extern/shorewall_code
1
0
Fork 1
mirror of https://gitlab.com/shorewall/code.git synced 2024-12-24 07:08:53 +01:00
Code Issues Packages Projects Releases Wiki Activity
12,242 Commits 104 Branches 736 Tags 55 MiB
fc73c3934b
Commit Graph

2651 Commits

Author SHA1 Message Date
Tom Eastep
7673b1ac4b Support multiple parameters in macros. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 11:04:19 -08:00
Tom Eastep
fc87576005 Back out silly change for output interfaces in the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 09:47:42 -08:00
Tom Eastep
3f550622bd Only use routing table for OUTPUT interface in the raw table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 07:51:55 -08:00
Tom Eastep
e7dee420ee Allow interfaces in the DEST column of the conntrack file when the chain is OUTPUT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 18:37:23 -08:00
Tom Eastep
e45fe53705 Correct another optimizer defect. 
- Don't declare command-mode rules as duplicates.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 18:00:26 -08:00
Tom Eastep
697fc001c3 Return to zone-based handling of 'all'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 16:31:05 -08:00
Tom Eastep
642f192b3d Disallow destination interface in the OUTPUT chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 15:37:53 -08:00
Tom Eastep
7b0578fa84 Fix AUDIT on IPv6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 12:09:18 -08:00
Tom Eastep
5acf0f60e7 Only apply log level to bare LOG rules in default-action macro. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 10:17:03 -08:00
Tom Eastep
fb3194d96b Correct handling of default-action macro when specified as "macro.Name" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 10:16:43 -08:00
Tom Eastep
066a017420 Correct typo in Raw.pm 
- The OUTPUT chain designator test was using '0' (zero) rather than 'O'.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 08:52:33 -08:00
Tom Eastep
1870c281a9 Make AUDIT support params again. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 08:26:44 -08:00
Tom Eastep
dbfc805707 Add 'IU' state in secmarks 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 08:10:53 -08:00
Tom Eastep
b7e2b28562 Transfer tag when merging into an NFLOG/ULOG rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-24 09:04:56 -08:00
Tom Eastep
67e1e6cf91 Allow WHITELIST in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 14:19:14 -08:00
Tom Eastep
cd2854cad0 Fix NFLOG/ULOG implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 13:49:43 -08:00
Tom Eastep
75c148a2dd Enable 'debug' on the try, stop and clear commands. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 11:46:14 -08:00
Tom Eastep
71bbc632ce Handle 'fw' correctly in the SOURCE column of the stoppedrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 08:35:51 -08:00
Tom Eastep
b6a1a7d538 Make NFLOG and ULOG built-ins. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 08:14:24 -08:00
Tom Eastep
30de211bda Implement format-3 conntrack files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 20:56:56 -08:00
Tom Eastep
3f7425b6a0 Purge %renamed before each table is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 17:27:09 -08:00
Tom Eastep
26dee73895 Support the audited targets on IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 08:24:51 -08:00
Tom Eastep
df7ce1a7d1 Add the AUDIT built-in and delete the Audit action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 08:24:33 -08:00
Tom Eastep
4a05571e7e Add forward prototype for process_macro() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 08:00:15 -08:00
Tom Eastep
b89e05740d Insure that nested zone exclusions go in the proper place in raw PREROUTING 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 14:49:21 -08:00
Tom Eastep
3040156981 Add SWITCH column to the conntrack file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 14:20:56 -08:00
Tom Eastep
54dadcc546 Ensure that zone-specific rules come before 'all' rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 14:20:30 -08:00
Tom Eastep
952aed225d Improve handling of 'all' in the conntrack file. 
- Also added 'all-' to represent all off-firewall zones.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 13:07:01 -08:00
Tom Eastep
1efd47a7e9 Apply Tuomo Soini's fix for RHEL5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 10:34:00 -08:00
Tom Eastep
374489c3cf Revert "Fix RHEL5 issue with route marking." 
This reverts commit 77f342b0e0.
 2012-11-21 10:19:24 -08:00
Tom Eastep
77f342b0e0 Fix RHEL5 issue with route marking. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 09:08:15 -08:00
Tom Eastep
8f52c9744e Correct some issues with default action macros. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 08:29:35 -08:00
Tom Eastep
1957af04fd Don't create a _weight file for an optional non-provider interface. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 16:10:30 -08:00
Tom Eastep
a0faba2a03 Correct interface/provider handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 13:27:15 -08:00
Tom Eastep
c798200b20 Another correction to CHECKSUM detection. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 10:09:28 -08:00
Tom Eastep
67ae9df0f8 Correct handling of unknown interfaces in TC. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 08:07:42 -08:00
Tom Eastep
ebb4e1f6e4 Don't generate start/stop functions for wildcard optional interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 07:06:27 -08:00
Tom Eastep
f458e99390 Correct the compiler's CHECKSUM detection 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 06:59:40 -08:00
Tom Eastep
5b049d7e9e Improve readability in Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 06:59:13 -08:00
Tom Eastep
3b20c0db54 Allow Macros to be used as Default Actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 16:52:10 -08:00
Tom Eastep
0d8931e49f Don't use ':' as a join character in contatenated macro ACTION expansion. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 12:58:29 -08:00
Tom Eastep
47791add99 Fix formatting of a line of code. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 12:30:25 -08:00
Tom Eastep
be587726f4 Merge branch '4.5.9' 2012-11-19 08:22:05 -08:00
Tom Eastep
b25ece75de Don't leave temporary chain in the raw table when LOAD_HELPERS_ONLY=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 08:18:32 -08:00
Tom Eastep
0db7b6c58a Don't require a parameter with '&' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 15:45:58 -08:00
Tom Eastep
57e913d86e Merge branch '4.5.9' 2012-11-18 15:02:46 -08:00
Tom Eastep
a4294658b6 Add a capability to use log levels as a target. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 14:50:59 -08:00
Tom Eastep
65e1b1c9e7 Allow NFLOG as a target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 13:15:24 -08:00
Tom Eastep
a07cfb0885 Allow NFLOG as a target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 13:13:43 -08:00
Tom Eastep
c6ffdd67e2 Add DROP target to the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 11:35:40 -08:00
Tom Eastep
5265cd5bb7 Add UNTRACKED match to the secmarks file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 11:01:49 -08:00
Tom Eastep
5712438bcb Eliminate Shell syntax error when a provider and its interface have the same name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-16 09:50:36 -08:00
Tom Eastep
a2b14c37ed Treat optional interfaces as pseudo-providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-16 09:48:21 -08:00
Tom Eastep
b1ffcd8628 Apply provider mask in 'routemark' chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-14 11:20:30 -08:00
Tom Eastep
34e3e4bf82 Merge branch '4.5.9' 2012-11-14 11:17:18 -08:00
Tom Eastep
06a4994488 Make exclusion work correctly with TPROXY. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-14 11:16:52 -08:00
Tom Eastep
391113dfe3 Apply provider mask in 'routemark' chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-13 06:55:59 -08:00
Tom Eastep
3c58d2180d Improve the efficiency of tcrule processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-13 06:55:35 -08:00
Tom Eastep
32c9e4274f Rename 'mysplit' to 'split_host_list' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-11 08:42:01 -08:00
Tom Eastep
896d874aab Set VARLIB in the script's initialize() function. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-09 12:29:19 -08:00
Tom Eastep
5fcdfd779c Don't default IPSET to 'ipset'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-09 08:54:54 -08:00
Tom Eastep
860ee6de27 Eliminate nonsensical warning message. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-06 07:36:36 -08:00
Tom Eastep
ec17ea1dee Remove superfluous check 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-03 08:19:46 -07:00
Tom Eastep
2e211bc2b6 Correct handling of wildcard interfaces in rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-03 07:24:41 -07:00
Tom Eastep
5f0b85b5b9 Replace a couple of more hard-coded directory names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-30 09:49:53 -07:00
Tom Eastep
3f1aeb33be Correct mark range with shifted mask. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-26 12:41:06 -07:00
Tom Eastep
e177916c12 Implement statistical marking in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-26 07:10:26 -07:00
Tom Eastep
0387b16983 Implement CHECKSUM action in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-22 15:42:13 -07:00
Tom Eastep
6af16e0cda Allow quotes in parameter to run_iptables() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-14 13:26:08 -07:00
Tom Eastep
ab7975539c Correct typo in get_params() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-14 09:30:27 -07:00
Tom Eastep
dfd0692176 Omit IPv6-specific code from checkkernelversion() in IPv4 script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-13 07:28:37 -07:00
Tom Eastep
8b650358d6 Don't shout in compiler directives 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-13 07:14:51 -07:00
Tom Eastep
cc90a06958 Add RESTORE_ROUTEMARKS option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-11 07:34:57 -07:00
Tom Eastep
54e066ec3a Re-order logic in add_group_to_zone 
- Need to normalize the address prior to comparing it with ALLIP

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-08 08:54:54 -07:00
Tom Eastep
620f88b339 Merge branch '4.5.8' 2012-10-07 17:41:01 -07:00
Tom Eastep
b7e6b1aa41 Allow IP range in the hosts file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 17:40:42 -07:00
Tom Eastep
c84603cdc6 Merge branch '4.5.8' 
Conflicts:
	Shorewall/Perl/Shorewall/Zones.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 17:04:27 -07:00
Tom Eastep
e2b029b0ba More hosts file corrections. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 17:00:35 -07:00
Tom Eastep
0efc0451c1 Allow IP range in the hosts file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 15:59:30 -07:00
Tom Eastep
9dd66fc6ff Allow IP range in the hosts file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 15:55:00 -07:00
Tom Eastep
0c9cc4a233 Change the 'dynamic' zone option to 'dynamic_shared' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 09:18:18 -07:00
Tom Eastep
c228668500 Implement logic associated with 'dynamic' zone option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-06 07:52:06 -07:00
Tom Eastep
afaba46aa3 Add 'dynamic' zone option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-06 07:21:49 -07:00
Tom Eastep
1f38a36acf Delete extraneous logic 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:

	Shorewall/Perl/Shorewall/Zones.pm
 2012-10-04 09:45:25 -07:00
Tom Eastep
526f72216a Correct handling of dash characters in interface/ipset names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-04 07:34:41 -07:00
Tom Eastep
642ff1be15 Correct handling of dash characters in interface/ipset names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-02 10:09:23 -07:00
Tom Eastep
92d39dc56d Expunge the g_perllib variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-01 06:59:39 -07:00
Tom Eastep
a8e9296473 Expunge the g_sbindir variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-01 06:55:48 -07:00
Tom Eastep
749e239d15 Expunge the g_libexec variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-01 06:51:36 -07:00
Tom Eastep
30d4ba67cc Revert "Allow '-' in the interface for dynamic zone." 
This reverts commit b68b34b820.
 2012-09-30 16:25:35 -07:00
Tom Eastep
4ef81041be Delete extraneous logic 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-30 16:09:34 -07:00
Tom Eastep
b68b34b820 Allow '-' in the interface for dynamic zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-30 16:04:38 -07:00
Tom Eastep
4311dc5ddf Merge branch '4.5.8' 2012-09-29 09:03:12 -07:00
Tom Eastep
38faa3e071 Correct handling of new ipv6 net syntax in the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-29 09:01:17 -07:00
Tom Eastep
81f92546d8 Merge branch '4.5.8' 2012-09-29 08:08:00 -07:00
Tom Eastep
91e2c31a58 Correct handling of new ipv6 net syntax in the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-27 14:51:28 -07:00
Tom Eastep
9c893a0e21 Restore the original calling sequences of validate_[46]net() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-27 07:22:40 -07:00
Tom Eastep
ffcf262de4 Ensure that the 1:1 NAT chain jumps always come last in PREROUTING. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-26 15:46:52 -07:00
Tom Eastep
bac0f36818 Yet another fix for TTL/HL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 16:23:15 -07:00
Tom Eastep
b451e10dd8 More fixes for HL and TTL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 14:25:31 -07:00
Tom Eastep
6d0142525c Merge branch '4.5.8' 2012-09-24 08:44:07 -07:00
Tom Eastep
cf130a7e16 Correct handling of {+-}0 in the TTL and HL tcrule actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 07:14:44 -07:00
Tom Eastep
70c76f577c Permit "[<ipv6 address>]/vlsm" in addition to "[<ipv6 address>/vlsm]" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-23 12:16:17 -07:00
Tom Eastep
607c93125c Don't unconditionally detect helpers when LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:
	docs/Internals.xml
 2012-09-23 06:55:00 -07:00
Tom Eastep
32f89fa24b Don't unconditionally detect helpers when LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-22 09:27:13 -07:00
Tom Eastep
4aeebb0b15 Merge branch '4.5.8' 2012-09-19 10:07:31 -07:00
Tom Eastep
e14f5e5199 Swicth from postincrement to preincrement when bumping 'filterpri'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-17 10:46:31 -07:00
Tom Eastep
483374d356 Continue development of the Internals document 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-17 07:52:18 -07:00
Tom Eastep
fc361afbc3 Disallow ':' as the only contents of the USER/GROUP column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-16 16:25:41 -07:00
Tom Eastep
124dafbf52 Delete IPAddrs dependency from Compiler.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-16 15:48:06 -07:00
Tom Eastep
78f3255bf0 Correct getparams. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-16 09:06:32 -07:00
Tom Eastep
adc983bccb Issue progress messages to display the priority of Shorewall-generated filters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-15 07:25:16 -07:00
Tom Eastep
e0f85edab3 Assign sequential priorities to filters 
- Also remove a redundant 0x prefix from a table number.

Signed-off-by: Tom Eastep <teastep@shorewall.net
 2012-09-13 09:30:11 -07:00
Tom Eastep
14073e8943 Change TOS priority offset from 10 to 15 
- Make it distinct from tcp-ack

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-13 08:25:05 -07:00
Tom Eastep
75953a87cb Optional priority on hfsc classes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-12 13:39:54 -07:00
Tom Eastep
a223245c01 Don't create classic blacklist chains if no blacklist file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-12 07:30:34 -07:00
Tom Eastep
89289f95ba Allow specification of priority for Shorewall-generated tc filters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-12 07:22:07 -07:00
Tom Eastep
f6e3107c00 Redefine tc filter priorities 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-10 10:03:16 -07:00
Tom Eastep
b4098ff5dd Appease the Fedora 17 version of emacs. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-10 10:02:47 -07:00
Tom Eastep
9d6e0fd9ed Add a PRIORITY column to the tcfilters file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-09 14:48:32 -07:00
Tom Eastep
0e1e38b035 Adjust VARDIR/VARLIB for old shorewallrc files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-09 13:12:32 -07:00
Tom Eastep
d7354aca14 Add a warning regarding the blacklist option being deprecated. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-05 07:19:48 -07:00
Tom Eastep
ebc4ad2f1e Add warning message when an OUTPUT stopped rule is ignored due to ADMINISABSENTMINDED 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-05 07:16:40 -07:00
Tom Eastep
6614239b32 Allow multiple USER/GROUPs in a rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-04 17:03:26 -07:00
Tom Eastep
3993abad4e Revert routestopped changes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-04 17:03:02 -07:00
Tom Eastep
eb854f1dbe Only process routestopped when stoppedrules does not exist or is empty 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-04 08:46:04 -07:00
Tom Eastep
4260e5f6ba Correctly handle the product name in export shorewallrc. 
- Also re-arranged the processing of the shorewallrc file to eliminate
  the kludgy shuffling of hashes.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-04 06:59:16 -07:00
Tom Eastep
bdd66e68c9 Have separate hashes for the two shorewallrc files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-03 20:09:20 -07:00
Tom Eastep
55e3b11a28 Pass both shorewallrc files to the compiler from lib.cli-std 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-03 15:07:50 -07:00
Tom Eastep
5b953cc1dd Handle different layouts on the admin system and remote firewall(s) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-03 09:50:07 -07:00
Tom Eastep
8e5bd3637d Implement stoppedrules file (less manpages) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-03 08:44:03 -07:00
Tom Eastep
7279553be4 Revert "Add GROUP zones" 
This reverts commit 4f2a4c0c6c.
 2012-09-02 11:08:38 -07:00
Tom Eastep
a6740c6c53 Revert "Assign marks to according to GROUP zones" 
This reverts commit 3fbfafb6e3.
 2012-09-02 11:06:28 -07:00
Tom Eastep
3fbfafb6e3 Assign marks to according to GROUP zones 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-01 18:13:49 -07:00
Tom Eastep
353915fc8b Allow ipsets in the routestopped file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-01 10:52:37 -07:00
Tom Eastep
e2c7284529 Correct handling of 'source' with ADMINISABSENTMINDED=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-01 08:26:31 -07:00
Tom Eastep
4f2a4c0c6c Add GROUP zones 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-31 17:37:01 -07:00
Tom Eastep
deea614677 Placate the latest Emacs WRT qw/.../ 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-31 17:36:38 -07:00
Tom Eastep
9b05146a85 New documents (WIP) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-30 10:06:58 -07:00
Tom Eastep
09a6f8bc16 Revert non-fatal error implementation 
- In the end, I didn't like the way this worked.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-29 11:35:11 -07:00
Tom Eastep
303dc65d13 Merge branch '4.5.7' 2012-08-28 11:46:04 -07:00
Tom Eastep
d838cf41bf Allow TTL and HL in the PREROUTING chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-28 11:45:32 -07:00
Tom Eastep
84e24325de Merge branch '4.5.7' 2012-08-27 07:30:21 -07:00
Tom Eastep
3aca90811c Clear the current comment at the end of the blrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-27 07:29:47 -07:00
Tom Eastep
7b12558249 Merge branch '4.5.7' 2012-08-26 09:18:16 -07:00
Tom Eastep
341dec0711 Another fix for the NOTRACK patch 
- 3 defects in a two-line patch :-(
 2012-08-26 09:17:57 -07:00
Tom Eastep
01b58bf66f Merge branch '4.5.7' 2012-08-26 08:27:39 -07:00
Tom Eastep
dc21d015da Clean up white-space in Togan's patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-26 08:27:24 -07:00
Tom Eastep
9e5d1cc1ce Merge branch '4.5.7' 2012-08-26 08:11:40 -07:00
Tom Eastep
779243094e Map NOTRACK to 'CT --notrack' if CT_TARGET is available. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-26 08:08:57 -07:00
Tom Eastep
7208464c68 Change "Compilation aborted..." to "Check aborted ..." 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-25 08:10:12 -07:00
Tom Eastep
1067f8a9bb Use the non-fatal error reporting feature for missing capabilities 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-24 06:25:29 -07:00
Tom Eastep
3006452cea Unconditionally restore route mark in PREROUTING and OUTPUT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-23 12:23:29 -07:00
Tom Eastep
e17010018c Unconditionally restore route mark in PREROUTING and OUTPUT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-23 12:15:14 -07:00
Tom Eastep
112312f2ee Add non-fatal error capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-23 05:50:36 -07:00
Tom Eastep
dffd98dff7 Revert change that added CONTINUE as a valid content of the ADDRESSES column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-21 10:51:01 -07:00
Tom Eastep
c20611b6c0 Add CONTINUE keyword to the masq file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-20 18:09:59 -07:00
Tom Eastep
1fd9e5e95c Compensate for silly RHEL bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-20 07:20:21 -07:00
Tom Eastep
7ac9e46e1f Add a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-16 15:49:33 -07:00
Tom Eastep
0a4f26a318 Correct handling of existing notrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-16 14:46:48 -07:00
Tom Eastep
f6c4650624 Allow a notrack with nothing but FORMAT and COMMENT lines to be removed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-16 10:49:59 -07:00
Tom Eastep
3c35af9d8c Merge branch 'master' into 4.5.7 2012-08-16 08:34:54 -07:00
Tom Eastep
1e11109bb2 Don't combine rules with '-m policy' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-16 08:34:30 -07:00
Tom Eastep
f59612671b Don't optimize chains with '-m ipsec' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-16 07:33:01 -07:00
Tom Eastep
da4f7ee524 Handle ppp devices correctly in the 'enable' command. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-16 06:59:35 -07:00
Tom Eastep
b132176dae Correct reference adjustment in new opt4 code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-14 13:36:39 -07:00
Tom Eastep
8487c78a0a Adjust reference counts when splicing in short chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-14 08:34:51 -07:00
Tom Eastep
fdc45a990d Arrange for HELPER to match in the RELATED section. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-13 15:44:19 -07:00
Tom Eastep
44a550870c Add HELPER action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-13 13:23:38 -07:00
Tom Eastep
bd3295b0e3 Remove temporary hack 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-13 08:55:43 -07:00
Tom Eastep
45288f5927 Revise notrack/conntrack handling: 
- Purge empty notrack files.
- Process both files.
 2012-08-13 07:28:07 -07:00
Tom Eastep
75b830b10e Merge branch 'master' into 4.5.7 2012-08-13 06:57:54 -07:00
Tom Eastep
4b2d48d621 Hardwire AUTOHELPERS until 4.5.8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-13 06:48:19 -07:00
Tom Eastep
50362040d7 Enable automatic helper association during 'stop'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-12 08:46:06 -07:00
Tom Eastep
2f1d59366c Unconditionally disable kernel automatic helper association during start. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-12 08:43:28 -07:00
Tom Eastep
b372163122 Enable automatic helper association during 'stop'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-12 08:42:53 -07:00
Tom Eastep
50bd1d6398 Add AUTOHELPER option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-12 07:25:11 -07:00
Tom Eastep
e6ef32ebc2 Make conditional directives case insensitive 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-11 08:48:35 -07:00
Tom Eastep
a5824dc2d4 Optimize extension 
- Eliminate short chains with a single reference.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-11 08:47:10 -07:00
Tom Eastep
b5af6f03fb Create better rules when a HELPER appears in an action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-11 07:48:03 -07:00
Tom Eastep
50dfffec94 Eliminate duplicate rules in raw-table chains when optimize level 16. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-10 07:09:01 -07:00
Tom Eastep
ad818c071a Generate omnibus tracking rules when NAT/ACCEPT with helper appears in an action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-10 06:55:18 -07:00
Tom Eastep
2ab50e65d7 Make conditional directives case insensitive 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-09 10:30:02 -07:00
Tom Eastep
4d3fbd1dfa Allow '?IF 0' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-08 07:24:17 -07:00
Tom Eastep
e8a4728981 Allow '?IF 0' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-08 07:23:43 -07:00
Tom Eastep
ee28638604 Add HELPERS to rules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-08 07:23:20 -07:00
Tom Eastep
a8495626b0 Merge branch '4.5.6' into 4.5.7 2012-08-07 15:10:15 -07:00
Tom Eastep
c6186571e5 Handle raw table zones from VSERVERS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-07 15:09:40 -07:00
Tom Eastep
ccf517307e Handle raw table zones from VSERVERS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-07 14:51:58 -07:00
Tom Eastep
c007f847a0 Handle disabled helpers in pre-3.5 kernels. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-06 15:54:45 -07:00
Tom Eastep
b4c812b676 Correct helper parsing in the Raw module. 
- Require (...) around multiple ctevents
- Detect invalid options

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-05 08:09:17 -07:00
Tom Eastep
9a0d53194a Correct Helper detection in the compiler. 
Use CT_MATCH when available.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-05 08:08:20 -07:00
Tom Eastep
093985dd93 Use HELPERS to enable/disable helper association. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-03 19:26:02 -07:00
Tom Eastep
72307df6d2 Replace the AUTOHELPERS option with the HELPERS option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-03 10:53:20 -07:00
Tom Eastep
7689b1e84b Remove the 'zone' helper option for now. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-03 06:39:58 -07:00
Tom Eastep
82c057d1ed Fix *VERSION handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 16:44:02 -07:00
Tom Eastep
21770a89d6 Detect which matches are available. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 15:38:23 -07:00
Tom Eastep
223ed5b3a3 More additions to the helper table and to the conntrack files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 13:25:44 -07:00
Tom Eastep
9ba0c07956 Redesign the CT:helper feature. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 11:10:08 -07:00
Tom Eastep
7d32258e6e Correct Helpers Module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 11:09:34 -07:00
Tom Eastep
07e56d129a Add AUTOHELPERS option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 11:09:18 -07:00
Tom Eastep
62d6d2558e Rename AUTO_COMMENT to AUTOCOMMENT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 11:06:41 -07:00
Tom Eastep
833e54c9c3 Rename the notrack file to conntrack 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-02 11:02:17 -07:00
Tom Eastep
f2dd43855e Correct typo in warning message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-01 13:13:18 -07:00
Tom Eastep
eaf238fa66 Merge branch '4.5.6' 2012-08-01 10:37:45 -07:00
Tom Eastep
542f279544 Don't allow a source interface in a DNAT/REDIRECT rule with source == firewall 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-08-01 10:01:08 -07:00
Tom Eastep
735b7c2cf5 Add support for nfacct 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-28 11:21:16 -07:00
Tom Eastep
87c0f934aa Add NFacct Match capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-28 08:19:05 -07:00
Tom Eastep
55b527d065 Eliminate a local variable. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-15 20:22:19 -07:00
Tom Eastep
e1e7ab42c1 Make 'routefilter' and 'sfilter' mutually exclusive 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-15 10:37:56 -07:00
Tom Eastep
65b16a1acf Compensate for bugs in the latest CPerl emacs extension 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-15 10:07:06 -07:00
Tom Eastep
1db79a91eb 'rpfilter' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-15 10:05:32 -07:00
Tom Eastep
e7cd84a72c Implement rpfilter match capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-15 07:54:46 -07:00
Tom Eastep
2cce81cfc1 Revert 83a8c7eda3 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-09 10:58:15 -07:00
Tom Eastep
9f4ca3ebc5 Additional simplification of evaluate_expression() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-08 07:48:27 -07:00
Tom Eastep
3c2385de06 Merge branch '4.5.6' 2012-07-08 07:36:15 -07:00
Tom Eastep
6ce3d0180e Ensure a defined value for __IPV[46] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-07 09:47:10 -07:00
Tom Eastep
83a8c7eda3 When TC_ENABLED=No, require providers to process tcrules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-07 08:02:57 -07:00
Tom Eastep
83df8a4e39 Avoid a call to eval() for simple expressions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-06 07:26:54 -07:00
Tom Eastep
e9d8228b6f Simplify handling of __IPVn in conditional directives. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-06 06:43:15 -07:00
Tom Eastep
65d8341c6c Correct a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-05 15:43:20 -07:00
Tom Eastep
61a9584433 Only require MANGLE_ENABLED to process the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-04 14:45:24 -07:00
Tom Eastep
000cc6978a Add missing 'sleep' when waiting for wildcard interface to come up 
- Also reverse the order of test and sleep when waiting for a regular
  interface to come up.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-03 08:06:30 -07:00
Tom Eastep
e4d66fb5fc Back out redundant part of recent patch 
- setup_traffic_shaping is only called when there are tc devices so the
  test of @tcdevices in that function is redundant.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-03 06:33:46 -07:00
Tom Eastep
537f6c157c Allow the compiler version to be tested in ?IF/?ELSIF 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-02 11:53:32 -07:00
Tom Eastep
a5b637b2a7 Use the correct filename in ?IF/?ELSIF exec call. 
- Also extend a comment in the TC module

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-02 11:53:01 -07:00
Tom Eastep
09c00cf425 Don't print phoney progress message 
- The 'Setting up Traffic Shaping' progress message was being issued when
  traffic shaping was not enabled.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-07-01 08:27:07 -07:00
Tom Eastep
6ddaa0190e Improve USER/GROUP validation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-30 14:46:50 -07:00
Tom Eastep
5c176c64b7 Add an ORIGINAL DEST column to /etc/shorewall/masq 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-29 15:32:01 -07:00
Tom Eastep
b195884b1f Insure that the correct filename/linenumber are printed in error messages out of process_conditional() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-29 09:01:26 -07:00
Tom Eastep
56d5ae2d41 Ensure that exclusion chains have DONT_MOVE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-27 18:06:38 -07:00
Tom Eastep
0bf2753472 Re-implement conditional inclusion 
- Correct defects
- Add ?ELSIF support
- Allow Perl-compatible expressions in ?IF
 2012-06-27 15:15:44 -07:00
Tom Eastep
c90006ecf8 Correct another logical name bug -- this time in TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-27 11:34:19 -07:00
Tom Eastep
af302900c6 Prevent multiple 'tproxy' providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-23 17:09:46 -07:00
Tom Eastep
9aa78656ec Add TPROXY_MARK to the output of 'shorewall show marks' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-23 07:57:39 -07:00
Tom Eastep
9d3766b77f Allow fwmarks with 'classify' interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-20 14:04:48 -07:00
Tom Eastep
24ddae6ede Don't use '--ctmark' when saving marks 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-20 13:30:27 -07:00
Tom Eastep
4d336ed8d6 Rewrite handling of the USER/GROUP column 
- Remove code that handled '+program' as that support was removed from
  the kernel in 2.6.14.
 2012-06-19 08:14:31 -07:00
Tom Eastep
da3e1b720c Apply user/group Id range patch from Gergely Risko 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-19 06:17:13 -07:00
Tom Eastep
7b4e5828e0 Clean up handling of RED options. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-18 12:17:22 -07:00
Tom Eastep
4c10fcd503 Complain if a RED_NONE option has a value specified. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-16 15:51:20 -07:00
Tom Eastep
5fc295e8cc Fix handling of stab 'tsize' option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-14 15:44:15 -07:00
Tom Eastep
c5ba167a3e Make CEIL optional 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-14 13:10:09 -07:00
Tom Eastep
6c47349689 Support 'red' queuing discipline 
- Also added 'ls' support for HFSC

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-13 14:29:13 -07:00
Tom Eastep
d2c415c580 Make IFB work with logical interface names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-13 13:48:12 -07:00
Tom Eastep
28ab3749ca Allow fractional delays in TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-13 13:47:31 -07:00
Tom Eastep
a29dbf4ff8 Fix for linklayer 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-12 11:48:12 -07:00
Tom Eastep
19cace7e8d Merge branch '4.5.5' 
Conflicts:
	Shorewall/Perl/Shorewall/Providers.pm
 2012-06-11 17:02:59 -07:00
Tom Eastep
4791a8ca66 Don't delete default routes when 'fallback' is specified. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-11 16:57:49 -07:00
Tom Eastep
844f6c63e4 Add support for TC size tables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-06-11 15:45:47 -07:00