holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Issue warning on bare SECTION headings.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-11-24 07:58:02 -08:00
parent 80d54ec40b
commit 3870157898
16 changed files with 80 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Shorewall/Perl/Shorewall/Accounting.pm
View File

@ -432,6 +432,7 @@ sub process_accounting_rule( ) {
fatal_error 'ACTION must be specified' if $action eq '-'; fatal_error 'ACTION must be specified' if $action eq '-';
if ( $action eq 'SECTION' ) { if ( $action eq 'SECTION' ) {
section_warning;
process_section( $chain ); process_section( $chain );
} else { } else {
for my $proto ( split_list $protos, 'Protocol' ) { for my $proto ( split_list $protos, 'Protocol' ) {

10
Shorewall/Perl/Shorewall/Config.pm
View File

@ -153,6 +153,7 @@ our %EXPORT_TAGS = ( internal => [ qw( create_temp_script
macro_comment macro_comment
dump_mark_layout dump_mark_layout
set_section_function set_section_function
section_warning
clear_section_function clear_section_function
$product $product
@ -551,6 +552,7 @@ our $nocomment; # When true, ignore [?]COMMENT in the current file
our $warningcount; # Used to suppress duplicate warnings about missing COMMENT support our $warningcount; # Used to suppress duplicate warnings about missing COMMENT support
our $warningcount1; # Used to suppress duplicate warnings about COMMENT being deprecated our $warningcount1; # Used to suppress duplicate warnings about COMMENT being deprecated
our $warningcount2; # Used to suppress duplicate warnings about FORMAT being deprecated our $warningcount2; # Used to suppress duplicate warnings about FORMAT being deprecated
our $warningcount3; # Used to suppress duplicate warnings about SECTION being deprecated
our $shorewall_dir; # Shorewall Directory; if non-empty, search here first for files. our $shorewall_dir; # Shorewall Directory; if non-empty, search here first for files.
@ -683,6 +685,7 @@ sub initialize( $;$$) {
$warningcount = 0; $warningcount = 0;
$warningcount1 = 0; $warningcount1 = 0;
$warningcount2 = 0; $warningcount2 = 0;
$warningcount3 = 0;
# #
# Misc Globals # Misc Globals
# #
@ -2167,6 +2170,13 @@ sub clear_section_function() {
$section_function = undef; $section_function = undef;
} }
#
# Generate a SECTION warning
#
sub section_warning() {
warning_message "'SECTION' is deprecated in favor of '?SECTION' - consider running '$product update -D'" unless $warningcount3++;
}
# #
# Open a file, setting $currentfile. Returns the file's absolute pathname if the file # Open a file, setting $currentfile. Returns the file's absolute pathname if the file
# exists, is non-empty and was successfully opened. Terminates with a fatal error # exists, is non-empty and was successfully opened. Terminates with a fatal error

3
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -110,7 +110,6 @@ our %section_rmap = ( ALL_SECTION , 'ALL',
UNTRACKED_SECTION, 'UNTRACKED', UNTRACKED_SECTION, 'UNTRACKED',
NEW_SECTION, 'NEW' ); NEW_SECTION, 'NEW' );
our @policy_chains; our @policy_chains;
our %default_actions; our %default_actions;
@ -3121,7 +3120,7 @@ sub process_raw_rule ( ) {
fatal_error 'ACTION must be specified' if $target eq '-'; fatal_error 'ACTION must be specified' if $target eq '-';
process_section( $source ), return 1 if $target eq 'SECTION'; section_warning, process_section( $source ), return 1 if $target eq 'SECTION';
# #
# Section Names are optional so once we get to an actual rule, we need to be sure that # Section Names are optional so once we get to an actual rule, we need to be sure that
# we close off any missing sections. # we close off any missing sections.

12
Shorewall/Samples/Universal/rules
View File

@ -9,12 +9,12 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
#SECTION INVALID #?SECTION INVALID
#SECTION UNTRACKED #?SECTION UNTRACKED
SECTION NEW ?SECTION NEW
Invalid(DROP) net $FW tcp Invalid(DROP) net $FW tcp
SSH(ACCEPT) net $FW SSH(ACCEPT) net $FW
Ping(ACCEPT) net $FW Ping(ACCEPT) net $FW

12
Shorewall/Samples/one-interface/rules
View File

@ -13,12 +13,12 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
#SECTION INVALID #?SECTION INVALID
#SECTION UNTRACKED #?SECTION UNTRACKED
SECTION NEW ?SECTION NEW
# Drop packets in the INVALID state # Drop packets in the INVALID state

12
Shorewall/Samples/three-interfaces/rules
View File

@ -13,12 +13,12 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
#SECTION INVALID #?SECTION INVALID
#SECTION UNTRACKED #?SECTION UNTRACKED
SECTION NEW ?SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #

12
Shorewall/Samples/two-interfaces/rules
View File

@ -13,12 +13,12 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
#SECTION INVALID #?SECTION INVALID
#SECTION UNTRACKED #?SECTION UNTRACKED
SECTION NEW ?SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #

12
Shorewall/configfiles/rules
View File

@ -9,9 +9,9 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
#SECTION INVALID #?SECTION INVALID
#SECTION UNTRACKED #?SECTION UNTRACKED
SECTION NEW ?SECTION NEW

6
Shorewall/manpages/shorewall-accounting.xml
View File

@ -79,9 +79,13 @@
<para>Section headers have the form:</para> <para>Section headers have the form:</para>
<para><option>SECTION</option> <para><option>[?]SECTION</option>
<replaceable>section-name</replaceable></para> <replaceable>section-name</replaceable></para>
<para>The optional "?" was added in Shorewalll 4.6.0 and is preferred.
Existing configurations may be converted to use this form using the
<command>shorewall update</command> command.</para>
<para>When sections are enabled:</para> <para>When sections are enabled:</para>
<itemizedlist> <itemizedlist>

8
Shorewall/manpages/shorewall-rules.xml
View File

@ -40,8 +40,12 @@
</warning> </warning>
<para>The rules file is divided into sections. Each section is introduced <para>The rules file is divided into sections. Each section is introduced
by a "Section Header" which is a line beginning with SECTION and followed by a "Section Header" which is a line beginning with [?]SECTION and
by the section name.</para> followed by the section name.</para>
<para>The optional "?" was added in Shorewalll 4.6.0 and is preferred.
Existing configurations may be converted to use this form using the
<command>shorewall update</command> command.</para>
<para>Sections are as follows and must appear in the order listed:</para> <para>Sections are as follows and must appear in the order listed:</para>

8
Shorewall6/Samples6/Universal/rules
View File

@ -9,10 +9,10 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
SECTION NEW ?SECTION NEW
Invalid(DROP) net $FW tcp Invalid(DROP) net $FW tcp
SSH(ACCEPT) net $FW SSH(ACCEPT) net $FW

8
Shorewall6/Samples6/one-interface/rules
View File

@ -13,10 +13,10 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
SECTION NEW ?SECTION NEW
# Drop packets in the INVALID state # Drop packets in the INVALID state

8
Shorewall6/Samples6/three-interfaces/rules
View File

@ -13,10 +13,10 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
SECTION NEW ?SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #

8
Shorewall6/Samples6/two-interfaces/rules
View File

@ -13,10 +13,10 @@
###################################################################################################################################################################################################### ######################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL #?SECTION ALL
#SECTION ESTABLISHED #?SECTION ESTABLISHED
#SECTION RELATED #?SECTION RELATED
SECTION NEW ?SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #

6
Shorewall6/manpages/shorewall6-accounting.xml
View File

@ -79,9 +79,13 @@
<para>Section headers have the form:</para> <para>Section headers have the form:</para>
<para><option>SECTION</option> <para><option>[?]SECTION</option>
<replaceable>section-name</replaceable></para> <replaceable>section-name</replaceable></para>
<para>The optional "?" was added in Shorewalll 4.6.0 and is preferred.
Existing configurations may be converted to use this form using the
<command>shorewall6 update</command> command.</para>
<para>When sections are enabled:</para> <para>When sections are enabled:</para>
<itemizedlist> <itemizedlist>

8
Shorewall6/manpages/shorewall6-rules.xml
View File

@ -33,8 +33,12 @@
request. All rules are terminating except LOG and QUEUE rules.</para> request. All rules are terminating except LOG and QUEUE rules.</para>
<para>The rules file is divided into sections. Each section is introduced <para>The rules file is divided into sections. Each section is introduced
by a "Section Header" which is a line beginning with SECTION and followed by a "Section Header" which is a line beginning with [?]SECTION and
by the section name.</para> followed by the section name.</para>
<para>The optional "?" was added in Shorewalll 4.6.0 and is preferred.
Existing configurations may be converted to use this form using the
<command>shorewall6 update</command> command.</para>
<para>Sections are as follows and must appear in the order listed:</para> <para>Sections are as follows and must appear in the order listed:</para>