extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-01 20:13:49 +01:00
Code Issues Packages Projects Releases Wiki Activity
9,108 Commits 104 Branches 736 Tags 55 MiB
fb5a007ba8
Commit Graph

799 Commits

Author SHA1 Message Date
Tom Eastep
07cba9e066 Bump version to RC1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-08 08:11:00 -08:00
Tom Eastep
efed2286b0 Move qt1() to lib.common 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-07 11:50:54 -08:00
Tom Eastep
f246f728e7 Flag '-' used as a port range separator 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-07 08:36:26 -08:00
Tom Eastep
5671a7ae2f Add new options to online usage info. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:45:43 -08:00
Tom Eastep
88447bfc7d Avoid dropping first line of library source text 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:45:21 -08:00
Tom Eastep
2d458b46b4 Update help text in prog.header* 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:13:33 -08:00
Tom Eastep
928b162d3c Fix bug in handling of -p option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 08:12:04 -08:00
Tom Eastep
7557b4b5fb Update version to 4.4.8 Beta 3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 07:41:29 -08:00
Tom Eastep
fe089ddc36 Don't copy headers in imported libraries 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-06 07:40:43 -08:00
Tom Eastep
c8d8d75cae Cosmetic change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-05 10:40:18 -08:00
Tom Eastep
f8c7a284a5 Remove duplicate/unneeded functions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-05 07:02:00 -08:00
Tom Eastep
abb943bfb7 Do library consolidation on IPv6 and load lib.cli into shorecap. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 13:11:33 -08:00
Tom Eastep
50330f71f6 Move many routines into lib.common. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 12:38:02 -08:00
Tom Eastep
7757c0bc20 Rename lib.run to lib.common 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 09:54:56 -08:00
Tom Eastep
7b52d812ae Generate correct library path name 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 09:40:18 -08:00
Tom Eastep
4c081e5998 Add lib.run 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-04 09:12:48 -08:00
Tom Eastep
a963c8f955 Don't export CONFDIR or SHAREDIR 
Document CONFDIR, SHAREDIR and VARDIR
Add FILEMODE to the old reserved variable names

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 11:46:23 -08:00
Tom Eastep
3f73b3c408 Export *DIR variables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 10:39:18 -08:00
Tom Eastep
c6981de0e5 Complete elimination of globals that are not .conf options 
Documentation to follow

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 09:50:07 -08:00
Tom Eastep
ee74696747 IPv6 work to only export when necessary 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 08:59:58 -08:00
Tom Eastep
234e4fa754 Update module versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 08:51:55 -08:00
Tom Eastep
7457f643ee Don't export globals when the script is 4.4.8 or later 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-03 08:51:40 -08:00
Tom Eastep
cce4bf277a Reduce export usage; Allow PURGE and RESTOREFILE to be specified on the run-line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 14:49:31 -08:00
Tom Eastep
2656a9b0c7 Eliminate use of PRODUCT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 12:34:36 -08:00
Tom Eastep
68f5215f07 Remove Reliance on HOSTNAME in generated programs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 11:45:35 -08:00
Tom Eastep
3ea6f6792f Eliminate VERSION reserved variable name 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 08:02:10 -08:00
Tom Eastep
5fc6d58e19 Eliminate STOPPING variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 07:37:30 -08:00
Tom Eastep
d4936f4bad Tweak to an RE used in optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-02 06:58:09 -08:00
Tom Eastep
f11bfd3890 Eliminate redundate setting of PRODUCT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-01 08:32:59 -08:00
Tom Eastep
cfa09dce22 Avoid multiple policy matches with OPTIMIZE=7 and not KLUDGEFREE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-01 08:32:37 -08:00
Tom Eastep
3ba797cb14 Correct several bugs in the VERBOSITY overhaul 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-03-01 06:57:04 -08:00
Tom Eastep
53c73bc8e9 Eliminate VERBOSE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 17:58:01 -08:00
Tom Eastep
14f83759ae Propagate VERBOSITY even though we don't use it yet 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 17:39:35 -08:00
Tom Eastep
546a48543d Propagate LOG_VERBOSITY 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 17:30:11 -08:00
Tom Eastep
39883aa690 Eliminate LOG_VERBOSE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 16:58:30 -08:00
Tom Eastep
fb55d63eaf Allow verbosity to be separate from -V 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 16:42:50 -08:00
Tom Eastep
333ac21c2f Prepare the footers for 4.6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 15:25:25 -08:00
Tom Eastep
83ed0a401b I'll eventually get it the way I like it 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 13:45:33 -08:00
Tom Eastep
585711caa8 Even simpler RE for detecting builtins 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 13:29:26 -08:00
Tom Eastep
693d0e5d4c Make new test in add_jump() a bit safer. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-28 12:44:29 -08:00
Tom Eastep
d2992c21f4 Update version to Beta 2 2010-02-28 09:04:37 -08:00
Tom Eastep
061d850c16 Rename RESTOREPATH to g_restorepath 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-26 08:35:50 -08:00
Tom Eastep
7fe7ebc891 Fix Handling of NFQUEUE(queue-num) in policies 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-25 08:44:28 -08:00
Tom Eastep
70a246501e Update version of Tc.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-23 07:08:48 -08:00
Tom Eastep
3fc10cd94b Prepend 'SW_' to constructed shell variable names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-22 10:27:59 -08:00
Tom Eastep
2a965d42b9 Add a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-21 07:57:34 -08:00
Tom Eastep
6307653a01 Pick up one fix from 4.4.7.4 regarding CONTINUE rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-20 09:42:58 -08:00
Tom Eastep
edaf541850 Don't apply rate limiting twice in ACCEPT+ rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-19 14:01:45 -08:00
Tom Eastep
ceff8adc78 Restore duplicate interface detection in tcinterfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-18 16:11:30 -08:00
Tom Eastep
3a2173ddb4 Some code cleanup in Tc.pm. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-18 15:56:59 -08:00
Tom Eastep
ea8be87720 Use Hex representation of device numbers > 9 in simple TC. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-18 12:53:01 -08:00
Tom Eastep
00b0490cd7 Create a unique hashtable for each instance of a per-IP rate limit 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 15:39:21 -08:00
Tom Eastep
625963a4f0 Final (hopefully) fix for SFQ handle assignment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 09:02:18 -08:00
Tom Eastep
41bb0782a3 Another tweak to SFQ handle assignment. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 08:06:27 -08:00
Tom Eastep
5649dbf9a8 Improve assignment of class ID for SFQ classses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-17 07:41:30 -08:00
Tom Eastep
eaafeb8c2b Add --hashlimit-htable-expire if the units are minutes or larger 2010-02-17 06:43:52 -08:00
Tom Eastep
375160d733 Avoid duplicate SFQ class numbers 2010-02-17 06:43:16 -08:00
Tom Eastep
167b29c2c5 Bump module version in Compiler.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-15 14:24:52 -08:00
Tom Eastep
8aaf4aab3a Don't create log chain for 'RETURN' rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-15 14:24:00 -08:00
Tom Eastep
4546394531 Cosmetic changes to Compiler.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-15 14:07:35 -08:00
Tom Eastep
12d3420a5d Detect FLOW_FILTER when LOAD_HELPERS_ONLY=No 2010-02-14 10:34:19 -08:00
Tom Eastep
5e9ecf1491 Update version of Config module 2010-02-13 11:00:34 -08:00
Tom Eastep
50d246c8be A little cleanup of compiler.pl 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-13 10:03:32 -08:00
Tom Eastep
1258149e0e Don't apply rate limiting twice in NAT rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-13 07:21:27 -08:00
Tom Eastep
ea5a6c79bc Bump CAPVERSION 2010-02-11 16:22:47 -08:00
Tom Eastep
5a96771e07 Start 4.4.8 Beta 1 2010-02-11 15:46:57 -08:00
Tom Eastep
b35f20b403 Avoid CAPVERSION bump to implement FLOW_FILTER detection 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-11 07:29:41 -08:00
Tom Eastep
b8c195f570 Accurately detect 'flow' availability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-10 14:50:26 -08:00
Tom Eastep
433fc385bc 'bridge' implies 'routeback' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-09 14:04:36 -08:00
Tom Eastep
46e2afcf16 Ignore TYPE if old distro 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-08 07:13:20 -08:00
Tom Eastep
b45a70f98a Make 'nosmurfs' work correctly on IPv6 with Address Type Match 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-08 07:12:58 -08:00
Tom Eastep
18d03a61f5 Make 'nosmurfs' work with Address Type Match on IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-07 08:43:31 -08:00
Tom Eastep
11a2ec9f7c Update version to 4.4.7 2010-02-05 16:40:48 -08:00
Tom Eastep
e64af57cae Give smurf logging chain a fixed name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-03 16:04:59 -08:00
Tom Eastep
f4e175f149 Fix IPv6 'nosmurfs'. Make 'nosmurfs' logging more efficient. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-03 15:03:15 -08:00
Tom Eastep
52880a8822 Clean up generate_matrix() fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-03 06:57:51 -08:00
Tom Eastep
9d288241da Fix issues in generate_matrix(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-02 19:42:54 -08:00
Tom Eastep
1d8a7ad09f Clear DEBUG and PURGE shell variables 
Delete a blank line

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-02 13:55:29 -08:00
Tom Eastep
753eb97667 Update version to 4.4.7 RC2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-02 10:30:53 -08:00
Tom Eastep
dd60f04a9f Work around lack of MARK Target support 2010-02-01 16:22:57 -08:00
Tom Eastep
d354560863 Finish last change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-01 14:25:51 -08:00
Tom Eastep
f0d101605b Don't try to combine nat chains that include '-s'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-02-01 14:24:07 -08:00
Tom Eastep
1981372c94 Make search for "-j ACCEPT" a little tighter 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-31 08:27:30 -08:00
Tom Eastep
3d39a47582 Set $have_ipsec after completing parse of the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-30 07:26:35 -08:00
Tom Eastep
659f774451 Sort %detect_capability for easier verification. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-29 13:09:53 -08:00
Tom Eastep
9d2decd26d Modify determine_capabilities to use detect_capability() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-29 10:38:22 -08:00
Tom Eastep
b8ec2be516 Clean up handling of %detect_capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-28 16:39:45 -08:00
Tom Eastep
ecc7861115 Validate LOAD_HELPERS_ONLY before detecting capabilities. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-28 08:05:24 -08:00
Tom Eastep
ebd847ef70 Don't display capabilties if they have not been determined 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-28 08:04:54 -08:00
Tom Eastep
05f2bb4b3a Correction to last patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 17:52:27 -08:00
Tom Eastep
9d25318d80 Fix detection of HASHLIMIT_MATCH on old kernels. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 12:53:31 -08:00
Tom Eastep
54456de888 Update module versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 09:01:00 -08:00
Tom Eastep
c05c1a6f50 Update version to 4.4.7 RC1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-27 06:58:44 -08:00
Tom Eastep
1556002b54 A couple of tweaks to the LOAD_HELPERS_ONLY optimization change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 15:59:31 -08:00
Tom Eastep
fb007bc1c7 Bump version to Beta 4 2010-01-25 12:25:01 -08:00
Tom Eastep
9408a114c6 Don't load unused modules when LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 10:50:49 -08:00
Tom Eastep
d933aa602b Eliminate 'ORIGINAL_POLICY_MATCH' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 08:13:22 -08:00
Tom Eastep
90b68a05de Don't export %capabilities 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-25 07:56:16 -08:00
Tom Eastep
bfdc6719c1 Fix DropBcasts() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-24 12:16:15 -08:00
Tom Eastep
e14d48c2cf Bump version to 4.4.7-Beta3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-22 16:46:29 -08:00
Tom Eastep
0d63182ab4 Fix ambiguous syntax in Config.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-22 16:44:45 -08:00
Tom Eastep
199a50e1c7 Update version to 4.4.7 Beta 2 
Add problems corrected to the release notes.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-22 10:35:27 -08:00
Tom Eastep
8f85c75264 Implement LOAD_HELPERS_ONLY for IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-21 15:49:44 -08:00
Tom Eastep
efc43b1b24 Add implementation of LOAD_HELPERS_ONLY 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-21 15:49:35 -08:00
Tom Eastep
a248acb4d4 Add LOAD_HELPERS_ONLY Option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-21 15:49:23 -08:00
Tom Eastep
e119037dea Make 'is_isable()' work with 'lo' 2010-01-17 15:38:20 -08:00
Tom Eastep
f072c10b18 Set version to 4.4.7 Beta1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-17 09:10:48 -08:00
Tom Eastep
f4102417ff Shorewall::Config changes for TPROXY from 4.5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-17 08:15:14 -08:00
Tom Eastep
07cdb8ca82 Backport TPROXY from 4.5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-17 08:12:44 -08:00
Tom Eastep
47007c5dbd Allow protocol to be expressed in octal or hex 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 14:20:47 -08:00
Tom Eastep
aad8ea837a Allow port numbers to be specified in Hex 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 14:00:47 -08:00
Tom Eastep
5ec7759d81 Don't pass an undefined value to fatal_error when numeric conversion fails. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 12:35:18 -08:00
Tom Eastep
4bf0b8e1dd Add new configuration options and optimization changes from 4.5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 09:53:53 -08:00
Tom Eastep
d5cc302ad9 Start 4.4.7 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-16 08:11:13 -08:00
Tom Eastep
ebf1e55609 Version to 4.4.6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 15:38:19 -08:00
Tom Eastep
880cd269c7 More mark geometry misses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 12:16:40 -08:00
Tom Eastep
72de96760f One more 0xFF -> $globals{TC_MASK} fix 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 12:11:00 -08:00
Tom Eastep
10c5630786 A few more instances of TC_MASK 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 10:50:14 -08:00
Tom Eastep
555133fa3c Bump version to 4.4.6-Beta2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 10:14:31 -08:00
Tom Eastep
b4b6dce7c8 Add some comments 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 08:12:00 -08:00
Tom Eastep
4821d5e8b7 Change quantum to 1875 for simple TC SFQ. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-13 08:11:49 -08:00
Tom Eastep
f69a741691 Port Simplified TC to 4.4.6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 17:01:20 -08:00
Tom Eastep
7e183e8eb4 Change version to 4.4.6-Beta1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:57:55 -08:00
Tom Eastep
57672d096c Don't invoke 4.5 optimization under 4.4. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:47:14 -08:00
Tom Eastep
ae31a09e8b Move code and add comments: 
- Declare all of the 'preview' helpers together in Chains.pm
- Add some clarifying comments in the compiler.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:32:59 -08:00
Tom Eastep
4420eed8d7 Allow users to preview the generated ruleset. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-12 15:32:50 -08:00
Tom Eastep
6b085b7897 Update module versions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 18:54:23 -08:00
Tom Eastep
5b4e9eb8e6 Revert change with migration issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 15:30:33 -08:00
Tom Eastep
0b549c7a15 Suppress mark geometry output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:55:42 -08:00
Tom Eastep
1a74dbf93e Add mark geometry changes to Shorewall::Chains and Shorewall::Compiler 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:39:22 -08:00
Tom Eastep
01293427f5 Add Mark Geometry changes to Shorewall::Tc 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:29:34 -08:00
Tom Eastep
4f5bb5e90b Add new mark geometry changes to Shorewall::Providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:22:01 -08:00
Tom Eastep
d2d2912534 Add New mark geometry variables to Shorewall::Config 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-11 14:16:03 -08:00
Tom Eastep
4e50ea14ea Back out EXMARK detection since it is unused in 4.4. 
Long overdue change to LIBVERSION

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-09 09:30:25 -08:00
Tom Eastep
b0feeb805d Fix typo in clear_firewall() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-09 07:28:57 -08:00
Tom Eastep
e6c0c8f6b7 Allow both <...> and [...] for IPv6 Addresses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-08 13:55:13 -08:00
Tom Eastep
83c2473d78 Correct typo in error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-06 08:26:13 -08:00
Tom Eastep
ca4eee3ae4 Correct handling of 'refresh' failures 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-06 08:01:46 -08:00
Tom Eastep
605da92eca Don't try to restore ipsets when 'restore' is being used to recover 
from a start/restart failure.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-06 07:44:34 -08:00
Tom Eastep
d362af9fb6 Set CAPSVERSION to 4.4.7 just to be safe. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-05 10:00:29 -08:00
Tom Eastep
ab1dc03986 Implement EXMARK capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-05 09:35:11 -08:00
Tom Eastep
d6123a8fbc Improve IPSET_SAVE restore logic: 
- Call startup_error() rather than fatal_error()
- Call startup_error when restore-ipsets file exists but Shorewall is running

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 14:23:33 -08:00
Tom Eastep
4e0f9b2ef3 Make save/restore work with SAVE_IPSETS=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 12:43:12 -08:00
Tom Eastep
1aa55779e2 Re-enable SAVE_IPSETS=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 11:14:45 -08:00
Tom Eastep
a1fd3aa7e3 Add a hack to work around a 'feature' of xtables-addons on Lenny 
Be more careful about checking for the ipset utility before saving the ipsets

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-04 10:15:27 -08:00
Tom Eastep
55e874b23f Update copyrights 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2010-01-01 12:58:27 -08:00
Tom Eastep
65c282af8b Delete temporary nat chain used in capabilities detection. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2009-12-31 10:42:21 -08:00
Tom Eastep
ea2ab6e4b6 A better solution to Marcus Limosani's issue 2009-12-29 08:22:15 -08:00
Tom Eastep
f568f3df9e Final fix for Marcus Limosani's problem 2009-12-28 15:05:54 -08:00
Tom Eastep
738a6de11b Make use of interface chains deterministic 2009-12-28 07:36:15 -08:00
Tom Eastep
f933816735 Simplify handling of packet clearing 2009-12-26 15:04:41 -08:00
Tom Eastep
d62f3a4fed Set version to 4.4.6 2009-12-24 08:00:59 -08:00
Tom Eastep
f233b86278 Fix 'forward' interface option in IPv6 2009-12-24 07:51:44 -08:00
Tom Eastep
e38df7efcb Fix another bug in ROUTE_FILTER Handling 2009-12-23 15:13:43 -08:00
Tom Eastep
e37cf0a370 Fix other issues with rp_filter fix 2009-12-20 15:54:41 -08:00
Tom Eastep
61b2ed7b57 Fix bug that prevented routefilter=2 2009-12-19 16:57:16 -08:00
Tom Eastep
d5914addd1 Disallow port 00 2009-12-19 14:59:03 -08:00
Tom Eastep
19af1a081c Handle kernel 2.6.31 and rp_filter 2009-12-19 13:47:12 -08:00
Tom Eastep
4f4d77be48 Add Kernel Version to the capabilities 2009-12-19 12:42:39 -08:00
Tom Eastep
24ddacb4a7 Adjust module versions 2009-12-19 07:35:30 -08:00
Tom Eastep
10ae98571b Revert change that allowed out of order policies 2009-12-19 07:20:00 -08:00
Tom Eastep
182ed24b02 Add a comment to process_rule1() 2009-12-14 15:52:16 -08:00
Tom Eastep
576cd76842 Remove superfluous logic from process_rule1 2009-12-14 14:49:38 -08:00
Tom Eastep
e9d12cfc11 Remove superfluous line of code 2009-12-14 07:17:55 -08:00
Tom Eastep
9988cfb619 Remove silly logic in expand_rule() 2009-12-10 08:00:18 -08:00
Tom Eastep
3214b14197 Fix macro handling of SOURCE and DEST columns 2009-12-08 13:29:06 -08:00
Tom Eastep
5e1f550b69 Fix ENHANCED_REJECT and MODULE_SUFFIX 2009-12-07 13:51:54 -08:00
Tom Eastep
7a6ad80c8a Make kernel version detection work with non-standard version naming such as found on OpenWRT 2009-12-06 10:42:28 -08:00
Tom Eastep
4bf55883ee Auto-load cls_flow 2009-12-03 12:15:23 -08:00
Tom Eastep
4494272dcd Improve error message 2009-11-29 09:55:32 -08:00
Tom Eastep
8c033de049 Fix limit check on TC mark values 2009-11-28 14:05:27 -08:00
Tom Eastep
e582f222ad Backout another Patch from the Virtual Zone Sequence and re-apply a couple of small optimizations 2009-11-28 07:25:31 -08:00
Tom Eastep
e5106f10bc Revert 8ff4d004c0 2009-11-28 07:23:23 -08:00
Tom Eastep
4e8d753682 Revert "Finish Virtual Zones" 
This reverts commit 222c8cf88f.
 2009-11-28 07:20:52 -08:00
Tom Eastep
d1812b4174 Revert "Fix a couple of bugs in virtual zones" 
This reverts commit 22991ac9dd.
 2009-11-28 07:20:28 -08:00
Tom Eastep
038b84e775 Revert "Small optimization in virtual zones" 
This reverts commit 251d7116c8.
 2009-11-28 07:20:01 -08:00
Tom Eastep
f21c71d7a6 Revert "Match section rules to the number of mark rules" 
This reverts commit 1699d8e941.
 2009-11-28 07:19:41 -08:00
Tom Eastep
0b1621027b Revert "Make 'virtual' a zone type rather than an option" 
This reverts commit 18eedf7e34.
 2009-11-28 07:19:10 -08:00
Tom Eastep
ea2c55a993 Revert "Fix off-by-one problem" 
This reverts commit 543af8bccb.
 2009-11-28 07:18:07 -08:00
Tom Eastep
f5bf3c9b43 Fix merge conflicts 2009-11-28 07:16:03 -08:00
Tom Eastep
7352771c5d Fix .spec history to omit false steps 2009-11-27 12:29:11 -08:00
Tom Eastep
543af8bccb Fix off-by-one problem 2009-11-27 08:56:23 -08:00
Tom Eastep
7f16e96167 Set version to 4.4.5 Beta1 2009-11-27 08:52:37 -08:00
Tom Eastep
18eedf7e34 Make 'virtual' a zone type rather than an option 2009-11-27 08:17:18 -08:00
Tom Eastep
1699d8e941 Match section rules to the number of mark rules 2009-11-26 17:12:11 -08:00
Tom Eastep
251d7116c8 Small optimization in virtual zones 2009-11-26 14:48:46 -08:00
Tom Eastep
22991ac9dd Fix a couple of bugs in virtual zones 2009-11-26 14:19:10 -08:00
Tom Eastep
222c8cf88f Finish Virtual Zones 2009-11-26 12:14:58 -08:00
Tom Eastep
8ff4d004c0 Better virtual zone implementation 2009-11-25 18:14:14 -08:00
Tom Eastep
8263ea1312 Limit providers to 15 2009-11-25 12:18:08 -08:00
Tom Eastep
d189c08533 Revert "Add 'virtual' zone support" 
This reverts commit a2cd4bd1f4.
 2009-11-25 11:51:13 -08:00
Tom Eastep
a2cd4bd1f4 Add 'virtual' zone support 2009-11-25 09:42:28 -08:00
Tom Eastep
4c40b205f8 Revert "Experimental explicit CONTINUE" 
This reverts commit 10056a03d9.
 2009-11-24 13:14:24 -08:00
Tom Eastep
10056a03d9 Experimental explicit CONTINUE 2009-11-24 12:50:53 -08:00
Tom Eastep
cd84efea94 Yet one more change to IPv6 address validation 2009-11-24 08:29:12 -08:00
Tom Eastep
deb45c5a27 Yet another IPv6 Address Normalization fix 2009-11-23 15:57:12 -08:00
Tom Eastep
bdb673a642 More IPv6 fixes 2009-11-23 15:21:25 -08:00
Tom Eastep
1710f9ce7c Several fixes to IPv6 Address Handling 2009-11-23 14:44:53 -08:00
Tom Eastep
9d85d0ff7a Allow IPv6 DNS names in net contexts 2009-11-23 13:51:46 -08:00
Tom Eastep
5610f78a48 Update version of Shorewall::Policy; improve 'expanded' description in Shorewall::Chains 2009-11-23 11:31:38 -08:00
Tom Eastep
99a35c1bf0 Allow <zone>::<serverport> in the rules file DEST column 2009-11-23 09:33:16 -08:00
Tom Eastep
5b02ef68a5 Simplify port == 0 test 2009-11-22 09:00:03 -08:00
Tom Eastep
d4ff629fd8 Generate error on port == 0 2009-11-22 08:44:11 -08:00
Tom Eastep
6e9d9e239d Apply 4.4.4.1 changes to master 2009-11-22 08:20:07 -08:00
Tom Eastep
4aeee6fd8b Make 'expanded' apply to all wildcard policies 2009-11-21 14:18:01 -08:00
Tom Eastep
c7de19cf39 Allow specific policy to supersede an expanded one 2009-11-21 13:56:40 -08:00
Tom Eastep
cbe944c354 Open the 4.5.0 Thread 2009-11-21 11:41:10 -08:00
Tom Eastep
ecf6a0ec4a Open 4.4.5 2009-11-21 11:08:50 -08:00
Tom Eastep
bce4d51a18 Allow wide MARK values in tcclasses when WIDE_TC_MARKS=Yes 2009-11-21 07:54:42 -08:00
Tom Eastep
c5bb493b29 Fix class number assignment when WIDE_TC_MARKS=Yes 2009-11-20 12:25:15 -08:00
Tom Eastep
0df84cf8b5 Remove superfluous line of code 2009-11-19 10:54:58 -08:00
Tom Eastep
a23632f45e Mostly cosmetic cleanup of Shorewall::Chains 2009-11-19 10:35:25 -08:00
Tom Eastep
c39a9fb5eb Fix typo in shorewall-rules(5) 2009-11-18 19:55:20 -08:00
Tom Eastep
4579a71574 More massaging of redundant test suppression 2009-11-17 11:14:02 -08:00
Tom Eastep
831611e792 Update version of Shorewall::Policy 2009-11-16 20:24:01 -08:00
Tom Eastep
5f70b261b6 Update version of Shorewall::Compiler 2009-11-16 20:21:59 -08:00
Tom Eastep
5ec4f8d82c Unconditionally include route marking and sticky chains 2009-11-16 14:15:01 -08:00
Tom Eastep
2a910ebddf Suppress redundant tests for provider availability in route rules processing 2009-11-16 12:43:44 -08:00
Tom Eastep
016537f631 Don't add route rules when interface is down 2009-11-16 10:58:38 -08:00
Tom Eastep
dd543a2934 Tweak policies display 2009-11-16 09:30:37 -08:00
Tom Eastep
f5a019becc Implement 'show policies' command 2009-11-15 09:24:56 -08:00
Tom Eastep
b662718eec Replace canonical_chain by rules_chain 2009-11-14 07:07:19 -08:00
Tom Eastep
10affb1cde Set version to 4.4.4 2009-11-13 13:52:49 -08:00
Tom Eastep
fa3bdde214 Set version to Beta2 2009-11-13 12:39:41 -08:00
Tom Eastep
0e6c9abb5b A fix for COPY handling 2009-11-12 16:45:39 -08:00
Tom Eastep
f904866336 More minor cleanup of chain name change 2009-11-12 12:30:08 -08:00
Tom Eastep
2d53f8cb0c Delete unnecessary function 2009-11-11 16:35:46 -08:00
Tom Eastep
b943f09e37 Fix indentation 2009-11-11 12:34:15 -08:00
Tom Eastep
4e6b8f8f42 Set version to 4.4.4-Beta1 2009-11-11 10:58:22 -08:00
Tom Eastep
0f078e7440 Ignore empty port in INTERFACE column 2009-11-11 10:52:14 -08:00
Tom Eastep
a4eb581d44 Document full logical interface implementation 2009-11-11 10:45:01 -08:00
Tom Eastep
06d3b2c692 Allow wildcard logical names in COPY column 2009-11-11 10:17:53 -08:00
Tom Eastep
6987cd15c5 Avoid dereference of null variable 2009-11-11 10:10:45 -08:00
Tom Eastep
ba8ad6346a More use of logical chain name 2009-11-11 10:06:06 -08:00
Tom Eastep
893a847c87 Suppress extra COMMENT warnings 2009-11-10 17:17:55 -08:00
Tom Eastep
bf8c38e054 Add ZONE2ZONE option to shorewall.conf 2009-11-10 14:12:55 -08:00
Tom Eastep
7120a73f0e Minor efficiency improvement in move_rules() 2009-11-10 08:08:02 -08:00
Tom Eastep
c9e57c93a2 Insure uniqueness of physical names; use logical name when constructing the name of a chain 2009-11-10 07:24:14 -08:00
Tom Eastep
4e2f2923b6 Update ::Config::VERSION 2009-11-09 13:16:40 -08:00
Tom Eastep
79b5cb49df Fix over-zealous use of physical name; Correct syntax errors 2009-11-09 12:38:00 -08:00
Tom Eastep
893a0c9d42 Remove order dependency in interface OPTIONS processing 2009-11-09 11:15:08 -08:00
Tom Eastep
9b127e6e06 Improve performance of logical->physical mapping 2009-11-09 07:27:14 -08:00
Tom Eastep
92208251b7 Add undocumented LOGICAL_NAMES option 2009-11-09 07:01:25 -08:00
Tom Eastep
dda6f06883 Update module versions 2009-11-08 09:01:30 -08:00
Tom Eastep
4d977306f9 Make 'physical' work as a general logical name facility 2009-11-08 08:37:03 -08:00
Tom Eastep
83621ff416 Add logical->physical mapping to Shorewall::Chains 2009-11-08 07:11:38 -08:00
Tom Eastep
09f1b6501c Add logical->physical mapping to Shorewall::Providers 2009-11-08 07:00:43 -08:00
Tom Eastep
ca1dd1416d Add logical->physical mapping to Shorewall::Tc 2009-11-08 06:26:47 -08:00
Tom Eastep
1238b771a2 Apply logical->physical mapping to /proc settings 2009-11-07 18:59:10 -08:00
Tom Eastep
b1706e10e3 Correct typo 2009-11-07 07:58:15 -08:00