extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-20 21:30:44 +01:00
Code Issues Packages Projects Releases Wiki Activity
12,973 Commits 104 Branches 736 Tags 55 MiB
6632afaf6a
Commit Graph

6084 Commits

Author SHA1 Message Date
Tom Eastep
4917500f12 Work around emacs bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 07:13:01 -07:00
Tom Eastep
50b7a81b13 Correct typo 
- list_split s/b split_list

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 06:56:16 -07:00
Tom Eastep
8c4bbf0c85 Implement REAP_OPTION capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-07 07:54:52 -07:00
Roberto C. Sanchez
12563c55a8 Add '. /lib/lsb/init-functions' to the Debian-specific init scripts, as recommended by lintian 2013-10-05 16:31:45 -04:00
Tom Eastep
5b515f007b Fix 'monthdays' in the TIME column. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-30 15:43:17 -07:00
Tom Eastep
24218934f8 Clean up uninstall scripts 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-30 15:42:58 -07:00
Tom Eastep
308aaad8d4 Use insserv on Debian 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-29 09:28:22 -07:00
Tom Eastep
d9c3345a2d Correct temporal port range in mDNS macros. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-29 08:05:52 -07:00
Tom Eastep
d7cbd1da21 Allow actions to manipulate the current comment from Perl. 
- Added set_comment()
- moved push/pop_comment() to the :DEFAULT export
 2013-09-23 12:21:44 -07:00
Tom Eastep
a389aa01a8 Fix for litedir 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-18 21:05:35 -07:00
Tom Eastep
a5c608e996 Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2013-09-18 17:59:49 -07:00
Tom Eastep
e570d91ab1 Document 'hostroute' and 'nohostroute' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-18 17:58:28 -07:00
Tom Eastep
eb75d0eef4 Add 'nohostroute' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-18 16:49:54 -07:00
Tom Eastep
4524281163 Apply Thomas D's Gentoo support patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-17 08:22:52 -07:00
Tom Eastep
14bd1a9061 Don't require SYSCONFFILE for all products 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-10 08:24:27 -07:00
Tom Eastep
159d677acb Update manpages to indicate that 'inline' is assumed for REJECT_ACTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-10 08:08:06 -07:00
Tom Eastep
5dbcdd65e2 Force 'inline' for REJECT_ACTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-10 07:37:53 -07:00
Tom Eastep
50411e638c Report the name of the SysV init file installed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-09 08:11:45 -07:00
Tom Eastep
dc5c0dc069 Validate default log levels 
- Name the .conf option involved in error messages

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-06 16:00:15 -07:00
Tom Eastep
87ae801c15 Use the -w ip[6]tables option when available. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-04 10:16:36 -07:00
Tom Eastep
ae63a0ab77 Correct description of how REJECT is handled: 
- Add UDP

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-02 17:07:58 -07:00
Tom Eastep
dcff4fad37 Add sample action to shorewall.conf manpage. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-01 12:20:44 -07:00
Tom Eastep
67603c5eb3 Implement REJECT_ACTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-01 09:14:10 -07:00
Tom Eastep
1540e50cce Remove blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-31 10:07:41 -07:00
Tom Eastep
39e348997f Add SERVICEFILE variable to shoreallrc. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-18 14:27:26 -07:00
Tom Eastep
156ed38b23 Correct installation of $SYSCONFFILE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-18 08:30:11 -07:00
Tom Eastep
a298817201 Improve INITSOURCE handling in the installers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-15 06:51:27 -07:00
Tom Eastep
0a2f6c18cc Correct typo in prog.footer 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-13 07:03:20 -07:00
Tom Eastep
32763e998b Make -v work with the status command 
- Also document exit status

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-13 06:52:46 -07:00
Tom Eastep
fc5c92cabc Use /etc/os-release to determine build host 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-08 17:44:40 -07:00
Tom Eastep
a10aea280b Add some abbreviations for common commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-06 07:05:47 -07:00
Tom Eastep
ceffc000eb Correct Typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-05 08:32:17 -07:00
Tom Eastep
6615c1f736 Clarify usage of Interface Option Chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-04 09:01:09 -07:00
Tom Eastep
83d1aa6682 Allow OPTIMIZE=All 
- Remove use of literal 4096 from OPTIMIZATION checks.
- Moved constant declarations to the Config module.
- Documented that level 1 is ignored when level 4 is specified.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-29 10:08:35 -07:00
Tom Eastep
e0a222938a Merge branch '4.5.19' 2013-07-27 08:14:35 -07:00
Tom Eastep
bf15b859bc Clarify the relationship between ROUTE_FILTER and routefilter. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-27 08:09:23 -07:00
Tom Eastep
36a4ef1676 Correct typo in action.IfEvent 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-25 06:10:11 -07:00
Tom Eastep
aabb22a50f Add the TRACK_RULES option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-24 07:22:51 -07:00
Tom Eastep
765b748283 Documentation updates 
- Add meaningful IDs to some sections in Events.xml
- Correct typos in the accounting manpages

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-22 07:54:45 -07:00
Tom Eastep
7aa33c140d Add an AutoBL action with helper AutoBLL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-17 10:19:18 -07:00
Tom Eastep
8c27b027fc Break <command> into <command>[<optionlist>] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-14 08:44:01 -07:00
Tom Eastep
891e3e0e1d Use the --reap option in sticky recent rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 14:46:39 -07:00
Tom Eastep
d6d0cad2f9 Add 'show event[s]' to manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 10:37:27 -07:00
Tom Eastep
5c7500e13e Display the current time as an integer in 'show event[s]' output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 09:46:08 -07:00
Tom Eastep
09240da55a Change the external name of MARK_ANYWHERE to 'Mark in the filter table' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 09:45:20 -07:00
Tom Eastep
2df4aae583 Reword an error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 07:22:28 -07:00
Tom Eastep
89f16bdb37 Include a current time event in /proc/net/xt_recent/ 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 07:14:22 -07:00
Tom Eastep
8e30831385 Resolve merge conflicts 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-11 14:20:38 -07:00
Tom Eastep
d2725fcd87 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2013-07-11 14:16:19 -07:00
Tom Eastep
9535a7d7df Rename 'Trigger' to 'Event' and document 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-11 10:39:21 -07:00
Tom Eastep
3c6df56b57 Implement Triggers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-10 13:27:58 -07:00
Tom Eastep
411ca87ec3 Allow logging rules with more than 15 ports 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-08 15:59:54 -07:00
Tom Eastep
948a7fccc2 Enhance a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-07 12:52:04 -07:00
Tom Eastep
73060a3761 Correct typo in dropBcast() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-06 07:58:21 -07:00
Tom Eastep
cd83d7727c Restore handle_original_dest(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:51:06 -07:00
Tom Eastep
5121634457 Add ihandle_original_dest() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:37:24 -07:00
Tom Eastep
131c1f432b Add iverify_source_interface() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:07:09 -07:00
Tom Eastep
03885f71d3 Create add_expanded_ijump() that breaks long lines 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-03 15:13:48 -07:00
Tom Eastep
b735b93378 Re-factor irule generation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-03 10:59:09 -07:00
Tom Eastep
b639a18eb9 Simplify fix for -q 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-03 08:16:27 -07:00
Tom Eastep
5ce5d5e607 Delete superfluous blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 15:03:50 -07:00
Tom Eastep
3e1ed30f4e Make initial progress message obey VERBOSITY 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 14:23:27 -07:00
Tom Eastep
00c5985458 Rename clone_rule() to clone_irule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:38:16 -07:00
Tom Eastep
1a44b66656 Cleaner handling of trailing spaces from log_irule_limit. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:32:35 -07:00
Tom Eastep
b215cf379a Generate a warning when Limit is invoked. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:31:29 -07:00
Tom Eastep
3ec6745df9 Use log_irule_limit() internally where possible. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 11:48:02 -07:00
Tom Eastep
55be5b0119 Add log_irule_limit() and log_irule() functions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 11:47:19 -07:00
Tom Eastep
42a649d093 Create $globals{LOGILIMIT} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 09:00:36 -07:00
Tom Eastep
18e7e43b2f Eliminate globals{STATEMATCH} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-01 16:01:57 -07:00
Tom Eastep
6803ce5d41 Add constants for %used values. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-01 15:36:16 -07:00
Tom Eastep
565fb74795 Correct bridge detection and 'qt' implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 13:07:38 -07:00
Tom Eastep
fc754040d5 Avoid shell error when detecting owner name match 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 09:51:32 -07:00
Tom Eastep
cc5a59231b Make qt() work correctly when tracing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 07:17:15 -07:00
Tom Eastep
25f96e6a88 Reword unreachable warning (again) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-20 10:50:28 -07:00
Tom Eastep
71bcd11ab6 Make ?...shell/perl directives case insensitive 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-20 10:39:39 -07:00
Tom Eastep
4bd35a0b93 Allow 'routeback=0' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-16 08:37:53 -07:00
Tom Eastep
cb132e2421 Include the chain name in the 'unreachable' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-11 06:29:07 -07:00
Tom Eastep
53f1cd40df Add 'unmanaged' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-10 12:36:18 -07:00
Tom Eastep
c653d9ce83 Only issue one 'unreachable' warning per chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-08 10:02:19 -07:00
Tom Eastep
6b67f2698d Add a Kerberos macro (from James Shubin) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-08 07:37:00 -07:00
Tom Eastep
254d2037ef Delete unused variable. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 15:34:25 -07:00
Tom Eastep
cb8e76b1d2 Add sub get_opttype to emphasize where rule option types are used. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 12:49:20 -07:00
Tom Eastep
2b579d2dff Small efficiency change in helper processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 12:48:22 -07:00
Tom Eastep
fc3e3dbf3c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-03 10:53:33 -07:00
Tom Eastep
81acedd1b3 Reword the 'unreachable' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 17:13:41 -07:00
Tom Eastep
d8f53cc0a9 Merge branch '4.5.17' 
Conflicts:
	Shorewall/Perl/Shorewall/Chains.pm
 2013-06-02 15:31:45 -07:00
Tom Eastep
481811d29f Merge NFACCT and EXPENSIVE matches during optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 13:29:13 -07:00
Tom Eastep
3867902b27 Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 07:31:32 -07:00
Tom Eastep
adf51d0059 Revise the unreachable warning stuff. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 16:32:46 -07:00
Tom Eastep
7dbd50708b Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:35 -07:00
Tom Eastep
4340bcffb1 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:25 -07:00
Tom Eastep
4a05e56d6d Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:16 -07:00
Tom Eastep
2d8078033c Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:03:10 -07:00
Tom Eastep
c5f2eeea80 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:02:39 -07:00
Tom Eastep
5343243f6b Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:01:55 -07:00
Tom Eastep
4865899018 Avoid a forward jump for local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:52:09 -07:00
Tom Eastep
9b68204865 Generate an 'unreachable rule(s)' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:17:22 -07:00
Tom Eastep
a550dd3eed Issue a warning when a rule is dropped do to terminated chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 21:01:07 -07:00
Tom Eastep
e9badc1f61 Correct comment in action.Drop 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 08:35:15 -07:00
Tom Eastep
f0aa29222f Correct minor IPv6 TPROXY bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 07:18:46 -07:00
Tom Eastep
eaf1d0e5c2 Another error check for hosts files and loopback zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 10:00:07 -07:00
Tom Eastep
446f764d19 Allow config with only local and firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:44 -07:00
Tom Eastep
9b0b3d4b70 Correct ICMPV6 type name translation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:19 -07:00
Tom Eastep
a48a4b7a2e Don't allow fowarding between local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 06:14:44 -07:00
Tom Eastep
8743b64e00 Export 'shorewall' from the Config module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-27 06:52:45 -07:00
Tom Eastep
2de0fbf7d0 Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 14:06:51 -07:00
Tom Eastep
f89c704d01 Disallow 'virtual' physical interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:47:44 -07:00
Tom Eastep
0b5a316cfc Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:03:54 -07:00
Tom Eastep
31f9ea5b93 Add progess and warning messages to 'update -D' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:55 -07:00
Tom Eastep
dde1f0a779 Only enable helpers during a 'clear' operation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:27 -07:00
Tom Eastep
60d0a50d9d Add some warning/progress messages to help understand 'update -D' behavior. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 13:20:12 -07:00
Tom Eastep
064f9f974c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-23 09:49:25 -07:00
Tom Eastep
fd11eb7d82 Omit fw->fw jumps when there is a local zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 09:19:34 -07:00
Tom Eastep
9e77bb5499 Ensure correct match ordering with trivial exclusion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 08:46:22 -07:00
Tom Eastep
8df8fe990a Allow 'local' zone to work with 'destonly' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 07:34:04 -07:00
Tom Eastep
ac02c484f5 Change 'local' interface option to a zone type. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-19 15:35:20 -07:00
Tom Eastep
5ec72dad6c Add routes for standard tables when there are no providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 15:32:05 -07:00
Tom Eastep
f6a55bbf05 Allow the '-V' option in the CLI programs. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 14:29:36 -07:00
Tom Eastep
739f3779f5 Generate warnings for local->non-firewall and non-firewall->local rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 07:51:12 -07:00
Tom Eastep
2e293dd356 Make 'local,destonly' work correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 14:36:51 -07:00
Tom Eastep
bc6a38ca64 Remove most special handling of 'Auth'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 10:44:26 -07:00
Tom Eastep
a5412cff38 Issue a warning when a rule will be optimized away due to 'destonly'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 09:30:59 -07:00
Tom Eastep
46a6a7b258 Correct earlier optimization. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 07:27:57 -07:00
Tom Eastep
b38f1416aa Mention "all+' in the "Important" notes at the top 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 13:41:12 -07:00
Tom Eastep
105d1db85d Cosmetic change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 11:24:09 -07:00
Tom Eastep
200d347ac8 Small Efficiency Change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 10:52:04 -07:00
Tom Eastep
c8133145e6 Add support for "all+" in the policy file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 09:01:12 -07:00
Tom Eastep
e3d9b2762d Add 'destonly' and 'local' to the interface manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 12:48:58 -07:00
Tom Eastep
9178ecbab0 Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:38:44 -07:00
Tom Eastep
d06a7b55b6 Add a 'destonly' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:37:40 -07:00
Tom Eastep
2fb01bec8d Don't assume 'destonly' with 'local'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:58:37 -07:00
Tom Eastep
6551d67b2e Call delete_chain_and_references recursively. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:29:29 -07:00
Tom Eastep
4b76d8c462 Handle optimize level 0 in the IPV6 nat table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:28:25 -07:00
Tom Eastep
1bb5b89ee1 Add the 'local' interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:27:12 -07:00
Tom Eastep
c3901f1161 Release mutex on error. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-09 09:57:09 -07:00
Tom Eastep
3923092468 Take 2 on conditional compilation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-08 19:01:39 -07:00
Tom Eastep
7215b61aa4 Document changes introduced by Mr-4. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-07 10:16:38 -07:00
Tom Eastep
577db69719 Support conditional compilation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-07 09:36:02 -07:00
Tom Eastep
56318e6cc8 Try to ensure that cp doesn't copy the firewall script to itself. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-06 09:22:16 -07:00
Tom Eastep
13c90e2aef Correct my update to Mr-4's bup patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 18:40:14 -07:00
Tom Eastep
fdfdb49951 Apply Mr-4's priority->perf patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 14:05:03 -07:00
Tom Eastep
61cb105c02 Apply Mr-4's noautosrc patch (modified) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 14:00:25 -07:00
Tom Eastep
4621dccd53 Apply Mr-4's special route handling in COPY (modified). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 13:27:34 -07:00
Tom Eastep
14cf5aa0d6 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2013-05-03 12:23:40 -07:00
Roberto C. Sanchez
a0228e9d3b Fix typos in manpages 2013-05-03 12:19:45 -04:00
Tom Eastep
b83ca4812b Include trailing space in a regular expression. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-03 08:36:38 -07:00
Tom Eastep
80efd095a8 Correct handling of INLINE without '-j' in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-01 14:52:48 -07:00
Tom Eastep
d6961c4c3b Clean up the temporary chains sooner. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-01 14:48:27 -07:00
Tom Eastep
54f5aaca63 Fix handling of CT_TARGET 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-01 11:15:36 -07:00
Tom Eastep
1012251957 Apply Mr-4's 4a patch (modified) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-27 07:04:40 -07:00
Tom Eastep
20d38e8b52 Centralize the validation of nfacct object names. 
- Also correct a missing ' ' from the output generated by INLINE
  freeform input.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-26 09:09:08 -07:00
Tom Eastep
52f5ae15d1 Apply Mr-4's cosmetic patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-25 17:29:41 -07:00
Tom Eastep
7e830e5df4 Allow special characters in nfacct names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-25 10:07:49 -07:00
Tom Eastep
8bb03a741d Update blrules manpages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-24 08:17:10 -07:00
Tom Eastep
f543c3bd1e Finish Mr-4's NFACCT patch 
- Correct indentation
- Remove '$type' argument to split_nfacct_list
- Update manpages.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-23 06:55:30 -07:00
Dash Four
68c7782e7d Shorewall 4.5.16 Beta 6 
Tom Eastep wrote:
> On 4/22/13 5:07 PM, "Dash Four" <mr.dash.four@googlemail.com> wrote:
>
>
>> Anyway, I've just implemented individual "!" in the NFACCT statement by
>> hacking your Accounting.pm - I can attach a small patch for
>> review/inclusion if you are interested, but be aware that it does change
>> the syntax slightly in a sense that "!" needs to be specified for each
>> object within NFACCT() - "NFACCT(...)!" is no longer allowed.
>>
>
> Sure -- send it along.
>
Attached - the above caveat applies though.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 21:17:59 -07:00
Tom Eastep
4faf3728f2 Implement INLINE in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 19:00:29 -07:00
Tom Eastep
ad70240347 Remove a blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 09:36:25 -07:00
Tom Eastep
739013f248 Handle nfacct object lists in parens following an ipset name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 07:56:56 -07:00
Tom Eastep
6d57e7a0ce Mark a rule as complex if an option value is a reference. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-21 14:44:30 -07:00
Tom Eastep
5ad69aa650 Add CHAIN_SCRIPTS option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-21 07:30:31 -07:00
Tom Eastep
a56dcc745d Clarify <chain>:COUNT in the accounting files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-20 17:11:46 -07:00
Tom Eastep
1b9fd642bb Add INLINE to the accounting file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-20 08:02:02 -07:00
Tom Eastep
7c8f1ae020 Correct HELPERS handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 16:35:19 -07:00
Tom Eastep
1fd62e1612 Restore order in the NFACCT target. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 11:11:37 -07:00
Tom Eastep
6c2679ce75 Allow incrementing an nfacct object when an ipset matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 10:44:57 -07:00
Tom Eastep
610bdf1aac Correct merge_rules() for LAST matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 08:40:01 -07:00
Tom Eastep
91c4dd2e56 Document multiple nfacct objects in one rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 06:38:02 -07:00
Tom Eastep
cbdca08fea Fix for multiple nfacct patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 16:37:54 -07:00
Tom Eastep
b87b4b61d8 Allow multiple nfacct matches in one accounting rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 16:14:57 -07:00
Tom Eastep
9c010691a3 Always place 'nfacct' last 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 15:26:34 -07:00
Tom Eastep
d3e9a2f7e8 Remove wrong entries from the helpers file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 15:25:18 -07:00
Tom Eastep
8ef11a376b Document 'HELPERS=none'. 
- Also make 'check -u' work correctly regarding HELPERS=

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 11:30:47 -07:00
Tom Eastep
4d686e873b Implement 'HELPERS=none' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 10:30:56 -07:00
Tom Eastep
f55e34dd8b Don't allow options on targets that don't accept them. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 17:18:01 -07:00
Tom Eastep
668bd4a1a4 Accept complex log levels with INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 16:59:14 -07:00
Tom Eastep
5d5f168f25 Don't clone rule unconditionally in format_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 13:35:32 -07:00
Tom Eastep
938bd72844 Better handling of the matches rule member. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 10:39:32 -07:00
Tom Eastep
ef01748dc9 Update manpages for INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 07:34:00 -07:00
Tom Eastep
8b91575c9e Maintain order when multiple instances of a match are separated. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 06:52:32 -07:00
Tom Eastep
0da38cc38e Order matches in rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-12 11:37:29 -07:00
Tom Eastep
6950cd2576 Allow '-' in a match name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 18:30:02 -07:00
Tom Eastep
ff4fb21044 Require that the '-j' part of a free-form rule be known. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 18:29:45 -07:00
Tom Eastep
614c5e6155 Assume LOG if a level is specified with INLINE. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 14:16:34 -07:00
Tom Eastep
35b0b4a4f9 Support A_ACCEPT! 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 13:37:49 -07:00
Tom Eastep
c34cf333ba Allow both {...} and ';' with INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 12:57:59 -07:00
Tom Eastep
b33bdeaa02 Allow a parameter to INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 11:54:58 -07:00
Tom Eastep
38f3ae0934 Handle 'NONE' policy correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 09:35:27 -07:00
Tom Eastep
beec4a188f Implement INLINE action (again). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 09:15:59 -07:00
Tom Eastep
f85d548d40 Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 06:23:22 -07:00
Tom Eastep
ee2e85c0fb Correct generation of the blacklog chain when disposition is audited 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-10 16:43:38 -07:00
Tom Eastep
186f71fa96 Add NEW_TOS_MATCH capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 14:04:16 -07:00
Tom Eastep
477e2bc455 Additional corrections to INLINE action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 09:41:43 -07:00
Tom Eastep
273f109daf Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 09:37:12 -07:00
Tom Eastep
50494f667c Implement INLINE action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-08 17:30:00 -07:00
Tom Eastep
183a0a75a1 Implement 'builtin' actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-08 16:14:26 -07:00
James Shubin
f176f91b7e Added VRRP macro. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-05 12:37:46 -07:00
Tom Eastep
a56f485797 Add Xymon macro. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-05 08:49:33 -07:00
Tom Eastep
9e10c38e26 Don't emit 'quantum' calculation unless the qdisc is 'htb' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-03 08:39:18 -07:00
Tom Eastep
ee66a45e2e Correct comments in the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-02 12:52:10 -07:00