extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-23 14:48:51 +01:00
Code Issues Packages Projects Releases Wiki Activity
9,915 Commits 104 Branches 736 Tags 55 MiB
46a99a7cd9
Commit Graph

3722 Commits

Author SHA1 Message Date
Tom Eastep
aba63d5c9b More action/macro documentation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-13 09:06:29 -08:00
Tom Eastep
9ba8823011 Document Action Changes in the release documents 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-13 08:45:58 -08:00
Tom Eastep
c18154cedc NAT in Actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-13 08:26:24 -08:00
Tom Eastep
ff402dcf09 Add a comment to the params for process_rule_common() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-12 13:02:27 -08:00
Tom Eastep
2e7dd0de97 Use process_rule_common() to process entries in action files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-12 12:55:32 -08:00
Tom Eastep
444a38ae2e Add a chain reference argument to process_rule_common() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-12 12:22:12 -08:00
Tom Eastep
dfa47cc300 Implement format-2 Actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-12 12:09:48 -08:00
Tom Eastep
1bbe95ead8 Allow wide macros in actions 2010-12-12 10:14:47 -08:00
Tom Eastep
acbbdc1690 Bump version in the Proxyarp module 2010-12-12 08:56:12 -08:00
Tom Eastep
13c4d21762 Replace a couple of lists of scalars with arrays; document move of process_rules1() 2010-12-12 07:29:46 -08:00
Tom Eastep
138e49276d Rename process_rule1() to process_rule_common() 2010-12-11 17:19:43 -08:00
Tom Eastep
7b86c699b6 Move process_rule1() from Rules.pm to Actions.pm 2010-12-11 17:16:50 -08:00
Tom Eastep
48b00d719e Complete Proxy NDP implementation 2010-12-11 10:04:07 -08:00
Tom Eastep
147e4da223 Ensure that interfaces listed in the tcinterfaces file are known 2010-12-11 07:39:16 -08:00
Tom Eastep
0344cdb294 Correct handling of proxyndp 2010-12-11 07:10:50 -08:00
Tom Eastep
1f4b218cde Ensure that interfaces listed in the proxyarp (proxyndp) file are known 2010-12-11 07:10:23 -08:00
Tom Eastep
caa4a54e38 Implement IPv6 proxyndp 2010-12-10 19:06:44 -08:00
Tom Eastep
2ae809888c Document fix for logical naming 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-10 12:19:43 -08:00
Tom Eastep
0a4e098c69 Fix broken logical naming in Proxy ARP 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-10 07:52:54 -08:00
Tom Eastep
fc6dbb3d56 Bump version to Beta 4 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-10 06:53:36 -08:00
Tom Eastep
6d65100457 Add PPP support in RedHat and SuSE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-05 09:11:08 -08:00
Tom Eastep
b9ee064284 Update version to Beta 4 2010-12-04 11:40:34 -08:00
Tom Eastep
19f40ab721 Bump version to Beta 3 2010-12-03 13:43:46 -08:00
Tom Eastep
2e35ad0a1b Fix params parsing on older distros 2010-12-03 13:40:11 -08:00
Tom Eastep
5458d9367f Bump version and document bug catcher 2010-12-03 09:17:26 -08:00
Tom Eastep
8ce1755f8e Add bug-catcher to get_params() 2010-12-03 08:05:11 -08:00
Tom Eastep
04537b8f2d Add some comments 2010-12-02 16:10:35 -08:00
Tom Eastep
79c87b2c72 Document fixes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-02 12:26:58 -08:00
Tom Eastep
4cd77bf9aa Correct handling of params file opens. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-12-02 10:14:45 -08:00
Tom Eastep
ec75c8aa86 Redirect params output to stderr 2010-12-01 15:04:33 -08:00
Tom Eastep
f68bfde86f Continue to fine-tune params processing 2010-12-01 13:57:16 -08:00
Tom Eastep
d33491d6c6 Continue to enhance params procesing 2010-12-01 13:18:10 -08:00
Tom Eastep
49cdc5d9eb Make new get_params work with bash 2010-12-01 10:41:49 -08:00
Tom Eastep
22580c5be0 More parameter processing improvements 2010-12-01 10:11:02 -08:00
Tom Eastep
901a986b18 Update release notes regarding suppressed warning 2010-12-01 09:21:46 -08:00
Tom Eastep
b224eb80d5 Omit warning message 2010-12-01 09:21:23 -08:00
Tom Eastep
cdb75bfd96 Better solution to multi-line exported symbols issue 2010-12-01 09:14:09 -08:00
Tom Eastep
5761bfd7d1 Document change to params processing 2010-12-01 08:16:41 -08:00
Tom Eastep
0455673bcb Remove fly speck from release notes 2010-12-01 07:27:31 -08:00
Tom Eastep
cae5ddc7e0 Initiate 4.4.16 2010-11-30 17:30:11 -08:00
Tom Eastep
6ef0f0f9d3 Document addition of startup_error() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-11-29 16:02:35 -08:00
Tom Eastep
6dc65e2811 Update Rules.pm version 2010-11-28 19:21:31 -08:00
Tom Eastep
81cc39049c Cosmetic change 2010-11-28 09:22:03 -08:00
Tom Eastep
f45af8ff0a Localize $current_params 2010-11-28 09:14:52 -08:00
Tom Eastep
ecb71f7791 Eliminate @param_stack 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-11-28 08:06:58 -08:00
Tom Eastep
195c0cdaca Document fix of root cause 2010-11-28 07:48:03 -08:00
Tom Eastep
4db68697b2 Fix root cause of macro.JAP failure 2010-11-28 07:42:12 -08:00
Tom Eastep
d5b5e7fa75 Document correction to macro.JAP 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-11-28 07:07:58 -08:00
Tom Eastep
3a8634934a Correct macro.JAP 2010-11-28 07:05:18 -08:00
Tom Eastep
b771ce2925 Clarify 'switch' in the Fool's firewall article 2010-11-27 10:28:44 -08:00
Tom Eastep
1ae9a3185a Disallow standard providers in the routes file 2010-11-26 16:41:30 -08:00
Tom Eastep
053da3a2c0 Fix undefined value on HEADER_MATCH 2010-11-26 16:41:07 -08:00
Tom Eastep
d5fc0150d0 Set version to 4.4.15 2010-11-26 09:49:40 -08:00
Tom Eastep
81622fe63b Add new Macros 2010-11-26 08:32:54 -08:00
Tom Eastep
00cedeeda3 Update macro template for HEADERS column 2010-11-24 11:23:37 -08:00
Tom Eastep
2702d7f208 Implement header matching 2010-11-24 10:46:06 -08:00
Tom Eastep
70453f2648 Avoid regression in fixing syn flood chain names 2010-11-22 14:34:58 -08:00
Tom Eastep
f2f2ef713d Update version of a couple of Perl Modules 2010-11-22 13:23:15 -08:00
Tom Eastep
93d165d3ec Document Munin Macro 2010-11-22 13:04:21 -08:00
Tom Eastep
6f6b417232 Add Munin Macro 2010-11-22 13:01:38 -08:00
Tom Eastep
9427510e8f Update version to RC 1 2010-11-22 13:01:12 -08:00
Tom Eastep
93f9e8914c Add another SNAT virtual alias example 2010-11-22 11:59:59 -08:00
Tom Eastep
2e4da207de Update version to Beta 3 2010-11-21 09:52:34 -08:00
Tom Eastep
befdbb4a04 Move version_command() to where it belongs 2010-11-21 07:41:29 -08:00
Tom Eastep
d08f8d6ac3 Update release documents 2010-11-19 17:53:58 -08:00
Tom Eastep
3ca3d64efe Generate correct name for synflood chains 2010-11-18 20:32:20 -08:00
Tom Eastep
407b92829f Another Perl 5.12 issue 2010-11-18 20:12:13 -08:00
Tom Eastep
63e5f6aff9 Correct handling of family switch in tcfilters processing 2010-11-18 06:56:07 -08:00
Tom Eastep
63fd81f9ec Simplify getparams 2010-11-17 17:26:41 -08:00
Tom Eastep
5e1c8f8d2a Add DEVICE column to routes file 2010-11-17 08:35:20 -08:00
Tom Eastep
421b1e745d Update release documents with /etc/shorewall/routes information 2010-11-16 21:02:50 -08:00
Tom Eastep
71eb783fcd Implement explicit provider routing 2010-11-16 20:38:54 -08:00
Tom Eastep
81e6e0889c Initiate Beta 2 2010-11-15 15:09:22 -08:00
Tom Eastep
3c5cadb02c Add another variable to the preceding optimization 2010-11-15 08:42:58 -08:00
Tom Eastep
64e49229f8 Simply variable initialization 2010-11-15 08:14:31 -08:00
Tom Eastep
7507f67d9a Now that I've RTFM, simplify the rule for skipping over the IPv6 header 2010-11-15 07:40:50 -08:00
Tom Eastep
94e827862e Fix typo in release notes 2010-11-15 07:40:18 -08:00
Tom Eastep
31bcb8727e Update release documents 2010-11-14 15:54:58 -08:00
Tom Eastep
5d0e719d03 Prevent suprious 'fi' in filter output 2010-11-14 10:51:42 -08:00
Tom Eastep
0e5dc41d31 Fix 'Shared' traffic shaping 2010-11-14 09:31:00 -08:00
Tom Eastep
997a697a65 Fix required/optional interface with physical eq '+' 2010-11-14 08:43:20 -08:00
Tom Eastep
9568a6ef59 Add getparams to the .spec file - Take 2 2010-11-14 08:10:05 -08:00
Tom Eastep
59f6b10a55 Add getparams to the .spec file 2010-11-14 08:03:14 -08:00
Tom Eastep
2d8785d574 Add 'TC_ENABLED=Shared' support 2010-11-14 07:52:51 -08:00
Tom Eastep
5bae689fe1 Generate distinct progress messages for IPv4 and IPv6 filters 2010-11-14 07:38:01 -08:00
Tom Eastep
ff571cb83b Give IPv6 filters a distinct priority 2010-11-14 06:55:09 -08:00
Tom Eastep
1d93a18b8d IPV6 now working -- BOTH still broken 2010-11-13 18:08:19 -08:00
Tom Eastep
3f6cce10d2 Protect against accidental output from params file 2010-11-13 16:16:58 -08:00
Tom Eastep
19122512d0 Fix new params file processing for INCLUDE 2010-11-13 10:59:09 -08:00
Tom Eastep
b20ed2d4de Simply another RE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-11-11 14:03:00 -08:00
Tom Eastep
775bee278a Fix for unexpected /usr/share/shorewall/init 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-11-11 13:03:00 -08:00
Tom Eastep
ff61d4dba4 Correct documentation of NULL_ROUTE_RFC1918 fix 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-11-10 14:18:33 -08:00
Tom Eastep
0602b619bd Fix NULL_ROUTE_RFC1918=Yes 2010-11-09 15:20:23 -08:00
Tom Eastep
8a9aaff4e8 Change shell variable resolution order 2010-11-07 13:28:03 -08:00
Tom Eastep
1e6b7c8130 Simplify an RE 2010-11-06 20:25:46 -07:00
Tom Eastep
092f032b8e Realign precedence of environment inheritance 2010-11-06 19:02:14 -07:00
Tom Eastep
25397e8284 Document params file processing change 2010-11-06 18:33:41 -07:00
Tom Eastep
69c3600107 Modernize processing of params file 2010-11-06 17:12:05 -07:00
Tom Eastep
7c4bc900d6 Belated update to Perl module versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-30 10:45:14 -07:00
Tom Eastep
dcf2d633b1 Don't save ipsets if there are no dynamic zones or ipset rules 2010-10-30 10:35:52 -07:00
Tom Eastep
d4f857f877 Update version to 4.4.15-Beta1 2010-10-30 07:12:03 -07:00
Tom Eastep
4daf4c372e Initialize release documents for 4.4.15 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-29 08:28:58 -07:00
Tom Eastep
1db13849ab Clear VERBOSE and VERBOSITY at CLI startup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-28 15:17:37 -07:00
Tom Eastep
5cf0cd2c33 Document VERBOSITY fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-28 11:41:38 -07:00
Tom Eastep
8758d3a834 Insure that VERBOSITY=0 when interrogating compiled script version 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-28 11:25:56 -07:00
Tom Eastep
20bb781874 Document fix for 10+ TC interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-28 10:33:17 -07:00
Tom Eastep
bc406b39bc Fix > 10 TC interfaces 2010-10-28 10:27:55 -07:00
Tom Eastep
6c90046ab5 Document fix for split_list() 2010-10-26 06:55:01 -07:00
Tom Eastep
f2ab068044 Fix split_list() 2010-10-26 06:49:55 -07:00
Tom Eastep
1060b201dd Update version to 4.4.14 2010-10-23 21:40:22 -07:00
Tom Eastep
ded852e0ee Fix compilation warning 2010-10-19 08:42:35 -07:00
Tom Eastep
3ec6185f72 Run update-rc.d on Debian 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-13 08:42:35 -07:00
Tom Eastep
28e473d9a1 Document change to FORWARD_CLEAR_MARK default 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-10 07:49:17 -07:00
Tom Eastep
11f2c7772a Clear FORWARD_CLEAR_MARK setting in the remaining config files 2010-10-09 11:28:13 -07:00
Tom Eastep
17860cacd8 Move dump_command() to a more logical place in the file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-07 14:36:05 -07:00
Tom Eastep
033d43b014 Implement undocumented dumpfilter extension file 2010-10-07 14:35:51 -07:00
Tom Eastep
f0ef27b3e5 Update version to RC1 2010-10-06 16:16:37 -07:00
Tom Eastep
b9602d9a6a Correct typo in the release notes 2010-10-06 11:24:45 -07:00
Tom Eastep
3d90c63528 Improve validation and reporting in the net list processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-05 16:20:07 -07:00
Tom Eastep
a10ced2da2 Make exclusion of set lists more consistent 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-05 12:22:27 -07:00
Tom Eastep
7767d30c7c Improve error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-05 11:25:18 -07:00
Tom Eastep
587dacdae0 Allow set lists with "!" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-05 08:38:30 -07:00
Tom Eastep
8fd221ef30 Refine source/dest network parsing in expand_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-04 18:57:11 -07:00
Tom Eastep
e74f48410f Correct handling of exclusion with ipset lists 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-04 14:29:50 -07:00
Tom Eastep
38851fe446 Delete obsolete options from shorewall.conf 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-04 07:44:28 -07:00
Tom Eastep
cee05d9763 Refine -lite handling of scfilter. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-03 12:52:30 -07:00
Tom Eastep
b3d0447ef2 Reword scfilter -lite explaination 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-03 11:00:51 -07:00
Tom Eastep
432534a650 Eliminate need to restart -lite to extract scfilter 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-03 10:56:55 -07:00
Tom Eastep
994ea3cce6 Document -lite log reading fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-03 08:35:17 -07:00
Tom Eastep
f9af35ffbe Document -lite fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-02 07:22:37 -07:00
Tom Eastep
b27fd07e9f Don't indent the embedded scfilter file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-01 13:20:36 -07:00
Tom Eastep
ac71868cc1 Package the scfilter along with the generated script for -lite 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-01 10:59:15 -07:00
Tom Eastep
6e9fc12517 Update version to Beta 4 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-01 09:31:11 -07:00
Tom Eastep
468af44876 Add support for 'scfilter' script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-01 09:15:58 -07:00
Tom Eastep
2fa7e11976 Add 'scfilter' extension script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-10-01 07:38:14 -07:00
Tom Eastep
3898edfddb Make 'show connections' work on ancient distros 2010-09-30 17:18:58 -07:00
Tom Eastep
077aa18a2d Update release notes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-30 15:03:02 -07:00
Tom Eastep
e795a9995b Update release documents 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-30 14:17:51 -07:00
Tom Eastep
1218ccf0cb More optimization performance improvements 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-30 14:15:19 -07:00
Tom Eastep
252a9f2205 More speedup of optimization level 8 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-29 13:30:10 -07:00
Tom Eastep
46f1074422 Reduce the cost of optimization substantially. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-29 11:54:39 -07:00
Tom Eastep
8017f603a0 Add progress message for each optimization pass. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-28 12:20:35 -07:00
Tom Eastep
6171d938f7 Correction to last change -- move two declarations to an outer block. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-28 12:20:06 -07:00
Tom Eastep
48c3200a5a Issue error message when required file is missing or has zero size. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-28 11:22:47 -07:00
Tom Eastep
68f537ac5b Bypass processing logic when an optional config file is absent. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-28 10:48:44 -07:00
Tom Eastep
47fbc83419 Don't add trailing whitespace to DNAT/REDIRECT target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-28 09:27:42 -07:00
Tom Eastep
91aabfc078 Revise fix for extraneous progress messages 2010-09-27 16:18:11 -07:00
Tom Eastep
0109b8113a Prevent random progress messages during compilation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-27 15:56:22 -07:00
Tom Eastep
75d50d126c Make zones with 'mss' complex. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-27 13:57:56 -07:00
Tom Eastep
f7eb3c3d8c Periodic elimination of trailing white space 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-27 11:16:18 -07:00
Tom Eastep
f33912d5f7 Correct/update release notes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-27 09:11:17 -07:00
Tom Eastep
ac646930a3 Tighter validation of ipset names in the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-26 08:36:27 -07:00
Tom Eastep
066c772fcd Correct minor issue with previous error message improvement change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-26 08:28:25 -07:00
Tom Eastep
0becb39202 Bump version to Beta 3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-26 08:15:32 -07:00
Tom Eastep
2828b65326 Improve error message generated when a token beginning with '+' reaches validate_net() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-26 07:56:55 -07:00
Tom Eastep
74f1cb2443 Mention maclist file in shorewall-ipsets(5) 2010-09-25 16:07:56 -07:00
Tom Eastep
f07ec1e9d3 Clean up untidiness where Shorewall6 tries to start on a system with an old kernel 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-25 08:46:14 -07:00
Tom Eastep
e018ee6adc Don't create <zone>_frwd when unnecessary 
- Set the zone {complex} flag based on ipsec options rather than the presense of any options.
- Generate forwarding blacklist rules in lieu of creating<zone>_frwd

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-24 15:25:57 -07:00
Tom Eastep
b5fdb089bc Fix syntax error in blacklist fix 2010-09-24 13:42:05 -07:00
Tom Eastep
0768235278 Correct blacklisting in simple configurations 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-24 13:41:54 -07:00
Tom Eastep
03161ed57d Bump version to 4.4.14 Beta 2 2010-09-23 19:33:37 -07:00
Tom Eastep
0f4d8eb929 Use 'conntrack' for 'show connections' 2010-09-23 19:08:40 -07:00
Tom Eastep
6702fbbd40 Make timestamps in log uniform 2010-09-23 07:40:27 -07:00
Tom Eastep
2c7b1b5d7b Add more comments 2010-09-22 15:26:01 -07:00
Tom Eastep
9d5642aedd Update Version to 4.4.14-Beta1 2010-09-21 11:34:26 -07:00
Tom Eastep
dbd7914ee6 More fiddling with move_rules() 
- Assert that the chain being moved has no blacklist jumps
- delete duplicate rules in case the destination chain has such a jump
 2010-09-20 18:00:39 -07:00
Tom Eastep
271154ed60 Rename DESTIFAC_DISALLOW -> DESTIFACE_DISALLOW 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-20 09:45:48 -07:00
Tom Eastep
bde0a297f9 Misc cleanup for 4.4.13 
1. Replace statement with equivalent function call in promote_blacklist_rules()
2. Bump version of Tunnels.pm
3. Fix typo in comment in Zones.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-20 09:45:38 -07:00
Tom Eastep
7baa1839cf Tighen up parsing of bracketed lists -- Take 2 2010-09-20 07:24:22 -07:00
Tom Eastep
f64993fe40 Tighen up parsing of bracketed lists 2010-09-20 07:05:23 -07:00
Tom Eastep
0ed33a0552 Document fix for '*' in interface names 2010-09-19 15:55:09 -07:00
Tom Eastep
9335ef5745 Don't allow '*' in interface names 2010-09-19 15:10:21 -07:00
Tom Eastep
25ca73ca54 Support alternative syntax for ipet lists 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-19 13:22:12 -07:00
Tom Eastep
0c6882c3a8 Merge branch '4.4.13' 2010-09-19 12:55:08 -07:00
Tom Eastep
c7fc4ce1f5 Correct order of release note entries 2010-09-19 12:54:54 -07:00
Tom Eastep
9111540a7f Support ipset lists 2010-09-19 12:36:20 -07:00
Tom Eastep
35a686eaa1 Add delete_reference() function. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-19 08:28:29 -07:00
Tom Eastep
9ba82bec1f Add warning about redundant 'blacklist' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-19 08:28:05 -07:00
Tom Eastep
e06ca34298 Add redundancy warning re 'blacklst' 2010-09-19 08:03:01 -07:00
Tom Eastep
b3d6ae78ba Add redundancy warning re 'blacklst' 2010-09-19 07:57:36 -07:00
Tom Eastep
940ccf2c34 Document for tcfilter port ranges 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 15:11:41 -07:00
Tom Eastep
c0382b8cb9 Adjust reference count in move rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 15:11:17 -07:00
Tom Eastep
ce9b5ee944 Make blacklist rule promotion much more effecient. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 13:35:24 -07:00
Tom Eastep
74abd4ad54 In copy_rules(), handle the unlikely case where both chains have blacklist jumps. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 12:26:07 -07:00
Tom Eastep
f7db24f756 Merge branch '4.4.13' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 09:29:50 -07:00
Tom Eastep
f25b9e1967 Allow :<port> in tcfilters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 09:26:29 -07:00
Tom Eastep
0e9c704069 Don't scan the filter table for jumps to 'blacklst' if the 'blacklst' chain does not exist 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 08:42:21 -07:00
Tom Eastep
c3299d5f89 Enable blacklist rule promotion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 08:38:22 -07:00
Tom Eastep
6f0893cd7a Correct Chains::promote_blacklist_rules() 
- Interate through chains that jump to 'blacklst' until no rule is promoted
  This is required to promote jumps past exclusion chains
- Correct reference counting; the first cut was horribly wrong

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 08:38:14 -07:00
Tom Eastep
c040344bc1 Promote 'in' blacklist rules to the head of the interface chain 
- Added Chains::promote_blacklist_rules()
- Called the function from Rules::generate_matrix()

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 08:38:02 -07:00
Tom Eastep
2fa16f6d08 Enable blacklist rule promotion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 08:36:59 -07:00
Tom Eastep
578fc6c521 Correct Chains::promote_blacklist_rules() 
- Interate through chains that jump to 'blacklst' until no rule is promoted
  This is required to promote jumps past exclusion chains
- Correct reference counting; the first cut was horribly wrong

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 08:36:35 -07:00
Tom Eastep
fd6ff1849a Promote 'in' blacklist rules to the head of the interface chain 
- Added Chains::promote_blacklist_rules()
- Called the function from Rules::generate_matrix()

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-18 07:37:42 -07:00
Tom Eastep
801c1cb6b3 Update release docs 2010-09-17 17:44:05 -07:00
Tom Eastep
fd568ece47 Clear raw table on 'clear' 2010-09-17 17:43:57 -07:00
Tom Eastep
1588c700c5 Fix blacklisting vs vservers 2010-09-17 17:43:40 -07:00
Tom Eastep
6106dd3ada Zero out {frozen} in a deleted chain entry 2010-09-17 17:43:04 -07:00
Tom Eastep
9946fbd3b5 Update release docs 2010-09-17 17:37:07 -07:00
Tom Eastep
580c561a51 Clear raw table on 'clear' 2010-09-17 17:12:34 -07:00
Tom Eastep
a42576aef8 Fix blacklisting vs vservers 2010-09-17 16:38:34 -07:00
Tom Eastep
79bb47582a Zero out {frozen} in a deleted chain entry 2010-09-17 16:00:36 -07:00
Tom Eastep
596d207dfc Simplify a test 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-17 15:43:56 -07:00
Tom Eastep
8cdbe5f88d Fix an optimization bug with the new blacklisting code 2010-09-17 15:43:47 -07:00
Tom Eastep
402b3b929e Restore trace output in move_rules() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-17 15:43:03 -07:00
Tom Eastep
c5bb3ecfac Simplify a test 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-17 15:42:05 -07:00
Tom Eastep
c9e876fcf5 Fix an optimization bug with the new blacklisting code 2010-09-17 15:10:02 -07:00
Tom Eastep
85430e459c Restore trace output in move_rules() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-17 14:35:25 -07:00
Tom Eastep
ad660d7fe5 Simplify move_rules() 2010-09-17 13:53:10 -07:00
Tom Eastep
3d0f8e962e Simplify move_rules() 2010-09-17 13:49:32 -07:00
Tom Eastep
7a6943fa54 Disallow mss and blacklist on firewall and vserver zones 2010-09-17 12:54:58 -07:00
Tom Eastep
b76ee408a5 Emit clearer error messages 2010-09-17 12:54:54 -07:00
Tom Eastep
2e3635ff50 Be sure that {frozen} is defined 2010-09-17 12:54:44 -07:00
Tom Eastep
28aa7b8267 Re-add OPTIONS column to blacklist templates 2010-09-17 12:54:38 -07:00
Tom Eastep
ab78aac3a4 Disallow mss and blacklist on firewall and vserver zones 2010-09-17 12:46:38 -07:00
Tom Eastep
330afe1701 Emit clearer error messages 2010-09-17 12:35:34 -07:00
Tom Eastep
239b4a2356 Be sure that {frozen} is defined 2010-09-17 12:08:48 -07:00
Tom Eastep
65de1e4e6e Re-add OPTIONS column to blacklist templates 2010-09-17 11:56:47 -07:00
Tom Eastep
7175f8a63e Revert versions on Rules and Zones modules 2010-09-17 11:08:45 -07:00
Tom Eastep
d898c87617 Eliminate a parameter to add_jump() 2010-09-17 11:08:12 -07:00
Tom Eastep
07930fc535 Revert versions on Rules and Zones modules 2010-09-17 11:06:32 -07:00
Tom Eastep
5357f4c347 Eliminate a parameter to add_jump() 2010-09-17 11:05:35 -07:00
Tom Eastep
af24baaecd Update version to RC1 (one more time) 2010-09-17 09:14:56 -07:00
Tom Eastep
e61230a3db Update version to Beta 6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-17 08:23:24 -07:00
Tom Eastep
8e2c8e5a8f Document use of state match for NOTRACK 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-17 08:21:16 -07:00
Tom Eastep
882970a598 Use state match for UNTRACKED 2010-09-17 07:58:21 -07:00
Tom Eastep
2ce3c8aa88 Ensure that blacklist rules are before the other interface-oriented rules 2010-09-16 18:19:16 -07:00
Tom Eastep
27c445381e Treat 'blacklist' uniformly in hosts and zones 2010-09-16 15:48:12 -07:00
Tom Eastep
67b9ae0d2c Update release documents 2010-09-16 15:47:05 -07:00
Tom Eastep
1c870b532a Preserve dynamic blacklist during stop/clear/restore 2010-09-16 12:17:04 -07:00
Tom Eastep
a8c9fc1859 Implement new Blacklisting Scheme 2010-09-16 09:40:28 -07:00
Tom Eastep
3c1cff0794 First steps toward zone-based blacklisting 2010-09-16 06:55:48 -07:00
Tom Eastep
1d650b41cd Remove blacklisting by destination IP address support 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-15 15:24:58 -07:00
Tom Eastep
3ad3f0d9e0 Allow floating point numbers in tcinterfaces fields other than <rate> 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-15 14:07:21 -07:00
Tom Eastep
ba89ec39b5 Add :<burst> to /etc/shorewall/tcdevices 2010-09-15 11:56:14 -07:00
Tom Eastep
69a2fa1907 Replace to/from with dst/src 2010-09-15 11:25:46 -07:00
Tom Eastep
f925b335ef Ignore the 'blacklist' host option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-15 08:10:57 -07:00
Tom Eastep
373fc87165 More blacklisting wrapup 
- Deprecate 'blacklist' in the hosts file
- Base blacklisting on interfaces alone

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-15 07:38:20 -07:00
Tom Eastep
4d0e8d129b Add dup blacklist message 2010-09-14 18:04:27 -07:00
Tom Eastep
10a9ae496a More manpage updates for 4.4.13 2010-09-14 16:47:45 -07:00
Tom Eastep
94cdc73ec2 Restore setpolicy() to prog.header* 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-14 13:50:22 -07:00
Tom Eastep
c4a40d8c7b Set version to RC1 (again) 2010-09-14 13:09:50 -07:00
Tom Eastep
c6960f1ac2 Edit release notes 2010-09-14 07:36:29 -07:00
Tom Eastep
1f2691b052 Another fix for blacklisting; correct composition of $hosts1 2010-09-14 06:47:29 -07:00
Tom Eastep
0f913fca2f Don't create blackout unnecessarily 2010-09-13 18:15:50 -07:00
Tom Eastep
82bccf16b5 Avoid internal error when there are no 'to' entries 2010-09-13 17:55:20 -07:00
Tom Eastep
bb38ed16b0 Document ipset creation fix 2010-09-13 15:54:44 -07:00
Tom Eastep
b1e9bff382 Create new ipsets on 'start' 2010-09-13 15:46:04 -07:00
Tom Eastep
a6194fabd2 Delete blank line 2010-09-13 14:15:47 -07:00
Tom Eastep
33adbe7a27 Update documentation for net TC features 2010-09-13 13:51:25 -07:00
Tom Eastep
1729da87f1 Allow both 'to' and 'from' in blacklist 2010-09-13 12:51:10 -07:00
Tom Eastep
9b4c3e22dd Allow floating point numbers in TC rates 2010-09-13 12:50:50 -07:00
Tom Eastep
cb1f7adea3 Add :<burst> to IN-BANDWIDTH 2010-09-13 11:23:37 -07:00
Tom Eastep
283eda2fa5 Cosmetic change to OUT-BANDWIDTH code 2010-09-12 16:33:19 -07:00
Tom Eastep
bd9041306c Add undocumented OUT-BANDWIDTH column to tcinterfaces 2010-09-12 16:25:45 -07:00
Tom Eastep
a3b7b9c11b Delete unused functions from prog.header* 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-12 10:07:26 -07:00
Tom Eastep
931c5a8d0a Add an assertion 2010-09-11 16:24:27 -07:00
Tom Eastep
50fc972d2a Fix another SAME defect :-( 2010-09-11 16:15:09 -07:00
Tom Eastep
512cd7b08e Bump version to 4.4.13 RC 1 2010-09-11 15:46:14 -07:00
Tom Eastep
aad7b70e18 Rename constant 2010-09-11 15:31:43 -07:00
Tom Eastep
c6c6503d83 Clean up a remaining issue with SAME 2010-09-11 15:24:01 -07:00
Tom Eastep
f004916055 Disallow a DEST interface in mangle OUTPUT rules 2010-09-11 14:10:05 -07:00
Tom Eastep
3ea7808b38 Disallow a DEST interface in mangle PREROUTING rules 2010-09-11 14:02:09 -07:00
Tom Eastep
37a5a01185 Correct INPUT marking documentation 2010-09-11 12:47:32 -07:00
Tom Eastep
e93a7fe9df Avoid recent problems by not padding $target in process_tc_rule() 2010-09-11 11:03:28 -07:00
Tom Eastep
d9ced1051a One more fix for SAME 2010-09-11 10:35:45 -07:00
Tom Eastep
367fc041b8 Correct handling of SAME -- Take 2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-11 09:36:19 -07:00
Tom Eastep
83ae6d6eba Document fix for 'SAME' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-11 09:04:42 -07:00
Tom Eastep
dbc9f6ac8f Correct handling of SAME 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-11 08:56:22 -07:00
Tom Eastep
05b6947aac Document fix for ipset invocation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-11 08:55:35 -07:00
Tom Eastep
8dd42c9e19 Correct handling of dst/src list in ipset invocation 2010-09-11 07:41:01 -07:00
Tom Eastep
99f8f84024 Fix name of F chain in secmarks 2010-09-10 16:45:22 -07:00
Tom Eastep
69817007bf Some more fixes for blacklisting 2010-09-09 14:53:12 -07:00
Tom Eastep
50300a60b7 A number of corrections to split blacklisting. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-09 11:20:49 -07:00
Tom Eastep
64544f4ab5 Correct comparison in 'blacklist' handling 2010-09-09 10:22:48 -07:00
Tom Eastep
cd4b5d80ed Reduce patch footprint by two lines 2010-09-09 09:00:28 -07:00
Tom Eastep
df1e17eaa8 Re-enable 'blacklist' on bridge ports 2010-09-09 07:09:08 -07:00
Tom Eastep
828d190436 Change example 2010-09-07 19:14:43 -07:00
Tom Eastep
7dbd994f51 Update installers for secmarks 2010-09-07 07:56:11 -07:00
Tom Eastep
50b4bd8dfe More Blacklist and Secmark documentation updates 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-06 17:26:49 -07:00
Tom Eastep
f3255cd83a Rework blacklisting 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-06 15:29:20 -07:00
Tom Eastep
c6f58ba924 Enhance SELinux support: 
- Add state match
- Add user/group match
- Add examples to the man pages
 2010-09-06 09:06:40 -07:00
Tom Eastep
33dc8de8fb Allow dash's in ipset names 2010-09-05 11:41:35 -07:00
Tom Eastep
23e94e136c Allow COMMENT, SAVE and RESTORE to work correctly in secmarks 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-05 08:17:58 -07:00
Tom Eastep
629290259d Allow secmarks without TC_ENABLED 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-05 07:49:03 -07:00
Tom Eastep
b139ff7e90 Update docs and implementation of SECMARK 2010-09-04 16:08:29 -07:00
Tom Eastep
28ff3548ff Bump version to 4.4.13-Beta4 2010-09-04 15:30:02 -07:00
Tom Eastep
15d8d6d8b7 Add SECMARK and CONNSECMARK support 2010-09-04 15:12:08 -07:00
Tom Eastep
6caff51c98 Modify a comment are delete a silly identity assignment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-09-01 11:24:19 -07:00
Tom Eastep
62fcf1ae8b Adjust version of Raw.pm 2010-08-31 16:52:48 -07:00
Tom Eastep
dfebe5a35e Correct error message 2010-08-31 16:33:15 -07:00
Tom Eastep
8f94137007 Fix last change 2010-08-30 16:47:45 -07:00
Tom Eastep
1da6d51d1a Reduce the Beta3 patch footprint by making the second arg to known_interface() optional 2010-08-30 16:43:30 -07:00
Tom Eastep
add76ed14e Bump version to 4.4.13 Beta 3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-08-30 12:33:10 -07:00
Tom Eastep
7f0f4516d7 Rework handle_optional_interfaces() somewhat 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-08-30 12:29:39 -07:00
Tom Eastep
c18d206726 Use a function to generate the list of interfaces with an L3 address 2010-08-29 20:13:56 -07:00
Tom Eastep
57c54af6ed Re-implement optional interface handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-08-29 12:32:44 -07:00
Tom Eastep
d94f2cc86d Insure that the mapping to base names is deterministic 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-08-29 07:28:06 -07:00
Tom Eastep
be0231578f Insure uniqueness of chain_base mapping 2010-08-28 20:47:39 -07:00
Tom Eastep
95a09b996f Fix test for KLUDGEFREE 2010-08-28 20:47:15 -07:00
Tom Eastep
1531ad3bcd Re-implement interface->shell-variable mapping 2010-08-28 15:15:41 -07:00