4198 Commits

Author	SHA1	Message	Date
Tom Eastep	f3ecbc185c	Add Netmanager gateway detection ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2019-01-03 11:22:15 -08:00
Tom Eastep	a71a44346e	Document the provider table contents ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2019-01-02 15:27:38 -08:00
Tom Eastep	45ec24ea42	Add comments to the Zones module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-30 14:10:28 -08:00
Tom Eastep	bf3880ae59	Add some comments to the Misc module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-30 12:41:55 -08:00
Tom Eastep	d096db6a94	Add/modify comments in Chains.pm ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-19 09:19:26 -08:00
Tom Eastep	3239fb3eb9	Merge branch '5.2.1'	2018-12-15 09:56:14 -08:00
Tom Eastep	61ac08dc7f	Correct handling of netmask when two rates are specified in the RATE col. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-14 14:16:26 -08:00
Tom Eastep	f65b10c375	Remove dead/silly code from Shorewall::Chains::use_input/output_chain() ... - combine the two into a single function use_interface_chain(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-14 13:54:36 -08:00
Tom Eastep	35c7f304f7	Correct log name for untracked chain ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-14 11:00:27 -08:00
Tom Eastep	467544801e	Clean up of Chains.pm ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-14 10:59:31 -08:00
Tom Eastep	7cfe9ec272	Correct log name for untracked chain ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-14 10:58:26 -08:00
Tom Eastep	6908a4bcf7	Issue warning when ULOG is used. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-14 09:00:42 -08:00
Tom Eastep	be2110b47e	Revert "Remove ULOG support" ... This reverts commit 061ce3d781.	2018-12-14 08:54:07 -08:00
Tom Eastep	ad6401da8c	Cleanup of Config.pm ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-13 15:32:39 -08:00
Tom Eastep	668cb6deda	Make 'status -i' work when there are no providers ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-12-11 13:44:31 -08:00
Tom Eastep	8ed644a0ec	Correct HELPER requires error message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-11-28 11:00:41 -08:00
Tom Eastep	86b82c53cf	Correct HELPER requires error message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-11-28 10:59:53 -08:00
Tom Eastep	061ce3d781	Remove ULOG support ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-11-15 14:59:29 -08:00
Tom Eastep	03d2088cf7	Implement SW_CONFDIR support ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-11-06 15:40:26 -08:00
Tom Eastep	6534201284	Fix assertion failure during 'check -r' when DOCKER=Yes ... - avoid unnecessary mode transitions Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-10-31 15:30:03 -07:00
Tom Eastep	282ca14182	Corrections to DOCKER-ISOLATION change ... - Handle DOCKER-USER Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-10-28 09:20:47 -07:00
Tom Eastep	4b7d346911	Merge branch '5.2.1'	2018-10-27 09:11:00 -07:00
Tom Eastep	131a2cd40d	Accommodate Docker version 18.06 ... - Optionally replace DOCKER-ISOLATION with DOCKER-ISOLATION-STAGE-1 and -2 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-10-27 09:04:34 -07:00
Tom Eastep	ae90ab1f68	Add version of Jeremie Courreges-Anglas's <jca@tranquil.it> patch ... - Handle case where we are enabling/disabling a balanced/fallback provider and another such provider has lost carrier. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-10-11 15:18:47 -07:00
Tom Eastep	5e57c895b3	Avoid emacs issues with compiled code ... - handle embedded spaces in moduledir path names Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-10-09 14:47:36 -07:00
Tom Eastep	aab1df7421	Correct ip[6]tables-restore failure message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-10-06 08:22:46 -07:00
Tom Eastep	9f3cc88cf0	Prevent invalid code generation with SNAT(detect) ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-10-02 08:15:20 -07:00
Tom Eastep	1b6de901e0	Merge branch '5.2.0'	2018-08-24 15:33:16 -07:00
Tom Eastep	56780a5d1f	Apply rate limiting in the nat table on nat+accept rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-08-24 15:31:20 -07:00
Tom Eastep	22c1bc2e9c	Apply rate limiting in the nat table on nat+accept rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-08-23 14:07:10 -07:00
Tom Eastep	2d2ded7efc	Merge branch '5.2.0'	2018-08-07 07:46:29 -07:00
Tom Eastep	5e8fd570d1	Prepare for Perl 5.32 ... - Escape '{' in REs Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-08-07 07:43:58 -07:00
Tom Eastep	7c31f70dc8	Use '=' rather than '&' to create UNTRACKED rule chains. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-08-01 13:50:20 -07:00
Tom Eastep	f1eafdc314	Use '=' rather than '&' to create UNTRACKED rule chains. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-08-01 13:48:29 -07:00
Tom Eastep	c195bab01d	Correct handling of a provider interface that matches a wildcard. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-29 20:34:02 -07:00
Tom Eastep	0d682fe78b	Disallow optional shared providers ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-19 09:57:06 -07:00
Tom Eastep	410a20dda3	Make shared interface and 'load=<load-factor' play nice together ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-17 13:25:26 -07:00
Tom Eastep	0685d0edfd	Fix rate limiting ... - Avoid specifying a timeout when the match is '-m limit' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-15 08:57:43 -07:00
Tom Eastep	474604b1fe	Correct source interface exclusion ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-04 08:01:27 -07:00
Tom Eastep	93f0183550	Tweak do_ratelimit() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-03 14:22:30 -07:00
Tom Eastep	a42972644c	Allow specification of 'hashlimit' table sizes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-02 14:14:36 -07:00
Tom Eastep	49514e2d58	Allow specification of ht buckets and max entries in RATE columns ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-02 10:23:36 -07:00
Tom Eastep	a265685e20	Allow specification of VLSM in the RATE columns ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-07-02 09:08:45 -07:00
Matt Darfeuille	442e6ac152	Update version to 5.2 ... Signed-off-by: Matt Darfeuille <matdarf@gmail.com> Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-06-23 09:09:00 -07:00
Tom Eastep	bfb9852eb6	Allow MARK, CONNMARK, SAVE and RESTORE in the nat table ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-06-14 10:01:12 -07:00
Tom Eastep	a8b6a301f2	Revert "MARK and CONNMARK in the snat file" ... This reverts commit e36547f8be.	2018-06-14 07:58:33 -07:00
Tom Eastep	150f7ab798	Allow specification of the TPROXY mark in CONNMARK and MARK. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-06-14 07:58:06 -07:00
Tom Eastep	e36547f8be	MARK and CONNMARK in the snat file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-06-10 16:34:55 -07:00
Tom Eastep	0632723a6c	Support interface exclusion ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-06-10 12:02:19 -07:00
Tom Eastep	ec21b03c5b	Correct handling of dbl=src_dst in interface OPTIONS ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-18 10:18:09 -07:00
Tom Eastep	25dcf8c5d6	Check for linkdown in interface_is_usable() rather than ..._is_up(). ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-18 07:56:06 -07:00
Tom Eastep	c02b71b530	Correct interface_is_up() to look for the 'state' as well as 'UP' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-12 08:09:46 -07:00
Tom Eastep	78269d57bc	Handle missing AUTOMAKE ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-10 11:12:23 -07:00
Tom Eastep	fc91648315	Avoid split_line2 confusion when processing a raw line ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-10 09:30:02 -07:00
Tom Eastep	067f435ac5	Update BLACKLIST_DEFAULT if Drop or Reject ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-06 13:31:54 -07:00
Tom Eastep	90df607d79	Finish removal of 'refresh command' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-30 15:30:34 -07:00
Tom Eastep	5e2f1f573d	Unconditionally convert masq->snat ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-27 11:38:47 -07:00
Tom Eastep	011322992e	Revert "Delete masq file processing" ... This reverts commit 609ee8dea2.	2018-03-27 11:08:33 -07:00
Tom Eastep	609ee8dea2	Delete masq file processing ... - Automatically convert the masq file if it exists Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-26 11:40:22 -07:00
Matt Darfeuille	299ea2b41f	Update version to 5.2 ... - Remove unneeded punctuation marks Signed-off-by: Matt Darfeuille <matdarf@gmail.com> Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-24 09:53:02 -07:00
Tom Eastep	32f1ae1992	Make &lo work correctly ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-19 18:23:19 -07:00
Tom Eastep	3be071ca3d	Up the INCLUDE depth limit to 20 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-12 14:39:53 -07:00
Tom Eastep	e08e239c00	Implement AUTOMAKE=recursive ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-03 15:50:56 -08:00
Tom Eastep	02ed6f26a9	Allow AUTOMAKE=<depth> to specify search depth ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-03-03 13:04:48 -08:00
Tom Eastep	34c5441768	Apply optimize category 16 again after 8 if 8 did anything ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-27 14:17:21 -08:00
Tom Eastep	c3d8cba042	Reverse the order of optimize 8 and optimize 16 application ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-23 15:01:47 -08:00
Tom Eastep	c1a74b54fc	Implement RENAME_COMBINED ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-22 12:49:55 -08:00
Tom Eastep	88547f5140	Handle two-chain case when LOG_ZONE != 'Both' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-22 11:25:19 -08:00
Tom Eastep	7ad7598d5b	Implement LOG_ZONE ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-20 15:31:31 -08:00
Tom Eastep	4dfc6d90b9	Add 'logname' member to chain table entries. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-20 11:04:50 -08:00
Tom Eastep	0cb4a5c202	Correct "Invalid Policy Action" error message ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-19 10:04:18 -08:00
Tom Eastep	9a83365986	Remove the USEPKTTYPE capability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-16 11:20:00 -08:00
Tom Eastep	db4a26cfa9	'update' changes for V5.2 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-13 09:21:15 -08:00
Tom Eastep	95e956c913	Complete removal of INLINE_MATCHES ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-13 09:20:31 -08:00
Tom Eastep	5e3795b5a4	Delete support for single semicolon in INLINE and IP[6]TABLES rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-12 19:12:03 -08:00
Tom Eastep	24e21e730e	Correct typo in add_common_rules() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-12 19:10:35 -08:00
Tom Eastep	12bbbbfa2a	Merge branch '5.1.12' ... # Conflicts: # Shorewall/Perl/Shorewall/Config.pm	2018-02-09 17:16:12 -08:00
Tom Eastep	2a12e0950a	Allow pairs in braces to appear with ';;' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-09 12:58:18 -08:00
Tom Eastep	c518e85215	Clarify warning message regarding INLINE_MATCHES ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-08 11:21:38 -08:00
Tom Eastep	91c76f7559	Add INLINE_MATCHES=Yes to deprecated option list ... - Issue a warning for each line requiring change. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-07 19:08:28 -08:00
Tom Eastep	73b39abd62	Remove INLINE_MATCHES ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-07 14:41:49 -08:00
Tom Eastep	3903fe5fd9	Remove the 'refresh' command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-07 12:38:24 -08:00
Tom Eastep	a3e10157de	Merge branch '5.1.12'	2018-02-06 17:35:31 -08:00
Tom Eastep	ebe09a95b8	Lightweight format_rule() for use in digest creation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-02-02 09:27:19 -08:00
Tom Eastep	7bdd69d151	Optimization category 8 tweaks ... - Document cost of the category in shorewall.conf(5) - Omit DONT_DELETE chains from consideration right off the bat Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-31 14:58:01 -08:00
Tom Eastep	a08f0cfe10	Avoid awkward blank lines ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-30 19:15:10 -08:00
Tom Eastep	09a81ae574	Omit trailing black space from the generated script ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-30 14:31:54 -08:00
Tom Eastep	e17c4ac8af	Reorganize code around wait/Interface-variable fix ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-30 11:25:37 -08:00
Tom Eastep	a6000ee963	Reorganize code around wait/Interface-variable fix ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-30 11:25:04 -08:00
Tom Eastep	0ab1464f51	Merge branch '5.1.12'	2018-01-28 14:54:23 -08:00
Tom Eastep	789854adce	Revert "Correct order of optional interface and address variable handling" ... This reverts commit fbee4a91fd.	2018-01-28 14:54:06 -08:00
Tom Eastep	37101a2031	Merge branch '5.1.11' into 5.1.12	2018-01-28 13:15:42 -08:00
Tom Eastep	40bcfd15e5	Revert "Correct order of optional interface and address variable handling" ... This reverts commit f4cae55c1e.	2018-01-28 13:15:13 -08:00
Tom Eastep	230ab06e5d	Reverse order of required-interface and address variable processing ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-28 13:10:44 -08:00
Tom Eastep	09cda21dd4	Revert "Correct order of optional interface and address variable handling" ... This reverts commit 9253f90ac5.	2018-01-28 12:29:38 -08:00
Tom Eastep	9253f90ac5	Correct order of optional interface and address variable handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-28 11:39:06 -08:00
Tom Eastep	f4cae55c1e	Correct order of optional interface and address variable handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-28 10:54:03 -08:00
Tom Eastep	fbee4a91fd	Correct order of optional interface and address variable handling ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-28 10:53:20 -08:00
Tom Eastep	cdf5ad45d5	Eliminate the MAPOLDACTIONS option ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-24 12:59:26 -08:00
Tom Eastep	070a67d665	Deimplement OPTIMIZE_USE_FIRST ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-24 11:56:20 -08:00
Tom Eastep	9796c58eb2	Add OPTIMIZE_MASK constant ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-23 13:15:44 -08:00
Tom Eastep	cabc20957f	Delete an unnecessary variable ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-23 09:45:50 -08:00
Tom Eastep	a9a379c5a5	Implement INPUT SNAT ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-22 16:37:38 -08:00
Tom Eastep	64f704a964	Improve quoting in the route-balancing logic ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-21 14:46:51 -08:00
Tom Eastep	416224ee05	Correct typos and anachronisms in Chains.pm comments ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-21 11:53:58 -08:00
Tom Eastep	fb4b362724	Eliminate unnecessary local array ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-20 13:26:10 -08:00
Tom Eastep	97de2be778	Change a fatal_error() call with an assertion in add_policy_rules() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-19 13:39:51 -08:00
Tom Eastep	85cae3c7f8	Add parens to improve readability ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-19 12:47:17 -08:00
Tom Eastep	acd425a3c2	Remove superfluous logic from validate_portpari1() ... - Add comments Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-19 12:46:52 -08:00
Tom Eastep	27a0f0f7a0	Make TRACK_PROVIDERS=Yes the default ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-10 08:46:01 -08:00
Tom Eastep	9ac075fd56	Clear the connection mark in tunneled packets from tracked providers ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-09 17:12:14 -08:00
Tom Eastep	b2604583af	Revert "Clear the connection mark in tunneled packets from tracked providers" ... This reverts commit 62c6411cb0.	2018-01-09 17:01:51 -08:00
Tom Eastep	62c6411cb0	Clear the connection mark in tunneled packets from tracked providers ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-09 14:51:57 -08:00
Tom Eastep	1bc90beb01	Update copyrights ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-07 15:01:46 -08:00
Tom Eastep	eaccf033c6	Update copyrights for 2018 ... - Update some header versions to 5.1 Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-07 14:24:01 -08:00
Tom Eastep	056711d304	Remove anachronistic comment ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-06 13:58:20 -08:00
Tom Eastep	0aa0bebe07	Reword error message ... - "Invalid action name ..." to "Reserved action name ..." Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-06 13:56:36 -08:00
Tom Eastep	1a68d87c94	Don't enable forwarding in 'clear' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-04 15:39:07 -08:00
Tom Eastep	c518cfaa4a	Allow address variables to work correctly with the 'clear' command ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-01-03 08:58:28 -08:00
Tom Eastep	45a164733b	Fix breakage of ipp2p ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-30 08:38:14 -08:00
Tom Eastep	6f82bfe7d1	Handle PROTO '-' in conntrack file processing. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-29 15:54:15 -08:00
Tom Eastep	078c781dfa	Allow override of :syn assumption in CT rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-29 15:15:33 -08:00
Tom Eastep	46f68c6dcb	Move adjustment of the protocol in process_conntrack_rule() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-29 13:51:33 -08:00
Tom Eastep	9e3cb27d0a	Use the synchain name in log messages rather than the base chain name ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-28 14:13:50 -08:00
Tom Eastep	b1d1fa862a	Add comment noting that the 'physwild' interface member is currently unused ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-23 10:58:16 -08:00
Tom Eastep	24acf25451	Delete unused find_interfaces_by_option1() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-23 10:53:16 -08:00
Tom Eastep	229c47ac6c	Don't delete options that are to be ignored from %options ... - specifying some options can have side-effects that cause $interfaceref->{options}{$option} to be accessed Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-23 10:47:22 -08:00
Tom Eastep	38de9c1732	Make wildcard/option checks order-independent WRT the options ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-23 10:24:08 -08:00
Tom Eastep	17f4fd7cd2	Initialize $physwild to $wildcard ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-22 15:42:16 -08:00
Tom Eastep	cfd02c1bb6	More $minroot changes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-22 13:58:38 -08:00
Tom Eastep	19b7601c72	Improve handling of wildcard interfaces and options ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-22 13:43:45 -08:00
Tom Eastep	5a8e9cd0a3	Correct $minroot logic ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-22 09:08:27 -08:00
Tom Eastep	45468af2d2	Correct ingress policing for later releases of iproute2 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-18 11:52:19 -08:00
Tom Eastep	821d72093a	Rename DEFAULTACTION_SECTION to POLICYACTION_SECTION. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-02 16:25:15 -08:00
Tom Eastep	42d5d13780	Retain proto setting when switching inline <-> noinline ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-02 13:40:41 -08:00
Tom Eastep	7121a0f1b1	Disallow a protocol on the Reject Action ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-02 12:58:05 -08:00
Tom Eastep	ab12d63a4f	Change 'default action' to 'policy action' in comments and messages ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-02 12:55:17 -08:00
Tom Eastep	6ba1d5413b	Allow a protocol to be associated with an action ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-12-02 11:24:08 -08:00
Tom Eastep	b04b65cac8	Clear counters in all tables during 'reset' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-30 14:31:59 -08:00
Tom Eastep	5dcb684efc	Don't be specific when deleting IPv6 balanced/fallback default routes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-28 15:26:17 -08:00
Tom Eastep	7289175070	Chop first config dir if non-root or if compiling for export. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-23 09:57:12 -08:00
Tom Eastep	528b473f6b	Add some additional documentation to the Config module ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-22 08:41:37 -08:00
Tom Eastep	2a9272ccd1	Clean up RAs involving "|" ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-14 08:26:17 -08:00
Tom Eastep	130ddff9de	Correct a typo in an error message ... - Includes cosmetic changes to Providers.pm Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-10 11:25:52 -08:00
Tom Eastep	9cf298482d	Merge branch '5.1.8'	2017-11-09 12:59:59 -08:00
Tom Eastep	c5a586aa37	Allow [...] around gateway address in the providers file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-09 12:20:01 -08:00
Tom Eastep	832418585a	Don't make persistent routes and rules dependent on autosrc. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-08 09:46:25 -08:00
Tom Eastep	605f61fb3c	Don't make persistent routes and rules dependent on autosrc. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-08 09:45:59 -08:00
Tom Eastep	ef8b85fc3e	Implement support for logging in the SNAT file ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-11-02 12:44:42 -07:00
Tom Eastep	b35f1112f4	Allow 'noinline' in /etc/shorewall[6]/actions to override 'inline' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-20 09:19:50 -07:00
Tom Eastep	77d9eeb915	Eliminate extra parameter editing of TPROXY parameter list. ... - Clarify syntax for actions with multiple parameters Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-19 13:08:12 -07:00
Tom Eastep	17838c1443	Add TCPMSS to the allowed mangle actions. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-19 12:58:38 -07:00
Tom Eastep	5867ce6c3b	CLAMPMSS now done in the mangle table. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-18 15:55:07 -07:00
Tom Eastep	8ea96098bf	Warning when 'persistent' used with RESTORE_DEFAULT_ROUTE=Yes ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-11 15:22:07 -07:00
Tom Eastep	02ed36332a	Revert "Warn when RESTORE_DEFAULT_ROUTE=Yes and a persistent provider is defined" ... This reverts commit 39a3c72057.	2017-10-11 11:24:54 -07:00
Tom Eastep	cb4f9e7261	Don't restore default routes when there is an enabled fallback provider ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-11 11:24:13 -07:00
Tom Eastep	ddb12fcad9	Add/correct comments ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-11 11:00:46 -07:00
Tom Eastep	42ce754961	Don't restore default routes when a fallback= provider is enabled ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-11 11:00:05 -07:00
Tom Eastep	5cd4d63bc5	Delete main default routes when a fallback provider is enabled ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-11 10:59:31 -07:00
Tom Eastep	5b567f2d8b	Correct delete_default_routes() in tables other than main ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-11 10:58:48 -07:00
Tom Eastep	39a3c72057	Warn when RESTORE_DEFAULT_ROUTE=Yes and a persistent provider is defined ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-11 10:58:09 -07:00
Tom Eastep	b47e633c38	Use 'route replace' rather than 'route add' to avoid persistence issues ... Previous failure case was: - disable interface - reload - enable interface Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-09 08:58:10 -07:00
Tom Eastep	1b55a37a28	Ensure that 'rule add' commands don't fail with persistent interfaces ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-08 08:53:53 -07:00
Tom Eastep	a97dcd23d0	Allow merging of rules that specify an IPSEC policy ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-07 13:17:43 -07:00
Tom Eastep	108b169d8d	Treat LOG_TARGET like all other capabilities ... - Previous implementation could generate unworkable script when LOAD_HELPERS_ONLY=Yes Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-10-06 08:01:52 -07:00
Tom Eastep	8469f983d8	Merge branch '5.1.7' ... # Conflicts: # Shorewall/Perl/prog.footer	2017-09-29 15:25:37 -07:00
Tom Eastep	f54acb665a	Correct handling of mark range in MARK target. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-29 14:44:33 -07:00
Tom Eastep	3d2e9eb93e	Improve the fix for SELinux "getattr" denials ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-28 15:16:50 -07:00
Tom Eastep	c6a939301f	Improve the fix for SELinux "getattr" denials ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-28 15:16:00 -07:00
Tom Eastep	1cb98254cc	Handle SELinux getattr denials in open() processing ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-26 16:42:54 -07:00
Tom Eastep	baa791a1e3	Handle SELinux getattr denials in open() processing ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-26 16:41:50 -07:00
Tom Eastep	8b4b965f63	Remove unnecessary disable/enable of script generation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-21 14:36:30 -07:00
Tom Eastep	8ee2d6246c	Update a comment in the compiler ... - get_configuration() also processes the shorewallrc file(s) Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-21 12:32:34 -07:00
Tom Eastep	a7be3dfece	Align progress messages produced by 'reenable' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 13:29:13 -07:00
Tom Eastep	846e8c4ece	Correct reenable logic ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 13:29:08 -07:00
Tom Eastep	e2bf7e6584	Align progress messages produced by 'reenable' ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 13:28:09 -07:00
Tom Eastep	ff3994f6a1	Correct reenable logic ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 13:17:50 -07:00
Tom Eastep	494ec9c59c	Avoid extra comparison in reload_command() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 10:49:11 -07:00
Tom Eastep	1cde92e8f3	Initialize g_dockeringress ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 10:43:44 -07:00
Tom Eastep	721a1e3b33	Initialize g_dockeringress ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 10:39:52 -07:00
Tom Eastep	84fa774cb7	Change copyright dates in lib.runtime ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-19 09:03:00 -07:00
Tom Eastep	be5aabcbfb	Correct typo in Chains.pm ... &g_dockeringress -> $g_dockeringress Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-18 10:14:22 -07:00
Tom Eastep	a8937e6bc8	Correct harmless typo ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-18 10:06:41 -07:00
Tom Eastep	5e1cf17ebc	DOCKER-INGRESS support ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-17 10:57:29 -07:00
Tom Eastep	85a7ec6fe5	Correct module loading in the compiler ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-14 15:08:38 -07:00
Tom Eastep	2ed11c7e15	Default ADD_IP_ALIASES to 'No' in Shorewall6 ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-12 11:55:53 -07:00
Tom Eastep	4f79d2e82b	Move and simplify handling of nat columns ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-12 10:53:04 -07:00
Tom Eastep	e6a2ba78a4	Correct handling of DEST column during action invocation ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-08 10:05:37 -07:00
Tom Eastep	1065c2951b	Allow NAT targets to be passed to the Event actions ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-08 09:46:03 -07:00
Tom Eastep	3b373f3f21	Correct handling of ipsets in the DEST column of the snat file ... - Also corrected handling of exclusion Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-09-06 11:30:42 -07:00
Tom Eastep	b54a691110	Improve dynamic gateway detection ... - Use provider's routing table, if any Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-23 15:04:47 -07:00
Tom Eastep	90f33dd436	Eliminate MODULE_SUFFIX ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-23 12:48:14 -07:00
Tom Eastep	34e4fffd7d	Module suffix changes ... - Re-order default list in the compiler to match lib.common - MODULE_SUFFIX="ko ko.xz" in standard .conf files. Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-21 12:44:23 -07:00
Tom Eastep	419ff8903b	Invert logic in Shorewall::Chains::delete_reference() - better readability ... - similar change in Shorewall::Chains::adjust_reference_counts() Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-19 12:25:27 -07:00
Tom Eastep	390ac30be8	Remove a superfluous line of code from Shorewall::Chains::format_rule() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-19 12:12:54 -07:00
Tom Eastep	8cb98f16ea	Add a comment in Shorewall::Chains::optimize_level8() ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-19 08:08:24 -07:00
Tom Eastep	5a9f179e25	Allow port variables as the server port in DNAT rules ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-16 15:36:18 -07:00
Tom Eastep	8641d53bd1	Use MUTEX_TIMEOUT for ip[6]tables --wait interval ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-15 14:02:08 -07:00
Tom Eastep	7e3521e221	RESTORE_WAIT_OPTION ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-13 18:56:40 -07:00
Tom Eastep	ddefde2d10	Correct handling of address variables in DNAT rule. ... Signed-off-by: Tom Eastep <teastep@shorewall.net>	2017-08-13 08:30:11 -07:00