Commit Graph

2840 Commits

Author SHA1 Message Date
Tom Eastep
c3901f1161 Release mutex on error.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-09 09:57:09 -07:00
Tom Eastep
56318e6cc8 Try to ensure that cp doesn't copy the firewall script to itself.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-06 09:22:16 -07:00
Tom Eastep
13c90e2aef Correct my update to Mr-4's bup patch.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 18:40:14 -07:00
Tom Eastep
fdfdb49951 Apply Mr-4's priority->perf patch
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 14:05:03 -07:00
Tom Eastep
61cb105c02 Apply Mr-4's noautosrc patch (modified)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 14:00:25 -07:00
Tom Eastep
4621dccd53 Apply Mr-4's special route handling in COPY (modified).
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 13:27:34 -07:00
Tom Eastep
b83ca4812b Include trailing space in a regular expression.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-03 08:36:38 -07:00
Tom Eastep
80efd095a8 Correct handling of INLINE without '-j' in the tcrules file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-01 14:52:48 -07:00
Tom Eastep
d6961c4c3b Clean up the temporary chains sooner.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-01 14:48:27 -07:00
Tom Eastep
54f5aaca63 Fix handling of CT_TARGET
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-01 11:15:36 -07:00
Tom Eastep
1012251957 Apply Mr-4's 4a patch (modified)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-27 07:04:40 -07:00
Tom Eastep
20d38e8b52 Centralize the validation of nfacct object names.
- Also correct a missing ' ' from the output generated by INLINE
  freeform input.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-26 09:09:08 -07:00
Tom Eastep
52f5ae15d1 Apply Mr-4's cosmetic patch
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-25 17:29:41 -07:00
Tom Eastep
7e830e5df4 Allow special characters in nfacct names.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-25 10:07:49 -07:00
Tom Eastep
f543c3bd1e Finish Mr-4's NFACCT patch
- Correct indentation
- Remove '$type' argument to split_nfacct_list
- Update manpages.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-23 06:55:30 -07:00
Dash Four
68c7782e7d Shorewall 4.5.16 Beta 6
Tom Eastep wrote:
> On 4/22/13 5:07 PM, "Dash Four" <mr.dash.four@googlemail.com> wrote:
>
>
>> Anyway, I've just implemented individual "!" in the NFACCT statement by
>> hacking your Accounting.pm - I can attach a small patch for
>> review/inclusion if you are interested, but be aware that it does change
>> the syntax slightly in a sense that "!" needs to be specified for each
>> object within NFACCT() - "NFACCT(...)!" is no longer allowed.
>>
>
> Sure -- send it along.
>
Attached - the above caveat applies though.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 21:17:59 -07:00
Tom Eastep
4faf3728f2 Implement INLINE in the tcrules file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 19:00:29 -07:00
Tom Eastep
ad70240347 Remove a blank line
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 09:36:25 -07:00
Tom Eastep
739013f248 Handle nfacct object lists in parens following an ipset name.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 07:56:56 -07:00
Tom Eastep
6d57e7a0ce Mark a rule as complex if an option value is a reference.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-21 14:44:30 -07:00
Tom Eastep
5ad69aa650 Add CHAIN_SCRIPTS option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-21 07:30:31 -07:00
Tom Eastep
1b9fd642bb Add INLINE to the accounting file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-20 08:02:02 -07:00
Tom Eastep
7c8f1ae020 Correct HELPERS handling
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 16:35:19 -07:00
Tom Eastep
1fd62e1612 Restore order in the NFACCT target.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 11:11:37 -07:00
Tom Eastep
6c2679ce75 Allow incrementing an nfacct object when an ipset matches.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 10:44:57 -07:00
Tom Eastep
610bdf1aac Correct merge_rules() for LAST matches.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 08:40:01 -07:00
Tom Eastep
cbdca08fea Fix for multiple nfacct patch.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 16:37:54 -07:00
Tom Eastep
b87b4b61d8 Allow multiple nfacct matches in one accounting rule.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 16:14:57 -07:00
Tom Eastep
9c010691a3 Always place 'nfacct' last
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 15:26:34 -07:00
Tom Eastep
8ef11a376b Document 'HELPERS=none'.
- Also make 'check -u' work correctly regarding HELPERS=

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 11:30:47 -07:00
Tom Eastep
4d686e873b Implement 'HELPERS=none'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 10:30:56 -07:00
Tom Eastep
f55e34dd8b Don't allow options on targets that don't accept them.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 17:18:01 -07:00
Tom Eastep
668bd4a1a4 Accept complex log levels with INLINE
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 16:59:14 -07:00
Tom Eastep
5d5f168f25 Don't clone rule unconditionally in format_rule()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 13:35:32 -07:00
Tom Eastep
938bd72844 Better handling of the matches rule member.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 10:39:32 -07:00
Tom Eastep
8b91575c9e Maintain order when multiple instances of a match are separated.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 06:52:32 -07:00
Tom Eastep
0da38cc38e Order matches in rules.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-12 11:37:29 -07:00
Tom Eastep
6950cd2576 Allow '-' in a match name.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 18:30:02 -07:00
Tom Eastep
ff4fb21044 Require that the '-j' part of a free-form rule be known.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 18:29:45 -07:00
Tom Eastep
614c5e6155 Assume LOG if a level is specified with INLINE.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 14:16:34 -07:00
Tom Eastep
35b0b4a4f9 Support A_ACCEPT!
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 13:37:49 -07:00
Tom Eastep
c34cf333ba Allow both {...} and ';' with INLINE
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 12:57:59 -07:00
Tom Eastep
b33bdeaa02 Allow a parameter to INLINE
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 11:54:58 -07:00
Tom Eastep
38f3ae0934 Handle 'NONE' policy correctly.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 09:35:27 -07:00
Tom Eastep
beec4a188f Implement INLINE action (again).
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 09:15:59 -07:00
Tom Eastep
f85d548d40 Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 06:23:22 -07:00
Tom Eastep
ee2e85c0fb Correct generation of the blacklog chain when disposition is audited
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-10 16:43:38 -07:00
Tom Eastep
186f71fa96 Add NEW_TOS_MATCH capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-09 14:04:16 -07:00
Tom Eastep
477e2bc455 Additional corrections to INLINE action.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-09 09:41:43 -07:00
Tom Eastep
273f109daf Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-09 09:37:12 -07:00