holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Pass INVALID ICMPs through the blacklist chains

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1402 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-06-17 19:53:19 +00:00
parent 1ca874db80
commit 3ca68c3b59
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall2/changelog.txt
View File

@ -32,3 +32,5 @@ Changes since 2.0.2
15) Fix rules that have bridge ports in both SOURCE and DEST. Update 15) Fix rules that have bridge ports in both SOURCE and DEST. Update
comments in the rules file WRT "all" in SOURCE or DEST. comments in the rules file WRT "all" in SOURCE or DEST.
16) Pass INVALID icmp packets through the blacklisting chains.

4
Shorewall2/firewall
View File

@ -4496,7 +4496,7 @@ setup_blacklist() {
createchain blacklst no createchain blacklst no
[ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW" || state= [ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW,INVALID" || state=
for host in $hosts; do for host in $hosts; do
interface=${host%%:*} interface=${host%%:*}
@ -4851,7 +4851,7 @@ initialize_netfilter () {
fi fi
fi fi
[ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW" || state= [ -n "$BLACKLISTNEWONLY" ] && state="-m state --state NEW,INVALID" || state=
echo "Creating Interface Chains..." echo "Creating Interface Chains..."

7
Shorewall2/releasenotes.txt
View File

@ -1,4 +1,4 @@
Shorewall 2.0.3 RC1 Shorewall 2.0.3 RC2
---------------------------------------------------------------------- ----------------------------------------------------------------------
Problems Corrected since 2.0.2 Problems Corrected since 2.0.2
@ -39,6 +39,11 @@ Problems Corrected since 2.0.2
"all" in the SOURCE or DEST column does not affect intra-zone "all" in the SOURCE or DEST column does not affect intra-zone
traffic. traffic.
12) With BLACKLISTNEWONLY=Yes, ICMP packets with state INVALID are now
passed through the blacklisting chains. Without this change, it is
not possible to blacklist hosts that are mounting certain types of
ICMP-based DOS attacks.
----------------------------------------------------------------------- -----------------------------------------------------------------------
Issues when migrating from Shorewall 2.0.2 to Shorewall 2.0.3: Issues when migrating from Shorewall 2.0.2 to Shorewall 2.0.3: