Tom Eastep
01b58bf66f
Merge branch '4.5.7'
2012-08-26 08:27:39 -07:00
Tom Eastep
dc21d015da
Clean up white-space in Togan's patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-26 08:27:24 -07:00
Tom Eastep
9e5d1cc1ce
Merge branch '4.5.7'
2012-08-26 08:11:40 -07:00
Tom Eastep
779243094e
Map NOTRACK to 'CT --notrack' if CT_TARGET is available.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-26 08:08:57 -07:00
Tom Eastep
7208464c68
Change "Compilation aborted..." to "Check aborted ..."
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-25 08:10:12 -07:00
Tom Eastep
1067f8a9bb
Use the non-fatal error reporting feature for missing capabilities
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-24 06:25:29 -07:00
Tom Eastep
3006452cea
Unconditionally restore route mark in PREROUTING and OUTPUT.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-23 12:23:29 -07:00
Tom Eastep
e17010018c
Unconditionally restore route mark in PREROUTING and OUTPUT.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-23 12:15:14 -07:00
Tom Eastep
112312f2ee
Add non-fatal error capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-23 05:50:36 -07:00
Tom Eastep
dffd98dff7
Revert change that added CONTINUE as a valid content of the ADDRESSES column
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-21 10:51:01 -07:00
Tom Eastep
c20611b6c0
Add CONTINUE keyword to the masq file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-20 18:09:59 -07:00
Tom Eastep
1fd9e5e95c
Compensate for silly RHEL bug
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-20 07:20:21 -07:00
Tom Eastep
7ac9e46e1f
Add a comment
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-16 15:49:33 -07:00
Tom Eastep
0a4f26a318
Correct handling of existing notrack file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-16 14:46:48 -07:00
Tom Eastep
f6c4650624
Allow a notrack with nothing but FORMAT and COMMENT lines to be removed.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-16 10:49:59 -07:00
Tom Eastep
3c35af9d8c
Merge branch 'master' into 4.5.7
2012-08-16 08:34:54 -07:00
Tom Eastep
1e11109bb2
Don't combine rules with '-m policy'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-16 08:34:30 -07:00
Tom Eastep
f59612671b
Don't optimize chains with '-m ipsec'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-16 07:33:01 -07:00
Tom Eastep
da4f7ee524
Handle ppp devices correctly in the 'enable' command.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-16 06:59:35 -07:00
Tom Eastep
b132176dae
Correct reference adjustment in new opt4 code
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-14 13:36:39 -07:00
Tom Eastep
8487c78a0a
Adjust reference counts when splicing in short chain
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-14 08:34:51 -07:00
Tom Eastep
fdc45a990d
Arrange for HELPER to match in the RELATED section.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-13 15:44:19 -07:00
Tom Eastep
44a550870c
Add HELPER action.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-13 13:23:38 -07:00
Tom Eastep
bd3295b0e3
Remove temporary hack
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-13 08:55:43 -07:00
Tom Eastep
45288f5927
Revise notrack/conntrack handling:
...
- Purge empty notrack files.
- Process both files.
2012-08-13 07:28:07 -07:00
Tom Eastep
75b830b10e
Merge branch 'master' into 4.5.7
2012-08-13 06:57:54 -07:00
Tom Eastep
4b2d48d621
Hardwire AUTOHELPERS until 4.5.8.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-13 06:48:19 -07:00
Tom Eastep
50362040d7
Enable automatic helper association during 'stop'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-12 08:46:06 -07:00
Tom Eastep
2f1d59366c
Unconditionally disable kernel automatic helper association during start.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-12 08:43:28 -07:00
Tom Eastep
b372163122
Enable automatic helper association during 'stop'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-12 08:42:53 -07:00
Tom Eastep
50bd1d6398
Add AUTOHELPER option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-12 07:25:11 -07:00
Tom Eastep
e6ef32ebc2
Make conditional directives case insensitive
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-11 08:48:35 -07:00
Tom Eastep
a5824dc2d4
Optimize extension
...
- Eliminate short chains with a single reference.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-11 08:47:10 -07:00
Tom Eastep
b5af6f03fb
Create better rules when a HELPER appears in an action
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-11 07:48:03 -07:00
Tom Eastep
50dfffec94
Eliminate duplicate rules in raw-table chains when optimize level 16.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-10 07:09:01 -07:00
Tom Eastep
ad818c071a
Generate omnibus tracking rules when NAT/ACCEPT with helper appears in an action.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-10 06:55:18 -07:00
Tom Eastep
2ab50e65d7
Make conditional directives case insensitive
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-09 10:30:02 -07:00
Tom Eastep
4d3fbd1dfa
Allow '?IF 0'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-08 07:24:17 -07:00
Tom Eastep
e8a4728981
Allow '?IF 0'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-08 07:23:43 -07:00
Tom Eastep
ee28638604
Add HELPERS to rules file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-08 07:23:20 -07:00
Tom Eastep
a8495626b0
Merge branch '4.5.6' into 4.5.7
2012-08-07 15:10:15 -07:00
Tom Eastep
c6186571e5
Handle raw table zones from VSERVERS
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-07 15:09:40 -07:00
Tom Eastep
ccf517307e
Handle raw table zones from VSERVERS
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-07 14:51:58 -07:00
Tom Eastep
c007f847a0
Handle disabled helpers in pre-3.5 kernels.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-06 15:54:45 -07:00
Tom Eastep
b4c812b676
Correct helper parsing in the Raw module.
...
- Require (...) around multiple ctevents
- Detect invalid options
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-05 08:09:17 -07:00
Tom Eastep
9a0d53194a
Correct Helper detection in the compiler.
...
Use CT_MATCH when available.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-05 08:08:20 -07:00
Tom Eastep
093985dd93
Use HELPERS to enable/disable helper association.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-03 19:26:02 -07:00
Tom Eastep
72307df6d2
Replace the AUTOHELPERS option with the HELPERS option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-03 10:53:20 -07:00
Tom Eastep
7689b1e84b
Remove the 'zone' helper option for now.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-03 06:39:58 -07:00
Tom Eastep
82c057d1ed
Fix *VERSION handling.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 16:44:02 -07:00
Tom Eastep
21770a89d6
Detect which matches are available.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 15:38:23 -07:00
Tom Eastep
223ed5b3a3
More additions to the helper table and to the conntrack files.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 13:25:44 -07:00
Tom Eastep
9ba0c07956
Redesign the CT:helper feature.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 11:10:08 -07:00
Tom Eastep
7d32258e6e
Correct Helpers Module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 11:09:34 -07:00
Tom Eastep
07e56d129a
Add AUTOHELPERS option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 11:09:18 -07:00
Tom Eastep
62d6d2558e
Rename AUTO_COMMENT to AUTOCOMMENT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 11:06:41 -07:00
Tom Eastep
833e54c9c3
Rename the notrack file to conntrack
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-02 11:02:17 -07:00
Tom Eastep
f2dd43855e
Correct typo in warning message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-01 13:13:18 -07:00
Tom Eastep
eaf238fa66
Merge branch '4.5.6'
2012-08-01 10:37:45 -07:00
Tom Eastep
542f279544
Don't allow a source interface in a DNAT/REDIRECT rule with source == firewall
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-08-01 10:01:08 -07:00
Tom Eastep
735b7c2cf5
Add support for nfacct
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-28 11:21:16 -07:00
Tom Eastep
87c0f934aa
Add NFacct Match capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-28 08:19:05 -07:00
Tom Eastep
55b527d065
Eliminate a local variable.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-15 20:22:19 -07:00
Tom Eastep
e1e7ab42c1
Make 'routefilter' and 'sfilter' mutually exclusive
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-15 10:37:56 -07:00
Tom Eastep
65b16a1acf
Compensate for bugs in the latest CPerl emacs extension
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-15 10:07:06 -07:00
Tom Eastep
1db79a91eb
'rpfilter' option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-15 10:05:32 -07:00
Tom Eastep
e7cd84a72c
Implement rpfilter match capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-15 07:54:46 -07:00
Tom Eastep
2cce81cfc1
Revert 83a8c7eda3
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-09 10:58:15 -07:00
Tom Eastep
9f4ca3ebc5
Additional simplification of evaluate_expression()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-08 07:48:27 -07:00
Tom Eastep
3c2385de06
Merge branch '4.5.6'
2012-07-08 07:36:15 -07:00
Tom Eastep
6ce3d0180e
Ensure a defined value for __IPV[46]
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-07 09:47:10 -07:00
Tom Eastep
83a8c7eda3
When TC_ENABLED=No, require providers to process tcrules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-07 08:02:57 -07:00
Tom Eastep
83df8a4e39
Avoid a call to eval() for simple expressions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-06 07:26:54 -07:00
Tom Eastep
e9d8228b6f
Simplify handling of __IPVn in conditional directives.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-06 06:43:15 -07:00
Tom Eastep
65d8341c6c
Correct a comment
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-05 15:43:20 -07:00
Tom Eastep
61a9584433
Only require MANGLE_ENABLED to process the tcrules file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-04 14:45:24 -07:00
Tom Eastep
000cc6978a
Add missing 'sleep' when waiting for wildcard interface to come up
...
- Also reverse the order of test and sleep when waiting for a regular
interface to come up.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-03 08:06:30 -07:00
Tom Eastep
e4d66fb5fc
Back out redundant part of recent patch
...
- setup_traffic_shaping is only called when there are tc devices so the
test of @tcdevices in that function is redundant.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-03 06:33:46 -07:00
Tom Eastep
537f6c157c
Allow the compiler version to be tested in ?IF/?ELSIF
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-02 11:53:32 -07:00
Tom Eastep
a5b637b2a7
Use the correct filename in ?IF/?ELSIF exec call.
...
- Also extend a comment in the TC module
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-02 11:53:01 -07:00
Tom Eastep
09c00cf425
Don't print phoney progress message
...
- The 'Setting up Traffic Shaping' progress message was being issued when
traffic shaping was not enabled.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-07-01 08:27:07 -07:00
Tom Eastep
6ddaa0190e
Improve USER/GROUP validation.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-30 14:46:50 -07:00
Tom Eastep
5c176c64b7
Add an ORIGINAL DEST column to /etc/shorewall/masq
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-29 15:32:01 -07:00
Tom Eastep
b195884b1f
Insure that the correct filename/linenumber are printed in error messages out of process_conditional()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-29 09:01:26 -07:00
Tom Eastep
56d5ae2d41
Ensure that exclusion chains have DONT_MOVE
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-27 18:06:38 -07:00
Tom Eastep
0bf2753472
Re-implement conditional inclusion
...
- Correct defects
- Add ?ELSIF support
- Allow Perl-compatible expressions in ?IF
2012-06-27 15:15:44 -07:00
Tom Eastep
c90006ecf8
Correct another logical name bug -- this time in TC
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-27 11:34:19 -07:00
Tom Eastep
af302900c6
Prevent multiple 'tproxy' providers
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-23 17:09:46 -07:00
Tom Eastep
9aa78656ec
Add TPROXY_MARK to the output of 'shorewall show marks'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-23 07:57:39 -07:00
Tom Eastep
9d3766b77f
Allow fwmarks with 'classify' interfaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-20 14:04:48 -07:00
Tom Eastep
24ddae6ede
Don't use '--ctmark' when saving marks
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-20 13:30:27 -07:00
Tom Eastep
4d336ed8d6
Rewrite handling of the USER/GROUP column
...
- Remove code that handled '+program' as that support was removed from
the kernel in 2.6.14.
2012-06-19 08:14:31 -07:00
Tom Eastep
da3e1b720c
Apply user/group Id range patch from Gergely Risko
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-19 06:17:13 -07:00
Tom Eastep
7b4e5828e0
Clean up handling of RED options.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-18 12:17:22 -07:00
Tom Eastep
4c10fcd503
Complain if a RED_NONE option has a value specified.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-16 15:51:20 -07:00
Tom Eastep
5fc295e8cc
Fix handling of stab 'tsize' option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-14 15:44:15 -07:00
Tom Eastep
c5ba167a3e
Make CEIL optional
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-14 13:10:09 -07:00
Tom Eastep
6c47349689
Support 'red' queuing discipline
...
- Also added 'ls' support for HFSC
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-13 14:29:13 -07:00
Tom Eastep
d2c415c580
Make IFB work with logical interface names.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-13 13:48:12 -07:00
Tom Eastep
28ab3749ca
Allow fractional delays in TC
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2012-06-13 13:47:31 -07:00