Commit Graph

1331 Commits

Author SHA1 Message Date
Tom Eastep
633eba6c90 Set version to 4.4.12 2010-08-15 08:50:45 -07:00
Tom Eastep
1510e111c4 Fix typo in conf basics doc 2010-08-13 20:27:14 -07:00
Tom Eastep
7281c9166e Record the config directory in the state file 2010-08-12 17:54:07 -07:00
Tom Eastep
15eec24672 Simplify logic for generating all parent zones
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-08-12 15:15:19 -07:00
Tom Eastep
49053afdcb Fix port range validate issue 2010-08-12 09:49:26 -07:00
Tom Eastep
69eaf84078 Fix bug with 'any' 2010-08-12 07:31:37 -07:00
Tom Eastep
965ad7ced1 Minor tweaks to the IPAddrs module 2010-08-11 11:46:26 -07:00
Tom Eastep
0234564a1b Add destination IP blacklisting 2010-08-10 17:33:50 -07:00
Tom Eastep
8d4498c9b8 Update Version to 4.4.12 RC 1 2010-08-06 19:31:36 -07:00
Tom Eastep
0f02ee2628 Fix issue with set match generation 2010-08-06 10:17:54 -07:00
Tom Eastep
364ad41cf5 Add support for new ipset match syntax 2010-08-03 21:06:17 -07:00
Tom Eastep
2774ee1bd6 Make 'icmp' a synonym for 'ipv6-icmp' in IPv6 compilations 2010-08-02 08:04:55 -07:00
Tom Eastep
3ce8ff5741 Bump version to Beta 4 2010-08-01 16:10:32 -07:00
Tom Eastep
967629569b Taylor Universal config to work with Shorewall-init and streamline ruleset
- Make interface 'all' optional and set REQUIRE_INTERFACE=Yes
- Add COMPLETE option
- Set FASTACCEPT in Universal samples
- Reset SUBSYSLOCK in Universal samples

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-08-01 08:36:56 -07:00
Tom Eastep
a88e2afa69 Tweak the Universal documentation 2010-07-31 18:43:54 -07:00
Tom Eastep
0b3dfcc844 Revert version to Beta 3 2010-07-31 13:23:53 -07:00
Tom Eastep
fdcc263023 Fix a couple of minor bugs 2010-07-31 13:11:46 -07:00
Tom Eastep
0174045181 Fixes for Universal Sample 2010-07-31 10:49:49 -07:00
Tom Eastep
beeeb6efbc Allow '+' as a physical interface 2010-07-31 10:08:45 -07:00
Tom Eastep
fdeb9006fa Correct module versions 2010-07-31 09:02:51 -07:00
Tom Eastep
005b6f7b45 Use new hashlimit match syntax if available 2010-07-31 07:19:41 -07:00
Tom Eastep
637cfdaa14 Handle case where old hashlimit match is no longer supported 2010-07-29 17:14:36 -07:00
Tom Eastep
e598dc77b7 Correct/improve LOGLIMIT handling 2010-07-29 16:50:17 -07:00
Tom Eastep
a639b75e36 Bump version to RC1 2010-07-29 11:40:15 -07:00
Tom Eastep
6a1fea3a40 Add 'user marks' 2010-07-27 11:02:36 -07:00
Tom Eastep
f1a8da61bc Use global log rate limiting, if any, for synflood logging 2010-07-26 14:58:38 -07:00
Tom Eastep
bd5facda30 Implement per-IP log rate limiting 2010-07-25 12:42:39 -07:00
Tom Eastep
9bf06caa35 Bump version to Beta 2 2010-07-25 08:11:49 -07:00
Tom Eastep
1528cc2094 Correct RE in split_action() 2010-07-24 11:50:10 -07:00
Tom Eastep
e956068959 Make default setting of MANGLE_ENABLED depend on the capability with the same name 2010-07-24 09:27:21 -07:00
Tom Eastep
e5a7d2ae69 Fix syntax error in generated script 2010-07-23 11:24:42 -07:00
Tom Eastep
9eedf155bc Fix syntax error in generated script 2010-07-23 11:23:23 -07:00
Tom Eastep
3248fc8ab1 Add additional progress messages to updown() 2010-07-22 15:11:19 -07:00
Tom Eastep
49a8861f5b Pretty up the code 2010-07-22 13:57:34 -07:00
Tom Eastep
7db9645225 Avoid an extra blank line 2010-07-22 13:51:47 -07:00
Tom Eastep
666cc35b46 Don't slow down stop with 'wait' 2010-07-22 12:56:49 -07:00
Tom Eastep
4e33efd8a6 Allow :random to work with REDIRECT
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-22 07:26:38 -07:00
Tom Eastep
8959245375 Update version to 4.4.12-Beta1 2010-07-21 20:35:36 -07:00
Tom Eastep
411d392ccd Additional progress messages during up/down processing 2010-07-21 20:35:03 -07:00
Tom Eastep
d897635af5 Allow bizarre overriding of SOURCE/DEST with ipsets
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-20 16:03:12 -07:00
Tom Eastep
1de257be19 Make ADD and DELETE work with any type of ipset.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-20 15:42:11 -07:00
Tom Eastep
79128605b1 Validate all IPSET Names 2010-07-18 17:18:10 -07:00
Tom Eastep
cbb524b067 Implement ADD/DEL commands
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-18 08:46:38 -07:00
Tom Eastep
d99aff5e09 Use Perl Constants rather literals for IPv6 Networks
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-16 10:06:29 -07:00
Tom Eastep
17bdcc1360 Eradicate incorrect multicast network address 2010-07-16 09:33:17 -07:00
Tom Eastep
b52b7c422f Drop multicast and anycast in Drop and Reject actions 2010-07-12 16:44:34 -07:00
Tom Eastep
c1b212225e Use uniform coding style in latest changes 2010-07-12 13:07:11 -07:00
Tom Eastep
328e1b7f6a Don't generate rules to link local net from vserver zones 2010-07-12 12:39:51 -07:00
Tom Eastep
59189d6324 Don't generate rules from link local net to vserver zones 2010-07-12 11:52:56 -07:00
Tom Eastep
4792d1e5f1 Fix nets= in Shorewall6 2010-07-11 19:52:18 -07:00
Tom Eastep
5a5546ef1b Set version to 4.4.11 2010-07-09 09:01:08 -07:00
Tom Eastep
d0c1c3d69c Change comment to clarify assumption about function arguments 2010-07-08 17:45:18 -07:00
Tom Eastep
9eca7fb37b Simplify logic in loopback helper functions 2010-07-08 17:11:27 -07:00
Tom Eastep
591a4bc7f6 Revert version of modules with only whitespace changes; rename a couple of functions for clarity 2010-07-07 06:43:07 -07:00
Tom Eastep
02fab09a14 Add PERL= option to shorewall.conf and shorewall6.conf
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-05 13:11:52 -07:00
Tom Eastep
31a9d24164 Fix missing quote when REQUIRE_INTERFACE=Yes 2010-07-05 09:47:03 -07:00
Tom Eastep
f977631af9 Just reset provider bits in FORWARD chain 2010-07-05 09:46:24 -07:00
Tom Eastep
b445b4fdd9 Fix compiler detection of FWMARK_RT_MASK -- take 2 2010-07-05 08:51:13 -07:00
Tom Eastep
0e87ccbcfd Fix compiler detection of FWMARK_RT_MASK 2010-07-05 08:39:32 -07:00
Tom Eastep
542557069e Back out a couple of harmless but unintended changes 2010-07-05 08:02:51 -07:00
Tom Eastep
898c3a045f Bump version to RC1 2010-07-05 07:08:06 -07:00
Tom Eastep
312624cef5 Fix NET3 bug (netmap) 2010-07-04 15:58:37 -07:00
Tom Eastep
7689831cd7 Minor cleanup of 4.4.11 Beta 3.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-04 09:29:16 -07:00
Tom Eastep
2ee4fd8f5a Add FWMARK_RT_MASK capability.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-04 09:08:04 -07:00
Tom Eastep
d3e30b5fe4 Add FORWARD_CLEAR_MARK option 2010-07-03 17:03:42 -07:00
Tom Eastep
5d1e19364a Bump version to Beta 3 2010-07-03 10:54:39 -07:00
Tom Eastep
148b251766 Only send loopback traffic to the 'loopback' chain 2010-07-03 10:53:25 -07:00
Tom Eastep
21ce6f9b84 Add new zone-list function to return all but firewall zone.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-03 08:33:10 -07:00
Tom Eastep
c8274f0538 Minor vserver doc update 2010-07-02 13:34:21 -07:00
Tom Eastep
63154367ad Forbid 'ipsec' in a vserver host entry
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-02 13:12:23 -07:00
Tom Eastep
e5d3ce582a Correct Old Defect in ipsec match generation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-02 13:11:57 -07:00
Tom Eastep
9e81a5101f Cleaner fix for ipsec/vserver issue
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-02 12:24:58 -07:00
Tom Eastep
261af19b4e Fix invalid policy match with vserver zone.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-07-02 12:18:18 -07:00
Tom Eastep
f2ca9e25c9 Make find_hosts_by_option() work with options specified on the interface 2010-07-02 07:19:52 -07:00
Tom Eastep
338c021272 Fix refression in handling of mss= 2010-07-01 09:05:25 -07:00
Tom Eastep
64decb25fe Bump version to 4.4.11-Beta2 2010-07-01 07:08:11 -07:00
Tom Eastep
9f15ccb24f Update Raw.pm version.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-30 20:40:26 -07:00
Tom Eastep
e4afc15370 Finish Vserver Implementation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-30 20:35:46 -07:00
Tom Eastep
9e37fe1ffa Deimplement flawed rate limiting with simple TC
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-26 07:42:08 -07:00
Tom Eastep
914d752f1d Fix latency parsing 2010-06-25 16:10:26 -07:00
Tom Eastep
2909b6fd92 Quiet down the Perl interpreter on some boxen 2010-06-24 13:58:46 -07:00
Tom Eastep
1cb22d0bcf First feeble steps toward vserver zones 2010-06-22 16:42:20 -07:00
Tom Eastep
dbbe6b264d Fix the IPSET fix 2010-06-18 12:06:12 -07:00
Tom Eastep
e7340dabc0 Fix IPSET issue 2010-06-18 12:05:44 -07:00
Tom Eastep
32d8a9d996 Allow patch from Gabriel 2010-06-12 14:10:40 -07:00
Tom Eastep
d58127e51c Allow networks to be specified in a NETMAP rule 2010-06-12 13:50:58 -07:00
Tom Eastep
9acec39898 Fix a couple of issues with Simple TC 2010-06-12 13:50:11 -07:00
Tom Eastep
625f254d02 Add tcfilters to manpage index 2010-06-10 06:15:15 -07:00
Tom Eastep
6040f02bb0 Don't set variables needlessly 2010-06-08 16:33:54 -07:00
Tom Eastep
32d575a8c8 Remove extra logic 2010-06-08 16:18:23 -07:00
Tom Eastep
dcd64cd096 Move ipset-load code to Chains.pm. Better there than in Compiler.pm
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-08 16:18:14 -07:00
Tom Eastep
a5816c23d4 Move save_dynamic_chains to Chains.pm where it belongs.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-08 16:17:57 -07:00
Tom Eastep
6537c1e55a Improve readability 2010-06-08 16:16:23 -07:00
Tom Eastep
52a80e69a9 More tweaks to saving/restoring dynamic chains
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-08 11:27:09 -07:00
Tom Eastep
ec3fdbde98 More changes having to do with with dynamic chains
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-08 11:26:53 -07:00
Tom Eastep
aa4b0f71af Much cleaner implementation of save_dynamic_chains()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-07 10:11:33 -07:00
Tom Eastep
0978f3d41a More periodic removal of trailing white space 2010-06-07 09:16:56 -07:00
Tom Eastep
3467969c26 Periodic removal of trailing white space 2010-06-07 07:30:56 -07:00
Tom Eastep
04de6fac6d Make dynamic chain saving work with IPv6
Also, use hidden files to save the chain contents.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-07 07:18:21 -07:00
Tom Eastep
db138edbd1 Update versions of modified modules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-06 13:49:26 -07:00
Tom Eastep
b3370dfd78 Initiate 4.4.11
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-06 13:36:45 -07:00
Tom Eastep
17b6e370af Purge saved dynamic blacklist if the chain doesn't exist 2010-06-06 13:24:09 -07:00
Tom Eastep
25c0e3c7b3 Retain UPnP and dynamic blacklist over 'restart' 2010-06-06 13:23:49 -07:00
Tom Eastep
ca7d145746 Don't enter command mode for upnpclient rule for non-optional interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-06 08:05:19 -07:00
Tom Eastep
99a0226a43 Slight improvement of regular expression used to insert chain name into rules after '-A'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-06 08:04:28 -07:00
Tom Eastep
fdc3b698a9 Version to 4.4.10 (again) 2010-06-05 15:58:23 -07:00
Tom Eastep
d388b29d70 Let Zones.pm export chain_base rather than Chains.pm 2010-06-05 08:40:00 -07:00
Tom Eastep
0e995d65ac Version to 4.4.10-RC2 2010-06-04 16:19:15 -07:00
Tom Eastep
742a3b2eef Make wait and required work on wildcard interfaces
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-04 10:35:45 -07:00
Tom Eastep
82a74d7534 Resolve Optional/Required interfaces with wildcard names
Optional is allowed
Required is not

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-04 08:46:29 -07:00
Tom Eastep
165535cd8b Disallow wildcard optional/required interfaces
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-04 07:18:55 -07:00
Tom Eastep
7625b4069b Delete references to prenet subsystem locks.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-06-03 12:31:39 -07:00
Tom Eastep
43afd03b9b Bump version to 4.4.10 2010-06-03 11:18:02 -07:00
Tom Eastep
226eb6ca3e Cleanup of optimization fix
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-29 09:56:14 -07:00
Tom Eastep
50ce5bab68 Fix Optimization Bug
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-29 08:58:16 -07:00
Tom Eastep
d58480943a Bump version to 4.4.10 RC 1 2010-05-27 17:21:11 -07:00
Tom Eastep
e627e0ea76 Bump version to 4.4.10-Beta4
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-26 16:47:49 -07:00
Tom Eastep
cdcb42ce9c Increment version to 4.4.10-Beta3.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-25 07:17:57 -07:00
Tom Eastep
9c0564831a Fix syntax error in generated shell script
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-24 06:23:45 -07:00
Tom Eastep
4264524448 Bump Version to 4.4.10-Beta2
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-20 14:13:38 -07:00
Tom Eastep
50dc02da07 Implement the 'REQUIRE_INTERFACE' option.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-19 07:32:02 -07:00
Tom Eastep
4690075ed8 Start firewall on up event for optional interface.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-18 20:29:03 -07:00
Tom Eastep
0c9a0150d2 Document Shorewall-init; delete old auto-stop code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-18 14:42:39 -07:00
Tom Eastep
f9d187c288 Correct issues found in Fedora Testing
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-18 10:27:12 -07:00
Tom Eastep
499b0cddaa Log the text from startup errors.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-17 07:02:30 -07:00
Tom Eastep
a534bca914 Fix an existing bug in Shorewall6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-16 19:28:49 -07:00
Tom Eastep
a501222194 Fix some bugs in the Shorewall-init implementation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-16 17:41:09 -07:00
Tom Eastep
4f428d8135 De-implement 'close'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-16 15:31:41 -07:00
Tom Eastep
749d6be64e Add 'optional' interfaces to updown processing.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-15 17:06:00 -07:00
Tom Eastep
a3589dc6e9 Implement the 'up' and 'down' script commands
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-15 12:48:04 -07:00
Tom Eastep
88188202cc Add 'wait' interface option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-15 09:52:46 -07:00
Tom Eastep
16e451a7d8 Add 'required' interface option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-15 09:04:32 -07:00
Tom Eastep
a2758421ed Bump version to 4.4.10-Beta1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-13 17:03:14 -07:00
Tom Eastep
529f9a07b4 Update Rules.pm version to 4.4.10 2010-05-13 16:39:52 -07:00
Tom Eastep
1d0b8b1cec Correct syntax error in generated code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-13 16:32:42 -07:00
Tom Eastep
449ca038ba Implement 'close' command 2010-05-13 16:29:25 -07:00
Tom Eastep
65a5d34276 Update Module Versions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-03 12:46:29 -07:00
Tom Eastep
96bef5bd49 Assume 'routeback' in routestopped based on interface config.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-03 12:31:11 -07:00
Tom Eastep
fca404eeaf Update version to 4.4.9
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-03 10:02:02 -07:00
Tom Eastep
c7848be266 Back out the rest of the original change for dup / -[psiod]
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-03 09:59:25 -07:00
Tom Eastep
70c6a2cdf3 Update version to 4.4.9-RC2
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-02 07:25:50 -07:00
Tom Eastep
639b3ea57d Simplify checking for /! -[piosd] /
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-01 09:13:16 -07:00
Tom Eastep
311372013d More fixes to optimization
Only disallow / ! -[piosd] / if the target is a chain

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-01 08:58:41 -07:00
Tom Eastep
518416ec2e Add a comment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-01 08:08:39 -07:00
Tom Eastep
94c6b37e8e Avoid leaving an orphan '!' behind.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-01 07:51:24 -07:00
Tom Eastep
219b2e0761 A more comprehensive solution to multiple -[piosd] matches.
- eliminate duplicate -[piosd] matches in merged rules
- avoid tracing !* unconditionally

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-01 07:26:25 -07:00
Tom Eastep
16161d9cfc Add new trace types.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-05-01 06:43:09 -07:00
Tom Eastep
1173518d78 More minor cleanup of first code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-30 07:22:09 -07:00
Tom Eastep
076da4bd5c Couple of tweaks to my earliest code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-29 11:19:50 -07:00
Tom Eastep
2c1cede54e Revise addressless bridge change
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-27 15:23:38 -07:00
Tom Eastep
d8b0f496df Allow simple configuration of a bridge with no IP address
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-27 12:26:58 -07:00
Tom Eastep
988f7c4d7e More fixes for bad NAT optimization
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-26 16:50:18 -07:00
Tom Eastep
0e4698d57c Fix rare optimization bug
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-26 16:19:58 -07:00
Tom Eastep
6d61e962eb Use -m conntrack if available in place of -m state
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-25 13:35:41 -07:00
Tom Eastep
21e0c68ef2 Bump version to 4.4.9 RC1 2010-04-25 09:37:17 -07:00
Tom Eastep
fb2ddcee7b Bump Version to 4.4.9 Beta 5 2010-04-24 21:53:12 -07:00
Tom Eastep
b821bdcdfd One more pass at improving regex's for target isolation and matching
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-22 14:45:34 -07:00
Tom Eastep
64bf772594 Set OUTPUT policy to ACCEPT when optimize_chain deletes all of its rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-22 13:38:38 -07:00
Tom Eastep
fb754b3a2e Don't remove a lone ACCEPT rule from the OUTPUT chain
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-22 11:35:14 -07:00
Tom Eastep
a1a78cf09b Abandon the fantesy that multiple optimize 8 passes will achieve anything.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-16 17:12:08 -07:00
Tom Eastep
c52a3dcd14 Don't generate policy chains for fw to bridgeport zones.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-16 09:56:11 -07:00
Tom Eastep
1030c852f9 Simplify a test
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-16 09:21:30 -07:00
Tom Eastep
e7a4aaafc1 Modify optimization 8 loop to continue until no chains are combined.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-16 09:17:57 -07:00
Tom Eastep
4f00de0c57 Make additional optimize 8 passes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-16 08:42:25 -07:00
Tom Eastep
21b44ac42b Change version to 4.4.9-Beta4
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-16 07:25:53 -07:00
Tom Eastep
82d6ba511f Unify the REs that look for '-[jg] <chain>'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-15 18:02:31 -07:00
Tom Eastep
cec59360f6 Use '-j' rather than '-g' when jumping to tcpre, just to be safe
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-15 14:14:13 -07:00
Tom Eastep
46d207a86f Restore original amount of whitespace in maclist rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-15 14:13:37 -07:00
Tom Eastep
e9a94b0cfb Unify reference count adjustment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-15 14:12:48 -07:00
Tom Eastep
cf59d9ec68 Fix an optimize 8 bug.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-15 12:45:00 -07:00
Tom Eastep
c1bcf360ee Fix another 'add_rule' that should have been an 'add_jump'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-15 09:59:57 -07:00
Tom Eastep
96d69bd8c3 Centralize message generation; optimize optimization-8 loop
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-15 09:29:37 -07:00
Tom Eastep
cff6f0010f Remove chain name after '-A' (again).
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-14 17:05:03 -07:00
Tom Eastep
f8bacb54ef Optimize 8
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-14 13:21:10 -07:00
Tom Eastep
4137961169 Speed up the replace_references* functions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-11 09:00:24 -07:00
Tom Eastep
715ea9ef32 Speed up delete_jumps()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-11 08:38:14 -07:00
Tom Eastep
76b9ef7005 Use unshift rather than splice for readability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-10 09:25:29 -07:00
Tom Eastep
2e443df8e3 Adjust references in move_rules()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-10 09:09:46 -07:00
Tom Eastep
ff73d802da More cleanup of rule and chain deletion:
- Rename purge_jumps() to delete_jumps()
- Add delete_chain() function
- Remove an unnecessary assertion

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-10 08:37:17 -07:00
Tom Eastep
1de304bfd9 Relocate purge_jumps() and change the loop exit condition to be a bit safer.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-09 13:51:44 -07:00
Tom Eastep
14477d61fe Verify that purge_jumps() reset the 'to' chain's referenced flag.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-09 12:28:01 -07:00
Tom Eastep
2ff1df53da Unify chain deletion.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-09 11:38:18 -07:00
Tom Eastep
7a831107c7 Replace the complex rule deletion loops with C-stype for loops.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-09 09:58:32 -07:00
Tom Eastep
9dc8267888 Don't apply RE to rules that we've already checked.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-09 09:46:07 -07:00
Tom Eastep
1e078b8c8d Use splice() to delete rules from chains
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-09 09:38:03 -07:00
Tom Eastep
56bc28a182 Prepare 4.4.9 Beta 3
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-09 07:32:21 -07:00
Tom Eastep
c2c0fb0dd2 Fix deletion of only rule in a chain
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-08 17:20:11 -07:00
Tom Eastep
ab1a27ca2a Update version to 4.4.9 Beta 2
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-08 13:14:51 -07:00
Tom Eastep
9a00191c88 Remove a 'defined' test that is no longer needed.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-08 13:12:17 -07:00
Tom Eastep
359c221783 Keep rules arrays compressed throughout the compilation process
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-08 12:53:30 -07:00
Tom Eastep
3937c10251 Keep rule arrays compressed during optimization
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-08 11:35:15 -07:00
Tom Eastep
9126cc63d9 Delete unused rules arrays
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-08 10:55:31 -07:00
Tom Eastep
cca2c18370 Another case where reference counts are wrong
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-07 20:07:03 -07:00
Tom Eastep
aeb3b277b0 Fix reference count issue
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-07 19:47:49 -07:00
Tom Eastep
3711e64d71 Fix for 0 values propagated to the script
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-07 14:38:29 -07:00
Tom Eastep
3092a85999 SWAG regarding LOG_VERBOSITY issue
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-04-07 13:43:57 -07:00
Tom Eastep
af893b6296 Add 'N' trace records for chain creation.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-30 07:32:38 -07:00
Tom Eastep
b2d8039ff6 Remove unnecessary text and 'before' images from trace entries
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-30 07:12:22 -07:00
Tom Eastep
7e97e9519d Conditionally trace writes by copy2().
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-29 11:56:26 -07:00
Tom Eastep
51d4bf19b5 Conditionally trace writes by copy2().
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-29 11:56:06 -07:00
Tom Eastep
350a89e449 More complete generated script trace
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-29 09:48:23 -07:00
Tom Eastep
5c91fb40e2 Remove unneeded test; correct typo
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-29 09:04:45 -07:00
Tom Eastep
6d7226ae93 Remove special trace entries
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-28 16:31:03 -07:00
Tom Eastep
1fd656b8c9 Tweak trace facility
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-28 15:31:05 -07:00
Tom Eastep
b0733d93ee Implement a more robust trace
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-28 13:09:04 -07:00
Tom Eastep
ef4237f5a0 Avoid verbosity overflow/underflow
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-28 07:27:27 -07:00
Tom Eastep
3e215d0482 Minor cleanup in the Chains module.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-27 08:18:41 -07:00
Tom Eastep
1153ff0c75 Avoid a shell warning when brctl is not installed.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-27 07:33:40 -07:00
Tom Eastep
f30cd7e287 Clarify provisional policy handling.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-26 08:02:49 -07:00
Tom Eastep
6cdc1ab7a2 Allow a logical interface name in the EXTERNAL column of the proxyarp file
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-25 11:41:06 -07:00
Tom Eastep
7d91edc6ec Remove redundant line of code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-23 12:49:06 -07:00
Tom Eastep
626b28fcd0 Auto-detect bridge when no options specified. Remove extra logic.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-23 09:28:11 -07:00
Tom Eastep
5e9aceae68 Detect bridges
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-23 08:38:54 -07:00
Tom Eastep
914d829a49 Don't optimize the 'blacklst' chain
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-22 06:47:39 -07:00
Tom Eastep
6ac549ef4e Add a comment explaining why avoiding creation of the blacklst chain
and branching to it is a bad idea.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-21 07:24:29 -07:00
Tom Eastep
6fc347b9be Prepare 4.4.9-Beta1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-20 07:06:47 -07:00
Tom Eastep
9a88156769 Back off on not jumping to the blacklist chain when there are no blacklist entries.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-19 11:32:22 -07:00
Tom Eastep
fae29bcf6f Change version to 4.4.8
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-19 10:17:32 -07:00
Tom Eastep
b22b279bd1 Some additional idiot-proofing.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-19 10:01:02 -07:00
Tom Eastep
a71f5df64f Fix indentation and quoting in TC progress messages
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-19 06:59:58 -07:00
Tom Eastep
f44dbcf20b More copyright updates
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-18 11:13:51 -07:00
Tom Eastep
91bc3b3293 Mark a restored configuration as 'Restored' rather than 'Started'.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-17 10:10:56 -07:00
Tom Eastep
1177540fd8 Update version to RC2
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-16 12:39:35 -07:00
Tom Eastep
66c883de2c Fix UDPLITE handling of source port when no dest port given.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-16 10:45:31 -07:00
Tom Eastep
b2a56cd542 Copyright update
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-16 09:53:51 -07:00
Tom Eastep
a01fa345b7 Add support for UDP Lite
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-16 09:42:50 -07:00
Tom Eastep
16bbe780c7 Try to avoid printing import banners unnecessarily
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-16 07:23:02 -07:00
Tom Eastep
787cec4fe7 Fix 'uninitialized variable' bug in Config::copy2
Bug reported by Tuomo Soini

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-16 07:12:39 -07:00
Tom Eastep
196cd5417f Allow 'default' optimizations to be disabled by specifying optimization 4096.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-11 17:15:44 -08:00
Tom Eastep
249f9412f6 Add undocumented OPTIMIZE=-1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-10 17:31:08 -08:00
Tom Eastep
4f32be03d7 Fix typo in comment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-08 15:34:38 -08:00
Tom Eastep
93494c6ae3 Eliminate nested function declarations in generate_matrix()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-08 13:11:10 -08:00
Tom Eastep
07cba9e066 Bump version to RC1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-08 08:11:00 -08:00
Tom Eastep
efed2286b0 Move qt1() to lib.common
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-07 11:50:54 -08:00
Tom Eastep
f246f728e7 Flag '-' used as a port range separator
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-07 08:36:26 -08:00
Tom Eastep
5671a7ae2f Add new options to online usage info.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-06 08:45:43 -08:00
Tom Eastep
88447bfc7d Avoid dropping first line of library source text
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-06 08:45:21 -08:00
Tom Eastep
2d458b46b4 Update help text in prog.header*
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-06 08:13:33 -08:00
Tom Eastep
928b162d3c Fix bug in handling of -p option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-06 08:12:04 -08:00
Tom Eastep
7557b4b5fb Update version to 4.4.8 Beta 3
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-06 07:41:29 -08:00
Tom Eastep
fe089ddc36 Don't copy headers in imported libraries
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-06 07:40:43 -08:00
Tom Eastep
c8d8d75cae Cosmetic change
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-05 10:40:18 -08:00
Tom Eastep
f8c7a284a5 Remove duplicate/unneeded functions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-05 07:02:00 -08:00
Tom Eastep
abb943bfb7 Do library consolidation on IPv6 and load lib.cli into shorecap.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-04 13:11:33 -08:00
Tom Eastep
50330f71f6 Move many routines into lib.common.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-04 12:38:02 -08:00
Tom Eastep
7757c0bc20 Rename lib.run to lib.common
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-04 09:54:56 -08:00
Tom Eastep
7b52d812ae Generate correct library path name
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-04 09:40:18 -08:00
Tom Eastep
4c081e5998 Add lib.run
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-04 09:12:48 -08:00
Tom Eastep
a963c8f955 Don't export CONFDIR or SHAREDIR
Document CONFDIR, SHAREDIR and VARDIR
Add FILEMODE to the old reserved variable names

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-03 11:46:23 -08:00
Tom Eastep
3f73b3c408 Export *DIR variables
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-03 10:39:18 -08:00
Tom Eastep
c6981de0e5 Complete elimination of globals that are not .conf options
Documentation to follow

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-03 09:50:07 -08:00
Tom Eastep
ee74696747 IPv6 work to only export when necessary
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-03 08:59:58 -08:00
Tom Eastep
234e4fa754 Update module versions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-03 08:51:55 -08:00
Tom Eastep
7457f643ee Don't export globals when the script is 4.4.8 or later
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-03 08:51:40 -08:00
Tom Eastep
cce4bf277a Reduce export usage; Allow PURGE and RESTOREFILE to be specified on the run-line
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-02 14:49:31 -08:00
Tom Eastep
2656a9b0c7 Eliminate use of PRODUCT
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-02 12:34:36 -08:00
Tom Eastep
68f5215f07 Remove Reliance on HOSTNAME in generated programs
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-02 11:45:35 -08:00
Tom Eastep
3ea6f6792f Eliminate VERSION reserved variable name
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-02 08:02:10 -08:00
Tom Eastep
5fc6d58e19 Eliminate STOPPING variable
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-02 07:37:30 -08:00
Tom Eastep
d4936f4bad Tweak to an RE used in optimization
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-02 06:58:09 -08:00
Tom Eastep
f11bfd3890 Eliminate redundate setting of PRODUCT
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-01 08:32:59 -08:00
Tom Eastep
cfa09dce22 Avoid multiple policy matches with OPTIMIZE=7 and not KLUDGEFREE
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-01 08:32:37 -08:00
Tom Eastep
3ba797cb14 Correct several bugs in the VERBOSITY overhaul
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-03-01 06:57:04 -08:00
Tom Eastep
53c73bc8e9 Eliminate VERBOSE
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 17:58:01 -08:00
Tom Eastep
14f83759ae Propagate VERBOSITY even though we don't use it yet
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 17:39:35 -08:00
Tom Eastep
546a48543d Propagate LOG_VERBOSITY
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 17:30:11 -08:00
Tom Eastep
39883aa690 Eliminate LOG_VERBOSE
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 16:58:30 -08:00
Tom Eastep
fb55d63eaf Allow verbosity to be separate from -V
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 16:42:50 -08:00
Tom Eastep
333ac21c2f Prepare the footers for 4.6.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 15:25:25 -08:00
Tom Eastep
83ed0a401b I'll eventually get it the way I like it
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 13:45:33 -08:00
Tom Eastep
585711caa8 Even simpler RE for detecting builtins
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 13:29:26 -08:00
Tom Eastep
693d0e5d4c Make new test in add_jump() a bit safer.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-28 12:44:29 -08:00
Tom Eastep
d2992c21f4 Update version to Beta 2 2010-02-28 09:04:37 -08:00
Tom Eastep
061d850c16 Rename RESTOREPATH to g_restorepath
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-26 08:35:50 -08:00
Tom Eastep
7fe7ebc891 Fix Handling of NFQUEUE(queue-num) in policies
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-25 08:44:28 -08:00
Tom Eastep
70a246501e Update version of Tc.pm
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-23 07:08:48 -08:00
Tom Eastep
3fc10cd94b Prepend 'SW_' to constructed shell variable names.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-22 10:27:59 -08:00
Tom Eastep
2a965d42b9 Add a comment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-21 07:57:34 -08:00
Tom Eastep
6307653a01 Pick up one fix from 4.4.7.4 regarding CONTINUE rules.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-20 09:42:58 -08:00
Tom Eastep
edaf541850 Don't apply rate limiting twice in ACCEPT+ rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-19 14:01:45 -08:00
Tom Eastep
ceff8adc78 Restore duplicate interface detection in tcinterfaces.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-18 16:11:30 -08:00
Tom Eastep
3a2173ddb4 Some code cleanup in Tc.pm.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-18 15:56:59 -08:00
Tom Eastep
ea8be87720 Use Hex representation of device numbers > 9 in simple TC.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-18 12:53:01 -08:00
Tom Eastep
00b0490cd7 Create a unique hashtable for each instance of a per-IP rate limit
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-17 15:39:21 -08:00
Tom Eastep
625963a4f0 Final (hopefully) fix for SFQ handle assignment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-17 09:02:18 -08:00
Tom Eastep
41bb0782a3 Another tweak to SFQ handle assignment.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-17 08:06:27 -08:00
Tom Eastep
5649dbf9a8 Improve assignment of class ID for SFQ classses
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-17 07:41:30 -08:00
Tom Eastep
eaafeb8c2b Add --hashlimit-htable-expire if the units are minutes or larger 2010-02-17 06:43:52 -08:00
Tom Eastep
375160d733 Avoid duplicate SFQ class numbers 2010-02-17 06:43:16 -08:00
Tom Eastep
167b29c2c5 Bump module version in Compiler.pm
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-15 14:24:52 -08:00
Tom Eastep
8aaf4aab3a Don't create log chain for 'RETURN' rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-15 14:24:00 -08:00
Tom Eastep
4546394531 Cosmetic changes to Compiler.pm
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-15 14:07:35 -08:00
Tom Eastep
12d3420a5d Detect FLOW_FILTER when LOAD_HELPERS_ONLY=No 2010-02-14 10:34:19 -08:00
Tom Eastep
5e9ecf1491 Update version of Config module 2010-02-13 11:00:34 -08:00
Tom Eastep
50d246c8be A little cleanup of compiler.pl
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-13 10:03:32 -08:00
Tom Eastep
1258149e0e Don't apply rate limiting twice in NAT rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-13 07:21:27 -08:00
Tom Eastep
ea5a6c79bc Bump CAPVERSION 2010-02-11 16:22:47 -08:00
Tom Eastep
5a96771e07 Start 4.4.8 Beta 1 2010-02-11 15:46:57 -08:00
Tom Eastep
b35f20b403 Avoid CAPVERSION bump to implement FLOW_FILTER detection
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-11 07:29:41 -08:00
Tom Eastep
b8c195f570 Accurately detect 'flow' availability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-10 14:50:26 -08:00
Tom Eastep
433fc385bc 'bridge' implies 'routeback'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-09 14:04:36 -08:00
Tom Eastep
46e2afcf16 Ignore TYPE if old distro
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-08 07:13:20 -08:00
Tom Eastep
b45a70f98a Make 'nosmurfs' work correctly on IPv6 with Address Type Match
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-08 07:12:58 -08:00
Tom Eastep
18d03a61f5 Make 'nosmurfs' work with Address Type Match on IPv6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-07 08:43:31 -08:00
Tom Eastep
11a2ec9f7c Update version to 4.4.7 2010-02-05 16:40:48 -08:00
Tom Eastep
e64af57cae Give smurf logging chain a fixed name.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-03 16:04:59 -08:00
Tom Eastep
f4e175f149 Fix IPv6 'nosmurfs'. Make 'nosmurfs' logging more efficient.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-03 15:03:15 -08:00
Tom Eastep
52880a8822 Clean up generate_matrix() fix.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-03 06:57:51 -08:00
Tom Eastep
9d288241da Fix issues in generate_matrix().
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-02 19:42:54 -08:00
Tom Eastep
1d8a7ad09f Clear DEBUG and PURGE shell variables
Delete a blank line

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-02 13:55:29 -08:00
Tom Eastep
753eb97667 Update version to 4.4.7 RC2
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-02 10:30:53 -08:00
Tom Eastep
dd60f04a9f Work around lack of MARK Target support 2010-02-01 16:22:57 -08:00
Tom Eastep
d354560863 Finish last change.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-01 14:25:51 -08:00
Tom Eastep
f0d101605b Don't try to combine nat chains that include '-s'.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-02-01 14:24:07 -08:00
Tom Eastep
1981372c94 Make search for "-j ACCEPT" a little tighter
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-31 08:27:30 -08:00
Tom Eastep
3d39a47582 Set $have_ipsec after completing parse of the hosts file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-30 07:26:35 -08:00
Tom Eastep
659f774451 Sort %detect_capability for easier verification.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-29 13:09:53 -08:00
Tom Eastep
9d2decd26d Modify determine_capabilities to use detect_capability()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-29 10:38:22 -08:00
Tom Eastep
b8ec2be516 Clean up handling of %detect_capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-28 16:39:45 -08:00
Tom Eastep
ecc7861115 Validate LOAD_HELPERS_ONLY before detecting capabilities.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-28 08:05:24 -08:00
Tom Eastep
ebd847ef70 Don't display capabilties if they have not been determined
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-28 08:04:54 -08:00
Tom Eastep
05f2bb4b3a Correction to last patch.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-27 17:52:27 -08:00
Tom Eastep
9d25318d80 Fix detection of HASHLIMIT_MATCH on old kernels.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-27 12:53:31 -08:00
Tom Eastep
54456de888 Update module versions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-27 09:01:00 -08:00
Tom Eastep
c05c1a6f50 Update version to 4.4.7 RC1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-27 06:58:44 -08:00
Tom Eastep
1556002b54 A couple of tweaks to the LOAD_HELPERS_ONLY optimization change.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-25 15:59:31 -08:00
Tom Eastep
fb007bc1c7 Bump version to Beta 4 2010-01-25 12:25:01 -08:00
Tom Eastep
9408a114c6 Don't load unused modules when LOAD_HELPERS_ONLY=Yes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-25 10:50:49 -08:00
Tom Eastep
d933aa602b Eliminate 'ORIGINAL_POLICY_MATCH'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-25 08:13:22 -08:00
Tom Eastep
90b68a05de Don't export %capabilities
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-25 07:56:16 -08:00
Tom Eastep
bfdc6719c1 Fix DropBcasts()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-24 12:16:15 -08:00
Tom Eastep
e14d48c2cf Bump version to 4.4.7-Beta3
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-22 16:46:29 -08:00
Tom Eastep
0d63182ab4 Fix ambiguous syntax in Config.pm
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-22 16:44:45 -08:00
Tom Eastep
199a50e1c7 Update version to 4.4.7 Beta 2
Add problems corrected to the release notes.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-22 10:35:27 -08:00
Tom Eastep
8f85c75264 Implement LOAD_HELPERS_ONLY for IPv6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-21 15:49:44 -08:00
Tom Eastep
efc43b1b24 Add implementation of LOAD_HELPERS_ONLY
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-21 15:49:35 -08:00
Tom Eastep
a248acb4d4 Add LOAD_HELPERS_ONLY Option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-21 15:49:23 -08:00
Tom Eastep
e119037dea Make 'is_isable()' work with 'lo' 2010-01-17 15:38:20 -08:00
Tom Eastep
f072c10b18 Set version to 4.4.7 Beta1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-17 09:10:48 -08:00
Tom Eastep
f4102417ff Shorewall::Config changes for TPROXY from 4.5
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-17 08:15:14 -08:00
Tom Eastep
07cdb8ca82 Backport TPROXY from 4.5
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-17 08:12:44 -08:00
Tom Eastep
47007c5dbd Allow protocol to be expressed in octal or hex
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-16 14:20:47 -08:00
Tom Eastep
aad8ea837a Allow port numbers to be specified in Hex
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-16 14:00:47 -08:00
Tom Eastep
5ec7759d81 Don't pass an undefined value to fatal_error when numeric conversion fails.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-16 12:35:18 -08:00
Tom Eastep
4bf0b8e1dd Add new configuration options and optimization changes from 4.5
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-16 09:53:53 -08:00
Tom Eastep
d5cc302ad9 Start 4.4.7
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-16 08:11:13 -08:00
Tom Eastep
ebf1e55609 Version to 4.4.6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-13 15:38:19 -08:00
Tom Eastep
880cd269c7 More mark geometry misses
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-13 12:16:40 -08:00
Tom Eastep
72de96760f One more 0xFF -> $globals{TC_MASK} fix
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-13 12:11:00 -08:00
Tom Eastep
10c5630786 A few more instances of TC_MASK
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-13 10:50:14 -08:00
Tom Eastep
555133fa3c Bump version to 4.4.6-Beta2
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-13 10:14:31 -08:00
Tom Eastep
b4b6dce7c8 Add some comments
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-13 08:12:00 -08:00
Tom Eastep
4821d5e8b7 Change quantum to 1875 for simple TC SFQ.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-13 08:11:49 -08:00
Tom Eastep
f69a741691 Port Simplified TC to 4.4.6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-12 17:01:20 -08:00
Tom Eastep
7e183e8eb4 Change version to 4.4.6-Beta1
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-12 15:57:55 -08:00
Tom Eastep
57672d096c Don't invoke 4.5 optimization under 4.4.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-12 15:47:14 -08:00
Tom Eastep
ae31a09e8b Move code and add comments:
- Declare all of the 'preview' helpers together in Chains.pm
- Add some clarifying comments in the compiler.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-12 15:32:59 -08:00
Tom Eastep
4420eed8d7 Allow users to preview the generated ruleset.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-12 15:32:50 -08:00
Tom Eastep
6b085b7897 Update module versions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-11 18:54:23 -08:00
Tom Eastep
5b4e9eb8e6 Revert change with migration issue
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-11 15:30:33 -08:00
Tom Eastep
0b549c7a15 Suppress mark geometry output
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-11 14:55:42 -08:00
Tom Eastep
1a74dbf93e Add mark geometry changes to Shorewall::Chains and Shorewall::Compiler
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-11 14:39:22 -08:00
Tom Eastep
01293427f5 Add Mark Geometry changes to Shorewall::Tc
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-11 14:29:34 -08:00
Tom Eastep
4f5bb5e90b Add new mark geometry changes to Shorewall::Providers
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-11 14:22:01 -08:00
Tom Eastep
d2d2912534 Add New mark geometry variables to Shorewall::Config
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-11 14:16:03 -08:00
Tom Eastep
4e50ea14ea Back out EXMARK detection since it is unused in 4.4.
Long overdue change to LIBVERSION

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-09 09:30:25 -08:00
Tom Eastep
b0feeb805d Fix typo in clear_firewall()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-09 07:28:57 -08:00
Tom Eastep
e6c0c8f6b7 Allow both <...> and [...] for IPv6 Addresses
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-08 13:55:13 -08:00
Tom Eastep
83c2473d78 Correct typo in error message
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-06 08:26:13 -08:00
Tom Eastep
ca4eee3ae4 Correct handling of 'refresh' failures
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-06 08:01:46 -08:00
Tom Eastep
605da92eca Don't try to restore ipsets when 'restore' is being used to recover
from a start/restart failure.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-06 07:44:34 -08:00
Tom Eastep
d362af9fb6 Set CAPSVERSION to 4.4.7 just to be safe.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-05 10:00:29 -08:00
Tom Eastep
ab1dc03986 Implement EXMARK capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-05 09:35:11 -08:00
Tom Eastep
d6123a8fbc Improve IPSET_SAVE restore logic:
- Call startup_error() rather than fatal_error()
- Call startup_error when restore-ipsets file exists but Shorewall is running

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-04 14:23:33 -08:00
Tom Eastep
4e0f9b2ef3 Make save/restore work with SAVE_IPSETS=Yes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-04 12:43:12 -08:00
Tom Eastep
1aa55779e2 Re-enable SAVE_IPSETS=Yes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-04 11:14:45 -08:00
Tom Eastep
a1fd3aa7e3 Add a hack to work around a 'feature' of xtables-addons on Lenny
Be more careful about checking for the ipset utility before saving the ipsets

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-04 10:15:27 -08:00
Tom Eastep
55e874b23f Update copyrights
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2010-01-01 12:58:27 -08:00
Tom Eastep
65c282af8b Delete temporary nat chain used in capabilities detection.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2009-12-31 10:42:21 -08:00
Tom Eastep
ea2ab6e4b6 A better solution to Marcus Limosani's issue 2009-12-29 08:22:15 -08:00
Tom Eastep
f568f3df9e Final fix for Marcus Limosani's problem 2009-12-28 15:05:54 -08:00
Tom Eastep
738a6de11b Make use of interface chains deterministic 2009-12-28 07:36:15 -08:00
Tom Eastep
f933816735 Simplify handling of packet clearing 2009-12-26 15:04:41 -08:00
Tom Eastep
d62f3a4fed Set version to 4.4.6 2009-12-24 08:00:59 -08:00
Tom Eastep
f233b86278 Fix 'forward' interface option in IPv6 2009-12-24 07:51:44 -08:00
Tom Eastep
e38df7efcb Fix another bug in ROUTE_FILTER Handling 2009-12-23 15:13:43 -08:00
Tom Eastep
e37cf0a370 Fix other issues with rp_filter fix 2009-12-20 15:54:41 -08:00
Tom Eastep
61b2ed7b57 Fix bug that prevented routefilter=2 2009-12-19 16:57:16 -08:00
Tom Eastep
d5914addd1 Disallow port 00 2009-12-19 14:59:03 -08:00
Tom Eastep
19af1a081c Handle kernel 2.6.31 and rp_filter 2009-12-19 13:47:12 -08:00
Tom Eastep
4f4d77be48 Add Kernel Version to the capabilities 2009-12-19 12:42:39 -08:00
Tom Eastep
24ddacb4a7 Adjust module versions 2009-12-19 07:35:30 -08:00
Tom Eastep
10ae98571b Revert change that allowed out of order policies 2009-12-19 07:20:00 -08:00
Tom Eastep
182ed24b02 Add a comment to process_rule1() 2009-12-14 15:52:16 -08:00
Tom Eastep
576cd76842 Remove superfluous logic from process_rule1 2009-12-14 14:49:38 -08:00
Tom Eastep
e9d12cfc11 Remove superfluous line of code 2009-12-14 07:17:55 -08:00
Tom Eastep
9988cfb619 Remove silly logic in expand_rule() 2009-12-10 08:00:18 -08:00
Tom Eastep
3214b14197 Fix macro handling of SOURCE and DEST columns 2009-12-08 13:29:06 -08:00
Tom Eastep
5e1f550b69 Fix ENHANCED_REJECT and MODULE_SUFFIX 2009-12-07 13:51:54 -08:00
Tom Eastep
7a6ad80c8a Make kernel version detection work with non-standard version naming such as found on OpenWRT 2009-12-06 10:42:28 -08:00
Tom Eastep
4bf55883ee Auto-load cls_flow 2009-12-03 12:15:23 -08:00
Tom Eastep
4494272dcd Improve error message 2009-11-29 09:55:32 -08:00
Tom Eastep
8c033de049 Fix limit check on TC mark values 2009-11-28 14:05:27 -08:00
Tom Eastep
e582f222ad Backout another Patch from the Virtual Zone Sequence and re-apply a couple of small optimizations 2009-11-28 07:25:31 -08:00
Tom Eastep
e5106f10bc Revert 8ff4d004c0 2009-11-28 07:23:23 -08:00
Tom Eastep
4e8d753682 Revert "Finish Virtual Zones"
This reverts commit 222c8cf88f.
2009-11-28 07:20:52 -08:00
Tom Eastep
d1812b4174 Revert "Fix a couple of bugs in virtual zones"
This reverts commit 22991ac9dd.
2009-11-28 07:20:28 -08:00
Tom Eastep
038b84e775 Revert "Small optimization in virtual zones"
This reverts commit 251d7116c8.
2009-11-28 07:20:01 -08:00
Tom Eastep
f21c71d7a6 Revert "Match section rules to the number of mark rules"
This reverts commit 1699d8e941.
2009-11-28 07:19:41 -08:00
Tom Eastep
0b1621027b Revert "Make 'virtual' a zone type rather than an option"
This reverts commit 18eedf7e34.
2009-11-28 07:19:10 -08:00
Tom Eastep
ea2c55a993 Revert "Fix off-by-one problem"
This reverts commit 543af8bccb.
2009-11-28 07:18:07 -08:00
Tom Eastep
f5bf3c9b43 Fix merge conflicts 2009-11-28 07:16:03 -08:00
Tom Eastep
7352771c5d Fix .spec history to omit false steps 2009-11-27 12:29:11 -08:00
Tom Eastep
543af8bccb Fix off-by-one problem 2009-11-27 08:56:23 -08:00
Tom Eastep
7f16e96167 Set version to 4.4.5 Beta1 2009-11-27 08:52:37 -08:00
Tom Eastep
18eedf7e34 Make 'virtual' a zone type rather than an option 2009-11-27 08:17:18 -08:00
Tom Eastep
1699d8e941 Match section rules to the number of mark rules 2009-11-26 17:12:11 -08:00
Tom Eastep
251d7116c8 Small optimization in virtual zones 2009-11-26 14:48:46 -08:00
Tom Eastep
22991ac9dd Fix a couple of bugs in virtual zones 2009-11-26 14:19:10 -08:00
Tom Eastep
222c8cf88f Finish Virtual Zones 2009-11-26 12:14:58 -08:00
Tom Eastep
8ff4d004c0 Better virtual zone implementation 2009-11-25 18:14:14 -08:00
Tom Eastep
8263ea1312 Limit providers to 15 2009-11-25 12:18:08 -08:00
Tom Eastep
d189c08533 Revert "Add 'virtual' zone support"
This reverts commit a2cd4bd1f4.
2009-11-25 11:51:13 -08:00
Tom Eastep
a2cd4bd1f4 Add 'virtual' zone support 2009-11-25 09:42:28 -08:00
Tom Eastep
4c40b205f8 Revert "Experimental explicit CONTINUE"
This reverts commit 10056a03d9.
2009-11-24 13:14:24 -08:00
Tom Eastep
10056a03d9 Experimental explicit CONTINUE 2009-11-24 12:50:53 -08:00
Tom Eastep
cd84efea94 Yet one more change to IPv6 address validation 2009-11-24 08:29:12 -08:00
Tom Eastep
deb45c5a27 Yet another IPv6 Address Normalization fix 2009-11-23 15:57:12 -08:00
Tom Eastep
bdb673a642 More IPv6 fixes 2009-11-23 15:21:25 -08:00
Tom Eastep
1710f9ce7c Several fixes to IPv6 Address Handling 2009-11-23 14:44:53 -08:00
Tom Eastep
9d85d0ff7a Allow IPv6 DNS names in net contexts 2009-11-23 13:51:46 -08:00
Tom Eastep
5610f78a48 Update version of Shorewall::Policy; improve 'expanded' description in Shorewall::Chains 2009-11-23 11:31:38 -08:00
Tom Eastep
99a35c1bf0 Allow <zone>::<serverport> in the rules file DEST column 2009-11-23 09:33:16 -08:00
Tom Eastep
5b02ef68a5 Simplify port == 0 test 2009-11-22 09:00:03 -08:00
Tom Eastep
d4ff629fd8 Generate error on port == 0 2009-11-22 08:44:11 -08:00
Tom Eastep
6e9d9e239d Apply 4.4.4.1 changes to master 2009-11-22 08:20:07 -08:00
Tom Eastep
4aeee6fd8b Make 'expanded' apply to all wildcard policies 2009-11-21 14:18:01 -08:00
Tom Eastep
c7de19cf39 Allow specific policy to supersede an expanded one 2009-11-21 13:56:40 -08:00
Tom Eastep
cbe944c354 Open the 4.5.0 Thread 2009-11-21 11:41:10 -08:00
Tom Eastep
ecf6a0ec4a Open 4.4.5 2009-11-21 11:08:50 -08:00
Tom Eastep
bce4d51a18 Allow wide MARK values in tcclasses when WIDE_TC_MARKS=Yes 2009-11-21 07:54:42 -08:00
Tom Eastep
c5bb493b29 Fix class number assignment when WIDE_TC_MARKS=Yes 2009-11-20 12:25:15 -08:00
Tom Eastep
0df84cf8b5 Remove superfluous line of code 2009-11-19 10:54:58 -08:00
Tom Eastep
a23632f45e Mostly cosmetic cleanup of Shorewall::Chains 2009-11-19 10:35:25 -08:00
Tom Eastep
c39a9fb5eb Fix typo in shorewall-rules(5) 2009-11-18 19:55:20 -08:00
Tom Eastep
4579a71574 More massaging of redundant test suppression 2009-11-17 11:14:02 -08:00
Tom Eastep
831611e792 Update version of Shorewall::Policy 2009-11-16 20:24:01 -08:00
Tom Eastep
5f70b261b6 Update version of Shorewall::Compiler 2009-11-16 20:21:59 -08:00
Tom Eastep
5ec4f8d82c Unconditionally include route marking and sticky chains 2009-11-16 14:15:01 -08:00
Tom Eastep
2a910ebddf Suppress redundant tests for provider availability in route rules processing 2009-11-16 12:43:44 -08:00
Tom Eastep
016537f631 Don't add route rules when interface is down 2009-11-16 10:58:38 -08:00
Tom Eastep
dd543a2934 Tweak policies display 2009-11-16 09:30:37 -08:00
Tom Eastep
f5a019becc Implement 'show policies' command 2009-11-15 09:24:56 -08:00
Tom Eastep
b662718eec Replace canonical_chain by rules_chain 2009-11-14 07:07:19 -08:00
Tom Eastep
10affb1cde Set version to 4.4.4 2009-11-13 13:52:49 -08:00
Tom Eastep
fa3bdde214 Set version to Beta2 2009-11-13 12:39:41 -08:00
Tom Eastep
0e6c9abb5b A fix for COPY handling 2009-11-12 16:45:39 -08:00
Tom Eastep
f904866336 More minor cleanup of chain name change 2009-11-12 12:30:08 -08:00
Tom Eastep
2d53f8cb0c Delete unnecessary function 2009-11-11 16:35:46 -08:00
Tom Eastep
b943f09e37 Fix indentation 2009-11-11 12:34:15 -08:00
Tom Eastep
4e6b8f8f42 Set version to 4.4.4-Beta1 2009-11-11 10:58:22 -08:00
Tom Eastep
0f078e7440 Ignore empty port in INTERFACE column 2009-11-11 10:52:14 -08:00
Tom Eastep
a4eb581d44 Document full logical interface implementation 2009-11-11 10:45:01 -08:00
Tom Eastep
06d3b2c692 Allow wildcard logical names in COPY column 2009-11-11 10:17:53 -08:00
Tom Eastep
6987cd15c5 Avoid dereference of null variable 2009-11-11 10:10:45 -08:00
Tom Eastep
ba8ad6346a More use of logical chain name 2009-11-11 10:06:06 -08:00
Tom Eastep
893a847c87 Suppress extra COMMENT warnings 2009-11-10 17:17:55 -08:00
Tom Eastep
bf8c38e054 Add ZONE2ZONE option to shorewall.conf 2009-11-10 14:12:55 -08:00
Tom Eastep
7120a73f0e Minor efficiency improvement in move_rules() 2009-11-10 08:08:02 -08:00
Tom Eastep
c9e57c93a2 Insure uniqueness of physical names; use logical name when constructing the name of a chain 2009-11-10 07:24:14 -08:00
Tom Eastep
4e2f2923b6 Update ::Config::VERSION 2009-11-09 13:16:40 -08:00
Tom Eastep
79b5cb49df Fix over-zealous use of physical name; Correct syntax errors 2009-11-09 12:38:00 -08:00
Tom Eastep
893a0c9d42 Remove order dependency in interface OPTIONS processing 2009-11-09 11:15:08 -08:00
Tom Eastep
9b127e6e06 Improve performance of logical->physical mapping 2009-11-09 07:27:14 -08:00
Tom Eastep
92208251b7 Add undocumented LOGICAL_NAMES option 2009-11-09 07:01:25 -08:00
Tom Eastep
dda6f06883 Update module versions 2009-11-08 09:01:30 -08:00
Tom Eastep
4d977306f9 Make 'physical' work as a general logical name facility 2009-11-08 08:37:03 -08:00
Tom Eastep
83621ff416 Add logical->physical mapping to Shorewall::Chains 2009-11-08 07:11:38 -08:00
Tom Eastep
09f1b6501c Add logical->physical mapping to Shorewall::Providers 2009-11-08 07:00:43 -08:00
Tom Eastep
ca1dd1416d Add logical->physical mapping to Shorewall::Tc 2009-11-08 06:26:47 -08:00
Tom Eastep
1238b771a2 Apply logical->physical mapping to /proc settings 2009-11-07 18:59:10 -08:00
Tom Eastep
b1706e10e3 Correct typo 2009-11-07 07:58:15 -08:00
Tom Eastep
bcd4887d84 Correct capitalization in error message; remove unused variable 2009-11-07 07:39:28 -08:00
Tom Eastep
7f54a6fea9 Make non-wild physical work correctly 2009-11-07 07:19:52 -08:00
Tom Eastep
496cfc391e Make parsing of zone options tighter 2009-11-06 15:51:53 -08:00
Tom Eastep
b491745f1c More physical interface changes 2009-11-06 13:10:19 -08:00
Tom Eastep
4ef45ff665 Generate an error if a bridge port is configured as a provider interface 2009-11-06 09:22:16 -08:00
Tom Eastep
73eab1fa55 Report physical name in zone reports rather than logical name 2009-11-06 08:40:53 -08:00
Tom Eastep
d73ebb8a6a Add comment explaining the purpose of dump_zone_contents() 2009-11-06 08:11:18 -08:00
Tom Eastep
7014bd3ea0 Add 'physical' interface option for bridge ports 2009-11-06 08:07:13 -08:00
Tom Eastep
89bdcf9a3d Implement 'physical' option 2009-11-06 07:27:44 -08:00
Tom Eastep
a98195e156 Back out fix for multiple bridges with wildcard ports 2009-11-05 16:34:41 -08:00
Tom Eastep
fb3477b8b5 A couple of additional tweaks to the two-bridge fix 2009-11-05 13:40:03 -08:00
Tom Eastep
b4199fd068 Document ICMP codes 2009-11-05 11:44:40 -08:00
Tom Eastep
28b660c853 Avoid reporting bogus duplicate interface with two bridges and wildcard ports 2009-11-05 11:04:14 -08:00
Tom Eastep
4548db58da Relax port list limitation in /etc/shorewall/routestopped 2009-11-03 11:36:32 -08:00
Tom Eastep
25549b176c Update version to 4.4.4 2009-11-03 10:06:29 -08:00
Tom Eastep
5a525134ea Be sure that startup log is secured 0600 2009-11-03 09:34:21 -08:00
Tom Eastep
f2f91ce7dd Some optimizations 2009-11-03 09:28:34 -08:00
Tom Eastep
c893ba6ffa Remove dependence of Shorewall::Rules on Scalar::Util 2009-11-03 07:40:06 -08:00
Tom Eastep
45653ffe79 A couple of more move_rules() tweaks 2009-11-02 15:35:00 -08:00
Tom Eastep
f97e0c5989 Flesh out fix for Perl run-time errors 2009-11-02 07:15:20 -08:00
Tom Eastep
11ddfa92e9 Eliminate Perl run-time errors out of move_rules() 2009-11-01 17:14:42 -08:00
Tom Eastep
59d01ccf97 A couple of tweaks to 'limit' class option 2009-10-27 12:33:14 -07:00
Tom Eastep
105754823a Raise max limit to 128 2009-10-26 13:03:26 -07:00
Tom Eastep
f0b4b1f42e Add limit option to tcclasses 2009-10-26 12:23:32 -07:00
Tom Eastep
cc0adc218f Update comments and release documentation 2009-10-26 10:03:51 -07:00
Tom Eastep
8251948d2a Add a comment 2009-10-24 15:55:56 -07:00
Tom Eastep
b3571261dd Fix optional providers 2009-10-24 12:05:44 -07:00
Tom Eastep
3e2cf982a3 Correct messages issued when a provider is not added 2009-10-24 08:50:15 -07:00
Tom Eastep
86df82a29a Fix IPv6 address validation error 2009-10-23 13:41:51 -07:00
Tom Eastep
46896e7dce Fix for Ipv6 2009-10-23 11:34:13 -07:00
Tom Eastep
d0cda6b6ea Add TRACK_PROVIDERS option 2009-10-20 13:24:17 -07:00
Tom Eastep
49f361124e Make 'track' the default 2009-10-20 12:24:28 -07:00
Tom Eastep
7adb9b12bb Move all function declarations from prog.footer6 to prog.header6 2009-10-19 07:37:49 -07:00
Tom Eastep
a0482132c6 Move all function declarations from prog.footer6 to prog.header6 2009-10-19 07:28:30 -07:00
Tom Eastep
abc9ab061a Remove superfluous variables from generated script 2009-10-19 07:25:03 -07:00
Tom Eastep
65e4a5ff66 Move all functions from prog.footer to prog.header; minor tweaks elsewhere 2009-10-18 08:47:20 -07:00
Tom Eastep
0a74320bc2 Fix progress message 2009-10-17 14:23:11 -07:00
Tom Eastep
30dbfdc949 Fix intentation problem introduces with config-detection fix 2009-10-17 11:08:34 -07:00
Tom Eastep
e6755b7172 Merge nested zone fix into master 2009-10-17 10:59:41 -07:00
Tom Eastep
44c5ebcfa4 Fix initialization 2009-10-15 13:06:04 -07:00
Tom Eastep
19a90db09f Back out last unnecessary change 2009-10-14 07:13:52 -07:00
Tom Eastep
990a9f0fdc Fix RETAIN_ALIASES 2009-10-13 14:36:47 -07:00
Tom Eastep
80f41779f8 Replace keyword 'object' with 'script' 2009-10-12 08:24:47 -07:00
Tom Eastep
7064b8dd08 Update version of changed modules 2009-10-08 15:49:54 -07:00
Tom Eastep
3f7a1f9574 Rename a variable 2009-10-08 09:48:15 -07:00
Tom Eastep
83a9d8dd1b Rename 'object' to 'script' 2009-10-05 15:43:29 -07:00
Tom Eastep
dc643c67e9 Move declaration to inner block where it is used 2009-10-05 14:23:43 -07:00
Tom Eastep
8089ef1599 Fix 'routeback' in routestopped file 2009-10-03 10:44:26 -07:00
Tom Eastep
964cba79a9 Initialize 4.4.3 2009-10-02 11:31:08 -07:00
Tom Eastep
a87cb7b95d Generate list of builtins in initialize() 2009-10-01 15:02:14 -07:00
Tom Eastep
ddb46931a0 Update version 2009-10-01 08:44:05 -07:00
Tom Eastep
327e170be5 Fix range-in-masq patch 2009-10-01 08:16:22 -07:00
Tom Eastep
39ee3b2025 Tweak emitter 2009-09-29 14:28:50 -05:00
Tom Eastep
393673a884 Allow MARK in action body -- take 2 2009-09-25 16:15:56 -04:00
Tom Eastep
bfdc8db31a Allow MARK in action body 2009-09-25 16:01:24 -04:00
Tom Eastep
d84458518e Add capability to detect old hashlimit syntax 2009-09-23 16:56:31 -04:00
Tom Eastep
20250c9ce9 Hack to make new LIMIT stuff work on ancient iptables releases 2009-09-20 09:10:23 -04:00
Tom Eastep
96b19dd218 Fix accounting extension feature 2009-09-15 13:01:20 -07:00
Tom Eastep
120aade417 Allow Extension Scripts for Accounting Chains 2009-09-15 12:22:51 -07:00
Tom Eastep
4f4925002a Revert "Allow Extension Scripts for Accounting Chains"
This reverts commit 728ad2fecf.
2009-09-15 12:18:29 -07:00
Tom Eastep
728ad2fecf Allow Extension Scripts for Accounting Chains 2009-09-15 11:16:37 -07:00
Tom Eastep
6afc43d200 Correct typo in comment 2009-09-13 09:20:32 -07:00
Tom Eastep
8fdbb6f252 Bump Nat.pm version; remove inadvertent paste 2009-09-13 09:13:50 -07:00
Tom Eastep
5793246d7c Make processing of original dest in Format-1 macros more obvious 2009-09-13 09:01:34 -07:00
Tom Eastep
8fdebf0c38 Add new columns to macros 2009-09-13 08:09:40 -07:00
Tom Eastep
9b0a9e8ecd Add -<family> to 'ip route del default' command 2009-09-12 08:48:52 -07:00
Tom Eastep
8c2a228a7d Apply Jesse Shrieve's SNAT patch 2009-09-11 07:47:31 -07:00
Tom Eastep
f33e842f1b Update module version 2009-09-10 14:56:23 -07:00