holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Initial implementation of CT target support in the 'notrack' file.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2011-12-04 17:15:58 -08:00
parent a794027f63
commit 2cffae738f
1 changed files with 76 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
Shorewall/Perl/Shorewall/Raw.pm
View File

@ -36,12 +36,14 @@ our @EXPORT = qw( setup_notrack );
our @EXPORT_OK = qw( );
our $VERSION = 'MODULEVERSION';
my %valid_ctevent = ( new => 1, related => 1, destroy => 1, reply => 1, assured => 1, protoinfo => 1, helper => 1, mark => 1, natseqinfo => 1, secmark => 1 );
#
# Notrack
#
sub process_notrack_rule( $$$$$$ ) {
sub process_notrack_rule( $$$$$$$ ) {
my ($source, $dest, $proto, $ports, $sports, $user ) = @_;
my ($action, $source, $dest, $proto, $ports, $sports, $user ) = @_;
$proto = '' if $proto eq 'any';
$ports = '' if $ports eq 'any' || $ports eq 'all';
@ -57,6 +59,37 @@ sub process_notrack_rule( $$$$$$ ) {
my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user );
my $target = $action;
unless ( $action eq 'NOTRACK' ) {
( $target, my ( $option, $args, $junk ) ) = split ':', $action, 4;
fatal_error "Invalid notrack ACTION ( $action )" if $junk || $target ne 'CT';
require_capability 'CT_TARGET', 'CT entries in the notrack file', '';
if ( $option eq 'notrack' ) {
fatal_error "Invalid notrack ACTION ( $action )" if supplied $args;
$action = 'CT --notrack';
} else {
fatal_error "Invalid or missing CT option and arguments" unless supplied $option && supplied $args;
if ( $option eq 'ctevents' ) {
for ( split ',', $args ) {
fatal_error "Invalid 'ctevents' event ($_)" unless $valid_ctevent{$_};
}
$action = "CT --ctevents $args";
} elsif ( $option eq 'expevent' ) {
fatal_error "Invalid expevent argument ($args)" unless $args eq 'new';
} elsif ( $option eq 'zone' ) {
fatal_error "Invalid zone id ($args)" unless $args =~ /^\d+$/;
} else {
fatal_error "Invalid CT optio ($option)";
}
}
}
expand_rule
$chainref ,
$restriction ,
@ -64,9 +97,9 @@ sub process_notrack_rule( $$$$$$ ) {
$source ,
$dest ,
'' ,
'NOTRACK' ,
$action ,
'' ,
'NOTRACK' ,
$target ,
'' ;
progress_message " Notrack rule \"$currentline\" $done";
@ -74,8 +107,19 @@ sub process_notrack_rule( $$$$$$ ) {
$globals{UNTRACKED} = 1;
}
sub process_format( $ ) {
my $format = shift;
fatal_error q(FORMAT must be '1' or '2') unless $format =~ /^[12]$/;
$format;
}
sub setup_notrack() {
my $format = 1;
my $action = 'NOTRACK';
if ( my $fn = open_file 'notrack' ) {
first_entry "$doing $fn...";
@ -83,14 +127,36 @@ sub setup_notrack() {
my $nonEmpty = 0;
while ( read_a_line ) {
my ( $action, $source, $dest, $proto, $ports, $sports, $user );
my ( $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Notrack File', { source => 0, dest => 1, proto => 2, dport => 3, sport => 4, user => 5 };
if ( $format == 1 ) {
( $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Notrack File', { source => 0, dest => 1, proto => 2, dport => 3, sport => 4, user => 5 };
if ( $source eq 'COMMENT' ) {
process_comment;
if ( $source eq 'FORMAT' ) {
$format = process_format( $dest );
next;
}
if ( $source eq 'COMMENT' ) {
process_comment;
next;
}
} else {
process_notrack_rule $source, $dest, $proto, $ports, $sports, $user;
( $action, $source, $dest, $proto, $ports, $sports, $user ) = split_line1 'Notrack File', { action => 0, source => 1, dest => 2, proto => 3, dport => 4, sport => 5, user => 6 }, { COMMENT => 0, FORMAT => 2 };
if ( $action eq 'FORMAT' ) {
$format = process_format( $source );
$action = 'NOTRACK';
next;
}
if ( $action eq 'COMMENT' ) {
process_comment;
next;
}
}
process_notrack_rule $action, $source, $dest, $proto, $ports, $sports, $user;
}
clear_comment;