Commit Graph

4537 Commits

Author SHA1 Message Date
Tom Eastep
ca8e99ed51 Correct implementation of the ALL section.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-16 14:10:21 -07:00
Tom Eastep
e5886abed1 Take care of oversights in the Stateless NAT implementation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-16 14:10:07 -07:00
Tom Eastep
c597eb25fc Delete QUOTA_MATCH
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-16 05:39:28 -07:00
Tom Eastep
bc706324e9 Add an ALL section to the rules files.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-15 15:32:24 -07:00
Tom Eastep
d5290fc881 Correct typo that caused an internal error
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-15 10:11:12 -07:00
Tom Eastep
0b2a8b12c7 Implement Stateless NAT support.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-14 12:01:17 -07:00
Tom Eastep
71480ff647 Validate nets in the netmap file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-13 15:59:42 -07:00
Tom Eastep
97121116a3 Add rawpost table detection
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-13 11:14:29 -07:00
Tom Eastep
37b08dd991 Merge branch '4.4.22' 2011-08-13 10:48:27 -07:00
Tom Eastep
dec4f4f186 Separate target and targetopts in add_ijump calls.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-13 09:56:14 -07:00
Tom Eastep
b1b323191c Merge branch '4.4.22' 2011-08-11 20:19:47 -07:00
Tom Eastep
786455b287 Unlink .bak file if no changes to .conf.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-11 20:19:30 -07:00
Tom Eastep
39c71418da Merge branch '4.4.22' 2011-08-10 09:34:37 -07:00
Tom Eastep
7708c251db Fix ECN when MANGLE_FORWARD is not available.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-10 09:34:15 -07:00
Tom Eastep
8eff66dcfd Fix handling or ORIGINAL DEST when CONNTRACK_MATCH is not available
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-10 07:12:13 -07:00
Tom Eastep
67c1fa1e63 Fix old state match 2011-08-08 20:35:55 -07:00
Tom Eastep
8fe064914b Fix old state match 2011-08-08 20:32:02 -07:00
Tom Eastep
4824c9b8ff Add QUOTA_MATCH capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-08 14:37:47 -07:00
Tom Eastep
35457f4e95 Remove she-bang from lib.*
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-03 07:54:46 -07:00
Tom Eastep
b0fe8e1e60 Merge branch '4.4.22' 2011-08-03 07:20:57 -07:00
Tom Eastep
a548bddea8 Remove she-bang from first line of prog.header*
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-03 07:20:34 -07:00
Tom Eastep
679de4ccf6 Apply Orion Poplawski's 'qtnoin' patch
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-02 16:51:49 -07:00
Tom Eastep
50a29f6858 Correct detection of OLD_IPSET_MATCH when LOAD_MODULES_ONLY=No
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-02 11:58:54 -07:00
Tom Eastep
ae0cffa588 Fix handling of zone names beginning with 'all' 2011-08-02 09:13:23 -07:00
Tom Eastep
d358285d56 Remove obsolete comment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-31 11:34:46 -07:00
Tom Eastep
f675513383 Make 'build' work on a Mac
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-30 10:57:32 -07:00
Tom Eastep
512273fa91 Avoid undefined reference in Shorewall::rules::save_policies
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-30 07:04:42 -07:00
Tom Eastep
42ae3ba581 Cleaner fix for TCP_FLAGS_DISPOSITION
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-30 06:57:18 -07:00
Tom Eastep
d9fe6e7a42 Handle missing TCP_FLAGS_DISPOSITION setting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-28 15:56:34 -07:00
Tom Eastep
6c025d20c9 Fix Shorewall6 Kernel Version test
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-28 15:53:35 -07:00
Tom Eastep
a992ec594a Accomodate kernel version 3.0
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-27 17:03:27 -07:00
Tom Eastep
33f7822df9 Correct 'action' editing RE in parameterized actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-25 09:16:22 -07:00
Tom Eastep
a18c502796 Correct reference counting in one more place in expand_rule()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-25 07:42:01 -07:00
Tom Eastep
ecd2e2276e Add some comments and remove extra whitespace
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-25 06:56:05 -07:00
Tom Eastep
215e923562 A little cleanup
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 16:17:22 -07:00
Tom Eastep
703bc88bfd Move merge_rules() back to where it was.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 15:06:42 -07:00
Tom Eastep
6300d6cbfc Validate 'action' parameter to the new parameterized actions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 11:46:57 -07:00
Tom Eastep
ac5a6f4471 Cleanup of progress messages
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 09:13:46 -07:00
Tom Eastep
f2c9647579 Set empty target in rules created via add_irule()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 08:28:43 -07:00
Tom Eastep
e693665be1 Add correct reference counting to merge_rules()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 08:03:45 -07:00
Tom Eastep
ea4b8cdb6f Exempt policy chains from optimization level 8.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 16:34:01 -07:00
Tom Eastep
b789d825f8 Unify the setting of $targetref and $jump
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 14:47:16 -07:00
Tom Eastep
83e6e2f105 Another fix for reference counting.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 13:54:56 -07:00
Tom Eastep
028fc20741 Correct reference accounting when long port lists are split
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 07:31:58 -07:00
Tom Eastep
3d616980a6 Don't delete the {target} member in clear_rule_target() but instead set it to ''
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 07:30:56 -07:00
Tom Eastep
567993292f Some efficiency changes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 17:48:14 -07:00
Tom Eastep
5764e7899b Rename combined chains created by optimization level 8
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 14:12:03 -07:00
Tom Eastep
22463e451d More efficient method of generating rule strings for comparison
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 11:06:29 -07:00
Tom Eastep
1d24f28c83 Rename %special -> %opttype
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 11:06:03 -07:00
Tom Eastep
bfd63dcace Revert LOGLIMIT conversion change
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 07:53:30 -07:00
Tom Eastep
2adf2883d5 Revert addition of do_i functions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 07:23:13 -07:00
Tom Eastep
5e190f4e4e Implement '_i' equivalents of all do_ functions.
Also implements handling of long port lists in new-format rules.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 06:22:52 -07:00
Tom Eastep
0791ea6698 Make 'KLUDGEFREE' a global to make it faster to test.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-21 12:57:20 -07:00
Tom Eastep
4eeb233d95 A little reorg to prepare for moving long port list remediation to the new chain structure.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 18:52:20 -07:00
Tom Eastep
705ffbca49 Fix for LOGMARK(<list>)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 17:33:31 -07:00
Tom Eastep
a7ab53e135 Trap '!' in port columns.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 15:55:18 -07:00
Tom Eastep
32a8b254a0 Some optimizations in the new rule infrastructure
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 15:53:00 -07:00
Tom Eastep
ca655a6f52 Use add_ijump for all jump 'irules'.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 07:30:49 -07:00
Tom Eastep
12b5aa687b More conversion to new rule interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-19 11:58:10 -07:00
Tom Eastep
f8be76f471 Make LOGMARK work without a parameter.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-19 11:57:12 -07:00
Tom Eastep
8b56e16bf9 Fix LOGMARK
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-19 06:54:41 -07:00
Tom Eastep
58de3dd3c1 Fix :persistent and :random in /etc/shorewall/masq
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 15:35:07 -07:00
Tom Eastep
346df62cc6 Support long-form iptables options.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 13:47:52 -07:00
Tom Eastep
796f3b6668 Correct cmdlevel settings in irules.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 10:05:39 -07:00
Tom Eastep
1e89074bf8 Correct tracing of nested rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 09:46:41 -07:00
Tom Eastep
a80b04bd74 Correct formatting of empty arguments to add_commands
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 09:45:59 -07:00
Tom Eastep
bfd69c33c7 Correctly format empty arguments to add_commands()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 09:19:52 -07:00
Tom Eastep
043fb8757c Convert Rules.pm infrastructure to use the new rule interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 08:29:42 -07:00
Tom Eastep
7aa7cd54c2 Convert Providers.pm to use the new rules interface.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 07:43:25 -07:00
Tom Eastep
3c60f107b7 Convert generate_matrix() to use the new rules interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 07:24:21 -07:00
Tom Eastep
2efa2796d3 More new rule interface calls in the Misc module
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 15:12:58 -07:00
Tom Eastep
b2305ca9cf Convert Tunnels file to use irules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 11:33:01 -07:00
Tom Eastep
a211f8fd0f Infrastructure for new rule interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 10:37:15 -07:00
Tom Eastep
f3f535abac POC of new rule interface
Also removed FAKE_AUDIT option

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 08:35:09 -07:00
Tom Eastep
950c32d46b Convert add_commands() calls to the equivalent add_rule() calls.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 16:31:29 -07:00
Tom Eastep
03913019d8 Mark DHCP rules for the convenience of move_rules().
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 15:34:57 -07:00
Tom Eastep
27621fa0f9 Impose some structure on setting rule options
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 14:46:34 -07:00
Tom Eastep
0f742187ae Implement intermediate rule representation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 09:41:53 -07:00
Tom Eastep
9661b445f2 Make install/uninstall files version independent
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-13 07:29:47 -07:00
Tom Eastep
d1b8d7b953 Make perl modules version-neutral
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-10 15:10:27 -07:00
Tom Eastep
11c580de54 Fix exclusion in IPv6 hosts file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 17:27:09 -07:00
Tom Eastep
e21ff03339 Fix ipsets in IPv6 hosts file
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 16:17:35 -07:00
Tom Eastep
fbeddca6a4 Another IPv6 ipset issue (z:!+set in the DEST column)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 15:40:18 -07:00
Tom Eastep
a998476d00 Correct Accounting module version
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 07:08:47 -07:00
Tom Eastep
6c802d3353 Tighten up source and dest checking in expand_rule()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 07:08:39 -07:00
Tom Eastep
1f30976790 Correct change that tightened editing of IPv6 addresses
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 18:34:33 -07:00
Tom Eastep
22f1d1ba89 Another fix for IPv6 and IPSETs
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 16:31:35 -07:00
Tom Eastep
a8daff0008 Correct handling of <interface>:+<ipset> in Shorewall6.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 15:57:08 -07:00
Tom Eastep
b70666eaf6 Move .spec files to release/
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 10:07:08 -07:00
Tom Eastep
27b99a62d0 Move known problems file to release sub-directory
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 09:14:54 -07:00
Tom Eastep
76c97a1cc4 Move release documents to their own directory 2011-07-07 15:51:50 -07:00
Tom Eastep
7fa59706c5 Correct TPROXY/IPv6 address fix
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-07 14:50:44 -07:00
Tom Eastep
3f903fe3f1 Allow IPv6 Address as the third argument to TPROXY
- also update the manpages to describe TPROXY

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-07 06:43:16 -07:00
Tom Eastep
cf5613441d Correct loading of xt_ipset
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-05 15:57:14 -07:00
Tom Eastep
95acabe97e Make load and reload use the .conf file in the CWD
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-05 15:56:38 -07:00
Tom Eastep
1c199a2644 Add semicolons in new actions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 14:59:07 -07:00
Tom Eastep
20cee7649e Change quotes in action.Broadcast 2011-07-04 13:32:32 -07:00
Tom Eastep
a355141f40 Correct typo in .spec files
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 13:13:52 -07:00
Tom Eastep
87870ad121 Add new actions to the .spec file 2011-07-04 13:01:49 -07:00
Tom Eastep
e1d8d71348 Version to 4.4.22 Beta 1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 09:36:54 -07:00
Tom Eastep
dd353eeafb Allow optimizatin of Invalid and NotSyn chains
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 07:50:25 -07:00
Tom Eastep
c4ba1089e6 Don't include IPv6 code in Shorewall/action.Broadcast
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 07:49:38 -07:00
Tom Eastep
6be8c08673 Create action chain without leading % when possible
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 07:48:52 -07:00
Tom Eastep
863881841a Add action.Invalid and action.NotSyn and modify action.Drop and action.Reject to use them
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 17:14:36 -07:00
Tom Eastep
1536ff4b92 Corrections to dropBcast/allowBcast
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 15:58:19 -07:00
Tom Eastep
bd1d7d6f92 Don't quote the empty setting of LOGLIMIT
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 15:55:45 -07:00
Tom Eastep
f96c32634c Make config file quoting more consistent with update
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 15:55:27 -07:00
Tom Eastep
befc8a00f6 Create parameterized action.Broadcast
- replace invocations of dropBcast with invocations of Broadcast(DROP,...)

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 08:58:30 -07:00
Tom Eastep
24deabb03f Merge branch '4.4.21' 2011-07-03 08:48:27 -07:00
Tom Eastep
9691a8ceb3 Don't collapse '-' and '--' in @actparms
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 08:47:53 -07:00
Tom Eastep
029ac610fe Merge branch '4.4.21' 2011-07-03 07:23:09 -07:00
Tom Eastep
d31e2d67ba DEFAULTS directive enforces max number of parameters
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 07:22:29 -07:00
Tom Eastep
62c62441bb Eliminate duplicate function definitions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 07:04:52 -07:00
Tom Eastep
d99090978d Merge branch '4.4.21' 2011-07-03 06:40:08 -07:00
Tom Eastep
5b06e88b3d Push/Pop comment during action processing
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 06:37:41 -07:00
Tom Eastep
7e3f97c154 Prepare for more parameterized actions
- Export add_commands, incr_cmd_level and decr_cmd_level by default
- Move ensure_audit_chain and require_audit from Rules.pm to Chains.pm
- Add get_action_logging() function
- Export require_capability and have_capability by default

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-03 06:22:51 -07:00
Tom Eastep
ad71faacaa Correct push_action_params()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 17:02:39 -07:00
Tom Eastep
42aa3724af Trace system calls when debugging
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 08:37:57 -07:00
Tom Eastep
4ea8a65cd9 Trace system calls when debugging
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 08:27:17 -07:00
Tom Eastep
afa5ea3fd2 Minor tweaks to Config.pm
- Look for unprintable gunk in lines processed by split_line1()
- Modify a comment
- replace awkward close/assert statement

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 08:10:43 -07:00
Tom Eastep
bd9bf3d43a Rename & export get_actionchain() -> get_action_chain()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-02 07:02:18 -07:00
Tom Eastep
c309ca3075 Revert "Simplify push_action_params()"
This reverts commit 89ee25dde2.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-01 16:23:39 -07:00
Tom Eastep
8ab45b4de3 Save current action chain along with params. Add get_action_chain()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-01 16:21:36 -07:00
Tom Eastep
89ee25dde2 Simplify push_action_params()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-01 15:38:39 -07:00
Tom Eastep
981c9a9047 Minor rewording in the release notes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-01 13:03:33 -07:00
Tom Eastep
ea22d79aeb Update the version of Providers.pm 2011-06-30 18:40:48 -07:00
Tom Eastep
6ff02dbaa3 Make 'fallback' and 'balance' mutually exclusive
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-30 10:00:01 -07:00
Tom Eastep
7f255313d9 Document fix for TPROXY
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-29 20:29:18 -07:00
Tom Eastep
f09d286738 Correct script generation problem with TPROXY
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-29 20:05:27 -07:00
Tom Eastep
3e8c1f4e3c Add undocumented -c option to show and dump
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-29 11:48:23 -07:00
Tom Eastep
cbeebb6bf8 Bump version to 4.4.21.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-29 11:36:04 -07:00
Tom Eastep
20283d7151 Update Change log with RC 1 changes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-29 11:34:53 -07:00
Tom Eastep
ea038bcecb Correct regular expression in process_shorewall_conf()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-28 06:42:41 -07:00
Tom Eastep
05103bacd0 Don't expand single-quoted .conf option values
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-26 07:45:09 -07:00
Tom Eastep
0b431aa8c1 Minor tweaks to Config.pm
- Add/revise comments
- Rename $line -> $lineref in expand_variables()
- Collapse 3 lines into one in process_shorewall_conf()
2011-06-26 06:50:22 -07:00
Tom Eastep
7507c81882 Remove some whitespace
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-25 21:55:49 -07:00
Tom Eastep
9f37f09b28 Clean up variable expansion:
1) Centralize code in function expand_variables()
2) Eliminate %rawconfig
3) Correct logic in update_config_file() - the defect was not observable
   but the code was clearly silly
2011-06-25 21:08:32 -07:00
Tom Eastep
47c759d93c Convert %actparms to an array
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-25 11:39:13 -07:00
Tom Eastep
024c1fbd08 Validate first argument to the default actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-25 10:51:17 -07:00
Tom Eastep
713af61380 Detect too many parameters to Drop and Reject 2011-06-25 10:38:01 -07:00
Tom Eastep
5740b69dc6 Fix another empty parameter list issue 2011-06-25 09:46:58 -07:00
Tom Eastep
fe2ef23f04 Correct install.sh
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 21:16:55 -07:00
Tom Eastep
f4acb5fa2f Install annotated and un-annotated config files
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 15:13:40 -07:00
Tom Eastep
19c1f388a7 Modify Debian test in update
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 15:01:25 -07:00
Tom Eastep
fb2085b0c3 Support 'update' on Debian
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 13:40:32 -07:00
Tom Eastep
ca9276fd7e Add quotes on deprecated and obsolete options if appropriate
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 11:47:34 -07:00
Tom Eastep
129d1739d1 Cosmetic changes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 07:58:46 -07:00
Tom Eastep
7583a5c7a3 Use updated values in configuration verification
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 07:22:41 -07:00
Tom Eastep
7ec5f60571 Document FOREWARD->FORWARD typo correction
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 07:21:12 -07:00
Tom Eastep
11b847f3a4 Correct spelling in an error message (FOREWARD -> FORWARD)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 06:22:16 -07:00
Tom Eastep
4c9417d5f6 Add ipset support in Shorewall6 to the highlights section.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-24 06:21:42 -07:00
Tom Eastep
6f68ed5508 Initiate 4.4.21 RC 1 2011-06-23 16:23:52 -07:00
Tom Eastep
ba9a0016a8 Move update_config_file() to before process_shorewall_conf()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-23 06:37:21 -07:00
Tom Eastep
de7d95e7ff Rename 'ipset v4' -> 'ipset v5'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-23 06:36:35 -07:00
Tom Eastep
04d551d8ca Detect ipset V4 and use its syntax
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 16:43:42 -07:00
Tom Eastep
000268f50c Smarten up action.Drop and action.Reject WRT omitted parameters
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 15:45:14 -07:00
Tom Eastep
a5167dcd28 Update header documentation in action.Drop and action.Reject
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 14:27:32 -07:00
Tom Eastep
7ef7490cd6 Change the compiler's default for LEGACY_FASTSTART
- No visible effect since the compiler doesn't use this option
2011-06-22 13:56:17 -07:00
Tom Eastep
1b3d7947b8 Update the .conf file before validating ('update' command)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 12:31:58 -07:00
Tom Eastep
ba7d5fd720 Avoid two-stage processing of shorewall.conf when not updating.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 10:56:25 -07:00
Tom Eastep
106ba52362 Change signature of get_action_params
- Accepts a number of parameters rather than a list
- Change action.Drop and action.Reject accordingly
- Define correct number of parameter variables in action.Drop and action.Reject

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 08:27:01 -07:00
Tom Eastep
0d2e2a14d3 Document additional parameters to standard default actions and DEFAULT in macro files
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 08:05:13 -07:00
Tom Eastep
62a75cb98d Fix parameterization of standard default actions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 07:51:42 -07:00
Tom Eastep
b43bee2c62 Streamline PERL in action.Drop and action.Reject
- Rename read_action_param => get_action_params
- Allow it to accept a list of indexes and to return a list

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 06:53:15 -07:00
Tom Eastep
bbf853bd1d Cleaner handling of DEFAULTS in a non-action context
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-22 06:11:20 -07:00
Tom Eastep
ece598288f Disallow DEFAULTS in the rules file 2011-06-21 21:00:08 -07:00
Tom Eastep
d51ca478bd Reverse one hunk from empty-parameter fix
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-21 11:45:32 -07:00
Tom Eastep
fe9e2ba28d Correct error message 2011-06-20 19:47:33 -07:00
Tom Eastep
063e21e69f Allow an empty parameter list in an action (e.g., "Action()")
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 19:45:01 -07:00
Tom Eastep
71d88b93a0 Make IPv6 Dynamic Zone set names unique
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 17:22:34 -07:00
Tom Eastep
7b2cbf2449 Make 'show dynamic <zone>' work correctly with new ipset program
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 17:22:04 -07:00
Tom Eastep
39e74911d8 Improve generated code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 14:34:26 -07:00
Tom Eastep
ec28bdb5a0 Document Shorewall6 support for dynamic zones.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 14:33:49 -07:00
Tom Eastep
44cbfd8f27 Correct defects found while unit testing IPv6 Dynamic Zones
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 13:33:25 -07:00
Tom Eastep
119d38c92b Enable dynamic zones for IPv6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 10:41:29 -07:00
Tom Eastep
785de281b5 More IPv6 ipset fixes
- use 'family inet6' rather than 'family ipv6'
- Correct one more case of 'iphash' vs 'hash:ip family inet6'
- Encapsulate ipset -N into an 'ensure_ipset()' function

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-20 07:43:32 -07:00
Tom Eastep
4c2f12e645 Some whitespace changes 2011-06-19 19:08:32 -07:00
Tom Eastep
e4bcc12301 Use 'here documents' rather than single quotes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 18:33:10 -07:00
Tom Eastep
2097d0f4a0 Accomodate new syntax of ipset saved commands
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 14:06:42 -07:00
Tom Eastep
46d64e39d1 Use correct syntax to create IPv6 ipsets.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 14:04:53 -07:00
Tom Eastep
be6b08f835 Be sure to detect IPSET_MATCH before OLD_IPSET_MATCH.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 13:29:10 -07:00
Tom Eastep
d12336ec78 Reword 'update' description.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 13:28:17 -07:00
Tom Eastep
ee384d03ce Allow Shorewall-init to save/restore ipset contents
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 10:10:59 -07:00
Tom Eastep
7753f798b0 Bump Version to Beta 3
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 10:09:53 -07:00
Tom Eastep
2769b09f64 Correct typeos in shorewall and shorwall6 2011-06-19 08:39:44 -07:00
Tom Eastep
c264aaae6b Update module versions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 07:41:26 -07:00
Tom Eastep
4916610033 Rename upgrade => update
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-19 07:14:27 -07:00
Tom Eastep
df2f7ec6a5 Implement 'upgrade' and delete the '-u' and '-a' options of 'check'.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 17:39:44 -07:00
Tom Eastep
55242d1ed6 Add a few comments
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 16:55:00 -07:00
Tom Eastep
d66c7d478e Eliminate expansion of shell variables in the upgraded config file
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 16:33:41 -07:00
Tom Eastep
380443f26d Eliminate %defaults
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 15:44:07 -07:00
Tom Eastep
faeb2da2ba Corrections to Defaults
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 15:38:08 -07:00
Tom Eastep
f93ac02bfc Provide default values for added entries
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 14:50:07 -07:00
Tom Eastep
96f6dc3558 More defined => supplied changes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 13:08:26 -07:00
Tom Eastep
6f2cc31dde Implement .conf file upgrade
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 13:03:55 -07:00
Tom Eastep
e5d8be5aa5 Bump version to Beta 2
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 11:23:43 -07:00
Tom Eastep
d23f932ebe Don't generate INPUT hairpin rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-18 06:21:36 -07:00
Tom Eastep
f9ee8c494d Exempt wildcard interfaces from sfilter
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-14 06:45:22 -07:00
Tom Eastep
9aedd407cc Quell compiler warnings from Perl 5.14.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-13 06:40:03 -07:00
Tom Eastep
10ae91b600 Delete deprecated options from the .conf files
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-12 13:46:26 -07:00
Tom Eastep
8780aff7f2 Rename PLAIN->ANNOTATED 2011-06-12 09:45:50 -07:00
Tom Eastep
65d4709372 Drop IPv6 IPSET support for now 2011-06-12 09:14:33 -07:00
Tom Eastep
785bd7c987 Apply Tuomo Soini's patch
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-12 07:22:26 -07:00
Tom Eastep
9ab901927f Use supplied() where appropriate
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 16:14:31 -07:00
Tom Eastep
774aac1228 Add a supplied() function
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 15:40:55 -07:00
Tom Eastep
b7a3142620 Document parameterized default actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 15:25:48 -07:00
Tom Eastep
a60fe6e665 Allow parameters to be specified to Default Actions in the policy file
and in shorewall.conf.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 14:58:54 -07:00
Tom Eastep
68bf99ec69 Parameterize the standard default actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 08:34:37 -07:00
Tom Eastep
3dd363677c Implement set_action_param
Export both set_action_params and read_action_param by default

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 08:33:21 -07:00
Tom Eastep
8b6a7a7053 Implement read_action_param()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 07:49:57 -07:00
Tom Eastep
f278d05637 Rename action param functions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 07:46:54 -07:00
Tom Eastep
2549982528 Fix DEFAULTS
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 07:23:41 -07:00
Tom Eastep
af1898b17b Document default values for parameters
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-11 07:18:11 -07:00
Tom Eastep
6e6be468a9 Support for DEFAULT statements in actions 2011-06-10 17:05:09 -07:00
Tom Eastep
32c7d36cd0 Make zones with multiple interfaces complex
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-10 15:37:26 -07:00
Tom Eastep
dbd30f981c Set the interface routeback option if there are any IP host groups with 'routeback'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-10 15:37:09 -07:00
Tom Eastep
8a7ad569e4 Don't leave unused sfilter chains in the config
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 17:22:48 -07:00
Tom Eastep
3e9a54d404 Couple of tweaks
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 17:22:34 -07:00
Tom Eastep
a0b0c5bdac Jump (don't go) to sfilter1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 14:24:44 -07:00
Tom Eastep
1399a8ffde Don't move rules from a chain with references
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 14:24:38 -07:00
Tom Eastep
9555a552c2 Fix FORWARD with ipsec dest
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 14:24:08 -07:00
Tom Eastep
71177c3ca3 Exempt ipsec from sfilter
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-09 07:27:06 -07:00
Tom Eastep
fa2746d469 Apply sfilter to INPUT as well as FORWARD
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-08 09:40:28 -07:00
Tom Eastep
35d1586672 Correct sfq handle assignment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 13:58:45 -07:00
Tom Eastep
a3968beb7e Add fix inadvertently dropped from 4.4.19.4
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 13:57:52 -07:00
Tom Eastep
0e839f3d7b Initiate 4.4.21
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 09:54:35 -07:00
Tom Eastep
9fb2ab718c Have AUTOMAKE follow CONFIG_PATH
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 08:51:36 -07:00
Tom Eastep
9c2c562bf5 Correct autorepeat wart
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-07 06:45:50 -07:00
Tom Eastep
cf0275a049 Make FAKE_AUDIT work again 2011-06-06 16:08:29 -07:00
Tom Eastep
59c11e205b Update release notes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 15:48:26 -07:00
Tom Eastep
642319d706 Change annotated documentation default
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 15:40:21 -07:00
Tom Eastep
cfb3d6a801 Merge branch '4.4.20' 2011-06-06 14:09:26 -07:00
Tom Eastep
6136e986cf Update version to 4.4.20.1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 14:08:25 -07:00
Tom Eastep
186f89f387 Merge branch '4.4.20' 2011-06-06 13:23:47 -07:00
Tom Eastep
e8f61e2109 Restate vulnerability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 13:19:40 -07:00
Tom Eastep
447d0f0b2d Don't modify the .conf file installed in configfiles.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 09:46:52 -07:00
Tom Eastep
c42c6864b4 Don't modify the .conf file installed in configfiles.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 09:46:22 -07:00
Tom Eastep
2803d3ee0b Merge branch '4.4.20' 2011-06-06 07:02:57 -07:00
Tom Eastep
c2e78bfaf8 Correct address of the FSF
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-06 06:55:40 -07:00
Tom Eastep
aabefe91f1 Merge branch '4.4.20' 2011-06-04 08:46:40 -07:00
Tom Eastep
f1cbfab7ac More blacklist/audit fixes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-04 08:45:23 -07:00
Tom Eastep
653a61a04a Merge branch '4.4.20' 2011-06-04 07:44:24 -07:00
Tom Eastep
a9c0824a30 Correct BLACKLIST_DISPOSITION=A_xxx with BLACKLIST_LOG_LEVEL
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-04 07:44:07 -07:00
Tom Eastep
aa86b65ec3 Merge branch '4.4.20' 2011-06-02 11:44:15 -07:00
Tom Eastep
254e1ed784 Add 'I' STATE to secmarks
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 11:43:55 -07:00
Tom Eastep
c3b56c1e73 Merge branch '4.4.20' 2011-06-02 10:07:03 -07:00
Tom Eastep
561d461a25 Add 'NI' STATE setting in secmarks.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 10:06:27 -07:00
Tom Eastep
169c995940 Fix a typo in the release notes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 06:50:10 -07:00
Tom Eastep
1e883c2fdf Merge branch '4.4.20' 2011-06-02 06:47:09 -07:00
Tom Eastep
086a99ea24 Don't initialize PLAIN
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 06:23:57 -07:00
Tom Eastep
f9c5b8b0d5 Improve some comments
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-02 06:23:37 -07:00
Tom Eastep
36aee407ef Merge branch '4.4.20' 2011-06-01 13:01:27 -07:00
Tom Eastep
5f08605adc Delete some cruft
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-01 12:26:05 -07:00
Tom Eastep
faff915dd2 Fix a typo in the release notes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-01 06:53:09 -07:00
Tom Eastep
b30d1bfc48 Merge branch '4.4.20' 2011-06-01 06:34:43 -07:00
Tom Eastep
f253bb5a11 Corrections to release notes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-06-01 06:31:02 -07:00
Tom Eastep
243a09783c Merge branch '4.4.20' 2011-05-31 15:45:09 -07:00
Tom Eastep
7bf74bb8c9 Add new builtin targets to %builtin_target
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 15:43:42 -07:00
Tom Eastep
21d2c5720b Clarify 'bridge_nf_call_*'; mention that problems corrected in 4.4.19 dot releases are included
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 12:22:45 -07:00
Tom Eastep
468ff6efab First cut at IPSET/Dynamic-zone support in Shorewall6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 11:23:43 -07:00
Tom Eastep
8df470b5f5 Version to 4.4.20 2011-05-31 09:30:18 -07:00
Tom Eastep
5ce3a1f4d1 Update release documents
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 07:03:56 -07:00
Tom Eastep
2f6c5fd260 Set 'bridge-nf-call-ip6?tables' if bridges are configured.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-31 06:59:43 -07:00
Tom Eastep
4f296b62ae Another fix for auditone 2011-05-30 16:37:56 -07:00
Tom Eastep
e6275ba31d Fix a bug in auditing
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 15:28:00 -07:00
Tom Eastep
d89a915f26 Load IPv6 libraries when processing /etc/shorewall6/params
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 13:24:36 -07:00
Tom Eastep
2dec3a8ecb Correct handling of AUDIT_TARGET is both cli libraries.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 11:39:21 -07:00
Tom Eastep
26d08b92c0 Correct use of null value as a hash
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 11:38:49 -07:00
Tom Eastep
b0447b8bd3 Remove another MACLIST defect 2011-05-30 08:49:41 -07:00
Tom Eastep
7b560eefe4 Allow compound options in the installers
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 08:15:59 -07:00
Tom Eastep
60d33740f6 Fix MACLIST_DISPOSITION defect introduced earlier in this release
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-30 07:59:44 -07:00
Tom Eastep
11c209c55f Restore access to $Shorewall::Rules::family 2011-05-29 17:22:36 -07:00
Tom Eastep
2852cdeb53 Another attempt at the IPMARK fix 2011-05-29 14:42:23 -07:00
Tom Eastep
a71136fd5a Rework configuration files for Shorewall and Shorewall6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-29 14:34:18 -07:00
Tom Eastep
7404d912bd Add LOGRATE to */shorewall.conf 2011-05-28 19:12:34 -07:00
Tom Eastep
ec01e39479 Add LOGBURST to */shorewall.conf 2011-05-28 19:03:18 -07:00
Tom Eastep
9dc689dd13 Sort Sample .conf files 2011-05-28 12:38:12 -07:00
Tom Eastep
6d3640dafc Alphabetize config files and sync files and manpages
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-28 10:34:54 -07:00
Tom Eastep
03ecdc8c06 Clean up shorewall.conf and its documentation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-28 09:10:46 -07:00
Tom Eastep
243e8f1dbe Fix check for unreferenced 'sfilter' chain 2011-05-28 08:31:36 -07:00
Tom Eastep
fc34f07a7a Remove PKTTYPE option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-28 07:11:48 -07:00
Tom Eastep
a37dbf76dc Delete 'sfilter' chain if it isn't referenced
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 19:56:54 -07:00
Tom Eastep
1a2c9a08e1 Don't include comment in audit chain rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 19:56:04 -07:00
Tom Eastep
5082b0701a Get release notes changes for filter->sfilter 2011-05-27 19:43:13 -07:00
Tom Eastep
bac640e731 Get changes from 4.5.0 branch 2011-05-27 19:42:09 -07:00
Tom Eastep
586a3537bf Delete 'sfiter' chain if it doesn't have referenes 2011-05-27 19:38:03 -07:00
Tom Eastep
790c96c90a Version to RC 1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 09:11:47 -07:00
Tom Eastep
c6e9de65f1 Prevent duplicate 'filter' rules when combining two interface chains
into the same zone forwarding chain.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 06:43:47 -07:00
Tom Eastep
8a0dc9f0f6 Clean up release notes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-27 06:42:56 -07:00
Tom Eastep
fbfe7b9f93 Don't create 'reject' and AUDIT' in the 'stopped' case.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-26 14:11:36 -07:00
Tom Eastep
0287d96aa2 Finish filtering implementation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-26 13:38:44 -07:00
Tom Eastep
6c3163cc27 Routeback corrections
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-25 10:45:57 -07:00
Tom Eastep
e4d667ca6a Add routeback protection
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 17:07:31 -07:00
Tom Eastep
bbe165c3cf Bump version to Beta 5
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 11:40:11 -07:00
Tom Eastep
0beb327f0a Rename audited actions and Macros
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 11:31:42 -07:00
Tom Eastep
84b844ae79 Implement -T option for compile and check
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 10:21:49 -07:00
Tom Eastep
ee98772349 Add -c to the start command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 09:13:02 -07:00
Tom Eastep
021048379f Additions to the Beta 4 Documentation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 08:54:43 -07:00
Tom Eastep
e6c1de3829 Correct ADrop action
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 07:47:42 -07:00
Tom Eastep
d4b2a462a2 Add audited actions to the .spec files
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 07:30:46 -07:00
Tom Eastep
704f3fdd55 Document audited default actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 07:24:15 -07:00
Tom Eastep
c333368243 Create Audited versions of the IPv4 standard default actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-24 07:09:15 -07:00
Tom Eastep
f464ec5624 Fixes for AUDIT
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 20:59:33 -07:00
Tom Eastep
016f7d9f2a Yet more shorewall/shorewall6 unification
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 16:41:51 -07:00
Tom Eastep
a64d882a36 Apply Ed W's first patch
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 14:36:21 -07:00
Tom Eastep
c050b29985 Factor some similar code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 14:20:14 -07:00
Tom Eastep
0a11a0e2ad Add xt_AUDIT to modules.xtables
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 12:08:51 -07:00
Tom Eastep
3ab35c65b0 Correct LEGACY_FASTSTART error messages in shorewall and shorwall6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 11:24:52 -07:00
Tom Eastep
15e9e3182d Update copyrights
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 10:06:56 -07:00
Tom Eastep
31e74658c8 Update copyrights
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 09:51:51 -07:00
Tom Eastep
0704f7ca59 Clarify the problem corrected
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 09:25:19 -07:00
Tom Eastep
2d574fff10 Tweak wording
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 06:56:54 -07:00
Tom Eastep
7c250cd5b3 Clean up release notes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 06:55:54 -07:00
Tom Eastep
54f9a0e671 Correct and expand the Problems Corrected section of the release notes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 06:43:31 -07:00
Tom Eastep
3b28fcd566 Remove documentation disclaimer from release notes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 06:41:32 -07:00
Tom Eastep
485a7fb29d Implement 'restart -c'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-23 06:39:26 -07:00
Tom Eastep
e95003b82a Add FAKE_AUDIT option 2011-05-22 17:42:50 -07:00
Tom Eastep
5d04c93a16 Implement LEGACY_FASTSTART option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-22 15:36:29 -07:00
Tom Eastep
981b503fa4 Bump version to Beta 4 2011-05-22 11:05:22 -07:00
Tom Eastep
c56fe3448a Update release documents 2011-05-22 11:03:57 -07:00
Tom Eastep
529e256856 Assigned unused dev numbers 2011-05-22 10:18:26 -07:00
Tom Eastep
db6091f101 Avoid dependence on 'make' 2011-05-22 09:47:57 -07:00
Tom Eastep
99cb09bd84 Documentation update 1 for AUDIT supportttt
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-21 16:25:38 -07:00
Tom Eastep
83cdf78b18 Replace A_* builtin actions with builtin targets
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-21 15:02:04 -07:00
Tom Eastep
d9b095bdea Document new features 2011-05-21 12:07:23 -07:00
Tom Eastep
71ef1f48e2 Allow auditing of the builtin actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-21 10:38:25 -07:00
Tom Eastep
82d6a00c9e Implement some extentions to AUDIT
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-21 09:25:58 -07:00
Tom Eastep
61b5dbbb95 Eliminate cruft left over from when Action.pm and Policy.pm were folded into Rules.pm - Phase II
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:48:28 -07:00
Tom Eastep
f64e171c19 Eliminate cruft left over from when Action.pm and Policy.pm were folded into Rules.pm
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:46:18 -07:00
Tom Eastep
ac2e9cce64 Shrink process_actions2 further.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:28:30 -07:00
Tom Eastep
676af32ebc Simplify a loop in process_actions2()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 10:11:23 -07:00
Tom Eastep
7cbf113ba0 Simplify an RE
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-20 08:33:36 -07:00
Tom Eastep
d15475efae Cleanup of AUDIT before Beta 3
- Correct merge snafus
- Rename the new actions (e.g., ADROP->A_DROP)
- Correct MACLIST_DISPOSITION logic
2011-05-20 07:47:35 -07:00
Tom Eastep
e9df13a42b Resolve merge conflicts 2011-05-19 15:10:22 -07:00
Tom Eastep
2e93b95afe Clean up release notes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-19 14:57:16 -07:00
Tom Eastep
5e68dbfa9a Complete first attempt at AUDIT support
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-19 12:06:43 -07:00
Tom Eastep
814494e277 More AUDIT changes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-19 08:35:40 -07:00
Tom Eastep
d2ab27c071 More AUDIT changes 2011-05-18 21:25:57 -07:00
Tom Eastep
ce8df2f66c Revert "Bump version to Beta 3"
This reverts commit 465e729288.
2011-05-18 17:50:12 -07:00
Tom Eastep
465e729288 Bump version to Beta 3 2011-05-18 17:08:07 -07:00
Tom Eastep
314921f766 Revert "Set quantum in subordinate SFQ class to the MTU for HFSC parents."
This reverts commit 5ab6f8e0e5.
2011-05-18 11:13:50 -07:00
Tom Eastep
166d27f6d4 Minor tweak to blacklisting
Reverse order of tests for 'from' and 'src'.
Use equivalent logic for generating unknown option error

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-18 11:13:03 -07:00
Tom Eastep
5ab6f8e0e5 Set quantum in subordinate SFQ class to the MTU for HFSC parents.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-18 10:34:46 -07:00
Tom Eastep
0e59932b8d Correct known problems 2011-05-18 10:14:20 -07:00
Tom Eastep
568e54b50d Update version to Beta 2 2011-05-18 09:58:35 -07:00
Tom Eastep
e940f5018e Implement whitelisting.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-18 08:30:01 -07:00
Tom Eastep
cec07a6be5 Don't apply HTB quantum to HFSC 2011-05-17 18:34:41 -07:00
Tom Eastep
8d12e13ff1 Improve wording in the change log 2011-05-17 13:55:00 -07:00
Tom Eastep
495aa9b9ac Implement NFLOG accounting action.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-17 13:42:13 -07:00
Tom Eastep
fd70e73d34 Add ACCOUNTING_TABLE option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-05-17 12:51:33 -07:00