forked from extern/shorewall_code
parent
21765d618d
commit
12513e24a3
@ -1169,16 +1169,14 @@ sub finish_section ( $ ) {
|
|||||||
#
|
#
|
||||||
# Create a normalized action name from the passed pieces.
|
# Create a normalized action name from the passed pieces.
|
||||||
#
|
#
|
||||||
# Internally, action invocations are uniquely identified by a 5-tuple that
|
# Internally, action invocations are uniquely identified by a 4-tuple that
|
||||||
# includes the action name, log level, log tag, dynamic invocation number
|
# includes the action name, log level, log tag and params. The pieces of the tuple
|
||||||
# (which is zero except for dynamic actions) and params. The pieces of the
|
# are separated by ":".
|
||||||
# tuple are separated by ":".
|
|
||||||
#
|
#
|
||||||
sub normalize_action( $$$ ) {
|
sub normalize_action( $$$ ) {
|
||||||
my $action = shift;
|
my $action = shift;
|
||||||
my $level = shift;
|
my $level = shift;
|
||||||
my $param = shift;
|
my $param = shift;
|
||||||
my $dynamic = $actions{$action}->{dynamic};
|
|
||||||
|
|
||||||
( $level, my $tag ) = split ':', $level;
|
( $level, my $tag ) = split ':', $level;
|
||||||
|
|
||||||
@ -1187,9 +1185,7 @@ sub normalize_action( $$$ ) {
|
|||||||
$param = '' unless defined $param;
|
$param = '' unless defined $param;
|
||||||
$param = '' if $param eq '-';
|
$param = '' if $param eq '-';
|
||||||
|
|
||||||
$actions{$action}->{dynamic}++ if $dynamic;
|
join( ':', $action, $level, $tag, $param );
|
||||||
|
|
||||||
join( ':', $action, $level, $tag, $dynamic, $param );
|
|
||||||
}
|
}
|
||||||
|
|
||||||
#
|
#
|
||||||
@ -1207,9 +1203,9 @@ sub normalize_action_name( $ ) {
|
|||||||
# Produce a recognizable target from a normalized action
|
# Produce a recognizable target from a normalized action
|
||||||
#
|
#
|
||||||
sub external_name( $ ) {
|
sub external_name( $ ) {
|
||||||
my ( $target, $level, $tag, $dynamic, $params ) = split /:/, shift, 5;
|
my ( $target, $level, $tag, $params ) = split /:/, shift, 4;
|
||||||
|
|
||||||
$target = join( '', $target, '(', $params , ')' ) if supplied $params;
|
$target = join( '', $target, '(', $params , ')' ) if $params;
|
||||||
$target .= ":$level" if $level && $level ne 'none';
|
$target .= ":$level" if $level && $level ne 'none';
|
||||||
$target .= ":$tag" if $tag;
|
$target .= ":$tag" if $tag;
|
||||||
$target;
|
$target;
|
||||||
@ -1218,13 +1214,13 @@ sub external_name( $ ) {
|
|||||||
#
|
#
|
||||||
# Define an Action
|
# Define an Action
|
||||||
#
|
#
|
||||||
sub new_action( $$$$$ ) {
|
sub new_action( $$$$ ) {
|
||||||
|
|
||||||
my ( $action , $type, $noinline, $nolog, $dynamic ) = @_;
|
my ( $action , $type, $noinline, $nolog ) = @_;
|
||||||
|
|
||||||
fatal_error "Invalid action name($action)" if reserved_name( $action );
|
fatal_error "Invalid action name($action)" if reserved_name( $action );
|
||||||
|
|
||||||
$actions{$action} = { actchain => '' , noinline => $noinline, nolog => $nolog , dynamic => $dynamic } if $type & ACTION;
|
$actions{$action} = { actchain => '' , noinline => $noinline, nolog => $nolog } if $type & ACTION;
|
||||||
|
|
||||||
$targets{$action} = $type;
|
$targets{$action} = $type;
|
||||||
}
|
}
|
||||||
@ -1697,7 +1693,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ );
|
|||||||
sub process_action($$) {
|
sub process_action($$) {
|
||||||
my ( $chainref, $caller ) = @_;
|
my ( $chainref, $caller ) = @_;
|
||||||
my $wholeaction = $chainref->{action};
|
my $wholeaction = $chainref->{action};
|
||||||
my ( $action, $level, $tag, $dynamic, $param ) = split /:/, $wholeaction, 5;
|
my ( $action, $level, $tag, $param ) = split /:/, $wholeaction, 4;
|
||||||
|
|
||||||
if ( $targets{$action} & BUILTIN ) {
|
if ( $targets{$action} & BUILTIN ) {
|
||||||
$level = '' if $level =~ /none!?/;
|
$level = '' if $level =~ /none!?/;
|
||||||
@ -1796,7 +1792,7 @@ sub process_actions() {
|
|||||||
#
|
#
|
||||||
# Add built-in actions to the target table and create those actions
|
# Add built-in actions to the target table and create those actions
|
||||||
#
|
#
|
||||||
$targets{$_} = new_action( $_ , ACTION + BUILTIN, 1, 0 , 0 ) for @builtins;
|
$targets{$_} = new_action( $_ , ACTION + BUILTIN, 1, 0 ) for @builtins;
|
||||||
|
|
||||||
for my $file ( qw/actions.std actions/ ) {
|
for my $file ( qw/actions.std actions/ ) {
|
||||||
open_file( $file, 2 );
|
open_file( $file, 2 );
|
||||||
@ -1819,7 +1815,6 @@ sub process_actions() {
|
|||||||
FILTER_OPT => 64 ,
|
FILTER_OPT => 64 ,
|
||||||
NAT_OPT => 128 ,
|
NAT_OPT => 128 ,
|
||||||
TERMINATING_OPT => 256 ,
|
TERMINATING_OPT => 256 ,
|
||||||
DYNAMIC_OPT => 512 ,
|
|
||||||
};
|
};
|
||||||
|
|
||||||
my %options = ( inline => INLINE_OPT ,
|
my %options = ( inline => INLINE_OPT ,
|
||||||
@ -1831,7 +1826,6 @@ sub process_actions() {
|
|||||||
filter => FILTER_OPT ,
|
filter => FILTER_OPT ,
|
||||||
nat => NAT_OPT ,
|
nat => NAT_OPT ,
|
||||||
terminating => TERMINATING_OPT ,
|
terminating => TERMINATING_OPT ,
|
||||||
dynamic => DYNAMIC_OPT ,
|
|
||||||
);
|
);
|
||||||
|
|
||||||
my $opts = $type == INLINE ? NOLOG_OPT : 0;
|
my $opts = $type == INLINE ? NOLOG_OPT : 0;
|
||||||
@ -1887,25 +1881,17 @@ sub process_actions() {
|
|||||||
|
|
||||||
$targets{$action} = $actiontype;
|
$targets{$action} = $actiontype;
|
||||||
|
|
||||||
make_terminating( $action ) if $opts & TERMINATING_OPT;
|
make_terminating( $action ) if $opts & TERMINATING_OPT
|
||||||
warning_message "The 'dynamic' option is ignored on built-in actions" if $opts & DYNAMIC_OPT;
|
|
||||||
} else {
|
} else {
|
||||||
fatal_error "Table names are only allowed for builtin actions" if $opts & ( MANGLE_OPT | RAW_OPT | NAT_OPT | FILTER_OPT );
|
fatal_error "Table names are only allowed for builtin actions" if $opts & ( MANGLE_OPT | RAW_OPT | NAT_OPT | FILTER_OPT );
|
||||||
|
|
||||||
new_action( $action,
|
new_action $action, $type, ( $opts & NOINLINE_OPT ) != 0 , ( $opts & NOLOG_OPT ) != 0;
|
||||||
$type,
|
|
||||||
( $opts & NOINLINE_OPT ) != 0,
|
|
||||||
( $opts & NOLOG_OPT ) != 0,
|
|
||||||
( $opts & DYNAMIC_OPT ) != 0 );
|
|
||||||
|
|
||||||
my $actionfile = find_file( "action.$action" );
|
my $actionfile = find_file( "action.$action" );
|
||||||
|
|
||||||
fatal_error "Missing Action File ($actionfile)" unless -f $actionfile;
|
fatal_error "Missing Action File ($actionfile)" unless -f $actionfile;
|
||||||
|
|
||||||
if ( $type == INLINE ) {
|
$inlines{$action} = { file => $actionfile, nolog => $opts & NOLOG_OPT } if $type == INLINE;
|
||||||
warning_message "The 'dynamic' option is ignored on 'inline' actions" if $opts & DYNAMIC_OPT;
|
|
||||||
$inlines{$action} = { file => $actionfile, nolog => $opts & NOLOG_OPT };
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -85,17 +85,6 @@
|
|||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
|
|
||||||
<varlistentry>
|
|
||||||
<term>dynamic</term>
|
|
||||||
|
|
||||||
<listitem>
|
|
||||||
<para>Added in Shorewall 5.0.4. When specified, this option
|
|
||||||
causes each invocation of the action to create a separate
|
|
||||||
iptables chain to hold the action rules. This is useful when
|
|
||||||
@caller is used within the action body. </para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
|
|
||||||
<varlistentry>
|
<varlistentry>
|
||||||
<term>inline</term>
|
<term>inline</term>
|
||||||
|
|
||||||
|
@ -86,17 +86,6 @@
|
|||||||
</listitem>
|
</listitem>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
|
|
||||||
<varlistentry>
|
|
||||||
<term>dynamic</term>
|
|
||||||
|
|
||||||
<listitem>
|
|
||||||
<para>Added in Shorewall 5.0.4. When specified, this option
|
|
||||||
causes each invocation of the action to create a separate
|
|
||||||
ip6tables chain to hold the action rules. This is useful when
|
|
||||||
@caller is used within the action body.</para>
|
|
||||||
</listitem>
|
|
||||||
</varlistentry>
|
|
||||||
|
|
||||||
<varlistentry>
|
<varlistentry>
|
||||||
<term>inline</term>
|
<term>inline</term>
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user