shorewall_code

mirror of https://gitlab.com/shorewall/code.git synced 2024-12-12 09:20:42 +01:00

Author	SHA1	Message	Date
Tom Eastep	d63262a0cb	change ZONE2ZONE default to '-'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-24 08:16:28 -08:00
Tom Eastep	3870157898	Issue warning on bare SECTION headings. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-24 07:58:02 -08:00
Tom Eastep	80d54ec40b	Implement ?SECTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-18 06:57:54 -08:00
Tom Eastep	855cb6e7f4	Correct handling of HFSC classes with DMAX but no UMAX Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-16 08:07:23 -08:00
Tom Eastep	e14d92c5ac	Add DROP support in tcrules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-11-04 10:50:11 -08:00
Tom Eastep	ca3385d1be	Remove superfluous '[' from character set. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-21 09:28:21 -07:00
Tom Eastep	5823411091	Correct typo in a regular expression. - Re-enable \|<mark> in the tctrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-21 07:04:23 -07:00
Tom Eastep	66c2fca2b0	Eradicate the use of 'fgrep' - Busybox on Leaf Bering does not have fgrep Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-14 07:15:08 -07:00
Tom Eastep	b27e3d2fff	Merge branch '4.5.21'	2013-10-08 13:17:41 -07:00
Tom Eastep	5e67808abd	Don't add host route in default table. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 11:27:41 -07:00
Tom Eastep	fa500b9ea2	Correct H323 and netbios-ns handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:24:52 -07:00
Tom Eastep	b6d7e9ea96	Work around emacs bug Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:24:40 -07:00
Tom Eastep	0e61c2f210	Correct H323 and netbios-ns handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:20:46 -07:00
Tom Eastep	3c9d984835	Correct typo - list_split s/b split_list Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 09:19:07 -07:00
Tom Eastep	4917500f12	Work around emacs bug Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 07:13:01 -07:00
Tom Eastep	50b7a81b13	Correct typo - list_split s/b split_list Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-08 06:56:16 -07:00
Tom Eastep	8c4bbf0c85	Implement REAP_OPTION capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-10-07 07:54:52 -07:00
Tom Eastep	5b515f007b	Fix 'monthdays' in the TIME column. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-30 15:43:17 -07:00
Tom Eastep	d7cbd1da21	Allow actions to manipulate the current comment from Perl. - Added set_comment() - moved push/pop_comment() to the :DEFAULT export	2013-09-23 12:21:44 -07:00
Tom Eastep	eb75d0eef4	Add 'nohostroute' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-18 16:49:54 -07:00
Tom Eastep	5dbcdd65e2	Force 'inline' for REJECT_ACTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-10 07:37:53 -07:00
Tom Eastep	dc5c0dc069	Validate default log levels - Name the .conf option involved in error messages Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-06 16:00:15 -07:00
Tom Eastep	87ae801c15	Use the -w ip[6]tables option when available. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-04 10:16:36 -07:00
Tom Eastep	67603c5eb3	Implement REJECT_ACTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-09-01 09:14:10 -07:00
Tom Eastep	1540e50cce	Remove blank line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-31 10:07:41 -07:00
Tom Eastep	0a2f6c18cc	Correct typo in prog.footer Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-13 07:03:20 -07:00
Tom Eastep	32763e998b	Make -v work with the status command - Also document exit status Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-13 06:52:46 -07:00
Tom Eastep	a10aea280b	Add some abbreviations for common commands Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-06 07:05:47 -07:00
Tom Eastep	ceffc000eb	Correct Typo Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-05 08:32:17 -07:00
Tom Eastep	6615c1f736	Clarify usage of Interface Option Chains Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-08-04 09:01:09 -07:00
Tom Eastep	83d1aa6682	Allow OPTIMIZE=All - Remove use of literal 4096 from OPTIMIZATION checks. - Moved constant declarations to the Config module. - Documented that level 1 is ignored when level 4 is specified. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-29 10:08:35 -07:00
Tom Eastep	aabb22a50f	Add the TRACK_RULES option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-24 07:22:51 -07:00
Tom Eastep	7aa33c140d	Add an AutoBL action with helper AutoBLL Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-17 10:19:18 -07:00
Tom Eastep	891e3e0e1d	Use the --reap option in sticky recent rules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 14:46:39 -07:00
Tom Eastep	5c7500e13e	Display the current time as an integer in 'show event[s]' output Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 09:46:08 -07:00
Tom Eastep	09240da55a	Change the external name of MARK_ANYWHERE to 'Mark in the filter table' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 09:45:20 -07:00
Tom Eastep	89f16bdb37	Include a current time event in /proc/net/xt_recent/ Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-12 07:14:22 -07:00
Tom Eastep	8e30831385	Resolve merge conflicts Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-11 14:20:38 -07:00
Tom Eastep	d2725fcd87	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code	2013-07-11 14:16:19 -07:00
Tom Eastep	9535a7d7df	Rename 'Trigger' to 'Event' and document Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-11 10:39:21 -07:00
Tom Eastep	3c6df56b57	Implement Triggers Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-10 13:27:58 -07:00
Tom Eastep	411ca87ec3	Allow logging rules with more than 15 ports Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-08 15:59:54 -07:00
Tom Eastep	948a7fccc2	Enhance a comment Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-07 12:52:04 -07:00
Tom Eastep	73060a3761	Correct typo in dropBcast() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-06 07:58:21 -07:00
Tom Eastep	cd83d7727c	Restore handle_original_dest(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:51:06 -07:00
Tom Eastep	5121634457	Add ihandle_original_dest() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:37:24 -07:00
Tom Eastep	131c1f432b	Add iverify_source_interface() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-04 14:07:09 -07:00
Tom Eastep	03885f71d3	Create add_expanded_ijump() that breaks long lines Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-03 15:13:48 -07:00
Tom Eastep	b735b93378	Re-factor irule generation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-03 10:59:09 -07:00
Tom Eastep	5ce5d5e607	Delete superfluous blank line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 15:03:50 -07:00
Tom Eastep	00c5985458	Rename clone_rule() to clone_irule() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:38:16 -07:00
Tom Eastep	1a44b66656	Cleaner handling of trailing spaces from log_irule_limit. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:32:35 -07:00
Tom Eastep	b215cf379a	Generate a warning when Limit is invoked. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 12:31:29 -07:00
Tom Eastep	3ec6745df9	Use log_irule_limit() internally where possible. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 11:48:02 -07:00
Tom Eastep	55be5b0119	Add log_irule_limit() and log_irule() functions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 11:47:19 -07:00
Tom Eastep	42a649d093	Create $globals{LOGILIMIT} Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-02 09:00:36 -07:00
Tom Eastep	18e7e43b2f	Eliminate globals{STATEMATCH} Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-01 16:01:57 -07:00
Tom Eastep	6803ce5d41	Add constants for %used values. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-07-01 15:36:16 -07:00
Tom Eastep	565fb74795	Correct bridge detection and 'qt' implementation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 13:07:38 -07:00
Tom Eastep	fc754040d5	Avoid shell error when detecting owner name match Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 09:51:32 -07:00
Tom Eastep	cc5a59231b	Make qt() work correctly when tracing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-24 07:17:15 -07:00
Tom Eastep	25f96e6a88	Reword unreachable warning (again) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-20 10:50:28 -07:00
Tom Eastep	71bcd11ab6	Make ?...shell/perl directives case insensitive Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-20 10:39:39 -07:00
Tom Eastep	4bd35a0b93	Allow 'routeback=0' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-16 08:37:53 -07:00
Tom Eastep	cb132e2421	Include the chain name in the 'unreachable' warning. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-11 06:29:07 -07:00
Tom Eastep	53f1cd40df	Add 'unmanaged' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-10 12:36:18 -07:00
Tom Eastep	c653d9ce83	Only issue one 'unreachable' warning per chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-08 10:02:19 -07:00
Tom Eastep	254d2037ef	Delete unused variable. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 15:34:25 -07:00
Tom Eastep	cb8e76b1d2	Add sub get_opttype to emphasize where rule option types are used. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 12:49:20 -07:00
Tom Eastep	2b579d2dff	Small efficiency change in helper processing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-04 12:48:22 -07:00
Tom Eastep	fc3e3dbf3c	Cosmetic change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-03 10:53:33 -07:00
Tom Eastep	81acedd1b3	Reword the 'unreachable' warning. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 17:13:41 -07:00
Tom Eastep	d8f53cc0a9	Merge branch '4.5.17' Conflicts: Shorewall/Perl/Shorewall/Chains.pm	2013-06-02 15:31:45 -07:00
Tom Eastep	481811d29f	Merge NFACCT and EXPENSIVE matches during optimization Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 13:29:13 -07:00
Tom Eastep	3867902b27	Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-02 07:31:32 -07:00
Tom Eastep	adf51d0059	Revise the unreachable warning stuff. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 16:32:46 -07:00
Tom Eastep	7dbd50708b	Clear the current filename after last file is processed. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:35 -07:00
Tom Eastep	4340bcffb1	Don't optimize away a rule that includes nfacct matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:25 -07:00
Tom Eastep	4a05e56d6d	Disable warning on unreachable rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:05:16 -07:00
Tom Eastep	2d8078033c	Clear the current filename after last file is processed. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:03:10 -07:00
Tom Eastep	c5f2eeea80	Don't optimize away a rule that includes nfacct matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:02:39 -07:00
Tom Eastep	5343243f6b	Disable warning on unreachable rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-06-01 13:01:55 -07:00
Tom Eastep	4865899018	Avoid a forward jump for local zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-30 06:52:09 -07:00
Tom Eastep	9b68204865	Generate an 'unreachable rule(s)' warning. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-30 06:17:22 -07:00
Tom Eastep	a550dd3eed	Issue a warning when a rule is dropped do to terminated chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-29 21:01:07 -07:00
Tom Eastep	f0aa29222f	Correct minor IPv6 TPROXY bug Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-29 07:18:46 -07:00
Tom Eastep	eaf1d0e5c2	Another error check for hosts files and loopback zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 10:00:07 -07:00
Tom Eastep	446f764d19	Allow config with only local and firewall zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 08:03:44 -07:00
Tom Eastep	9b0b3d4b70	Correct ICMPV6 type name translation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 08:03:19 -07:00
Tom Eastep	a48a4b7a2e	Don't allow fowarding between local zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-28 06:14:44 -07:00
Tom Eastep	8743b64e00	Export 'shorewall' from the Config module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-27 06:52:45 -07:00
Tom Eastep	2de0fbf7d0	Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 14:06:51 -07:00
Tom Eastep	f89c704d01	Disallow 'virtual' physical interfaces. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 08:47:44 -07:00
Tom Eastep	0b5a316cfc	Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-26 08:03:54 -07:00
Tom Eastep	31f9ea5b93	Add progess and warning messages to 'update -D' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 16:31:55 -07:00
Tom Eastep	dde1f0a779	Only enable helpers during a 'clear' operation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 16:31:27 -07:00
Tom Eastep	60d0a50d9d	Add some warning/progress messages to help understand 'update -D' behavior. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-25 13:20:12 -07:00
Tom Eastep	064f9f974c	Cosmetic change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-23 09:49:25 -07:00
Tom Eastep	fd11eb7d82	Omit fw->fw jumps when there is a local zone. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 09:19:34 -07:00
Tom Eastep	9e77bb5499	Ensure correct match ordering with trivial exclusion Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 08:46:22 -07:00
Tom Eastep	8df8fe990a	Allow 'local' zone to work with 'destonly' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-22 07:34:04 -07:00
Tom Eastep	ac02c484f5	Change 'local' interface option to a zone type. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-19 15:35:20 -07:00
Tom Eastep	5ec72dad6c	Add routes for standard tables when there are no providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 15:32:05 -07:00
Tom Eastep	f6a55bbf05	Allow the '-V' option in the CLI programs. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 14:29:36 -07:00
Tom Eastep	739f3779f5	Generate warnings for local->non-firewall and non-firewall->local rules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-16 07:51:12 -07:00
Tom Eastep	2e293dd356	Make 'local,destonly' work correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 14:36:51 -07:00
Tom Eastep	a5412cff38	Issue a warning when a rule will be optimized away due to 'destonly'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 09:30:59 -07:00
Tom Eastep	46a6a7b258	Correct earlier optimization. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-14 07:27:57 -07:00
Tom Eastep	105d1db85d	Cosmetic change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 11:24:09 -07:00
Tom Eastep	200d347ac8	Small Efficiency Change Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 10:52:04 -07:00
Tom Eastep	c8133145e6	Add support for "all+" in the policy file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-13 09:01:12 -07:00
Tom Eastep	9178ecbab0	Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 10:38:44 -07:00
Tom Eastep	d06a7b55b6	Add a 'destonly' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 10:37:40 -07:00
Tom Eastep	2fb01bec8d	Don't assume 'destonly' with 'local'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:58:37 -07:00
Tom Eastep	6551d67b2e	Call delete_chain_and_references recursively. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:29:29 -07:00
Tom Eastep	4b76d8c462	Handle optimize level 0 in the IPV6 nat table. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:28:25 -07:00
Tom Eastep	1bb5b89ee1	Add the 'local' interface option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-12 09:27:12 -07:00
Tom Eastep	c3901f1161	Release mutex on error. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-09 09:57:09 -07:00
Tom Eastep	56318e6cc8	Try to ensure that cp doesn't copy the firewall script to itself. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-06 09:22:16 -07:00
Tom Eastep	13c90e2aef	Correct my update to Mr-4's bup patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 18:40:14 -07:00
Tom Eastep	fdfdb49951	Apply Mr-4's priority->perf patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 14:05:03 -07:00
Tom Eastep	61cb105c02	Apply Mr-4's noautosrc patch (modified) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 14:00:25 -07:00
Tom Eastep	4621dccd53	Apply Mr-4's special route handling in COPY (modified). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-04 13:27:34 -07:00
Tom Eastep	b83ca4812b	Include trailing space in a regular expression. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-03 08:36:38 -07:00
Tom Eastep	80efd095a8	Correct handling of INLINE without '-j' in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 14:52:48 -07:00
Tom Eastep	d6961c4c3b	Clean up the temporary chains sooner. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 14:48:27 -07:00
Tom Eastep	54f5aaca63	Fix handling of CT_TARGET Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-05-01 11:15:36 -07:00
Tom Eastep	1012251957	Apply Mr-4's 4a patch (modified) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-27 07:04:40 -07:00
Tom Eastep	20d38e8b52	Centralize the validation of nfacct object names. - Also correct a missing ' ' from the output generated by INLINE freeform input. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-26 09:09:08 -07:00
Tom Eastep	52f5ae15d1	Apply Mr-4's cosmetic patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-25 17:29:41 -07:00
Tom Eastep	7e830e5df4	Allow special characters in nfacct names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-25 10:07:49 -07:00
Tom Eastep	f543c3bd1e	Finish Mr-4's NFACCT patch - Correct indentation - Remove '$type' argument to split_nfacct_list - Update manpages. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-23 06:55:30 -07:00
Dash Four	68c7782e7d	Shorewall 4.5.16 Beta 6 Tom Eastep wrote: > On 4/22/13 5:07 PM, "Dash Four" <mr.dash.four@googlemail.com> wrote: > > >> Anyway, I've just implemented individual "!" in the NFACCT statement by >> hacking your Accounting.pm - I can attach a small patch for >> review/inclusion if you are interested, but be aware that it does change >> the syntax slightly in a sense that "!" needs to be specified for each >> object within NFACCT() - "NFACCT(...)!" is no longer allowed. >> > > Sure -- send it along. > Attached - the above caveat applies though. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 21:17:59 -07:00
Tom Eastep	4faf3728f2	Implement INLINE in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 19:00:29 -07:00
Tom Eastep	ad70240347	Remove a blank line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 09:36:25 -07:00
Tom Eastep	739013f248	Handle nfacct object lists in parens following an ipset name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-22 07:56:56 -07:00
Tom Eastep	6d57e7a0ce	Mark a rule as complex if an option value is a reference. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-21 14:44:30 -07:00
Tom Eastep	5ad69aa650	Add CHAIN_SCRIPTS option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-21 07:30:31 -07:00
Tom Eastep	1b9fd642bb	Add INLINE to the accounting file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-20 08:02:02 -07:00
Tom Eastep	7c8f1ae020	Correct HELPERS handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 16:35:19 -07:00
Tom Eastep	1fd62e1612	Restore order in the NFACCT target. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 11:11:37 -07:00
Tom Eastep	6c2679ce75	Allow incrementing an nfacct object when an ipset matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 10:44:57 -07:00
Tom Eastep	610bdf1aac	Correct merge_rules() for LAST matches. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-19 08:40:01 -07:00
Tom Eastep	cbdca08fea	Fix for multiple nfacct patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 16:37:54 -07:00
Tom Eastep	b87b4b61d8	Allow multiple nfacct matches in one accounting rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 16:14:57 -07:00
Tom Eastep	9c010691a3	Always place 'nfacct' last Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 15:26:34 -07:00
Tom Eastep	8ef11a376b	Document 'HELPERS=none'. - Also make 'check -u' work correctly regarding HELPERS= Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 11:30:47 -07:00
Tom Eastep	4d686e873b	Implement 'HELPERS=none' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-18 10:30:56 -07:00
Tom Eastep	f55e34dd8b	Don't allow options on targets that don't accept them. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 17:18:01 -07:00
Tom Eastep	668bd4a1a4	Accept complex log levels with INLINE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 16:59:14 -07:00
Tom Eastep	5d5f168f25	Don't clone rule unconditionally in format_rule() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 13:35:32 -07:00
Tom Eastep	938bd72844	Better handling of the matches rule member. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 10:39:32 -07:00
Tom Eastep	8b91575c9e	Maintain order when multiple instances of a match are separated. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-17 06:52:32 -07:00
Tom Eastep	0da38cc38e	Order matches in rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-12 11:37:29 -07:00
Tom Eastep	6950cd2576	Allow '-' in a match name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 18:30:02 -07:00
Tom Eastep	ff4fb21044	Require that the '-j' part of a free-form rule be known. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 18:29:45 -07:00
Tom Eastep	614c5e6155	Assume LOG if a level is specified with INLINE. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 14:16:34 -07:00
Tom Eastep	35b0b4a4f9	Support A_ACCEPT! Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 13:37:49 -07:00
Tom Eastep	c34cf333ba	Allow both {...} and ';' with INLINE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 12:57:59 -07:00
Tom Eastep	b33bdeaa02	Allow a parameter to INLINE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 11:54:58 -07:00
Tom Eastep	38f3ae0934	Handle 'NONE' policy correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 09:35:27 -07:00
Tom Eastep	beec4a188f	Implement INLINE action (again). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 09:15:59 -07:00
Tom Eastep	f85d548d40	Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-11 06:23:22 -07:00
Tom Eastep	ee2e85c0fb	Correct generation of the blacklog chain when disposition is audited Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-10 16:43:38 -07:00
Tom Eastep	186f71fa96	Add NEW_TOS_MATCH capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 14:04:16 -07:00
Tom Eastep	477e2bc455	Additional corrections to INLINE action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 09:41:43 -07:00
Tom Eastep	273f109daf	Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-09 09:37:12 -07:00
Tom Eastep	50494f667c	Implement INLINE action Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-08 17:30:00 -07:00
Tom Eastep	183a0a75a1	Implement 'builtin' actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-08 16:14:26 -07:00
Tom Eastep	9e10c38e26	Don't emit 'quantum' calculation unless the qdisc is 'htb' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-03 08:39:18 -07:00
Tom Eastep	ee66a45e2e	Correct comments in the Chains module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-02 12:52:10 -07:00
Tom Eastep	c200efa6d7	Revert "Disable script generation while processing TC" This reverts commit `5b18ff91ca`.	2013-04-01 15:23:16 -07:00
Tom Eastep	5b18ff91ca	Disable script generation while processing TC Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-04-01 09:05:12 -07:00
Tom Eastep	ef5818ce7e	Merge branch '4.5.15'	2013-03-31 07:08:49 -07:00
Tom Eastep	58ef8e0ec3	Correct bounds check in do_dscp() - "< 0x2f" s/b "< 0x3f" Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-31 07:07:21 -07:00
Tom Eastep	8a84c1c371	Avoid 'echo' failure during 'enable'. - in the case where the kernel doesn't know about /proc/sys/net/ipv6/conf/x/accept_ra Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-31 07:02:11 -07:00
Tom Eastep	1db5741edd	Merge branch '4.5.15' Conflicts: Shorewall/Perl/Shorewall/Proc.pm	2013-03-30 18:08:17 -07:00
Tom Eastep	1139e1a09c	Establish /proc/sys/net/ipv6/conf/X/forwarding during 'enable' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 17:26:50 -07:00
Tom Eastep	d415de1883	Add the accept_ra Shorewall6 interface option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 16:44:18 -07:00
Tom Eastep	448d957e48	Fix use of names for DSCP. - From Thibaut Chèze Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-30 07:20:10 -07:00
Tom Eastep	8fe7963631	Revert another replace->add change. - Also includes a cosmetic change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-27 06:57:49 -07:00
Tom Eastep	6334b09653	Add a comment about why the 'id' member of builtin tables is initialized in process_providers() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 14:30:42 -07:00
Tom Eastep	e572d6ce50	Use the 'id' member in copy_and_edit_table(). - Also add prohibit and unreachable to the existing blackhole case. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:38:13 -07:00
Tom Eastep	792a19bf4b	Initialize the 'id' member of reserved tables after .conf has been read. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:36:57 -07:00
Tom Eastep	61e21de41b	Revert bad hunk from last change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-26 07:00:16 -07:00
Tom Eastep	43932f2bbd	Cleanup of table id/number and 'route replace' erradication Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-25 07:35:30 -07:00
Tom Eastep	6e5f00062c	Revert "Use 'replace' rather than 'add' for routes defined in the routes file." This reverts commit `215fd9e234`. Conflicts: Shorewall/Perl/Shorewall/Providers.pm	2013-03-24 14:19:31 -07:00
Tom Eastep	b5ea4067e4	Implement USE_RT_NAMES Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-24 10:56:38 -07:00
Tom Eastep	0c30e7c013	Uniform handling of VLSM width. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-23 09:19:26 -07:00
Tom Eastep	536fea27a5	Detect duplicate routes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 14:59:35 -07:00
Tom Eastep	215fd9e234	Use 'replace' rather than 'add' for routes defined in the routes file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 14:55:27 -07:00
Tom Eastep	4c0a0e0ff8	Don't emit 'qt ' in the undo_x_routing files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-22 13:20:27 -07:00
Tom Eastep	9e5cf92a59	Merge branch '4.5.14'	2013-03-21 12:00:20 -07:00
Tom Eastep	3ac6835650	Handle IPv6 /32 networks correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-21 11:30:59 -07:00
Tom Eastep	1e866eac28	Implement the other forms of NULL routing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-16 08:20:52 -07:00
Tom Eastep	b10218e773	Add a 'UDPLITE Port Redirection' capability. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 10:07:52 -07:00
Tom Eastep	8442477224	Add Enhanced Multi-port match capability Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 09:04:47 -07:00
Tom Eastep	fd2fcc996f	Don't allow port redirection with UDPLITE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-10 08:32:45 -07:00
Tom Eastep	8c4c856caa	Issue a warning if the contents of the DUPLICATE column may be invalid. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-09 07:57:13 -08:00
Tom Eastep	a167e3449e	Avoid Perl run-time errors when checking a provider interface. - Handle case where a provider interface matches a wildcard Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-09 07:56:16 -08:00
Tom Eastep	b871fc689c	Merge branch 'FETCH_HEAD' into 4.5.14	2013-03-09 07:11:47 -08:00
Tom Eastep	cfe2bd11b0	Allow 'none' in the COPY column when the DUPLICATE column is empty. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 19:18:13 -08:00
Tom Eastep	bd64baa8d9	Require at least one zone for a provider Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 13:08:23 -08:00
Tom Eastep	e1f7a9dbf8	Reverse an earlier silly patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 10:38:13 -08:00
Tom Eastep	4586568649	Merge branch '4.5.14' of ssh://git.code.sf.net/p/shorewall/code	2013-03-08 08:00:43 -08:00
Tom Eastep	b4d4083513	Split large '--ports' lists across multiple rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 07:38:23 -08:00
Tom Eastep	91f5a9dec0	Make 'main' work correctly when specified in the routes file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-08 07:26:49 -08:00
Tom Eastep	50030bcc2d	Revert "Don't allow routes to be added to non-Provider tables." This reverts commit `6f9a1ba29d`.	2013-03-08 06:55:12 -08:00
Tom Eastep	8eacbe287b	Correction to MULTIPORT patch Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 18:11:59 -08:00
Tom Eastep	6f9a1ba29d	Don't allow routes to be added to non-Provider tables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 17:18:57 -08:00
Tom Eastep	6ba02c4a24	Merge branch 'master' into 4.5.14 Conflicts: Shorewall/Perl/Shorewall/Providers.pm	2013-03-07 08:29:30 -08:00
Tom Eastep	c4f0be96ac	Require that interfaces in the COPY column be known. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:32:56 -08:00
Tom Eastep	7da10ff923	Additional change to copy blackhole routes. - Add 'blackhole' to the outer case statement - Add RFC1918 blackhole routes before starting providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:58 -08:00
Tom Eastep	ace9a49106	Allow addition of blackhole routes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:41 -08:00
Tom Eastep	7f2c933cb3	Copy blackhole routes to secondary tables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 07:01:18 -08:00
Tom Eastep	5aa731e963	Additional change to copy blackhole routes. - Add 'blackhole' to the outer case statement - Add RFC1918 blackhole routes before starting providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-07 06:52:16 -08:00
Tom Eastep	06e7f297f7	Allow addition of blackhole routes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 11:48:09 -08:00
Tom Eastep	216029c3a9	Copy blackhole routes to secondary tables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 11:04:23 -08:00
Tom Eastep	e12bc47546	Remove duplicate interface names in generated case statement. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 08:28:12 -08:00
Tom Eastep	384c179dd6	Avoid duplicate echo command in generated script. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 08:28:03 -08:00
Tom Eastep	32b2030e59	Remove duplicate interface names in generated case statement. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 07:03:41 -08:00
Tom Eastep	0bb62ed290	Avoid duplicate echo command in generated script. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-06 06:12:43 -08:00
Tom Eastep	49918b654e	Support '=' in SOURCE PORT(S) columns Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-04 09:56:10 -08:00
Tom Eastep	0857eb27d5	Another case of detecting invalid server IP address. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-02 09:08:13 -08:00
Tom Eastep	69f6149d4c	Detect missing, NIL or ALL server IP address in a DNAT rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-02 09:00:08 -08:00
Tom Eastep	5ca3b795fc	Correct IPv6 REDIRECT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 16:44:49 -08:00
Tom Eastep	9499a47a0d	Revert "Use '--to-dest' for IPv6 rather than '--to-destination'" This reverts commit `c9d8c22b60`.	2013-03-01 10:44:40 -08:00
Tom Eastep	c9d8c22b60	Use '--to-dest' for IPv6 rather than '--to-destination' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 09:03:22 -08:00
Tom Eastep	8960f72532	Handle DNAT with no port correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-03-01 07:58:58 -08:00
Tom Eastep	ee091d09eb	Allow ports with UDPLITE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-28 06:27:51 -08:00
Tom Eastep	22c614d30b	Don't allow :persistent in a MASQUERADE rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-27 12:48:27 -08:00
Tom Eastep	418034579f	Support IPv6 Masquerade Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-27 09:25:26 -08:00
Tom Eastep	78babf0941	Fixes for IPv6 DNAT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-26 10:24:25 -08:00
Tom Eastep	45d53bdb1d	Delete superfluous statement. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:50:33 -08:00
Tom Eastep	fb17de0595	Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code	2013-02-25 17:29:49 -08:00
Tom Eastep	6ed1caedd0	Validate IPv4 port range in ADDRESSES column Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:29:33 -08:00
Tom Eastep	1d4f189b5f	Don't allow interior brackets in an address range. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 17:26:17 -08:00
Tom Eastep	7006c62892	Correct port pair handling in the snat ADDRESS column. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 15:31:36 -08:00
Tom Eastep	6b825abeb4	Catch ::<port-range> in /etc/shorewall6/snat Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 13:41:43 -08:00
Tom Eastep	f2ee46b83e	Correct IPv6 address range parsing in handle_one_masq1 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 13:37:22 -08:00
Tom Eastep	e873cb28f4	Correctly handle a port number/range with an address variable - ADDRESSES column of the masq/snat files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 08:00:15 -08:00
Tom Eastep	de1a5a8024	Handle SNAT 'ADDRESS' without enclosing [...] Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-25 06:42:19 -08:00
Tom Eastep	34c6013f1b	Handle missing provider in a masq/snat entry. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-24 08:12:02 -08:00
Tom Eastep	82f9ba8bb7	Correct detection of IPv6 PERSISTENT_SNAT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 12:59:38 -08:00
Tom Eastep	6035d49ede	Correct NAT capability required error message. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 11:57:32 -08:00
Tom Eastep	67ef1f8b93	Correct detection of IPv6 NAT_ENABLED. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-23 11:57:07 -08:00
Tom Eastep	0349a9a88c	Rename the IPv6 masq file 'snat'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 13:05:24 -08:00
Tom Eastep	2591a17946	Cosmetic change to the output with the '-r' option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 11:59:57 -08:00
Tom Eastep	b562f7f311	Allow specification of destination addresses in Shorewall6 masq. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 08:34:03 -08:00
Tom Eastep	ce28c70c60	SNAT and DNAT support for IPv6. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-19 07:08:08 -08:00
Tom Eastep	d0b2d05d5b	Add optional argument to have_capability(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-18 15:15:26 -08:00
Tom Eastep	088fc1a3a3	Report used/required capabilities Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-18 08:48:18 -08:00
Tom Eastep	6d92d293b8	Use 'here documents' in the usage() function. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-17 07:44:10 -08:00
Tom Eastep	7859267539	Eliminate $globals{CONFDIR} Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-14 17:24:49 -08:00
Tom Eastep	c68513672d	Comments and documentation. - Removes the Actions-4.5 article Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-14 08:48:45 -08:00
Tom Eastep	93b3fd9be5	Correct IPv6 address checking (again) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 13:37:26 -08:00
Tom Eastep	138638cb1a	Effectively use the specified directory as the CONFIG_PATH til .conf is read Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 07:45:24 -08:00
Tom Eastep	c5bb16ac26	Another fix for IPv6 address lists. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-13 07:44:19 -08:00
Tom Eastep	f44becdee1	Rename BLACKLIST_LOGLEVEL to BLACKLIST_LOG_LEVEL for consistent naming. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-12 07:47:02 -08:00
Tom Eastep	84c5822c20	Correct IPv6 List Handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-11 16:45:03 -08:00
Tom Eastep	b4977db5b2	Add %section_states that maps sections to their related state(s). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-11 14:59:48 -08:00
Tom Eastep	8d0a80a7e2	Merge branch '4.5.13'	2013-02-11 06:40:11 -08:00
Tom Eastep	b9d5b92f1b	Correct handling of expressions consisting of a single number. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 15:19:30 -08:00
Tom Eastep	b349cc0f22	A better fix for inline default action with parameters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:29:30 -08:00
Tom Eastep	a312bfbb42	Add a section => name function map Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:27:43 -08:00
Tom Eastep	c35e753b1d	A better fix for inline default action with parameters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:16:18 -08:00
Tom Eastep	8b4349b356	Merge branch '4.5.13'	2013-02-10 09:05:41 -08:00
Tom Eastep	54c43396f0	Correct default action handling: - isolate basic target before testing for action/inline - delete the action chain if appropriate. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 09:00:13 -08:00
Tom Eastep	f9dc89dc61	Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 07:56:04 -08:00
Tom Eastep	60e3f1015e	Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-10 07:51:35 -08:00
Tom Eastep	8e0a90e077	Merge branch '4.5.13'	2013-02-09 17:54:06 -08:00
Tom Eastep	cadf2747fe	Correct reset_optflags() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 17:53:40 -08:00
Tom Eastep	810ebe32ce	Merge branch '4.5.13'	2013-02-09 13:15:44 -08:00
Tom Eastep	c04c61b314	Correct typos in check_rules(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 11:42:54 -08:00
Tom Eastep	a8fdfa4e48	Create an ESTABLISHED chain Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 09:32:12 -08:00
Tom Eastep	a4297381e9	Don't ACCEPT untracked packets unless UNTRACKED_DISPOSITION=ACCEPT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 09:15:05 -08:00
Tom Eastep	eaa6d72a4f	Allow parameters to be omitted in action invocations. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-09 07:07:01 -08:00
Tom Eastep	62a567b550	Treat each -m conntrack subtype as a separate match Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-08 10:08:23 -08:00
Tom Eastep	e4f1c62e71	Improve handling of nested state actions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-08 09:09:20 -08:00
Tom Eastep	b9e504683e	Prevent a state action from invoking another one. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-07 16:52:06 -08:00
Tom Eastep	aae6e001fe	Convert dropInvalid and allowInvalid to inline actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-07 11:21:13 -08:00
Tom Eastep	aa528dd075	Revert "Convert allowInvalid and dropInvalid into macros" This reverts commit `272e1d330c`.	2013-02-07 09:09:56 -08:00
Tom Eastep	e4ae242123	Another tweak to check_state() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 12:07:51 -08:00
Tom Eastep	272e1d330c	Convert allowInvalid and dropInvalid into macros Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 09:54:12 -08:00
Tom Eastep	a66256b25b	Additional refinements of check_state() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-06 08:16:42 -08:00
Tom Eastep	11b976fb36	Correct reference type in check_state() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-05 19:55:22 -08:00
Tom Eastep	a6ccd53fe0	Unconditionally use '-j' to branch to a state chain or DISPOSITION. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:17:49 -08:00
Tom Eastep	b22b63b1c3	Don't use '-g' when DISPOSITION is CONTINUE. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:09:17 -08:00
Tom Eastep	615df6ab8f	Handle 'RETURN' in state chain with terminating disposition. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 15:08:20 -08:00
Tom Eastep	d8214885f2	Assume that the conntrack state value in a rule is not a reference. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-04 08:29:50 -08:00
Tom Eastep	475942deb9	Normalize rules prior to combine_state tests. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 18:14:14 -08:00
Tom Eastep	f1707d2ace	More state rule check fixes. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 18:02:02 -08:00
Tom Eastep	30d96afb69	Push/pop $actionresult. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 12:43:28 -08:00
Tom Eastep	014b4ddc50	Combine adjacent rules differing only in conntrack state match. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 09:03:22 -08:00
Tom Eastep	5b9d1a6159	Handle UNTRACKED_DISPOSITION=ACCEPT correctly. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-03 07:59:47 -08:00
Tom Eastep	752463bfab	Fix TCPFlags Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 22:19:13 -08:00
Tom Eastep	ebef29e161	Handle port numbers being passed to one of the tcp-specific actions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 12:48:54 -08:00
Tom Eastep	9b30f48ba0	Correct handling of actions when @chain is altered. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 10:57:08 -08:00
Tom Eastep	8249831e6d	Detect some state conflicts Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 09:32:57 -08:00
Tom Eastep	cc1054be66	Correct handling of audited dispositions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-02 09:30:25 -08:00
Tom Eastep	c68d4c6e27	Simplify Perl from actions even further. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 15:55:39 -08:00
Tom Eastep	752e960f2f	Allow specification of the action type via perl_action_helper(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 12:59:48 -08:00
Tom Eastep	a5d3b1f470	Remove requirement that matches and proto end with a space in perl helper API. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-02-01 12:29:30 -08:00
Tom Eastep	abca3a2024	Improve maintainability of @colums vis a vis @rulecolumns. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 10:47:40 -08:00
Tom Eastep	755d605578	Make %statetable global Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:26:47 -08:00
Tom Eastep	78db4abef5	Remove some redundant local variables from finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:02:23 -08:00
Tom Eastep	fc73c3934b	Replace BLACKLISTNEWONLY with BLACKLIST Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-30 08:00:47 -08:00
Tom Eastep	75fb164234	Don't issue fatal error if a proto other than tcp is passed to a tcp-only inline Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 10:31:20 -08:00
Tom Eastep	27c5e67632	Rename process_rule to process_raw_rule and process_rule1 to process_rule Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 10:13:48 -08:00
Tom Eastep	61d8f704f9	Correct rule-generation detection in perl_action_helper Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 09:43:12 -08:00
Tom Eastep	f33e36b61e	Raise an error if a protocol other than TCP is passed to a TCP-only inline Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 07:46:50 -08:00
Tom Eastep	670931c987	Initialize the columns array to '-'s. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-29 07:46:07 -08:00
Tom Eastep	316b67473e	Merge branch 'master' into 4.5.13 Conflicts: Shorewall/Perl/Shorewall/Rules.pm Shorewall/action.Established Shorewall/actions.std	2013-01-29 07:30:52 -08:00
Tom Eastep	42f46ea5e7	Accurately determine if an inline action generates a rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 20:46:20 -08:00
Tom Eastep	49166efdca	Make the TCP standard actions inline Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 18:01:08 -08:00
Tom Eastep	5a2c1792cb	Inline the conntrack state actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 16:55:54 -08:00
Tom Eastep	a70c441458	Add CONTINUE as a possible setting for RELATED_DISPOSITION. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 11:47:45 -08:00
Tom Eastep	519861d7b2	Add CONTINUE as a possible setting for RELATED_DISPOSITION. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:58:03 -08:00
Tom Eastep	2e8eeff416	Correct error messages that include the section name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:52 -08:00
Tom Eastep	2217f89902	Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:45 -08:00
Tom Eastep	5c63444c14	Correct error messages that include the section name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:41:09 -08:00
Tom Eastep	cfa5d86f5c	Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-28 07:40:26 -08:00
Tom Eastep	b3b074fb61	More infrastructure Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 15:37:23 -08:00
Tom Eastep	cbbcfe355e	Infrastructure for more powerful action handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 12:37:10 -08:00
Tom Eastep	2a2e23cb17	Merge branch '4.5.13'	2013-01-27 11:26:59 -08:00
Tom Eastep	1b94c3651d	Always handle ESTABLISHED before the other connection states. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:56:41 -08:00
Tom Eastep	b1b2aa910e	Correct section handling: - Correct typo (' INVALID' -> 'INVALID' ) - Don't jump to non-existent target in finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:14:27 -08:00
Tom Eastep	aa609b87a9	Allow arbitrary actions for the various states. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:10:24 -08:00
Tom Eastep	a3a90d8d2e	Correct section handling: - Correct typo (' INVALID' -> 'INVALID' ) - Don't jump to non-existent target in finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 10:08:02 -08:00
Tom Eastep	6c8761c7dd	Add a "matches" argument to process_rule1 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:21:30 -08:00
Tom Eastep	9194165e89	Handle explicit CONTINUE value for UNTRACKED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:17:09 -08:00
Tom Eastep	6306103991	Clean up fix for optimize 8 performance issue Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:13:27 -08:00
Tom Eastep	749773f89a	Handle explicit CONTINUE value for UNTRACKED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 08:12:49 -08:00
Tom Eastep	5db317b6f7	Clean up fix for optimize 8 performance issue Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-27 07:55:55 -08:00
Tom Eastep	380d427a5d	Dramatically reduce the CPU cost of optimize 8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 17:46:31 -08:00
Tom Eastep	6ce392b08e	Correct handling of handle_first_entry() to avoid runaway recursion. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 12:18:17 -08:00
Tom Eastep	5fa01728ad	Pass UNTRACKED packets through the blacklist chain when BLACKLISTNEWONLY=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 09:18:20 -08:00
Tom Eastep	7bc66da663	Call handle_first_entry in the warning/error-message generators. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-26 07:30:50 -08:00
Tom Eastep	b8cc9c5a6a	Drop chain-ending rules whose target is 'RETURN'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-25 14:03:04 -08:00
Tom Eastep	b7273d6999	Favor low-numbered less complex synonym chains in optimization 8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-25 13:55:04 -08:00
Tom Eastep	e12b919dc1	Prefer shorter action chain names in optimize level 8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 17:25:11 -08:00
Tom Eastep	18c0956374	Fix two bugs in the UNTRACKED section implementation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 16:41:18 -08:00
Tom Eastep	6403f4959d	Implement UNTRACKED SECTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 15:42:01 -08:00
Tom Eastep	0ca93c1ac9	Unify handling of the RELATED and INVALID sections within finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 14:38:02 -08:00
Tom Eastep	a40c74ddec	Eliminate forward declaration of finish_chain_section() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 09:04:50 -08:00
Tom Eastep	c2bc74cdfe	Add INVALID section to the rules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-24 08:33:59 -08:00
Tom Eastep	7fe2027229	Eliminate superfluous ESTABLISHED,RELATED rule Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 16:17:19 -08:00
Tom Eastep	8fe36422b5	Delete stale comment Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 10:44:12 -08:00
Tom Eastep	f61f5a8183	Don't copy a chain that has a single RETURN rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-22 09:07:07 -08:00
Tom Eastep	4ed5c5fdfe	Sort the chain list in optimize_level8. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 16:00:32 -08:00
Tom Eastep	25d6164f21	Try to avoid ~combN chains when dealing with action chains. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 11:51:33 -08:00
Tom Eastep	32c475193f	Another fix for RELATED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 11:50:46 -08:00
Tom Eastep	982fabc96f	Delete $caller argument from process_default_action() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:45:54 -08:00
Tom Eastep	5beae475f5	Make optimize 8 a multi-pass operation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:12:42 -08:00
Tom Eastep	c820c54f41	Correctly handle audited RELATED_DISPOSITION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 09:03:27 -08:00
Tom Eastep	4a354ba5a2	Avoid internal error during standard chain completion Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 08:02:50 -08:00
Tom Eastep	e23876b582	Rename '$inline' to '$action' in policy_rules() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-21 07:36:50 -08:00
Tom Eastep	64e76599e0	Correct handling of default actions that set Shorewall variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 16:15:04 -08:00
Tom Eastep	c4a2f3d386	Set caller when possible in policy chains. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 14:51:16 -08:00
Tom Eastep	bc882af6c5	Allow RESET of Shorewall variables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 07:32:34 -08:00
Tom Eastep	d31221b03c	Fix variable assignment. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-20 07:26:10 -08:00
Tom Eastep	f403420926	Allow setting chain variables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-19 10:52:11 -08:00
Tom Eastep	b31c76cc50	Proper job of fixing DEFER_DNS_RESOLUTION=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 17:18:29 -08:00
Tom Eastep	1307770178	Allow setting action parameters Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 15:05:14 -08:00
Tom Eastep	95aab78c0d	Add infrastructure to delete the %usedactions entry for an action chain if the chain parameters are modified. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 14:54:57 -08:00
Tom Eastep	4587430e4a	Move get_action_logging() to the Config Module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 13:06:55 -08:00
Tom Eastep	8ccd1ab52b	Handle exclusion correctly when DEFER_DNS_RESOLUTION=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-18 12:09:54 -08:00
Tom Eastep	89a09f0256	Implement DEFER_DNS_RESOLUTION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 17:00:14 -08:00
Tom Eastep	54dbbaaa2d	Don't resolve DNS names at compile time. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 10:34:31 -08:00
Tom Eastep	90bd19feb9	Convert DNS names into ip addresses in validate_net(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-13 07:39:27 -08:00
Tom Eastep	853b9ce916	Enable DNS names without an interface name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-12 14:38:26 -08:00
Tom Eastep	c61d51363d	Correct generation of rules in the ESTABLISHED section of the rules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-12 06:49:32 -08:00
Tom Eastep	af83989465	Update copyright dates. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 16:01:10 -08:00
Tom Eastep	b53fd39b49	Avoid a fatal Perl error in Config::cleanup when an fatal error occurs while compiling a default action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 15:50:23 -08:00
Tom Eastep	38097bef5d	Correct an optimizer bug. - delete_chain_and_references() was only deleting the downward references and not the upward ones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-11 14:55:43 -08:00
Tom Eastep	76a63fb7e8	Don't flush 'noarp' ARP entries = doing so kills the loopback interface Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-10 17:14:40 -08:00
Tom Eastep	15ca9edf8a	Allow delete_tc1() to work on devices which an @ suffix in their reported names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-09 14:09:07 -08:00
Tom Eastep	199bce925f	Don't add chains with RETURNs to %terminating. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-09 12:54:29 -08:00
Tom Eastep	1fd3a6a522	Detect terminating chains - no RETURN Rules - last rule is terminating Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 16:32:24 -08:00
Tom Eastep	011dd2c901	Add a RETURNS flag to optflags indicating that there is RETURN in the chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 15:25:53 -08:00
Tom Eastep	e54563d9c1	Don't append rules that can't be matched. Also, delete chains whose only rule is a -j RETURN Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 13:53:03 -08:00
Tom Eastep	f8c1b02dba	Correct test for optimization in 'check -r' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-08 09:51:32 -08:00
Tom Eastep	dece73f7b6	Another fix for *C actions in arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:59:24 -08:00
Tom Eastep	eb3b47ae24	Correctly handle *C actions in arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:29:41 -08:00
Tom Eastep	c157228f7d	Correct handling of unknown ACTION in arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 18:21:58 -08:00
Tom Eastep	a7af052d91	Correct issue with generating ESTABLISHED rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 16:07:24 -08:00
Tom Eastep	414a74d23c	Support protocol lists in most files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 16:06:54 -08:00
Tom Eastep	0526863e66	Make $section numeric Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 13:39:49 -08:00
Tom Eastep	5dbe2aa9ec	Optimize a test in finish_chain_section(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-07 07:00:15 -08:00
Tom Eastep	ca202ca10b	Flush the arp cache after applying the arprules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 17:46:40 -08:00
Tom Eastep	de4e0898b5	Catch protocol lists in contexts that don't allow them. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 17:23:14 -08:00
Tom Eastep	edc0a84e5d	Optimize RELATED rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 16:48:37 -08:00
Tom Eastep	d4c9885c09	Change interpretation of the log tag when LOGTAGONLY=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-06 13:10:18 -08:00
Tom Eastep	c41b9e596d	Don't add --cstate to dropInvalid rule. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 09:42:55 -08:00
Tom Eastep	9fd7933b5d	Make inline actions work in sections other than NEW. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 09:32:50 -08:00
Tom Eastep	f223e3584c	Make '+' optional in the ADD and DEL statements. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-06 07:37:11 -08:00
Tom Eastep	3f24416f37	Add a warning for opcode inversion when not arptables_jf. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-05 13:14:32 -08:00
Tom Eastep	38aa7f3857	Correct opcode inversion when not ARPTABLES_JF Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:26:46 -08:00
Tom Eastep	7f6430a383	Correct address inversion in match_arp_net() Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:20:51 -08:00
Tom Eastep	4fc0dba26d	Correct two-interface check in process_arprule. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-05 08:17:53 -08:00
Tom Eastep	0c7e10dbfa	Add a comment to the Zones file - define the {bridge} member.	2013-01-05 08:15:56 -08:00
Tom Eastep	97009bad79	Correct arptables_jf MAC handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 17:27:16 -08:00
Tom Eastep	af7b7195d2	Fix MAC handling in the ARP module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 15:55:52 -08:00
Tom Eastep	a732f6e538	Add some comments to the ARP module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2013-01-04 15:07:51 -08:00
Tom Eastep	38657d9f98	Support for arptables. Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-04 09:17:57 -08:00
Tom Eastep	90e0c8b717	Don't update mtime on shorewall.conf during update that doesn't change the file Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-02 15:03:07 -08:00
Tom Eastep	aca3ce3c21	Delete blank line Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2013-01-01 08:29:02 -08:00
Tom Eastep	34f8125416	Correct a couple of issues with update -D - shorewall.conf.bak is no longer unlinked - The mtime of all unaltered files is no longer updated	2012-12-31 12:43:02 -08:00
Tom Eastep	87715e5f0b	Correct Typo Signed-off-by: Tom Eastep <teastep@mint14.(none)>	2012-12-31 10:36:27 -08:00
Tom Eastep	5848d7cab7	Correct helper validation Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-30 13:20:56 -08:00
Tom Eastep	5dfc27355e	Correct a comment Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-29 11:34:12 -08:00
Tom Eastep	6d9cca1cff	fq_codel Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-29 10:58:11 -08:00
Tom Eastep	51deec115b	Correct handling of wildcard interfaces - chain_base[1] renamed var_base[1] - $chain replaced by $var in renamed functions - replace trailing '+' by '_plus' to provide uniqueness - add sub chain_base() to the Chains module as an identity mapper Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 10:39:19 -08:00
Tom Eastep	643f419264	Merge branch '4.5.11' Conflicts: Shorewall/Perl/Shorewall/Rules.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 09:02:33 -08:00
Tom Eastep	2009a66bb5	Avoid invalid function name for starting an optional interface Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-28 08:04:06 -08:00
Tom Eastep	ebe4267c49	Rename IGNOREOLDCAPVERSIONS to WARNOLDCAPVERSION Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-27 09:58:45 -08:00
Tom Eastep	8b92a59821	Ignore '-m comment' when detecting duplicate rules Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-27 09:51:33 -08:00
Tom Eastep	ef0102e9f1	Add the 'IGNOREOLDCAPS' option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 15:48:08 -08:00
Tom Eastep	14bbda14a2	Add some comments describing Config.pm globals - Also changed $shell from 'my' to 'our'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 10:55:13 -08:00
Tom Eastep	bfeea76cf2	Disallow ?FORMAT when $max_format == 1 Signed-off-by: Tom Eastep <teastep@shorewall.net> Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-26 07:37:23 -08:00
Tom Eastep	100e03cf93	Don't set $nocomment in in-line action Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-26 07:06:29 -08:00
Tom Eastep	84cc78c58e	Eliminate @comments Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-25 17:00:24 -08:00
Tom Eastep	3f28af80d2	Disallow ?FORMAT when $max_format == 1 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-25 08:10:48 -08:00
Tom Eastep	6126ae67e6	Don't apply AUTOCOMMENT or comment continuation to inline actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:50:26 -08:00
Tom Eastep	575020c851	More comment handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:35:42 -08:00
Tom Eastep	1c212e878f	Restore SECTION handling in Accounting File Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 13:33:44 -08:00
Tom Eastep	4393a6c603	Eliminate redundant calls to clear_comment. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 12:35:08 -08:00
Tom Eastep	fca5b75c5b	Merge branch '4.5.11'	2012-12-24 10:30:43 -08:00
Tom Eastep	c942a95d3c	Allow ?COMMENT in accounting. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 10:15:23 -08:00
Tom Eastep	89ea37e088	Correct nested comments. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 10:11:53 -08:00
Tom Eastep	14f8947012	Remove old COMMENT/FORMAT handling Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-24 09:31:20 -08:00
Tom Eastep	15817078b8	Use 'our' for globals to aid debugging. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 13:16:54 -08:00
Tom Eastep	0acd93a032	Ensure that action and macro files always allow comment directives. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 12:19:30 -08:00
Tom Eastep	4d2379f542	Implement update -D Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 10:50:31 -08:00
Tom Eastep	c9eccaf3b8	Implement ?COMMENT directive Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-23 10:49:32 -08:00
Tom Eastep	44a4f6d77d	Move COMMENT handling to the Config module. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 13:51:24 -08:00
Tom Eastep	e4e61c4193	A more uniform way of handling $max_format Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 11:57:25 -08:00
Tom Eastep	0cd0675c98	Always push $file_format and $max_format onto the include stack. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 08:15:46 -08:00
Tom Eastep	bc230c00a3	Optimizations in process_compiler_directive() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-22 08:14:46 -08:00
Tom Eastep	10108b2d6a	Convert file processors to use ?FORMAT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:49:28 -08:00
Tom Eastep	35aeaf340f	Implement ?FORMAT directive Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:31:42 -08:00
Tom Eastep	0eb041d2d1	Correct ?SET error message Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:23:26 -08:00
Tom Eastep	a5debe793f	Add $file_format exported variable and handle in the include stack. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-21 15:14:23 -08:00
Tom Eastep	df7785f2e9	Implement user-defined address variables. - Also correct handling of ${0} & ${chain} in a SWITCH column. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-18 17:58:20 -08:00
Tom Eastep	2869a9a94d	Rename add_quotes to join_parts Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-15 16:12:03 -08:00
Tom Eastep	b6e699ca5c	Factor some common code into a function. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-13 06:46:57 -08:00
Tom Eastep	743478614b	Make @0 work correctly again. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 13:13:17 -08:00
Tom Eastep	5944b4fc7b	Make @chain (@{chain}) a synonym for @0 (@{0}) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:55:04 -08:00
Tom Eastep	8a0abab4cc	Rename 'ALLOWUNKNOWNVARIABLES' to 'IGNOREUNKNOWNVARIABLES' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:51:31 -08:00
Tom Eastep	5da7db3d5f	Implement @-variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-12 11:46:38 -08:00
Tom Eastep	14cdaf21fc	Handle nested params in push_action_params() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-09 10:45:29 -08:00
Tom Eastep	88d4814209	Merge branch '4.5.10' Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-08 20:54:33 -08:00
Tom Eastep	6ab5cfd63a	Use split_list2 in isolate_basic_target() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-06 19:12:44 -08:00
Tom Eastep	7190cd1265	Handle nested parens when pushing action parameters. - Add an optional argument to split_list1 that causes parens to be retained. Signed-off-by: Tom Eastep <teastep@shorewall.net> Conflicts: Shorewall/Perl/Shorewall/Config.pm	2012-12-06 15:20:10 -08:00
Tom Eastep	5f48e4e531	Handle nested parens when pushing action parameters. - Add an optional argument to split_list1 that causes parens to be retained. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-06 15:13:14 -08:00
Tom Eastep	fdadb57e82	Minor readability improvement Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 19:41:18 -08:00
Tom Eastep	8139f2ad91	Rename process_conditional() to process_compiler_directive() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 14:53:03 -08:00
Tom Eastep	189cd59650	Improve expression evaluation - Only quote values when there is not an odd number of preceding quotes - Make address family test return a numeric value - Unconditionally trace the generated expression if debugging is set. - Convert an empty expression into '' rather than generate an error. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 08:37:50 -08:00
Tom Eastep	4ec47783f1	Detect missing target in merge_levels() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:52:07 -08:00
Tom Eastep	2875fbb521	Cosmetic change (add a blank line). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:51:41 -08:00
Tom Eastep	25c53f5a60	Detect missing target in merge_levels() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-05 07:51:21 -08:00
Tom Eastep	c61c9ba7eb	Make expression evaluation more deterministic. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 18:10:19 -08:00
Tom Eastep	2fbbc70e83	Only do SET and RESET when we aren't omitting. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 16:27:18 -08:00
Tom Eastep	c18996b6f5	Implement ?set and ?reset directives Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 14:28:03 -08:00
Tom Eastep	fb2d876683	Rename $loglevel and $logtag to $_loglevel and $_logtag respectively. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 08:49:59 -08:00
Tom Eastep	a25b3c68ee	Rename %symbols to %variables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-04 08:49:25 -08:00
Tom Eastep	314632f1f4	Unified symbol table for shell variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 17:18:21 -08:00
Tom Eastep	409f5f2aab	Expand variables from the shorewallrc1 then shorewallrc hashes	2012-12-03 15:33:33 -08:00
Tom Eastep	fb0035bdf3	Add ALLOWUNKNOWNVARIABLES option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 14:43:35 -08:00
Tom Eastep	72aabef0fa	Add $logaction and $logtag as variables usable within actions - Also make action variables usable in ?if and ?elsif expressions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 12:31:47 -08:00
Tom Eastep	fc3606a489	Prepare for multiple options in actions files Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 08:17:55 -08:00
Tom Eastep	ad4709cb6d	Small effeciency improvement - Don't check for 'bad match' until it is known that the matches are the same. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-03 06:54:44 -08:00
Tom Eastep	c0abdc1fe8	Add some comments in and around delete_duplicates() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 17:31:13 -08:00
Tom Eastep	cd5e9be467	Carefully suppress duplicate rules in all tables Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 12:20:24 -08:00
Tom Eastep	c05c928c6c	Delete adjacent duplicate rules in tables other than 'raw' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 09:21:04 -08:00
Tom Eastep	a33cf5cc91	Fix AUTOCOMMENT=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-02 08:26:54 -08:00
Tom Eastep	65676cb865	Support passing log levels inside parameters. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 15:06:51 -08:00
Tom Eastep	8ebbdee20f	Only look for numerics if a shell variable begins with a number. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 12:52:26 -08:00
Tom Eastep	6c1a5b8051	Be more agressive about detecting action recursion. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 12:10:06 -08:00
Tom Eastep	b9adc2ebec	Remove another vestage of CONDITION_INIT Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 09:33:01 -08:00
Tom Eastep	44f00cd0aa	Restore original $actionfile logic in process_actions() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 08:09:20 -08:00
Tom Eastep	ae5680401f	Remove questionable autocreate of an action in createlogactionchain() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 08:04:29 -08:00
Tom Eastep	8cbe26e32c	Ignore 'inline' for certain actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-12-01 07:54:42 -08:00
Tom Eastep	146402d9be	Yet another correction to the same line :-( Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 09:55:24 -08:00
Tom Eastep	70f26d8bb2	Correct line in prior commit. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 09:30:27 -08:00
Tom Eastep	893d054cb8	Reduce the block levels in define_firewall() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 08:46:49 -08:00
Tom Eastep	53fd0e7c8c	Don't require functions called from Shorewall::Compiler::compiler to know the current indentation. Also, add an optional 'times' parameter to push_indent() and pop_indent(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 07:49:42 -08:00
Tom Eastep	6702bb1989	Revert condition initialization patch. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-30 07:31:29 -08:00
Tom Eastep	e60369728a	Only initialize switches that survived optimization - Also use push_indent to make things more readable Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 15:25:28 -08:00
Tom Eastep	7d4bc568d8	Include initialization in condition match if supported Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 14:54:09 -08:00
Tom Eastep	11d4e92a29	Correct check for leading zeros in action variables. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 14:39:02 -08:00
Tom Eastep	409c427134	Add support for future condition initial values. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 12:15:15 -08:00
Tom Eastep	7bdce1bc97	Disallow superfluous leading zeros in action parameter numbers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 08:29:20 -08:00
Tom Eastep	e1524763ad	Also substute the chain name for '@0'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 08:28:52 -08:00
Tom Eastep	15121e0743	Also substitute the chain name for '@0' in SWITCH names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 08:05:49 -08:00
Tom Eastep	9c0d8a2533	Use '@{0}' as the chain name surrogate in SWITCH columns Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-29 07:17:13 -08:00
Tom Eastep	bff91cd325	Allow overriding 'inline' on some standard actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-28 15:03:08 -08:00
Tom Eastep	8006d150f1	Allow switch initialization. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 16:17:43 -08:00
Tom Eastep	e44acdc6af	Corrections to in-line actions. - Avoid reference to uninitialized variable. - Remove another vestage of multi-parameter macros. - Correct a typo. - Correct handling of SOURCE and DEST in an in-line action body. - Correct a comment. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 12:56:14 -08:00
Tom Eastep	e2297f2582	Remove meaningless type from an error message. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 12:53:47 -08:00
Tom Eastep	d7096ae52e	Back out default-action macros and document in-line actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 10:53:18 -08:00
Tom Eastep	6bf996d4b8	Implement inline actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-27 10:32:48 -08:00
Tom Eastep	85a46690c0	Improve optimize level 16 fix. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 15:11:07 -08:00
Tom Eastep	a4dcd1071a	Revert change to macro level merging. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 13:41:12 -08:00
Tom Eastep	78ba8bac50	Replace '@' by the chain name in SWITCH columns. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 13:28:23 -08:00
Tom Eastep	bf75b2b919	$0 expands to the current action chain name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 13:23:20 -08:00
Tom Eastep	7673b1ac4b	Support multiple parameters in macros. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 11:04:19 -08:00
Tom Eastep	fc87576005	Back out silly change for output interfaces in the conntrack file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 09:47:42 -08:00
Tom Eastep	3f550622bd	Only use routing table for OUTPUT interface in the raw table. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-26 07:51:55 -08:00
Tom Eastep	e7dee420ee	Allow interfaces in the DEST column of the conntrack file when the chain is OUTPUT. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 18:37:23 -08:00
Tom Eastep	e45fe53705	Correct another optimizer defect. - Don't declare command-mode rules as duplicates. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 18:00:26 -08:00
Tom Eastep	697fc001c3	Return to zone-based handling of 'all'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 16:31:05 -08:00
Tom Eastep	642f192b3d	Disallow destination interface in the OUTPUT chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 15:37:53 -08:00
Tom Eastep	7b0578fa84	Fix AUDIT on IPv6. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 12:09:18 -08:00
Tom Eastep	5acf0f60e7	Only apply log level to bare LOG rules in default-action macro. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 10:17:03 -08:00
Tom Eastep	fb3194d96b	Correct handling of default-action macro when specified as "macro.Name" Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 10:16:43 -08:00
Tom Eastep	066a017420	Correct typo in Raw.pm - The OUTPUT chain designator test was using '0' (zero) rather than 'O'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 08:52:33 -08:00
Tom Eastep	1870c281a9	Make AUDIT support params again. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 08:26:44 -08:00
Tom Eastep	dbfc805707	Add 'IU' state in secmarks Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-25 08:10:53 -08:00
Tom Eastep	b7e2b28562	Transfer tag when merging into an NFLOG/ULOG rule. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-24 09:04:56 -08:00
Tom Eastep	67e1e6cf91	Allow WHITELIST in IPv6 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 14:19:14 -08:00
Tom Eastep	cd2854cad0	Fix NFLOG/ULOG implementation. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 13:49:43 -08:00
Tom Eastep	75c148a2dd	Enable 'debug' on the try, stop and clear commands. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 11:46:14 -08:00
Tom Eastep	71bbc632ce	Handle 'fw' correctly in the SOURCE column of the stoppedrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 08:35:51 -08:00
Tom Eastep	b6a1a7d538	Make NFLOG and ULOG built-ins. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-23 08:14:24 -08:00
Tom Eastep	30de211bda	Implement format-3 conntrack files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 20:56:56 -08:00
Tom Eastep	3f7425b6a0	Purge %renamed before each table is processed. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 17:27:09 -08:00
Tom Eastep	26dee73895	Support the audited targets on IPv6 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 08:24:51 -08:00
Tom Eastep	df7ce1a7d1	Add the AUDIT built-in and delete the Audit action. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 08:24:33 -08:00
Tom Eastep	4a05571e7e	Add forward prototype for process_macro() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-22 08:00:15 -08:00
Tom Eastep	b89e05740d	Insure that nested zone exclusions go in the proper place in raw PREROUTING Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 14:49:21 -08:00
Tom Eastep	3040156981	Add SWITCH column to the conntrack file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 14:20:56 -08:00
Tom Eastep	54dadcc546	Ensure that zone-specific rules come before 'all' rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 14:20:30 -08:00
Tom Eastep	952aed225d	Improve handling of 'all' in the conntrack file. - Also added 'all-' to represent all off-firewall zones. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 13:07:01 -08:00
Tom Eastep	1efd47a7e9	Apply Tuomo Soini's fix for RHEL5 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 10:34:00 -08:00
Tom Eastep	374489c3cf	Revert "Fix RHEL5 issue with route marking." This reverts commit `77f342b0e0`.	2012-11-21 10:19:24 -08:00
Tom Eastep	77f342b0e0	Fix RHEL5 issue with route marking. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 09:08:15 -08:00
Tom Eastep	8f52c9744e	Correct some issues with default action macros. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-21 08:29:35 -08:00
Tom Eastep	1957af04fd	Don't create a _weight file for an optional non-provider interface. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 16:10:30 -08:00
Tom Eastep	a0faba2a03	Correct interface/provider handling. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 13:27:15 -08:00
Tom Eastep	c798200b20	Another correction to CHECKSUM detection. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 10:09:28 -08:00
Tom Eastep	67ae9df0f8	Correct handling of unknown interfaces in TC. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 08:07:42 -08:00
Tom Eastep	ebb4e1f6e4	Don't generate start/stop functions for wildcard optional interfaces Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 07:06:27 -08:00
Tom Eastep	f458e99390	Correct the compiler's CHECKSUM detection Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 06:59:40 -08:00
Tom Eastep	5b049d7e9e	Improve readability in Rules module Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-20 06:59:13 -08:00
Tom Eastep	3b20c0db54	Allow Macros to be used as Default Actions. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 16:52:10 -08:00
Tom Eastep	0d8931e49f	Don't use ':' as a join character in contatenated macro ACTION expansion. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 12:58:29 -08:00
Tom Eastep	47791add99	Fix formatting of a line of code. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 12:30:25 -08:00
Tom Eastep	be587726f4	Merge branch '4.5.9'	2012-11-19 08:22:05 -08:00
Tom Eastep	b25ece75de	Don't leave temporary chain in the raw table when LOAD_HELPERS_ONLY=No Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-19 08:18:32 -08:00
Tom Eastep	0db7b6c58a	Don't require a parameter with '&' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 15:45:58 -08:00
Tom Eastep	57e913d86e	Merge branch '4.5.9'	2012-11-18 15:02:46 -08:00
Tom Eastep	a4294658b6	Add a capability to use log levels as a target. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 14:50:59 -08:00
Tom Eastep	65e1b1c9e7	Allow NFLOG as a target Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 13:15:24 -08:00
Tom Eastep	a07cfb0885	Allow NFLOG as a target Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 13:13:43 -08:00
Tom Eastep	c6ffdd67e2	Add DROP target to the conntrack file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 11:35:40 -08:00
Tom Eastep	5265cd5bb7	Add UNTRACKED match to the secmarks file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-18 11:01:49 -08:00
Tom Eastep	5712438bcb	Eliminate Shell syntax error when a provider and its interface have the same name. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-16 09:50:36 -08:00
Tom Eastep	a2b14c37ed	Treat optional interfaces as pseudo-providers. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-16 09:48:21 -08:00
Tom Eastep	b1ffcd8628	Apply provider mask in 'routemark' chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-14 11:20:30 -08:00
Tom Eastep	34e3e4bf82	Merge branch '4.5.9'	2012-11-14 11:17:18 -08:00
Tom Eastep	06a4994488	Make exclusion work correctly with TPROXY. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-14 11:16:52 -08:00
Tom Eastep	391113dfe3	Apply provider mask in 'routemark' chain. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-13 06:55:59 -08:00
Tom Eastep	3c58d2180d	Improve the efficiency of tcrule processing. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-13 06:55:35 -08:00
Tom Eastep	32c9e4274f	Rename 'mysplit' to 'split_host_list' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-11 08:42:01 -08:00
Tom Eastep	896d874aab	Set VARLIB in the script's initialize() function. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-09 12:29:19 -08:00
Tom Eastep	5fcdfd779c	Don't default IPSET to 'ipset'. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-09 08:54:54 -08:00
Tom Eastep	860ee6de27	Eliminate nonsensical warning message. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-06 07:36:36 -08:00
Tom Eastep	ec17ea1dee	Remove superfluous check Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-03 08:19:46 -07:00
Tom Eastep	2e211bc2b6	Correct handling of wildcard interfaces in rules. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-11-03 07:24:41 -07:00
Tom Eastep	5f0b85b5b9	Replace a couple of more hard-coded directory names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-30 09:49:53 -07:00
Tom Eastep	3f1aeb33be	Correct mark range with shifted mask. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-26 12:41:06 -07:00
Tom Eastep	e177916c12	Implement statistical marking in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-26 07:10:26 -07:00
Tom Eastep	0387b16983	Implement CHECKSUM action in the tcrules file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-22 15:42:13 -07:00
Tom Eastep	6af16e0cda	Allow quotes in parameter to run_iptables() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-14 13:26:08 -07:00
Tom Eastep	ab7975539c	Correct typo in get_params() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-14 09:30:27 -07:00
Tom Eastep	dfd0692176	Omit IPv6-specific code from checkkernelversion() in IPv4 script Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-13 07:28:37 -07:00
Tom Eastep	8b650358d6	Don't shout in compiler directives Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-13 07:14:51 -07:00
Tom Eastep	cc90a06958	Add RESTORE_ROUTEMARKS option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-11 07:34:57 -07:00
Tom Eastep	54e066ec3a	Re-order logic in add_group_to_zone - Need to normalize the address prior to comparing it with ALLIP Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-08 08:54:54 -07:00
Tom Eastep	620f88b339	Merge branch '4.5.8'	2012-10-07 17:41:01 -07:00
Tom Eastep	b7e6b1aa41	Allow IP range in the hosts file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 17:40:42 -07:00
Tom Eastep	c84603cdc6	Merge branch '4.5.8' Conflicts: Shorewall/Perl/Shorewall/Zones.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 17:04:27 -07:00
Tom Eastep	e2b029b0ba	More hosts file corrections. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 17:00:35 -07:00
Tom Eastep	0efc0451c1	Allow IP range in the hosts file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 15:59:30 -07:00
Tom Eastep	9dd66fc6ff	Allow IP range in the hosts file Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 15:55:00 -07:00
Tom Eastep	0c9cc4a233	Change the 'dynamic' zone option to 'dynamic_shared' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-07 09:18:18 -07:00
Tom Eastep	c228668500	Implement logic associated with 'dynamic' zone option Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-06 07:52:06 -07:00
Tom Eastep	afaba46aa3	Add 'dynamic' zone option. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-06 07:21:49 -07:00
Tom Eastep	1f38a36acf	Delete extraneous logic Signed-off-by: Tom Eastep <teastep@shorewall.net> Conflicts: Shorewall/Perl/Shorewall/Zones.pm	2012-10-04 09:45:25 -07:00
Tom Eastep	526f72216a	Correct handling of dash characters in interface/ipset names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-04 07:34:41 -07:00
Tom Eastep	642ff1be15	Correct handling of dash characters in interface/ipset names. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-02 10:09:23 -07:00
Tom Eastep	92d39dc56d	Expunge the g_perllib variable Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-01 06:59:39 -07:00
Tom Eastep	a8e9296473	Expunge the g_sbindir variable Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-01 06:55:48 -07:00
Tom Eastep	749e239d15	Expunge the g_libexec variable Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-10-01 06:51:36 -07:00
Tom Eastep	30d4ba67cc	Revert "Allow '-' in the interface for dynamic zone." This reverts commit `b68b34b820`.	2012-09-30 16:25:35 -07:00
Tom Eastep	4ef81041be	Delete extraneous logic Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-09-30 16:09:34 -07:00
Tom Eastep	b68b34b820	Allow '-' in the interface for dynamic zone. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-09-30 16:04:38 -07:00
Tom Eastep	4311dc5ddf	Merge branch '4.5.8'	2012-09-29 09:03:12 -07:00
Tom Eastep	38faa3e071	Correct handling of new ipv6 net syntax in the hosts file. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2012-09-29 09:01:17 -07:00

... 10 11 12 13 14 ...

3507 Commits