holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Convert allowInvalid and dropInvalid into macros

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-02-06 09:54:12 -08:00
parent a66256b25b
commit 272e1d330c
5 changed files with 25 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Shorewall/Macros/macro.allowInvalid Normal file
View File

@ -0,0 +1,11 @@
#
# Shorewall version 4 - allowInvalid
#
# /usr/share/shorewall/macro.allowInvalid
#
# This macro accepts packets in the INVALID conntrack state
#
###############################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE RATE USER/
# PORT(S) PORT(S) LIMIT GROUP
Invalid(ACCEPT) - - -

11
Shorewall/Macros/macro.dropInvalid Normal file
View File

@ -0,0 +1,11 @@
#
# Shorewall version 4 - dropInvalid
#
# /usr/share/shorewall/macro.dropInvalid
#
# This macro drops packets in the INVALID conntrack state
#
###############################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE RATE USER/
# PORT(S) PORT(S) LIMIT GROUP
Invalid(DROP) - - -

32
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -252,9 +252,9 @@ sub initialize( $ ) {
@columnstack = (); @columnstack = ();
if ( $family == F_IPV4 ) { if ( $family == F_IPV4 ) {
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn dropInvalid allowInvalid allowinUPnP forwardUPnP Limit/; @builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn allowinUPnP forwardUPnP Limit/;
} else { } else {
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn dropInvalid allowInvalid/; @builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn/;
} }
} }
@ -1508,8 +1508,6 @@ sub dropNotSyn ( $$$$ ) {
sub rejNotSyn ( $$$$ ) { sub rejNotSyn ( $$$$ ) {
my ($chainref, $level, $tag, $audit) = @_; my ($chainref, $level, $tag, $audit) = @_;
warning_message "rejNotSyn is deprecated in favor of NotSyn(REJECT)";
my $target = 'REJECT --reject-with tcp-reset'; my $target = 'REJECT --reject-with tcp-reset';
if ( supplied $audit ) { if ( supplied $audit ) {
@ -1520,28 +1518,6 @@ sub rejNotSyn ( $$$$ ) {
add_ijump $chainref , j => $target, p => '6 ! --syn'; add_ijump $chainref , j => $target, p => '6 ! --syn';
} }
sub dropInvalid ( $$$$ ) {
my ($chainref, $level, $tag, $audit) = @_;
warning_message "dropInvalid is deprecated in favor of Invalid(DROP)";
my $target = require_audit( 'DROP', $audit );
log_rule_limit $level, $chainref, 'dropInvalid' , 'DROP', '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
add_ijump $chainref , j => $target, state_imatch 'INVALID';
}
sub allowInvalid ( $$$$ ) {
my ($chainref, $level, $tag, $audit) = @_;
warning_message "allowInvalid is deprecated in favor of Invalid(ACCEPT)";
my $target = require_audit( 'ACCEPT', $audit );
log_rule_limit $level, $chainref, 'allowInvalid' , 'ACCEPT', '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
add_ijump $chainref , j => $target, state_imatch 'INVALID';
}
sub forwardUPnP ( $$$$ ) { sub forwardUPnP ( $$$$ ) {
my $chainref = set_optflags( 'forwardUPnP', DONT_OPTIMIZE ); my $chainref = set_optflags( 'forwardUPnP', DONT_OPTIMIZE );
@ -1604,8 +1580,6 @@ my %builtinops = ( 'dropBcast' => \&dropBcast,
'allowBcast' => \&allowBcast, 'allowBcast' => \&allowBcast,
'dropNotSyn' => \&dropNotSyn, 'dropNotSyn' => \&dropNotSyn,
'rejNotSyn' => \&rejNotSyn, 'rejNotSyn' => \&rejNotSyn,
'dropInvalid' => \&dropInvalid,
'allowInvalid' => \&allowInvalid,
'allowinUPnP' => \&allowinUPnP, 'allowinUPnP' => \&allowinUPnP,
'forwardUPnP' => \&forwardUPnP, 'forwardUPnP' => \&forwardUPnP,
'Limit' => \&Limit, 'Limit' => \&Limit,
@ -1859,7 +1833,7 @@ sub process_macro ($$$$$$$$$$$$$$$$$$$$) {
my $actiontype = $targets{$action} || find_macro( $action ); my $actiontype = $targets{$action} || find_macro( $action );
fatal_error( "Invalid Action ($mtarget) in macro") unless $actiontype & ( ACTION + STANDARD + NATRULE + MACRO + CHAIN ); fatal_error( "Invalid Action ($mtarget) in macro") unless $actiontype;
if ( $msource ) { if ( $msource ) {
if ( $msource eq '-' ) { if ( $msource eq '-' ) {

4
Shorewall/actions.std
View File

@ -15,10 +15,6 @@
# dropBcast # Silently Drop Broadcast/multicast # dropBcast # Silently Drop Broadcast/multicast
# dropNotSyn # Silently Drop Non-syn TCP packets # dropNotSyn # Silently Drop Non-syn TCP packets
# rejNotSyn # Silently Reject Non-syn TCP packets # rejNotSyn # Silently Reject Non-syn TCP packets
# dropInvalid # Silently Drop packets that are in the INVALID
# # conntrack state.
# allowInvalid # Accept packets that are in the INVALID
# # conntrack state.
# allowoutUPnP # Allow traffic from local command 'upnpd' (does not # allowoutUPnP # Allow traffic from local command 'upnpd' (does not
# # work with kernel 2.6.14 and later). # # work with kernel 2.6.14 and later).
# allowinUPnP # Allow UPnP inbound (to firewall) traffic # allowinUPnP # Allow UPnP inbound (to firewall) traffic

4
Shorewall6/actions.std
View File

@ -12,10 +12,6 @@
# dropBcasts # Silently Drop multicast and anycast packets # dropBcasts # Silently Drop multicast and anycast packets
# dropNotSyn # Silently Drop Non-syn TCP packets # dropNotSyn # Silently Drop Non-syn TCP packets
# rejNotSyn # Silently Reject Non-syn TCP packets # rejNotSyn # Silently Reject Non-syn TCP packets
# dropInvalid # Silently Drop packets that are in the INVALID
# # conntrack state.
# allowInvalid # Accept packets that are in the INVALID
# # conntrack state.
# #
############################################################################### ###############################################################################
#ACTION #ACTION