extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-22 14:20:40 +01:00
Code Issues Packages Projects Releases Wiki Activity
10,240 Commits 104 Branches 736 Tags 55 MiB
561d461a25
Commit Graph

1483 Commits

Author SHA1 Message Date
Tom Eastep
2919c48ba0 Avoid forward reference to ensure_chain() 2010-08-16 13:25:01 -07:00
Tom Eastep
00837ed503 Add Shorewall::Chains::find_chain() 2010-08-16 13:12:12 -07:00
Tom Eastep
633eba6c90 Set version to 4.4.12 2010-08-15 08:50:45 -07:00
Tom Eastep
1510e111c4 Fix typo in conf basics doc 2010-08-13 20:27:14 -07:00
Tom Eastep
7281c9166e Record the config directory in the state file 2010-08-12 17:54:07 -07:00
Tom Eastep
15eec24672 Simplify logic for generating all parent zones 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-08-12 15:15:19 -07:00
Tom Eastep
49053afdcb Fix port range validate issue 2010-08-12 09:49:26 -07:00
Tom Eastep
69eaf84078 Fix bug with 'any' 2010-08-12 07:31:37 -07:00
Tom Eastep
965ad7ced1 Minor tweaks to the IPAddrs module 2010-08-11 11:46:26 -07:00
Tom Eastep
0234564a1b Add destination IP blacklisting 2010-08-10 17:33:50 -07:00
Tom Eastep
8d4498c9b8 Update Version to 4.4.12 RC 1 2010-08-06 19:31:36 -07:00
Tom Eastep
0f02ee2628 Fix issue with set match generation 2010-08-06 10:17:54 -07:00
Tom Eastep
364ad41cf5 Add support for new ipset match syntax 2010-08-03 21:06:17 -07:00
Tom Eastep
2774ee1bd6 Make 'icmp' a synonym for 'ipv6-icmp' in IPv6 compilations 2010-08-02 08:04:55 -07:00
Tom Eastep
3ce8ff5741 Bump version to Beta 4 2010-08-01 16:10:32 -07:00
Tom Eastep
967629569b Taylor Universal config to work with Shorewall-init and streamline ruleset 
- Make interface 'all' optional and set REQUIRE_INTERFACE=Yes
- Add COMPLETE option
- Set FASTACCEPT in Universal samples
- Reset SUBSYSLOCK in Universal samples

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-08-01 08:36:56 -07:00
Tom Eastep
a88e2afa69 Tweak the Universal documentation 2010-07-31 18:43:54 -07:00
Tom Eastep
0b3dfcc844 Revert version to Beta 3 2010-07-31 13:23:53 -07:00
Tom Eastep
fdcc263023 Fix a couple of minor bugs 2010-07-31 13:11:46 -07:00
Tom Eastep
0174045181 Fixes for Universal Sample 2010-07-31 10:49:49 -07:00
Tom Eastep
beeeb6efbc Allow '+' as a physical interface 2010-07-31 10:08:45 -07:00
Tom Eastep
fdeb9006fa Correct module versions 2010-07-31 09:02:51 -07:00
Tom Eastep
005b6f7b45 Use new hashlimit match syntax if available 2010-07-31 07:19:41 -07:00
Tom Eastep
637cfdaa14 Handle case where old hashlimit match is no longer supported 2010-07-29 17:14:36 -07:00
Tom Eastep
e598dc77b7 Correct/improve LOGLIMIT handling 2010-07-29 16:50:17 -07:00
Tom Eastep
a639b75e36 Bump version to RC1 2010-07-29 11:40:15 -07:00
Tom Eastep
6a1fea3a40 Add 'user marks' 2010-07-27 11:02:36 -07:00
Tom Eastep
f1a8da61bc Use global log rate limiting, if any, for synflood logging 2010-07-26 14:58:38 -07:00
Tom Eastep
bd5facda30 Implement per-IP log rate limiting 2010-07-25 12:42:39 -07:00
Tom Eastep
9bf06caa35 Bump version to Beta 2 2010-07-25 08:11:49 -07:00
Tom Eastep
1528cc2094 Correct RE in split_action() 2010-07-24 11:50:10 -07:00
Tom Eastep
e956068959 Make default setting of MANGLE_ENABLED depend on the capability with the same name 2010-07-24 09:27:21 -07:00
Tom Eastep
e5a7d2ae69 Fix syntax error in generated script 2010-07-23 11:24:42 -07:00
Tom Eastep
9eedf155bc Fix syntax error in generated script 2010-07-23 11:23:23 -07:00
Tom Eastep
3248fc8ab1 Add additional progress messages to updown() 2010-07-22 15:11:19 -07:00
Tom Eastep
49a8861f5b Pretty up the code 2010-07-22 13:57:34 -07:00
Tom Eastep
7db9645225 Avoid an extra blank line 2010-07-22 13:51:47 -07:00
Tom Eastep
666cc35b46 Don't slow down stop with 'wait' 2010-07-22 12:56:49 -07:00
Tom Eastep
4e33efd8a6 Allow :random to work with REDIRECT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-22 07:26:38 -07:00
Tom Eastep
8959245375 Update version to 4.4.12-Beta1 2010-07-21 20:35:36 -07:00
Tom Eastep
411d392ccd Additional progress messages during up/down processing 2010-07-21 20:35:03 -07:00
Tom Eastep
d897635af5 Allow bizarre overriding of SOURCE/DEST with ipsets 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-20 16:03:12 -07:00
Tom Eastep
1de257be19 Make ADD and DELETE work with any type of ipset. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-20 15:42:11 -07:00
Tom Eastep
79128605b1 Validate all IPSET Names 2010-07-18 17:18:10 -07:00
Tom Eastep
cbb524b067 Implement ADD/DEL commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-18 08:46:38 -07:00
Tom Eastep
d99aff5e09 Use Perl Constants rather literals for IPv6 Networks 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-16 10:06:29 -07:00
Tom Eastep
17bdcc1360 Eradicate incorrect multicast network address 2010-07-16 09:33:17 -07:00
Tom Eastep
b52b7c422f Drop multicast and anycast in Drop and Reject actions 2010-07-12 16:44:34 -07:00
Tom Eastep
c1b212225e Use uniform coding style in latest changes 2010-07-12 13:07:11 -07:00
Tom Eastep
328e1b7f6a Don't generate rules to link local net from vserver zones 2010-07-12 12:39:51 -07:00
Tom Eastep
59189d6324 Don't generate rules from link local net to vserver zones 2010-07-12 11:52:56 -07:00
Tom Eastep
4792d1e5f1 Fix nets= in Shorewall6 2010-07-11 19:52:18 -07:00
Tom Eastep
5a5546ef1b Set version to 4.4.11 2010-07-09 09:01:08 -07:00
Tom Eastep
d0c1c3d69c Change comment to clarify assumption about function arguments 2010-07-08 17:45:18 -07:00
Tom Eastep
9eca7fb37b Simplify logic in loopback helper functions 2010-07-08 17:11:27 -07:00
Tom Eastep
591a4bc7f6 Revert version of modules with only whitespace changes; rename a couple of functions for clarity 2010-07-07 06:43:07 -07:00
Tom Eastep
02fab09a14 Add PERL= option to shorewall.conf and shorewall6.conf 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-05 13:11:52 -07:00
Tom Eastep
31a9d24164 Fix missing quote when REQUIRE_INTERFACE=Yes 2010-07-05 09:47:03 -07:00
Tom Eastep
f977631af9 Just reset provider bits in FORWARD chain 2010-07-05 09:46:24 -07:00
Tom Eastep
b445b4fdd9 Fix compiler detection of FWMARK_RT_MASK -- take 2 2010-07-05 08:51:13 -07:00
Tom Eastep
0e87ccbcfd Fix compiler detection of FWMARK_RT_MASK 2010-07-05 08:39:32 -07:00
Tom Eastep
542557069e Back out a couple of harmless but unintended changes 2010-07-05 08:02:51 -07:00
Tom Eastep
898c3a045f Bump version to RC1 2010-07-05 07:08:06 -07:00
Tom Eastep
312624cef5 Fix NET3 bug (netmap) 2010-07-04 15:58:37 -07:00
Tom Eastep
7689831cd7 Minor cleanup of 4.4.11 Beta 3. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-04 09:29:16 -07:00
Tom Eastep
2ee4fd8f5a Add FWMARK_RT_MASK capability. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-04 09:08:04 -07:00
Tom Eastep
d3e30b5fe4 Add FORWARD_CLEAR_MARK option 2010-07-03 17:03:42 -07:00
Tom Eastep
5d1e19364a Bump version to Beta 3 2010-07-03 10:54:39 -07:00
Tom Eastep
148b251766 Only send loopback traffic to the 'loopback' chain 2010-07-03 10:53:25 -07:00
Tom Eastep
21ce6f9b84 Add new zone-list function to return all but firewall zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-03 08:33:10 -07:00
Tom Eastep
c8274f0538 Minor vserver doc update 2010-07-02 13:34:21 -07:00
Tom Eastep
63154367ad Forbid 'ipsec' in a vserver host entry 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-02 13:12:23 -07:00
Tom Eastep
e5d3ce582a Correct Old Defect in ipsec match generation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-02 13:11:57 -07:00
Tom Eastep
9e81a5101f Cleaner fix for ipsec/vserver issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-02 12:24:58 -07:00
Tom Eastep
261af19b4e Fix invalid policy match with vserver zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-07-02 12:18:18 -07:00
Tom Eastep
f2ca9e25c9 Make find_hosts_by_option() work with options specified on the interface 2010-07-02 07:19:52 -07:00
Tom Eastep
338c021272 Fix refression in handling of mss= 2010-07-01 09:05:25 -07:00
Tom Eastep
64decb25fe Bump version to 4.4.11-Beta2 2010-07-01 07:08:11 -07:00
Tom Eastep
9f15ccb24f Update Raw.pm version. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-30 20:40:26 -07:00
Tom Eastep
e4afc15370 Finish Vserver Implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-30 20:35:46 -07:00
Tom Eastep
9e37fe1ffa Deimplement flawed rate limiting with simple TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-26 07:42:08 -07:00
Tom Eastep
914d752f1d Fix latency parsing 2010-06-25 16:10:26 -07:00
Tom Eastep
2909b6fd92 Quiet down the Perl interpreter on some boxen 2010-06-24 13:58:46 -07:00
Tom Eastep
1cb22d0bcf First feeble steps toward vserver zones 2010-06-22 16:42:20 -07:00
Tom Eastep
dbbe6b264d Fix the IPSET fix 2010-06-18 12:06:12 -07:00
Tom Eastep
e7340dabc0 Fix IPSET issue 2010-06-18 12:05:44 -07:00
Tom Eastep
32d8a9d996 Allow patch from Gabriel 2010-06-12 14:10:40 -07:00
Tom Eastep
d58127e51c Allow networks to be specified in a NETMAP rule 2010-06-12 13:50:58 -07:00
Tom Eastep
9acec39898 Fix a couple of issues with Simple TC 2010-06-12 13:50:11 -07:00
Tom Eastep
625f254d02 Add tcfilters to manpage index 2010-06-10 06:15:15 -07:00
Tom Eastep
6040f02bb0 Don't set variables needlessly 2010-06-08 16:33:54 -07:00
Tom Eastep
32d575a8c8 Remove extra logic 2010-06-08 16:18:23 -07:00
Tom Eastep
dcd64cd096 Move ipset-load code to Chains.pm. Better there than in Compiler.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-08 16:18:14 -07:00
Tom Eastep
a5816c23d4 Move save_dynamic_chains to Chains.pm where it belongs. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-08 16:17:57 -07:00
Tom Eastep
6537c1e55a Improve readability 2010-06-08 16:16:23 -07:00
Tom Eastep
52a80e69a9 More tweaks to saving/restoring dynamic chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-08 11:27:09 -07:00
Tom Eastep
ec3fdbde98 More changes having to do with with dynamic chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-08 11:26:53 -07:00
Tom Eastep
aa4b0f71af Much cleaner implementation of save_dynamic_chains() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-07 10:11:33 -07:00
Tom Eastep
0978f3d41a More periodic removal of trailing white space 2010-06-07 09:16:56 -07:00
Tom Eastep
3467969c26 Periodic removal of trailing white space 2010-06-07 07:30:56 -07:00
Tom Eastep
04de6fac6d Make dynamic chain saving work with IPv6 
Also, use hidden files to save the chain contents.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-07 07:18:21 -07:00
Tom Eastep
db138edbd1 Update versions of modified modules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-06 13:49:26 -07:00
Tom Eastep
b3370dfd78 Initiate 4.4.11 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-06 13:36:45 -07:00
Tom Eastep
17b6e370af Purge saved dynamic blacklist if the chain doesn't exist 2010-06-06 13:24:09 -07:00
Tom Eastep
25c0e3c7b3 Retain UPnP and dynamic blacklist over 'restart' 2010-06-06 13:23:49 -07:00
Tom Eastep
ca7d145746 Don't enter command mode for upnpclient rule for non-optional interface 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-06 08:05:19 -07:00
Tom Eastep
99a0226a43 Slight improvement of regular expression used to insert chain name into rules after '-A' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-06 08:04:28 -07:00
Tom Eastep
fdc3b698a9 Version to 4.4.10 (again) 2010-06-05 15:58:23 -07:00
Tom Eastep
d388b29d70 Let Zones.pm export chain_base rather than Chains.pm 2010-06-05 08:40:00 -07:00
Tom Eastep
0e995d65ac Version to 4.4.10-RC2 2010-06-04 16:19:15 -07:00
Tom Eastep
742a3b2eef Make wait and required work on wildcard interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-04 10:35:45 -07:00
Tom Eastep
82a74d7534 Resolve Optional/Required interfaces with wildcard names 
Optional is allowed
Required is not

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-04 08:46:29 -07:00
Tom Eastep
165535cd8b Disallow wildcard optional/required interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-04 07:18:55 -07:00
Tom Eastep
7625b4069b Delete references to prenet subsystem locks. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-06-03 12:31:39 -07:00
Tom Eastep
43afd03b9b Bump version to 4.4.10 2010-06-03 11:18:02 -07:00
Tom Eastep
226eb6ca3e Cleanup of optimization fix 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-29 09:56:14 -07:00
Tom Eastep
50ce5bab68 Fix Optimization Bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-29 08:58:16 -07:00
Tom Eastep
d58480943a Bump version to 4.4.10 RC 1 2010-05-27 17:21:11 -07:00
Tom Eastep
e627e0ea76 Bump version to 4.4.10-Beta4 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-26 16:47:49 -07:00
Tom Eastep
cdcb42ce9c Increment version to 4.4.10-Beta3. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-25 07:17:57 -07:00
Tom Eastep
9c0564831a Fix syntax error in generated shell script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-24 06:23:45 -07:00
Tom Eastep
4264524448 Bump Version to 4.4.10-Beta2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-20 14:13:38 -07:00
Tom Eastep
50dc02da07 Implement the 'REQUIRE_INTERFACE' option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-19 07:32:02 -07:00
Tom Eastep
4690075ed8 Start firewall on up event for optional interface. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-18 20:29:03 -07:00
Tom Eastep
0c9a0150d2 Document Shorewall-init; delete old auto-stop code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-18 14:42:39 -07:00
Tom Eastep
f9d187c288 Correct issues found in Fedora Testing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-18 10:27:12 -07:00
Tom Eastep
499b0cddaa Log the text from startup errors. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-17 07:02:30 -07:00
Tom Eastep
a534bca914 Fix an existing bug in Shorewall6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-16 19:28:49 -07:00
Tom Eastep
a501222194 Fix some bugs in the Shorewall-init implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-16 17:41:09 -07:00
Tom Eastep
4f428d8135 De-implement 'close' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-16 15:31:41 -07:00
Tom Eastep
749d6be64e Add 'optional' interfaces to updown processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-15 17:06:00 -07:00
Tom Eastep
a3589dc6e9 Implement the 'up' and 'down' script commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-15 12:48:04 -07:00
Tom Eastep
88188202cc Add 'wait' interface option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-15 09:52:46 -07:00
Tom Eastep
16e451a7d8 Add 'required' interface option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-15 09:04:32 -07:00
Tom Eastep
a2758421ed Bump version to 4.4.10-Beta1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-13 17:03:14 -07:00
Tom Eastep
529f9a07b4 Update Rules.pm version to 4.4.10 2010-05-13 16:39:52 -07:00
Tom Eastep
1d0b8b1cec Correct syntax error in generated code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-13 16:32:42 -07:00
Tom Eastep
449ca038ba Implement 'close' command 2010-05-13 16:29:25 -07:00
Tom Eastep
65a5d34276 Update Module Versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-03 12:46:29 -07:00
Tom Eastep
96bef5bd49 Assume 'routeback' in routestopped based on interface config. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-03 12:31:11 -07:00
Tom Eastep
fca404eeaf Update version to 4.4.9 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-03 10:02:02 -07:00
Tom Eastep
c7848be266 Back out the rest of the original change for dup / -[psiod] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-03 09:59:25 -07:00
Tom Eastep
70c6a2cdf3 Update version to 4.4.9-RC2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-02 07:25:50 -07:00
Tom Eastep
639b3ea57d Simplify checking for /! -[piosd] / 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-01 09:13:16 -07:00
Tom Eastep
311372013d More fixes to optimization 
Only disallow / ! -[piosd] / if the target is a chain

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-01 08:58:41 -07:00
Tom Eastep
518416ec2e Add a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-01 08:08:39 -07:00
Tom Eastep
94c6b37e8e Avoid leaving an orphan '!' behind. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-01 07:51:24 -07:00
Tom Eastep
219b2e0761 A more comprehensive solution to multiple -[piosd] matches. 
- eliminate duplicate -[piosd] matches in merged rules
- avoid tracing !* unconditionally

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-01 07:26:25 -07:00
Tom Eastep
16161d9cfc Add new trace types. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-05-01 06:43:09 -07:00
Tom Eastep
1173518d78 More minor cleanup of first code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-30 07:22:09 -07:00
Tom Eastep
076da4bd5c Couple of tweaks to my earliest code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-29 11:19:50 -07:00
Tom Eastep
2c1cede54e Revise addressless bridge change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-27 15:23:38 -07:00
Tom Eastep
d8b0f496df Allow simple configuration of a bridge with no IP address 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-27 12:26:58 -07:00
Tom Eastep
988f7c4d7e More fixes for bad NAT optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-26 16:50:18 -07:00
Tom Eastep
0e4698d57c Fix rare optimization bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-26 16:19:58 -07:00
Tom Eastep
6d61e962eb Use -m conntrack if available in place of -m state 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-25 13:35:41 -07:00
Tom Eastep
21e0c68ef2 Bump version to 4.4.9 RC1 2010-04-25 09:37:17 -07:00
Tom Eastep
fb2ddcee7b Bump Version to 4.4.9 Beta 5 2010-04-24 21:53:12 -07:00
Tom Eastep
b821bdcdfd One more pass at improving regex's for target isolation and matching 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-22 14:45:34 -07:00
Tom Eastep
64bf772594 Set OUTPUT policy to ACCEPT when optimize_chain deletes all of its rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-22 13:38:38 -07:00
Tom Eastep
fb754b3a2e Don't remove a lone ACCEPT rule from the OUTPUT chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-22 11:35:14 -07:00
Tom Eastep
a1a78cf09b Abandon the fantesy that multiple optimize 8 passes will achieve anything. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-16 17:12:08 -07:00
Tom Eastep
c52a3dcd14 Don't generate policy chains for fw to bridgeport zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-16 09:56:11 -07:00
Tom Eastep
1030c852f9 Simplify a test 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-16 09:21:30 -07:00
Tom Eastep
e7a4aaafc1 Modify optimization 8 loop to continue until no chains are combined. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-16 09:17:57 -07:00
Tom Eastep
4f00de0c57 Make additional optimize 8 passes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-16 08:42:25 -07:00
Tom Eastep
21b44ac42b Change version to 4.4.9-Beta4 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-16 07:25:53 -07:00
Tom Eastep
82d6ba511f Unify the REs that look for '-[jg] <chain>' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-15 18:02:31 -07:00
Tom Eastep
cec59360f6 Use '-j' rather than '-g' when jumping to tcpre, just to be safe 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-15 14:14:13 -07:00
Tom Eastep
46d207a86f Restore original amount of whitespace in maclist rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-15 14:13:37 -07:00
Tom Eastep
e9a94b0cfb Unify reference count adjustment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-15 14:12:48 -07:00
Tom Eastep
cf59d9ec68 Fix an optimize 8 bug. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-15 12:45:00 -07:00
Tom Eastep
c1bcf360ee Fix another 'add_rule' that should have been an 'add_jump' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-15 09:59:57 -07:00
Tom Eastep
96d69bd8c3 Centralize message generation; optimize optimization-8 loop 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-15 09:29:37 -07:00
Tom Eastep
cff6f0010f Remove chain name after '-A' (again). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-14 17:05:03 -07:00
Tom Eastep
f8bacb54ef Optimize 8 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-14 13:21:10 -07:00
Tom Eastep
4137961169 Speed up the replace_references* functions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-11 09:00:24 -07:00
Tom Eastep
715ea9ef32 Speed up delete_jumps() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-11 08:38:14 -07:00
Tom Eastep
76b9ef7005 Use unshift rather than splice for readability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-10 09:25:29 -07:00
Tom Eastep
2e443df8e3 Adjust references in move_rules() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-10 09:09:46 -07:00
Tom Eastep
ff73d802da More cleanup of rule and chain deletion: 
- Rename purge_jumps() to delete_jumps()
- Add delete_chain() function
- Remove an unnecessary assertion

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-10 08:37:17 -07:00
Tom Eastep
1de304bfd9 Relocate purge_jumps() and change the loop exit condition to be a bit safer. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-09 13:51:44 -07:00
Tom Eastep
14477d61fe Verify that purge_jumps() reset the 'to' chain's referenced flag. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-09 12:28:01 -07:00
Tom Eastep
2ff1df53da Unify chain deletion. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-09 11:38:18 -07:00
Tom Eastep
7a831107c7 Replace the complex rule deletion loops with C-stype for loops. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-09 09:58:32 -07:00
Tom Eastep
9dc8267888 Don't apply RE to rules that we've already checked. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-09 09:46:07 -07:00
Tom Eastep
1e078b8c8d Use splice() to delete rules from chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-09 09:38:03 -07:00
Tom Eastep
56bc28a182 Prepare 4.4.9 Beta 3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-09 07:32:21 -07:00
Tom Eastep
c2c0fb0dd2 Fix deletion of only rule in a chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-08 17:20:11 -07:00
Tom Eastep
ab1a27ca2a Update version to 4.4.9 Beta 2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-08 13:14:51 -07:00
Tom Eastep
9a00191c88 Remove a 'defined' test that is no longer needed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-08 13:12:17 -07:00
Tom Eastep
359c221783 Keep rules arrays compressed throughout the compilation process 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-08 12:53:30 -07:00
Tom Eastep
3937c10251 Keep rule arrays compressed during optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-08 11:35:15 -07:00
Tom Eastep
9126cc63d9 Delete unused rules arrays 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-08 10:55:31 -07:00
Tom Eastep
cca2c18370 Another case where reference counts are wrong 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-07 20:07:03 -07:00
Tom Eastep
aeb3b277b0 Fix reference count issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-07 19:47:49 -07:00
Tom Eastep
3711e64d71 Fix for 0 values propagated to the script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-07 14:38:29 -07:00
Tom Eastep
3092a85999 SWAG regarding LOG_VERBOSITY issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-04-07 13:43:57 -07:00
Tom Eastep
af893b6296 Add 'N' trace records for chain creation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-30 07:32:38 -07:00
Tom Eastep
b2d8039ff6 Remove unnecessary text and 'before' images from trace entries 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-30 07:12:22 -07:00
Tom Eastep
7e97e9519d Conditionally trace writes by copy2(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-29 11:56:26 -07:00
Tom Eastep
51d4bf19b5 Conditionally trace writes by copy2(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-29 11:56:06 -07:00
Tom Eastep
350a89e449 More complete generated script trace 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-29 09:48:23 -07:00
Tom Eastep
5c91fb40e2 Remove unneeded test; correct typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-29 09:04:45 -07:00
Tom Eastep
6d7226ae93 Remove special trace entries 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-28 16:31:03 -07:00
Tom Eastep
1fd656b8c9 Tweak trace facility 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-28 15:31:05 -07:00
Tom Eastep
b0733d93ee Implement a more robust trace 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-28 13:09:04 -07:00
Tom Eastep
ef4237f5a0 Avoid verbosity overflow/underflow 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-28 07:27:27 -07:00
Tom Eastep
3e215d0482 Minor cleanup in the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-27 08:18:41 -07:00
Tom Eastep
1153ff0c75 Avoid a shell warning when brctl is not installed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-27 07:33:40 -07:00
Tom Eastep
f30cd7e287 Clarify provisional policy handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-26 08:02:49 -07:00
Tom Eastep
6cdc1ab7a2 Allow a logical interface name in the EXTERNAL column of the proxyarp file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-25 11:41:06 -07:00
Tom Eastep
7d91edc6ec Remove redundant line of code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-23 12:49:06 -07:00
Tom Eastep
626b28fcd0 Auto-detect bridge when no options specified. Remove extra logic. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-23 09:28:11 -07:00
Tom Eastep
5e9aceae68 Detect bridges 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-23 08:38:54 -07:00
Tom Eastep
914d829a49 Don't optimize the 'blacklst' chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-22 06:47:39 -07:00
Tom Eastep
6ac549ef4e Add a comment explaining why avoiding creation of the blacklst chain 
and branching to it is a bad idea.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-21 07:24:29 -07:00
Tom Eastep
6fc347b9be Prepare 4.4.9-Beta1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-20 07:06:47 -07:00
Tom Eastep
9a88156769 Back off on not jumping to the blacklist chain when there are no blacklist entries. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-19 11:32:22 -07:00
Tom Eastep
fae29bcf6f Change version to 4.4.8 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-19 10:17:32 -07:00
Tom Eastep
b22b279bd1 Some additional idiot-proofing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-19 10:01:02 -07:00
Tom Eastep
a71f5df64f Fix indentation and quoting in TC progress messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-19 06:59:58 -07:00
Tom Eastep
f44dbcf20b More copyright updates 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-18 11:13:51 -07:00
Tom Eastep
91bc3b3293 Mark a restored configuration as 'Restored' rather than 'Started'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-17 10:10:56 -07:00
Tom Eastep
1177540fd8 Update version to RC2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-16 12:39:35 -07:00
Tom Eastep
66c883de2c Fix UDPLITE handling of source port when no dest port given. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-16 10:45:31 -07:00
Tom Eastep
b2a56cd542 Copyright update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-16 09:53:51 -07:00
Tom Eastep
a01fa345b7 Add support for UDP Lite 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-16 09:42:50 -07:00
Tom Eastep
16bbe780c7 Try to avoid printing import banners unnecessarily 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-16 07:23:02 -07:00
Tom Eastep
787cec4fe7 Fix 'uninitialized variable' bug in Config::copy2 
Bug reported by Tuomo Soini

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-16 07:12:39 -07:00
Tom Eastep
196cd5417f Allow 'default' optimizations to be disabled by specifying optimization 4096. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-11 17:15:44 -08:00
Tom Eastep
249f9412f6 Add undocumented OPTIMIZE=-1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-10 17:31:08 -08:00
Tom Eastep
4f32be03d7 Fix typo in comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-08 15:34:38 -08:00
Tom Eastep
93494c6ae3 Eliminate nested function declarations in generate_matrix() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-08 13:11:10 -08:00
Tom Eastep
07cba9e066 Bump version to RC1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-08 08:11:00 -08:00
Tom Eastep
efed2286b0 Move qt1() to lib.common 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-07 11:50:54 -08:00
Tom Eastep
f246f728e7 Flag '-' used as a port range separator 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-07 08:36:26 -08:00
Tom Eastep
5671a7ae2f Add new options to online usage info. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:45:43 -08:00
Tom Eastep
88447bfc7d Avoid dropping first line of library source text 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:45:21 -08:00
Tom Eastep
2d458b46b4 Update help text in prog.header* 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:13:33 -08:00
Tom Eastep
928b162d3c Fix bug in handling of -p option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:12:04 -08:00
Tom Eastep
7557b4b5fb Update version to 4.4.8 Beta 3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 07:41:29 -08:00
Tom Eastep
fe089ddc36 Don't copy headers in imported libraries 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 07:40:43 -08:00
Tom Eastep
c8d8d75cae Cosmetic change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-05 10:40:18 -08:00
Tom Eastep
f8c7a284a5 Remove duplicate/unneeded functions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-05 07:02:00 -08:00
Tom Eastep
abb943bfb7 Do library consolidation on IPv6 and load lib.cli into shorecap. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 13:11:33 -08:00
Tom Eastep
50330f71f6 Move many routines into lib.common. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 12:38:02 -08:00
Tom Eastep
7757c0bc20 Rename lib.run to lib.common 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 09:54:56 -08:00
Tom Eastep
7b52d812ae Generate correct library path name 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 09:40:18 -08:00
Tom Eastep
4c081e5998 Add lib.run 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 09:12:48 -08:00
Tom Eastep
a963c8f955 Don't export CONFDIR or SHAREDIR 
Document CONFDIR, SHAREDIR and VARDIR
Add FILEMODE to the old reserved variable names

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 11:46:23 -08:00
Tom Eastep
3f73b3c408 Export *DIR variables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 10:39:18 -08:00
Tom Eastep
c6981de0e5 Complete elimination of globals that are not .conf options 
Documentation to follow

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 09:50:07 -08:00
Tom Eastep
ee74696747 IPv6 work to only export when necessary 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 08:59:58 -08:00
Tom Eastep
234e4fa754 Update module versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 08:51:55 -08:00
Tom Eastep
7457f643ee Don't export globals when the script is 4.4.8 or later 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 08:51:40 -08:00
Tom Eastep
cce4bf277a Reduce export usage; Allow PURGE and RESTOREFILE to be specified on the run-line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 14:49:31 -08:00
Tom Eastep
2656a9b0c7 Eliminate use of PRODUCT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 12:34:36 -08:00
Tom Eastep
68f5215f07 Remove Reliance on HOSTNAME in generated programs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 11:45:35 -08:00
Tom Eastep
3ea6f6792f Eliminate VERSION reserved variable name 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 08:02:10 -08:00
Tom Eastep
5fc6d58e19 Eliminate STOPPING variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 07:37:30 -08:00
Tom Eastep
d4936f4bad Tweak to an RE used in optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 06:58:09 -08:00
Tom Eastep
f11bfd3890 Eliminate redundate setting of PRODUCT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-01 08:32:59 -08:00
Tom Eastep
cfa09dce22 Avoid multiple policy matches with OPTIMIZE=7 and not KLUDGEFREE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-01 08:32:37 -08:00
Tom Eastep
3ba797cb14 Correct several bugs in the VERBOSITY overhaul 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-01 06:57:04 -08:00
Tom Eastep
53c73bc8e9 Eliminate VERBOSE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 17:58:01 -08:00
Tom Eastep
14f83759ae Propagate VERBOSITY even though we don't use it yet 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 17:39:35 -08:00
Tom Eastep
546a48543d Propagate LOG_VERBOSITY 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 17:30:11 -08:00
Tom Eastep
39883aa690 Eliminate LOG_VERBOSE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 16:58:30 -08:00
Tom Eastep
fb55d63eaf Allow verbosity to be separate from -V 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 16:42:50 -08:00
Tom Eastep
333ac21c2f Prepare the footers for 4.6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 15:25:25 -08:00
Tom Eastep
83ed0a401b I'll eventually get it the way I like it 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 13:45:33 -08:00
Tom Eastep
585711caa8 Even simpler RE for detecting builtins 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 13:29:26 -08:00
Tom Eastep
693d0e5d4c Make new test in add_jump() a bit safer. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 12:44:29 -08:00
Tom Eastep
d2992c21f4 Update version to Beta 2 2010-02-28 09:04:37 -08:00
Tom Eastep
061d850c16 Rename RESTOREPATH to g_restorepath 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-26 08:35:50 -08:00
Tom Eastep
7fe7ebc891 Fix Handling of NFQUEUE(queue-num) in policies 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-25 08:44:28 -08:00
Tom Eastep
70a246501e Update version of Tc.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-23 07:08:48 -08:00
Tom Eastep
3fc10cd94b Prepend 'SW_' to constructed shell variable names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-22 10:27:59 -08:00
Tom Eastep
2a965d42b9 Add a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-21 07:57:34 -08:00
Tom Eastep
6307653a01 Pick up one fix from 4.4.7.4 regarding CONTINUE rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-20 09:42:58 -08:00
Tom Eastep
edaf541850 Don't apply rate limiting twice in ACCEPT+ rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-19 14:01:45 -08:00
Tom Eastep
ceff8adc78 Restore duplicate interface detection in tcinterfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-18 16:11:30 -08:00
Tom Eastep
3a2173ddb4 Some code cleanup in Tc.pm. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-18 15:56:59 -08:00
Tom Eastep
ea8be87720 Use Hex representation of device numbers > 9 in simple TC. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-18 12:53:01 -08:00
Tom Eastep
00b0490cd7 Create a unique hashtable for each instance of a per-IP rate limit 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 15:39:21 -08:00
Tom Eastep
625963a4f0 Final (hopefully) fix for SFQ handle assignment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 09:02:18 -08:00
Tom Eastep
41bb0782a3 Another tweak to SFQ handle assignment. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 08:06:27 -08:00
Tom Eastep
5649dbf9a8 Improve assignment of class ID for SFQ classses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 07:41:30 -08:00
Tom Eastep
eaafeb8c2b Add --hashlimit-htable-expire if the units are minutes or larger 2010-02-17 06:43:52 -08:00
Tom Eastep
375160d733 Avoid duplicate SFQ class numbers 2010-02-17 06:43:16 -08:00
Tom Eastep
167b29c2c5 Bump module version in Compiler.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-15 14:24:52 -08:00
Tom Eastep
8aaf4aab3a Don't create log chain for 'RETURN' rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-15 14:24:00 -08:00
Tom Eastep
4546394531 Cosmetic changes to Compiler.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-15 14:07:35 -08:00
Tom Eastep
12d3420a5d Detect FLOW_FILTER when LOAD_HELPERS_ONLY=No 2010-02-14 10:34:19 -08:00
Tom Eastep
5e9ecf1491 Update version of Config module 2010-02-13 11:00:34 -08:00
Tom Eastep
50d246c8be A little cleanup of compiler.pl 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-13 10:03:32 -08:00
Tom Eastep
1258149e0e Don't apply rate limiting twice in NAT rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-13 07:21:27 -08:00
Tom Eastep
ea5a6c79bc Bump CAPVERSION 2010-02-11 16:22:47 -08:00
Tom Eastep
5a96771e07 Start 4.4.8 Beta 1 2010-02-11 15:46:57 -08:00
Tom Eastep
b35f20b403 Avoid CAPVERSION bump to implement FLOW_FILTER detection 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-11 07:29:41 -08:00
Tom Eastep
b8c195f570 Accurately detect 'flow' availability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-10 14:50:26 -08:00
Tom Eastep
433fc385bc 'bridge' implies 'routeback' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-09 14:04:36 -08:00
Tom Eastep
46e2afcf16 Ignore TYPE if old distro 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-08 07:13:20 -08:00
Tom Eastep
b45a70f98a Make 'nosmurfs' work correctly on IPv6 with Address Type Match 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-08 07:12:58 -08:00
Tom Eastep
18d03a61f5 Make 'nosmurfs' work with Address Type Match on IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-07 08:43:31 -08:00
Tom Eastep
11a2ec9f7c Update version to 4.4.7 2010-02-05 16:40:48 -08:00
Tom Eastep
e64af57cae Give smurf logging chain a fixed name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-03 16:04:59 -08:00
Tom Eastep
f4e175f149 Fix IPv6 'nosmurfs'. Make 'nosmurfs' logging more efficient. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-03 15:03:15 -08:00
Tom Eastep
52880a8822 Clean up generate_matrix() fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-03 06:57:51 -08:00
Tom Eastep
9d288241da Fix issues in generate_matrix(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-02 19:42:54 -08:00
Tom Eastep
1d8a7ad09f Clear DEBUG and PURGE shell variables 
Delete a blank line

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-02 13:55:29 -08:00
Tom Eastep
753eb97667 Update version to 4.4.7 RC2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-02 10:30:53 -08:00
Tom Eastep
dd60f04a9f Work around lack of MARK Target support 2010-02-01 16:22:57 -08:00
Tom Eastep
d354560863 Finish last change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-01 14:25:51 -08:00
Tom Eastep
f0d101605b Don't try to combine nat chains that include '-s'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-01 14:24:07 -08:00
Tom Eastep
1981372c94 Make search for "-j ACCEPT" a little tighter 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-31 08:27:30 -08:00
Tom Eastep
3d39a47582 Set $have_ipsec after completing parse of the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-30 07:26:35 -08:00
Tom Eastep
659f774451 Sort %detect_capability for easier verification. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-29 13:09:53 -08:00
Tom Eastep
9d2decd26d Modify determine_capabilities to use detect_capability() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-29 10:38:22 -08:00
Tom Eastep
b8ec2be516 Clean up handling of %detect_capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-28 16:39:45 -08:00
Tom Eastep
ecc7861115 Validate LOAD_HELPERS_ONLY before detecting capabilities. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-28 08:05:24 -08:00
Tom Eastep
ebd847ef70 Don't display capabilties if they have not been determined 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-28 08:04:54 -08:00
Tom Eastep
05f2bb4b3a Correction to last patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 17:52:27 -08:00
Tom Eastep
9d25318d80 Fix detection of HASHLIMIT_MATCH on old kernels. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 12:53:31 -08:00
Tom Eastep
54456de888 Update module versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 09:01:00 -08:00
Tom Eastep
c05c1a6f50 Update version to 4.4.7 RC1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 06:58:44 -08:00
Tom Eastep
1556002b54 A couple of tweaks to the LOAD_HELPERS_ONLY optimization change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 15:59:31 -08:00
Tom Eastep
fb007bc1c7 Bump version to Beta 4 2010-01-25 12:25:01 -08:00
Tom Eastep
9408a114c6 Don't load unused modules when LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 10:50:49 -08:00
Tom Eastep
d933aa602b Eliminate 'ORIGINAL_POLICY_MATCH' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 08:13:22 -08:00
Tom Eastep
90b68a05de Don't export %capabilities 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 07:56:16 -08:00
Tom Eastep
bfdc6719c1 Fix DropBcasts() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-24 12:16:15 -08:00
Tom Eastep
e14d48c2cf Bump version to 4.4.7-Beta3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-22 16:46:29 -08:00
Tom Eastep
0d63182ab4 Fix ambiguous syntax in Config.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-22 16:44:45 -08:00
Tom Eastep
199a50e1c7 Update version to 4.4.7 Beta 2 
Add problems corrected to the release notes.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-22 10:35:27 -08:00
Tom Eastep
8f85c75264 Implement LOAD_HELPERS_ONLY for IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-21 15:49:44 -08:00
Tom Eastep
efc43b1b24 Add implementation of LOAD_HELPERS_ONLY 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-21 15:49:35 -08:00
Tom Eastep
a248acb4d4 Add LOAD_HELPERS_ONLY Option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-21 15:49:23 -08:00
Tom Eastep
e119037dea Make 'is_isable()' work with 'lo' 2010-01-17 15:38:20 -08:00
Tom Eastep
f072c10b18 Set version to 4.4.7 Beta1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-17 09:10:48 -08:00
Tom Eastep
f4102417ff Shorewall::Config changes for TPROXY from 4.5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-17 08:15:14 -08:00
Tom Eastep
07cdb8ca82 Backport TPROXY from 4.5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-17 08:12:44 -08:00
Tom Eastep
47007c5dbd Allow protocol to be expressed in octal or hex 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 14:20:47 -08:00
Tom Eastep
aad8ea837a Allow port numbers to be specified in Hex 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 14:00:47 -08:00
Tom Eastep
5ec7759d81 Don't pass an undefined value to fatal_error when numeric conversion fails. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 12:35:18 -08:00
Tom Eastep
4bf0b8e1dd Add new configuration options and optimization changes from 4.5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 09:53:53 -08:00
Tom Eastep
d5cc302ad9 Start 4.4.7 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 08:11:13 -08:00
Tom Eastep
ebf1e55609 Version to 4.4.6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 15:38:19 -08:00
Tom Eastep
880cd269c7 More mark geometry misses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 12:16:40 -08:00
Tom Eastep
72de96760f One more 0xFF -> $globals{TC_MASK} fix 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 12:11:00 -08:00
Tom Eastep
10c5630786 A few more instances of TC_MASK 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 10:50:14 -08:00
Tom Eastep
555133fa3c Bump version to 4.4.6-Beta2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 10:14:31 -08:00
Tom Eastep
b4b6dce7c8 Add some comments 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 08:12:00 -08:00
Tom Eastep
4821d5e8b7 Change quantum to 1875 for simple TC SFQ. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 08:11:49 -08:00
Tom Eastep
f69a741691 Port Simplified TC to 4.4.6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 17:01:20 -08:00
Tom Eastep
7e183e8eb4 Change version to 4.4.6-Beta1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:57:55 -08:00
Tom Eastep
57672d096c Don't invoke 4.5 optimization under 4.4. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:47:14 -08:00
Tom Eastep
ae31a09e8b Move code and add comments: 
- Declare all of the 'preview' helpers together in Chains.pm
- Add some clarifying comments in the compiler.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:32:59 -08:00
Tom Eastep
4420eed8d7 Allow users to preview the generated ruleset. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:32:50 -08:00
Tom Eastep
6b085b7897 Update module versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 18:54:23 -08:00
Tom Eastep
5b4e9eb8e6 Revert change with migration issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 15:30:33 -08:00
Tom Eastep
0b549c7a15 Suppress mark geometry output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:55:42 -08:00
Tom Eastep
1a74dbf93e Add mark geometry changes to Shorewall::Chains and Shorewall::Compiler 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:39:22 -08:00
Tom Eastep
01293427f5 Add Mark Geometry changes to Shorewall::Tc 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:29:34 -08:00
Tom Eastep
4f5bb5e90b Add new mark geometry changes to Shorewall::Providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:22:01 -08:00
Tom Eastep
d2d2912534 Add New mark geometry variables to Shorewall::Config 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:16:03 -08:00
Tom Eastep
4e50ea14ea Back out EXMARK detection since it is unused in 4.4. 
Long overdue change to LIBVERSION

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-09 09:30:25 -08:00
Tom Eastep
b0feeb805d Fix typo in clear_firewall() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-09 07:28:57 -08:00
Tom Eastep
e6c0c8f6b7 Allow both <...> and [...] for IPv6 Addresses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-08 13:55:13 -08:00
Tom Eastep
83c2473d78 Correct typo in error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-06 08:26:13 -08:00
Tom Eastep
ca4eee3ae4 Correct handling of 'refresh' failures 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-06 08:01:46 -08:00
Tom Eastep
605da92eca Don't try to restore ipsets when 'restore' is being used to recover 
from a start/restart failure.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-06 07:44:34 -08:00
Tom Eastep
d362af9fb6 Set CAPSVERSION to 4.4.7 just to be safe. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-05 10:00:29 -08:00
Tom Eastep
ab1dc03986 Implement EXMARK capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-05 09:35:11 -08:00
Tom Eastep
d6123a8fbc Improve IPSET_SAVE restore logic: 
- Call startup_error() rather than fatal_error()
- Call startup_error when restore-ipsets file exists but Shorewall is running

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 14:23:33 -08:00
Tom Eastep
4e0f9b2ef3 Make save/restore work with SAVE_IPSETS=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 12:43:12 -08:00
Tom Eastep
1aa55779e2 Re-enable SAVE_IPSETS=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 11:14:45 -08:00
Tom Eastep
a1fd3aa7e3 Add a hack to work around a 'feature' of xtables-addons on Lenny 
Be more careful about checking for the ipset utility before saving the ipsets

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 10:15:27 -08:00
Tom Eastep
55e874b23f Update copyrights 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-01 12:58:27 -08:00
Tom Eastep
65c282af8b Delete temporary nat chain used in capabilities detection. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2009-12-31 10:42:21 -08:00
Tom Eastep
ea2ab6e4b6 A better solution to Marcus Limosani's issue 2009-12-29 08:22:15 -08:00
Tom Eastep
f568f3df9e Final fix for Marcus Limosani's problem 2009-12-28 15:05:54 -08:00
Tom Eastep
738a6de11b Make use of interface chains deterministic 2009-12-28 07:36:15 -08:00
Tom Eastep
f933816735 Simplify handling of packet clearing 2009-12-26 15:04:41 -08:00
Tom Eastep
d62f3a4fed Set version to 4.4.6 2009-12-24 08:00:59 -08:00
Tom Eastep
f233b86278 Fix 'forward' interface option in IPv6 2009-12-24 07:51:44 -08:00
Tom Eastep
e38df7efcb Fix another bug in ROUTE_FILTER Handling 2009-12-23 15:13:43 -08:00
Tom Eastep
e37cf0a370 Fix other issues with rp_filter fix 2009-12-20 15:54:41 -08:00
Tom Eastep
61b2ed7b57 Fix bug that prevented routefilter=2 2009-12-19 16:57:16 -08:00
Tom Eastep
d5914addd1 Disallow port 00 2009-12-19 14:59:03 -08:00
Tom Eastep
19af1a081c Handle kernel 2.6.31 and rp_filter 2009-12-19 13:47:12 -08:00
Tom Eastep
4f4d77be48 Add Kernel Version to the capabilities 2009-12-19 12:42:39 -08:00
Tom Eastep
24ddacb4a7 Adjust module versions 2009-12-19 07:35:30 -08:00
Tom Eastep
10ae98571b Revert change that allowed out of order policies 2009-12-19 07:20:00 -08:00
Tom Eastep
182ed24b02 Add a comment to process_rule1() 2009-12-14 15:52:16 -08:00
Tom Eastep
576cd76842 Remove superfluous logic from process_rule1 2009-12-14 14:49:38 -08:00
Tom Eastep
e9d12cfc11 Remove superfluous line of code 2009-12-14 07:17:55 -08:00
Tom Eastep
9988cfb619 Remove silly logic in expand_rule() 2009-12-10 08:00:18 -08:00
Tom Eastep
3214b14197 Fix macro handling of SOURCE and DEST columns 2009-12-08 13:29:06 -08:00
Tom Eastep
5e1f550b69 Fix ENHANCED_REJECT and MODULE_SUFFIX 2009-12-07 13:51:54 -08:00
Tom Eastep
7a6ad80c8a Make kernel version detection work with non-standard version naming such as found on OpenWRT 2009-12-06 10:42:28 -08:00
Tom Eastep
4bf55883ee Auto-load cls_flow 2009-12-03 12:15:23 -08:00
Tom Eastep
4494272dcd Improve error message 2009-11-29 09:55:32 -08:00
Tom Eastep
8c033de049 Fix limit check on TC mark values 2009-11-28 14:05:27 -08:00
Tom Eastep
e582f222ad Backout another Patch from the Virtual Zone Sequence and re-apply a couple of small optimizations 2009-11-28 07:25:31 -08:00
Tom Eastep
e5106f10bc Revert 8ff4d004c0 2009-11-28 07:23:23 -08:00
Tom Eastep
4e8d753682 Revert "Finish Virtual Zones" 
This reverts commit 222c8cf88f.
 2009-11-28 07:20:52 -08:00
Tom Eastep
d1812b4174 Revert "Fix a couple of bugs in virtual zones" 
This reverts commit 22991ac9dd.
 2009-11-28 07:20:28 -08:00
Tom Eastep
038b84e775 Revert "Small optimization in virtual zones" 
This reverts commit 251d7116c8.
 2009-11-28 07:20:01 -08:00
Tom Eastep
f21c71d7a6 Revert "Match section rules to the number of mark rules" 
This reverts commit 1699d8e941.
 2009-11-28 07:19:41 -08:00
Tom Eastep
0b1621027b Revert "Make 'virtual' a zone type rather than an option" 
This reverts commit 18eedf7e34.
 2009-11-28 07:19:10 -08:00
Tom Eastep
ea2c55a993 Revert "Fix off-by-one problem" 
This reverts commit 543af8bccb.
 2009-11-28 07:18:07 -08:00
Tom Eastep
f5bf3c9b43 Fix merge conflicts 2009-11-28 07:16:03 -08:00
Tom Eastep
7352771c5d Fix .spec history to omit false steps 2009-11-27 12:29:11 -08:00
Tom Eastep
543af8bccb Fix off-by-one problem 2009-11-27 08:56:23 -08:00
Tom Eastep
7f16e96167 Set version to 4.4.5 Beta1 2009-11-27 08:52:37 -08:00
Tom Eastep
18eedf7e34 Make 'virtual' a zone type rather than an option 2009-11-27 08:17:18 -08:00
Tom Eastep
1699d8e941 Match section rules to the number of mark rules 2009-11-26 17:12:11 -08:00
Tom Eastep
251d7116c8 Small optimization in virtual zones 2009-11-26 14:48:46 -08:00
Tom Eastep
22991ac9dd Fix a couple of bugs in virtual zones 2009-11-26 14:19:10 -08:00
Tom Eastep
222c8cf88f Finish Virtual Zones 2009-11-26 12:14:58 -08:00
Tom Eastep
8ff4d004c0 Better virtual zone implementation 2009-11-25 18:14:14 -08:00
Tom Eastep
8263ea1312 Limit providers to 15 2009-11-25 12:18:08 -08:00
Tom Eastep
d189c08533 Revert "Add 'virtual' zone support" 
This reverts commit a2cd4bd1f4.
 2009-11-25 11:51:13 -08:00
Tom Eastep
a2cd4bd1f4 Add 'virtual' zone support 2009-11-25 09:42:28 -08:00
Tom Eastep
4c40b205f8 Revert "Experimental explicit CONTINUE" 
This reverts commit 10056a03d9.
 2009-11-24 13:14:24 -08:00
Tom Eastep
10056a03d9 Experimental explicit CONTINUE 2009-11-24 12:50:53 -08:00
Tom Eastep
cd84efea94 Yet one more change to IPv6 address validation 2009-11-24 08:29:12 -08:00
Tom Eastep
deb45c5a27 Yet another IPv6 Address Normalization fix 2009-11-23 15:57:12 -08:00
Tom Eastep
bdb673a642 More IPv6 fixes 2009-11-23 15:21:25 -08:00
Tom Eastep
1710f9ce7c Several fixes to IPv6 Address Handling 2009-11-23 14:44:53 -08:00
Tom Eastep
9d85d0ff7a Allow IPv6 DNS names in net contexts 2009-11-23 13:51:46 -08:00
Tom Eastep
5610f78a48 Update version of Shorewall::Policy; improve 'expanded' description in Shorewall::Chains 2009-11-23 11:31:38 -08:00
Tom Eastep
99a35c1bf0 Allow <zone>::<serverport> in the rules file DEST column 2009-11-23 09:33:16 -08:00
Tom Eastep
5b02ef68a5 Simplify port == 0 test 2009-11-22 09:00:03 -08:00
Tom Eastep
d4ff629fd8 Generate error on port == 0 2009-11-22 08:44:11 -08:00
Tom Eastep
6e9d9e239d Apply 4.4.4.1 changes to master 2009-11-22 08:20:07 -08:00
Tom Eastep
4aeee6fd8b Make 'expanded' apply to all wildcard policies 2009-11-21 14:18:01 -08:00
Tom Eastep
c7de19cf39 Allow specific policy to supersede an expanded one 2009-11-21 13:56:40 -08:00
Tom Eastep
cbe944c354 Open the 4.5.0 Thread 2009-11-21 11:41:10 -08:00
Tom Eastep
ecf6a0ec4a Open 4.4.5 2009-11-21 11:08:50 -08:00
Tom Eastep
bce4d51a18 Allow wide MARK values in tcclasses when WIDE_TC_MARKS=Yes 2009-11-21 07:54:42 -08:00
Tom Eastep
c5bb493b29 Fix class number assignment when WIDE_TC_MARKS=Yes 2009-11-20 12:25:15 -08:00
Tom Eastep
0df84cf8b5 Remove superfluous line of code 2009-11-19 10:54:58 -08:00
Tom Eastep
a23632f45e Mostly cosmetic cleanup of Shorewall::Chains 2009-11-19 10:35:25 -08:00
Tom Eastep
c39a9fb5eb Fix typo in shorewall-rules(5) 2009-11-18 19:55:20 -08:00
Tom Eastep
4579a71574 More massaging of redundant test suppression 2009-11-17 11:14:02 -08:00
Tom Eastep
831611e792 Update version of Shorewall::Policy 2009-11-16 20:24:01 -08:00
Tom Eastep
5f70b261b6 Update version of Shorewall::Compiler 2009-11-16 20:21:59 -08:00
Tom Eastep
5ec4f8d82c Unconditionally include route marking and sticky chains 2009-11-16 14:15:01 -08:00
Tom Eastep
2a910ebddf Suppress redundant tests for provider availability in route rules processing 2009-11-16 12:43:44 -08:00
Tom Eastep
016537f631 Don't add route rules when interface is down 2009-11-16 10:58:38 -08:00
Tom Eastep
dd543a2934 Tweak policies display 2009-11-16 09:30:37 -08:00
Tom Eastep
f5a019becc Implement 'show policies' command 2009-11-15 09:24:56 -08:00
Tom Eastep
b662718eec Replace canonical_chain by rules_chain 2009-11-14 07:07:19 -08:00
Tom Eastep
10affb1cde Set version to 4.4.4 2009-11-13 13:52:49 -08:00
Tom Eastep
fa3bdde214 Set version to Beta2 2009-11-13 12:39:41 -08:00
Tom Eastep
0e6c9abb5b A fix for COPY handling 2009-11-12 16:45:39 -08:00
Tom Eastep
f904866336 More minor cleanup of chain name change 2009-11-12 12:30:08 -08:00
Tom Eastep
2d53f8cb0c Delete unnecessary function 2009-11-11 16:35:46 -08:00
Tom Eastep
b943f09e37 Fix indentation 2009-11-11 12:34:15 -08:00
Tom Eastep
4e6b8f8f42 Set version to 4.4.4-Beta1 2009-11-11 10:58:22 -08:00
Tom Eastep
0f078e7440 Ignore empty port in INTERFACE column 2009-11-11 10:52:14 -08:00
Tom Eastep
a4eb581d44 Document full logical interface implementation 2009-11-11 10:45:01 -08:00
Tom Eastep
06d3b2c692 Allow wildcard logical names in COPY column 2009-11-11 10:17:53 -08:00
Tom Eastep
6987cd15c5 Avoid dereference of null variable 2009-11-11 10:10:45 -08:00
Tom Eastep
ba8ad6346a More use of logical chain name 2009-11-11 10:06:06 -08:00
Tom Eastep
893a847c87 Suppress extra COMMENT warnings 2009-11-10 17:17:55 -08:00
Tom Eastep
bf8c38e054 Add ZONE2ZONE option to shorewall.conf 2009-11-10 14:12:55 -08:00
Tom Eastep
7120a73f0e Minor efficiency improvement in move_rules() 2009-11-10 08:08:02 -08:00
Tom Eastep
c9e57c93a2 Insure uniqueness of physical names; use logical name when constructing the name of a chain 2009-11-10 07:24:14 -08:00
Tom Eastep
4e2f2923b6 Update ::Config::VERSION 2009-11-09 13:16:40 -08:00
Tom Eastep
79b5cb49df Fix over-zealous use of physical name; Correct syntax errors 2009-11-09 12:38:00 -08:00
Tom Eastep
893a0c9d42 Remove order dependency in interface OPTIONS processing 2009-11-09 11:15:08 -08:00
Tom Eastep
9b127e6e06 Improve performance of logical->physical mapping 2009-11-09 07:27:14 -08:00
Tom Eastep
92208251b7 Add undocumented LOGICAL_NAMES option 2009-11-09 07:01:25 -08:00
Tom Eastep
dda6f06883 Update module versions 2009-11-08 09:01:30 -08:00
Tom Eastep
4d977306f9 Make 'physical' work as a general logical name facility 2009-11-08 08:37:03 -08:00
Tom Eastep
83621ff416 Add logical->physical mapping to Shorewall::Chains 2009-11-08 07:11:38 -08:00
Tom Eastep
09f1b6501c Add logical->physical mapping to Shorewall::Providers 2009-11-08 07:00:43 -08:00
Tom Eastep
ca1dd1416d Add logical->physical mapping to Shorewall::Tc 2009-11-08 06:26:47 -08:00
Tom Eastep
1238b771a2 Apply logical->physical mapping to /proc settings 2009-11-07 18:59:10 -08:00
Tom Eastep
b1706e10e3 Correct typo 2009-11-07 07:58:15 -08:00
Tom Eastep
bcd4887d84 Correct capitalization in error message; remove unused variable 2009-11-07 07:39:28 -08:00
Tom Eastep
7f54a6fea9 Make non-wild physical work correctly 2009-11-07 07:19:52 -08:00
Tom Eastep
496cfc391e Make parsing of zone options tighter 2009-11-06 15:51:53 -08:00
Tom Eastep
b491745f1c More physical interface changes 2009-11-06 13:10:19 -08:00
Tom Eastep
4ef45ff665 Generate an error if a bridge port is configured as a provider interface 2009-11-06 09:22:16 -08:00
Tom Eastep
73eab1fa55 Report physical name in zone reports rather than logical name 2009-11-06 08:40:53 -08:00
Tom Eastep
d73ebb8a6a Add comment explaining the purpose of dump_zone_contents() 2009-11-06 08:11:18 -08:00
Tom Eastep
7014bd3ea0 Add 'physical' interface option for bridge ports 2009-11-06 08:07:13 -08:00
Tom Eastep
89bdcf9a3d Implement 'physical' option 2009-11-06 07:27:44 -08:00
Tom Eastep
a98195e156 Back out fix for multiple bridges with wildcard ports 2009-11-05 16:34:41 -08:00
Tom Eastep
fb3477b8b5 A couple of additional tweaks to the two-bridge fix 2009-11-05 13:40:03 -08:00
Tom Eastep
b4199fd068 Document ICMP codes 2009-11-05 11:44:40 -08:00
Tom Eastep
28b660c853 Avoid reporting bogus duplicate interface with two bridges and wildcard ports 2009-11-05 11:04:14 -08:00
Tom Eastep
4548db58da Relax port list limitation in /etc/shorewall/routestopped 2009-11-03 11:36:32 -08:00
Tom Eastep
25549b176c Update version to 4.4.4 2009-11-03 10:06:29 -08:00
Tom Eastep
5a525134ea Be sure that startup log is secured 0600 2009-11-03 09:34:21 -08:00
Tom Eastep
f2f91ce7dd Some optimizations 2009-11-03 09:28:34 -08:00
Tom Eastep
c893ba6ffa Remove dependence of Shorewall::Rules on Scalar::Util 2009-11-03 07:40:06 -08:00
Tom Eastep
45653ffe79 A couple of more move_rules() tweaks 2009-11-02 15:35:00 -08:00
Tom Eastep
f97e0c5989 Flesh out fix for Perl run-time errors 2009-11-02 07:15:20 -08:00
Tom Eastep
11ddfa92e9 Eliminate Perl run-time errors out of move_rules() 2009-11-01 17:14:42 -08:00
Tom Eastep
59d01ccf97 A couple of tweaks to 'limit' class option 2009-10-27 12:33:14 -07:00
Tom Eastep
105754823a Raise max limit to 128 2009-10-26 13:03:26 -07:00
Tom Eastep
f0b4b1f42e Add limit option to tcclasses 2009-10-26 12:23:32 -07:00
Tom Eastep
cc0adc218f Update comments and release documentation 2009-10-26 10:03:51 -07:00
Tom Eastep
8251948d2a Add a comment 2009-10-24 15:55:56 -07:00
Tom Eastep
b3571261dd Fix optional providers 2009-10-24 12:05:44 -07:00
Tom Eastep
3e2cf982a3 Correct messages issued when a provider is not added 2009-10-24 08:50:15 -07:00
Tom Eastep
86df82a29a Fix IPv6 address validation error 2009-10-23 13:41:51 -07:00
Tom Eastep
46896e7dce Fix for Ipv6 2009-10-23 11:34:13 -07:00
Tom Eastep
d0cda6b6ea Add TRACK_PROVIDERS option 2009-10-20 13:24:17 -07:00
Tom Eastep
49f361124e Make 'track' the default 2009-10-20 12:24:28 -07:00
Tom Eastep
7adb9b12bb Move all function declarations from prog.footer6 to prog.header6 2009-10-19 07:37:49 -07:00
Tom Eastep
a0482132c6 Move all function declarations from prog.footer6 to prog.header6 2009-10-19 07:28:30 -07:00
Tom Eastep
abc9ab061a Remove superfluous variables from generated script 2009-10-19 07:25:03 -07:00
Tom Eastep
65e4a5ff66 Move all functions from prog.footer to prog.header; minor tweaks elsewhere 2009-10-18 08:47:20 -07:00
Tom Eastep
0a74320bc2 Fix progress message 2009-10-17 14:23:11 -07:00
Tom Eastep
30dbfdc949 Fix intentation problem introduces with config-detection fix 2009-10-17 11:08:34 -07:00
Tom Eastep
e6755b7172 Merge nested zone fix into master 2009-10-17 10:59:41 -07:00
Tom Eastep
44c5ebcfa4 Fix initialization 2009-10-15 13:06:04 -07:00
Tom Eastep
19a90db09f Back out last unnecessary change 2009-10-14 07:13:52 -07:00
Tom Eastep
990a9f0fdc Fix RETAIN_ALIASES 2009-10-13 14:36:47 -07:00
Tom Eastep
80f41779f8 Replace keyword 'object' with 'script' 2009-10-12 08:24:47 -07:00
Tom Eastep
7064b8dd08 Update version of changed modules 2009-10-08 15:49:54 -07:00
Tom Eastep
3f7a1f9574 Rename a variable 2009-10-08 09:48:15 -07:00
Tom Eastep
83a9d8dd1b Rename 'object' to 'script' 2009-10-05 15:43:29 -07:00
Tom Eastep
dc643c67e9 Move declaration to inner block where it is used 2009-10-05 14:23:43 -07:00
Tom Eastep
8089ef1599 Fix 'routeback' in routestopped file 2009-10-03 10:44:26 -07:00
Tom Eastep
964cba79a9 Initialize 4.4.3 2009-10-02 11:31:08 -07:00
Tom Eastep
a87cb7b95d Generate list of builtins in initialize() 2009-10-01 15:02:14 -07:00
Tom Eastep
ddb46931a0 Update version 2009-10-01 08:44:05 -07:00
Tom Eastep
327e170be5 Fix range-in-masq patch 2009-10-01 08:16:22 -07:00
Tom Eastep
39ee3b2025 Tweak emitter 2009-09-29 14:28:50 -05:00
Tom Eastep
393673a884 Allow MARK in action body -- take 2 2009-09-25 16:15:56 -04:00
Tom Eastep
bfdc8db31a Allow MARK in action body 2009-09-25 16:01:24 -04:00
Tom Eastep
d84458518e Add capability to detect old hashlimit syntax 2009-09-23 16:56:31 -04:00
Tom Eastep
20250c9ce9 Hack to make new LIMIT stuff work on ancient iptables releases 2009-09-20 09:10:23 -04:00
Tom Eastep
96b19dd218 Fix accounting extension feature 2009-09-15 13:01:20 -07:00
Tom Eastep
120aade417 Allow Extension Scripts for Accounting Chains 2009-09-15 12:22:51 -07:00
Tom Eastep
4f4925002a Revert "Allow Extension Scripts for Accounting Chains" 
This reverts commit 728ad2fecf.
 2009-09-15 12:18:29 -07:00
Tom Eastep
728ad2fecf Allow Extension Scripts for Accounting Chains 2009-09-15 11:16:37 -07:00
Tom Eastep
6afc43d200 Correct typo in comment 2009-09-13 09:20:32 -07:00
Tom Eastep
8fdbb6f252 Bump Nat.pm version; remove inadvertent paste 2009-09-13 09:13:50 -07:00
Tom Eastep
5793246d7c Make processing of original dest in Format-1 macros more obvious 2009-09-13 09:01:34 -07:00
Tom Eastep
8fdebf0c38 Add new columns to macros 2009-09-13 08:09:40 -07:00
Tom Eastep
9b0a9e8ecd Add -<family> to 'ip route del default' command 2009-09-12 08:48:52 -07:00
Tom Eastep
8c2a228a7d Apply Jesse Shrieve's SNAT patch 2009-09-11 07:47:31 -07:00
Tom Eastep
f33e842f1b Update module version 2009-09-10 14:56:23 -07:00
Tom Eastep
74aff4f4ef Bump the version in a couple of modules modified for 4.4.2 2009-09-09 12:58:39 -07:00
Tom Eastep
212937a29d Make 'map_old_actions' a little cleaner 2009-09-09 12:37:49 -07:00
Tom Eastep
0b03f52ad9 Don't look for extension script for built-in actions 2009-09-09 11:53:51 -07:00
Tom Eastep
5fc0137a2e Update Compiler module version 2009-09-08 17:05:01 -07:00
Tom Eastep
128edd4bba Slight optimization -- also makes code easier to read 2009-09-08 16:00:40 -07:00
Tom Eastep
b4712a93fa Don't call compile_stop_firewall() during 'check'; call process_routestopped() instead - comments 2009-09-08 13:04:34 -07:00
Tom Eastep
5655dbb01b Don't call compile_stop_firewall() during 'check'; call process_routestopped() instead 2009-09-08 12:54:23 -07:00
Tom Eastep
b03d502bbb Allow comments on continued lines 2009-09-06 16:17:22 -07:00
Tom Eastep
70ebe17cb3 Reimplement MAPOLDACTIONS=Yes 2009-09-06 13:37:24 -07:00
Tom Eastep
7192b47289 Add a Lenny->Squeeze Howto 2009-09-06 09:51:32 -07:00
Tom Eastep
75eb186ea7 Split MASQ SOURCE warning into two separate warnings 2009-09-05 16:02:16 -07:00
Tom Eastep
ec94ed638e Better modularization of Chains and Actions 2009-09-05 08:43:14 -07:00
Tom Eastep
bb8ad187f1 Update version to 4.4.2 2009-09-04 11:40:34 -07:00
Tom Eastep
03821dc22c Process routestopped file during 'check' 2009-09-03 19:27:25 -07:00
Tom Eastep
76d9a80df3 A small optimization on the last restriction removal 2009-09-03 18:26:50 -07:00
Tom Eastep
84bff13e7f Apply 4.4.1.2 fix to trunk 2009-09-03 18:25:32 -07:00
Tom Eastep
4a809e14ab Documentation cleanup 2009-09-03 15:24:19 -07:00
Tom Eastep
df5291e119 Apply initialization fix to master branch 2009-09-03 14:54:47 -07:00
Tom Eastep
015d4f58ce Allow moving rules with commands 2009-09-03 14:11:44 -07:00
Tom Eastep
4412a05a70 Fix detection of PERSISTENT_SNAT 2009-09-03 13:56:00 -07:00
Tom Eastep
62b1dbcd7f Document portlist-splitting change 2009-09-02 15:30:26 -07:00
Tom Eastep
c9e9877f05 Combine port-list handling into a single function 2009-09-02 14:49:07 -07:00
Tom Eastep
9e09e61a1a Delete blank line 2009-09-01 11:18:14 -07:00
Tom Eastep
b778f04b1a Massage fix for multicast and nets= 2009-09-01 11:11:57 -07:00
Tom Eastep
b30da86cce Fix automatic multicast with nets= 2009-09-01 08:56:54 -07:00
Tom Eastep
1544c0b2b1 Add some comments concerning "$|" 2009-08-31 10:41:08 -07:00
Tom Eastep
d368d80a12 More robust checking of zone definitions 2009-08-31 09:09:15 -07:00
Tom Eastep
5297bb8b8d Fix undefined variable warning 2009-08-31 09:08:49 -07:00
Tom Eastep
2bb92a79f3 Fix silly hole in zones file parsing 2009-08-30 08:05:10 -07:00
Tom Eastep
b4f7b85b3b Fix multicast network in Policy.pm 2009-08-29 09:26:46 -07:00
Tom Eastep
1ef00c547b Disallow 'nets=' in a multi-zone interface definition 2009-08-29 07:41:27 -07:00
Tom Eastep
4809314fc1 Allow extending a zone defined with nets= 2009-08-29 07:20:16 -07:00
Tom Eastep
acfdc7e481 nets= allows multicast 2009-08-28 15:17:10 -07:00
Tom Eastep
383f3e8bcf Fix nested IPSEC zones 2009-08-26 12:44:10 -07:00
Tom Eastep
52dfd5b259 Make cleanup after error explicit 2009-08-26 10:34:04 -07:00
Tom Eastep
db803807a7 Add comment regarding tcclass.guarantee 2009-08-26 10:32:57 -07:00
Tom Eastep
1b26c65cbc Fix logging in rules at the end of INPUT and OUTPUT 2009-08-25 09:22:26 -07:00
Tom Eastep
088e164f18 Redefine 'full' when used in a sub-class definition 2009-08-24 11:56:16 -07:00
Tom Eastep
4eb9e5db3d Correct example in the docs and ensure that future idiots don't place 'default' in the PRIO column of tcclasses 2009-08-24 06:25:26 -07:00
Tom Eastep
679cff2779 Correct example in the docs and ensure that future idiots don't place 'default' in the PRIO column of tcclasses 2009-08-23 20:45:05 -07:00
Tom Eastep
e24dbb9aea Add 'clean' target to Makefiles 2009-08-23 10:43:01 -07:00
Tom Eastep
267bc808f5 Use 'set_command()' in the 'compile' case as well as the 'check' case 2009-08-22 09:39:15 -07:00
Tom Eastep
5ac331a5a0 Rename verbosity-oriented variables/functions 2009-08-22 07:57:55 -07:00
Tom Eastep
5dd41249c6 Remove trailing whitespace 2009-08-20 14:32:15 -07:00
Tom Eastep
8c16ac1d46 Update Module versions 2009-08-20 08:53:57 -07:00
Tom Eastep
ddf8bbe516 Remove some V4/V6 tests 2009-08-18 11:03:17 -07:00
Tom Eastep
1cf22ead7f Correct allip() return value 2009-08-18 07:35:17 -07:00
Tom Eastep
90b0bedc43 More performance tweaks 2009-08-17 16:29:18 -07:00
Tom Eastep
787a1867a0 Another tiny performance enhancement 2009-08-17 12:58:50 -07:00
Tom Eastep
e756689d0c Very minor performance tweak 2009-08-17 11:22:03 -07:00
Tom Eastep
89a6d7e5db Tweak initialization comments 2009-08-17 10:45:46 -07:00
Tom Eastep
d8cc9c5c92 Fix capabilities test for PERSISTENT_SNAT 2009-08-17 08:07:58 -07:00
Tom Eastep
0557148bec Avoid double globals initialization for IPv6 2009-08-16 09:24:51 -07:00
Tom Eastep
c908edab34 Add new capability for persistent SNAT 2009-08-15 08:35:54 -07:00
Tom Eastep
55f75604b3 Add support for 'persistent' 2009-08-15 08:15:38 -07:00
Tom Eastep
f042c641d6 Remove extraneous export 2009-08-15 07:01:06 -07:00
Tom Eastep
9b87812531 update version of Nat module 2009-08-14 15:03:59 -07:00
Tom Eastep
883f415e53 Start 4.4.1 2009-08-14 14:46:31 -07:00
Tom Eastep
2bac824207 Fix provider number in masq entry 2009-08-12 13:52:56 -07:00
Tom Eastep
5cb9ff0009 Fix 'upnpclient' on required interfaces 2009-08-11 08:31:58 -07:00
Tom Eastep
1a5027de9f Restore ipset binding capability 2009-08-08 08:26:22 -07:00
Tom Eastep
70f46c02cc Fix logging NAT rules 2009-08-05 12:48:14 -07:00
Tom Eastep
3efaef813f Update version to 4.4.0 2009-08-03 10:16:37 -07:00
Tom Eastep
489e09a4d7 Propagate super option to parents 2009-07-29 15:33:47 -07:00
Tom Eastep
4af6c7650e Correct handling of nested IPSEC zone 2009-07-29 14:35:27 -07:00
Tom Eastep
8d8920e7ad Disallow ipsec zones nested within an ip zone 2009-07-29 07:49:06 -07:00
Tom Eastep
19736bcdbd Update version to RC2 2009-07-28 13:45:26 -07:00
Tom Eastep
f2f8cab962 Make 'any' a reserved zone name 2009-07-26 12:29:37 -07:00
Tom Eastep
26cb2b1eeb Allow Shorewall6 to recognize TC, IP and IPSET 2009-07-26 12:26:49 -07:00
Tom Eastep
c028fefa30 Fix 'disable_ipv6 -- take 2 2009-07-24 17:27:42 -07:00
Tom Eastep
fde24c16df Fix 'disable_ipv6 2009-07-24 16:58:49 -07:00
Tom Eastep
c77f462d2d Delete prog.functions and prog.functions6 2009-07-24 14:51:24 -07:00
Tom Eastep
45fffc7261 Replace 'edit' by 'validate' in compiler parameter handling logic 2009-07-22 10:43:53 -07:00
Tom Eastep
264126e9f5 Fix syntax error in last change 2009-07-22 10:43:15 -07:00
Tom Eastep
7f790e3aa2 Don't call generate_matrix() during 'check' 2009-07-21 14:13:26 -07:00
Tom Eastep
0204ea46a6 Ensure that move_rules doesn't crash in NONAT case 2009-07-16 15:59:59 -07:00
Tom Eastep
55045ace4b Optimize nonat rules in certain cases 2009-07-16 11:05:37 -07:00
Tom Eastep
f16b2300b6 Remove references to Shorewall-shell, Shorewall-perl and prior Shorewall versions from the manpages 2009-07-15 17:50:55 -07:00
Tom Eastep
9c2966448e Fix NONAT of sub-zone 2009-07-15 15:59:53 -07:00
Tom Eastep
8e9bef0a61 Fix routing with no providers 2009-07-15 13:03:49 -07:00
Tom Eastep
3bd9d31c05 Correct NOROUTE logic when no providers 2009-07-15 12:32:26 -07:00
Tom Eastep
17f61ad1c6 Optimize creation of /etc/iproute2/rt_tables 2009-07-15 12:22:31 -07:00
Tom Eastep
8f57a5d7a2 Some minor tweaks to the Providers module 2009-07-14 16:12:59 -07:00
Tom Eastep
d64b526319 Come cleanup of the Chains module 2009-07-13 16:54:39 -07:00
Tom Eastep
887a643f9e Initiate RC1 2009-07-12 10:06:57 -07:00
Tom Eastep
75861185e0 Minor typo/cosmetic corrections 2009-07-12 09:26:25 -07:00
Tom Eastep
5bd3d710b7 Push version to Beta 4 2009-07-09 16:41:10 -07:00
Tom Eastep
bdd124b504 Derive IP6TABLES from IPTABLES 2009-07-09 10:29:56 -07:00
Tom Eastep
2142e92f8a Remove add_command and replace all calls with calls to add_commands 2009-07-06 18:38:39 -07:00
Tom Eastep
f88048ebe4 More revert conflicts 2009-07-06 18:23:23 -07:00
Tom Eastep
050375b211 Delete DISABLE_IPV6 option 2009-06-29 18:33:13 -07:00
Tom Eastep
9dbafc59d0 Fix 'findgw' 2009-06-29 08:14:53 -07:00
Tom Eastep
25c2403f48 Update version to Beta 3 2009-06-27 08:26:41 -07:00
Tom Eastep
b2b6633ced More on port list split/validation 2009-06-26 15:05:35 -07:00
Tom Eastep
cb681ab5ca Fix for source port counting 2009-06-26 10:31:43 -07:00
Tom Eastep
900cfa0def 1) Cosmetic change to compiler.pl 
2) Make 'purge_jump' handle '-g <target>' correctly
3) Minor effeciency changes to Chains.pm
 2009-06-26 09:46:15 -07:00
Tom Eastep
40bb8283d2 Verify the availability of the LOG target 2009-06-25 13:50:27 -07:00
Tom Eastep
6eb202666c Fix for mis-configured interfaces 2009-06-24 08:58:37 -07:00
Tom Eastep
bd55a545b5 Rename lib.user to lib.private 2009-06-20 09:35:08 -07:00
Tom Eastep
01d046fac9 Add lib.user extension script 2009-06-19 14:39:45 -07:00
Tom Eastep
117116eb4e Add USER/GROUP column to /etc/shorewall/masq 2009-06-19 08:00:26 -07:00
Tom Eastep
927aa5f0e8 Additional fix up of optional interface handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2009-06-17 09:39:35 -07:00
Tom Eastep
b99444ab8b Make new optional interface code work with shared providers 2009-06-17 07:30:01 -07:00
Tom Eastep
3483e8052a Small optimization in lookup_provider() 2009-06-16 15:52:38 -07:00
Tom Eastep
64fd1167d1 replace a couple of instances of 'which' with 'mywhich'; relocate some global variable code 2009-06-16 15:39:04 -07:00
Tom Eastep
c00195e62a Replace '_IS_UP' with '_IS_USABLE' 2009-06-16 14:25:13 -07:00
Tom Eastep
2a7491ebf2 More work on optional interfaces 2009-06-16 14:03:15 -07:00
Tom Eastep
58b2488459 Clean up 'upnpclient' implementation 2009-06-16 09:43:22 -07:00
Tom Eastep
abe07c9fae Add 'upnpclient' interface option 2009-06-15 13:34:35 -07:00
Tom Eastep
b6410902a0 Relocate code that sets provider variables 2009-06-15 12:25:20 -07:00
Tom Eastep
8eb6ab7cc9 Set optional interface variables when there are no providers 2009-06-15 12:07:18 -07:00
Tom Eastep
c96db9a01c Set optional provider variables when NOROUTE is true 2009-06-15 11:35:46 -07:00
Tom Eastep
440cc08802 Fix ORIGINAL DEST issue 2009-06-15 08:45:34 -07:00
Tom Eastep
894d4e5aa5 Update version to Beta2 2009-06-15 06:50:21 -07:00
Tom Eastep
a6d2497653 Integerize r2q before using it in a 'qdisc add' command 2009-06-14 14:29:12 -07:00
Tom Eastep
7440cd7d21 Correct 'help' in compiler.pl 2009-06-14 13:39:42 -07:00
Tom Eastep
e2ae6453ac Replace 'Shorewall-perl' with 'Shorewall' 2009-06-13 07:07:55 -07:00
Tom Eastep
265e4fa546 First cut at 4.4 2009-06-12 15:51:43 -07:00
Tom Eastep
1025ca6002 Refine ee0667c9da slightly 2009-06-12 07:34:31 -07:00
Tom Eastep
ee0667c9da Fix mnemonic handling in tcfilters 2009-06-12 07:27:08 -07:00
Tom Eastep
a1330cbfdf Purely cosmetic change in the Actions module 2009-06-10 14:31:22 -07:00
Tom Eastep
91b0e5aaa1 Update version and release docs to start work on 4.3.13 2009-06-07 10:52:53 -07:00
Tom Eastep
cb77458070 Allow INITLOG to be set in /etc/default/shorewall[6]; fix syntax error in Zones module 2009-06-07 08:07:56 -07:00
Tom Eastep
be8b352ee7 Cleanup of STDERR redirection; Update module versions 2009-06-05 15:12:59 -07:00
Tom Eastep
69c78676ad Redirect STDERR to log 2009-06-05 13:49:23 -07:00
Tom Eastep
9ee0d05507 Update version to 4.3.12 2009-06-05 11:53:01 -07:00
Tom Eastep
c370dc650c Remove support for 'norfc1918' and it's associated settings in shorewall.conf 2009-06-05 10:51:30 -07:00
Tom Eastep
7621859e0f Fix 'findgw' 2009-06-04 13:03:56 -07:00
Tom Eastep
93b2227ce6 Add FAQ 36 re: BANDWIDTH_IN 2009-06-03 17:11:14 -07:00
Tom Eastep
7ecd3f0437 Correct previous commit 2009-05-29 07:21:51 -07:00
Tom Eastep
f2cb2cca9e Suppress duplicate progress messages 2009-05-29 07:03:24 -07:00
Tom Eastep
d33532d6cd Add TOS field to tcfilters 2009-05-28 16:41:14 -07:00
Tom Eastep
97fa7a0513 Add LENGTH column to tcfilters file 2009-05-28 14:29:33 -07:00
Tom Eastep
d35274d7d9 Minor cosmetic change to the source 2009-05-28 14:04:42 -07:00
Tom Eastep
7418e27308 Deimplement ipset binding support 2009-05-28 07:22:48 -07:00
Tom Eastep
d0d999488b Fix silly bug in capabilities detection 2009-05-28 06:42:47 -07:00
Tom Eastep
0bd3b0c0af Clarify requirement for RT parameters 2009-05-24 16:58:41 -07:00
Tom Eastep
a0071a21e8 Tweak and document HFSC implementation 2009-05-24 10:06:36 -07:00
Tom Eastep
d97a96b350 First implementation of HFSC queuing discipline 2009-05-23 17:07:57 -07:00
Tom Eastep
787caa7f32 First implementation of HFSC queuing discipline 2009-05-23 17:04:39 -07:00
Tom Eastep
4cf2c1b59f Avoid 'large quantum' warnings during start/restart 2009-05-23 09:04:06 -07:00
Tom Eastep
110b6a613d More code structure cleanup -- Providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2009-05-22 13:55:39 -07:00
Tom Eastep
d6c8cd5d3e Warn if 'proxyarp' specified on a non-loose provider 2009-05-21 09:39:43 -07:00
Tom Eastep
ad6b47d3bf More code rationalization 2009-05-19 17:11:56 -07:00
Tom Eastep
f75f4158b3 Add 'findgw' user exit 2009-05-11 14:35:20 -07:00
Tom Eastep
3162eff925 Support version 3 of dhclient 2009-05-10 12:22:23 -07:00
Tom Eastep
e97f7a622c Update version to 4.3.11 2009-05-10 07:08:47 -07:00
Tom Eastep
e1771ebead Externalize the 'flow' classifier 2009-05-08 14:05:27 -07:00