the optimize level 8 code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-05-21 11:37:04 -07:00
Tom Eastep
f27ab4704c
Merge branch '5.2.4' 2020-04-30 11:18:18 -07:00
Tom Eastep
e5e8e6fbc0
Correct logic for deleting ipsets 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-29 13:07:04 -07:00
Tom Eastep
c11b647b1b
Fix defect which prevented dynamic blacklist ipsets from being created 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-29 12:34:41 -07:00
Tom Eastep
5706c5a860
Avoid hang during 'shorewall[6] start' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-29 12:33:50 -07:00
Tom Eastep
2bf9048057
Another Debian if_pre-down fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-24 16:47:42 -07:00
Tom Eastep
d618fd5812
Remove extraneous whitespace 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-23 20:31:07 -07:00
Tom Eastep
dddde56454
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 
# Conflicts:
#	Shorewall-init/install.sh
#	Shorewall/Perl/Shorewall/Providers.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-23 18:35:11 -07:00
Tom Eastep
0a9d2d9a33
Don't install script in if_down.d on Debian 
- Eliminates need for Debian-specific code in generated script

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-22 13:47:09 -07:00
Tom Eastep
39de88563f
Cleanup of Optimize 16 change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-21 13:02:56 -07:00
Tom Eastep
e14798b4a2
Make OPTIMIZE=16 an order of magnitude faster 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-21 13:02:34 -07:00
Tom Eastep
086f7a0e6d
Only destroy ipsets that will be restored 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-20 09:11:03 -07:00
Tom Eastep
057a2dec70
Correct typo with bad consequences 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-19 18:44:19 -07:00
Tom Eastep
cabadd4846
Honor 'wait=<seconds> when enabling an interface. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-19 14:31:12 -07:00
Tom Eastep
3c06be28be
Delete unnecessary check if IPv6 interface_is_usable() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-19 12:28:16 -07:00
Tom Eastep
381d55760b
Don't install ifupdown script in /etc/network/if-down.d on Debian 
- Network Manager sets PHASE=post-down when calling our updown script
  so we must process down commands in that phase.

- Modify the generated script to eliminate PHASE checks.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-18 11:42:32 -07:00
Tom Eastep
88a799b860
Allow IFUPDOWN=1 to work on Debian 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-18 11:27:15 -07:00
Tom Eastep
4e83d0788e
Rename valuesort() to sortchainsiftest() and remove keysort() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-11 13:42:41 -07:00
Tom Eastep
a49a9f9f9d
Sort specific hash keys and values if -t 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-07 11:12:16 -07:00
Tom Eastep
6dc99e77ae
Revert "Sort specific hash keys and values if -e" 
This reverts commit 5e648a9379.
 2020-04-07 11:09:27 -07:00
Tom Eastep
92b25d88b0
Revert "Add conditional sorts to find[_zone]_hosts_by_option()" 
This reverts commit 42a505c99d.
 2020-04-07 11:08:46 -07:00
Tom Eastep
42a505c99d
Add conditional sorts to find[_zone]_hosts_by_option() 
- Another case of different behavior by different Perl versions

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-06 13:48:45 -07:00
Tom Eastep
5e648a9379
Sort specific hash keys and values if -e 
- Makes testing output consistent across Perl versions

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-06 10:57:35 -07:00
Tom Eastep
e49f31fb42
Don't compute sha1 hash when testing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-04-02 10:11:21 -07:00
Tom Eastep
3f0e4959a1
Revert "When exporting or testing, set all variables defined in the params file" 
This reverts commit f9003fab43.
 2020-04-01 12:55:41 -07:00
Tom Eastep
112c4dc38a
Revert "Temporarily disable fix for exported variables" 
This reverts commit 137cc48779.
 2020-04-01 12:55:14 -07:00
Tom Eastep
137cc48779
Temporarily disable fix for exported variables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-31 16:43:30 -07:00
Tom Eastep
f9003fab43
When exporting or testing, set all variables defined in the params file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-31 15:55:09 -07:00
Tom Eastep
78da975989
Fix a couple of issues with product name 
- Use $Product rather that addressfamily-dependent logic
- Revert unneeded change from 5.2.3.7

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-28 14:24:32 -07:00
Tuomo Soini
be924ff765
Fix http links to point to current project website 
Also removes deprecated Shorewall6/configfiles/masq

Signed-off-by: Tuomo Soini <tis@foobar.fi>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-27 14:24:37 -07:00
Tom Eastep
2604378646
Add 'help' to the generated script's help text 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-08 13:20:27 -07:00
Tom Eastep
b52a330f41
Replace trace, debug and nolock with options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-07 17:48:10 -08:00
Tom Eastep
d3de75dd12
Add DOCKER_BRIDGE option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-07 11:34:23 -08:00
Tom Eastep
639dc86e1b
Merge branch 'master' into 5.2.4 
# Conflicts:
#	Shorewall/Perl/Shorewall/Config.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-06 13:07:00 -08:00
Tom Eastep
fa1aa4b481
Merge branch '5.2.3' 
# Conflicts:
#	docs/Introduction.xml
 2020-03-06 13:04:18 -08:00
Tom Eastep
9f3534dc1f
Correct Docker-related typos in Compiler.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-04 14:55:52 -08:00
Tom Eastep
f63f0bb2f1
Correct DOCKER code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-03 14:38:36 -08:00
Tom Eastep
65e101f306
Refine handling of MANGLE_ENABLED=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-02 08:21:34 -08:00
Tom Eastep
000f120c61
Improve checking when MANGLE_ENABLED=No in shorewall[6].conf 
- Fatal error when a feature is used that requires the mangle table

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-01 15:38:28 -08:00
Tom Eastep
f221ca290f
Improve checking when MANGLE_ENABLED=No in shorewall[6].conf 
- Fatal error when a feature is used that requires the mangle table

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-01 15:07:17 -08:00
Tom Eastep
8b99f8caac
Merge branch 'master' into 5.2.4 
# Conflicts:
#	docs/SharedConfig.xml

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-01 13:50:05 -08:00
Tom Eastep
8b2c79e5ce
Merge branch '5.2.3' into 5.2.4 
# Conflicts:
#	docs/Introduction.xml

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-03-01 13:48:45 -08:00
Tom Eastep
dcde2bfa4a
Correct logic that decides if a reload is necessary during enable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-02-26 15:22:17 -08:00
Tom Eastep
387b861759
Correct handling of ORIGDEST with OLD_CONNTRACK_MATCH 
- Also correct detection of OLD_CONNTRACK_MATCH in shorewall6

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-02-25 13:08:58 -08:00
Tom Eastep
6798c2f2b0
Accomodate both DOCKER-ISOLATION and DOCKER-ISOLATION-STAGE-* 
Previously, the code assumed that either DOCKER-ISOLATION or
DOCKER-ISOLATION-STAGE-* would exist but not both. That has been corrected
 2020-02-24 15:35:50 -08:00
Tom Eastep
e8f49bc9c7
Merge branch '5.2.3' 2020-02-18 11:11:53 -08:00
Tom Eastep
31b558b7f9
Filter out LIBVIRT rules when saving Docker Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-02-16 10:36:16 -08:00
Tom Eastep
367a5f7d97
Filter out LIBVIRT rules when saving Docker Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-02-16 10:33:18 -08:00
Tom Eastep
4efac2fda1
Handle essential IPv6-ICMP types when firewall is stopped 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-02-06 15:21:51 -08:00
Tom Eastep
5f50b70618
Merge branch '5.2.3' into 5.2.4 
# Conflicts:
#	docs/SharedConfig.xml

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2020-02-06 14:08:33 -08:00
Tom Eastep
7aaa04149e Merge branch '5.2.3' 
# Conflicts:
#	Shorewall/manpages/shorewall-files.xml
#	docs/SharedConfig.xml
 2020-02-01 09:45:33 -08:00
Tom Eastep
08da235896
Correct IPv6 Address Range parsing 
Previously, such ranges were required to be of the form [<addr1>-<addr2>]
rather than the more standard form [<addr1>]-[<addr2>]. In the snat file
(and in nat actions), the latter form was actually flagged as an error
while in other contexts, it resulted in a less obvious error being raised.

With this change, both forms are accepted.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-12-23 10:02:48 -08:00
Tom Eastep
77cad81ba7
Clean up comments 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-12-23 09:59:29 -08:00
Tom Eastep
157abcbd37
Allow NFQUEUE 'bypass' in the policy file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-10-21 14:41:02 -07:00
Tom Eastep
2b7a37e42a
Minor cleanup of the Chains module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-10-16 11:44:02 -07:00
Tom Eastep
cb56991fee
Merge branch '5.2.3' 2019-09-03 07:45:57 -07:00
Tom Eastep
40f6192e19
Make 'AUTOMAKE=No' the update default 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-08-25 14:20:54 -07:00
Tom Eastep
7051daeb08
Correct handle of multi-queue NFQUEUE when passed to a macro 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-08-25 14:18:54 -07:00
Tom Eastep
a9c42e1eaa
Correct NFQUEUE policy with per-CPU queues 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-08-25 14:18:06 -07:00
Tom Eastep
c127cec76c
Merge branch '5.2.3' 2019-04-14 14:35:09 -07:00
Tom Eastep
6b21135ade
Correct handling of an ipset in the SPORT column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-04-11 18:37:27 -07:00
Tom Eastep
2f66381a4a
Allow multiple protocols to be specified for a helper 
- the protocol list is specified in the %helpers hash as an array reference
  e.g., "[UDP,TCP]". Note that those are protocol *numbers*, not names.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-04-01 15:14:34 -07:00
Matt Darfeuille
53495ec0a8
Point exclusively to shorewall.org 
Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-03-25 11:35:00 -07:00
Tom Eastep
2f3f6ffa15
Revert "Make $update global in Config.pm" 
This reverts commit b9d0821acb.
 2019-03-17 08:02:53 -07:00
Tom Eastep
60f2f3b0d0
Allow variable expansion when processing shorewallrc. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2019-03-14 20:38:10 -07:00