forked from extern/shorewall_code
Henry Yang's patch plus fix LOGRATE/ratelimit conflict on rules file logging
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@723 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
510a35b46c
commit
3ee26da51c
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=1.4.6-20030813
|
||||
VERSION=1.4.6-20030821
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
@ -136,6 +136,8 @@ restore_file /etc/shorewall/ecn
|
||||
|
||||
restore_file /etc/shorewall/accounting
|
||||
|
||||
restore_file /etc/shorewall/usersets
|
||||
|
||||
if [ -f /usr/lib/shorewall/version-${VERSION}.bkout ]; then
|
||||
restore_file /usr/lib/shorewall/version
|
||||
oldversion="`cat /usr/lib/shorewall/version`"
|
||||
|
||||
@ -952,14 +952,15 @@ run_user_exit() # $1 = file name
|
||||
#
|
||||
# Add a logging rule.
|
||||
#
|
||||
log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates for the rule
|
||||
log_rule_limit() # $1 = log level, $2 = chain, $3 = disposition , $4 = rate limit $... = predicates for the rule
|
||||
{
|
||||
local level=$1
|
||||
local chain=$2
|
||||
local disposition=$3
|
||||
local rulenum=
|
||||
local limit=${4:-$LOGLIMIT}
|
||||
|
||||
shift;shift;shift
|
||||
shift;shift;shift;shift
|
||||
|
||||
if [ -n "$LOGRULENUMBERS" ]; then
|
||||
eval rulenum=\$${chain}_logrules
|
||||
@ -968,10 +969,10 @@ log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates fo
|
||||
|
||||
case $level in
|
||||
ULOG)
|
||||
eval iptables -A $chain $@ -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
eval iptables -A $chain $@ $limit -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
;;
|
||||
*)
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
eval iptables -A $chain $@ $limit -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $rulenum $disposition`"'
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -985,10 +986,10 @@ log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates fo
|
||||
else
|
||||
case $level in
|
||||
ULOG)
|
||||
eval iptables -A $chain $@ -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
eval iptables -A $chain $@ $limit -j ULOG $LOGPARMS --ulog-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
;;
|
||||
*)
|
||||
eval iptables -A $chain $@ -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
eval iptables -A $chain $@ $limit -j LOG $LOGPARMS --log-level $level --log-prefix '"`printf "$LOGFORMAT" $chain $disposition`"'
|
||||
;;
|
||||
esac
|
||||
|
||||
@ -998,6 +999,17 @@ log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates fo
|
||||
fi
|
||||
}
|
||||
|
||||
log_rule() # $1 = log level, $2 = chain, $3 = disposition , $... = predicates for the rule
|
||||
{
|
||||
local level=$1
|
||||
local chain=$2
|
||||
local disposition=$3
|
||||
|
||||
shift;shift;shift
|
||||
|
||||
log_rule_limit $level $chain $disposition "$LOGLIMIT" $@
|
||||
}
|
||||
|
||||
#
|
||||
# Stop the Firewall
|
||||
#
|
||||
@ -2191,7 +2203,7 @@ add_nat_rule() {
|
||||
done
|
||||
|
||||
if [ -n "$loglevel" ]; then
|
||||
log_rule $loglevel $chain $logtarget $ratelimit -t nat
|
||||
log_rule_limit $loglevel $chain $logtarget "$ratelimit" -t nat
|
||||
fi
|
||||
|
||||
addnatrule $chain $ratelimit $proto -j $target1 # Protocol is necessary for port redirection
|
||||
@ -2199,7 +2211,7 @@ add_nat_rule() {
|
||||
for adr in `separate_list $addr`; do
|
||||
if [ -n "$loglevel" ]; then
|
||||
ensurenatchain $chain
|
||||
log_rule $loglevel $chain $logtarget $ratelimit -t nat \
|
||||
log_rule_limit $loglevel $chain $logtarget "$ratelimit" -t nat \
|
||||
`fix_bang $proto $cli $sports -d $adr $multiport $dports`
|
||||
fi
|
||||
|
||||
@ -2403,7 +2415,7 @@ add_a_rule()
|
||||
if [ -n "$addr" -a -n "$CONNTRACK_MATCH" ]; then
|
||||
for adr in `separate_list $addr`; do
|
||||
if [ -n "$loglevel" -a -z "$natrule" ]; then
|
||||
log_rule $loglevel $chain $logtarget $ratelimit -m conntrack --ctorigdst $adr \
|
||||
log_rule_limit $loglevel $chain $logtarget "$ratelimit" -m conntrack --ctorigdst $adr \
|
||||
`fix_bang $proto $sports $multiport $state $cli -d $srv $dports`
|
||||
fi
|
||||
|
||||
@ -2412,7 +2424,7 @@ add_a_rule()
|
||||
done
|
||||
else
|
||||
if [ -n "$loglevel" -a -z "$natrule" ]; then
|
||||
log_rule $loglevel $chain $logtarget $ratelimit \
|
||||
log_rule_limit $loglevel $chain $logtarget "$ratelimit" \
|
||||
`fix_bang $proto $sports $multiport $state $cli -d $srv $dports`
|
||||
fi
|
||||
|
||||
@ -2423,7 +2435,7 @@ add_a_rule()
|
||||
done
|
||||
else
|
||||
if [ -n "$loglevel" -a -z "$natrule" ]; then
|
||||
log_rule $loglevel $chain $logtarget $ratelimit \
|
||||
log_rule_limit $loglevel $chain $logtarget "$ratelimit" \
|
||||
`fix_bang $proto $sports $multiport $state $cli $dports`
|
||||
fi
|
||||
|
||||
@ -2442,7 +2454,7 @@ add_a_rule()
|
||||
|
||||
if [ $command != check ]; then
|
||||
if [ -n "$loglevel" ]; then
|
||||
log_rule $loglevel $chain $logtarget $ratelimit \
|
||||
log_rule_limit $loglevel $chain $logtarget "$ratelimit" \
|
||||
`fix_bang $proto $multiport $dest_interface $state $cli $sports $dports`
|
||||
fi
|
||||
|
||||
@ -4936,6 +4948,7 @@ do_initialize() {
|
||||
LOGRATE=
|
||||
LOGBURST=
|
||||
LOGPARMS=
|
||||
LOGLIMIT=
|
||||
ADD_IP_ALIASES=
|
||||
ADD_SNAT_ALIASES=
|
||||
TC_ENABLED=
|
||||
@ -5018,9 +5031,9 @@ do_initialize() {
|
||||
TC_ENABLED="`added_param_value_yes TC_ENABLED $TC_ENABLED`"
|
||||
|
||||
if [ -n "${LOGRATE}${LOGBURST}" ]; then
|
||||
LOGPARMS="--match limit"
|
||||
[ -n "$LOGRATE" ] && LOGPARMS="$LOGPARMS --limit $LOGRATE"
|
||||
[ -n "$LOGBURST" ] && LOGPARMS="$LOGPARMS --limit-burst $LOGBURST"
|
||||
LOGLIMIT="--match limit"
|
||||
[ -n "$LOGRATE" ] && LOGLIMIT="$LOGLIMIT --limit $LOGRATE"
|
||||
[ -n "$LOGBURST" ] && LOGLIMIT="$LOGLIMIT --limit-burst $LOGBURST"
|
||||
fi
|
||||
|
||||
if [ -n "$IP_FORWARDING" ]; then
|
||||
|
||||
@ -381,7 +381,8 @@ ip_vlsm() {
|
||||
|
||||
|
||||
#
|
||||
# Chain name base for an interface -- remove all periods from the passed name.
|
||||
# Chain name base for an interface -- replace all periods with underscores in the passed name.
|
||||
# The result is echoed (less "+" and anything following).
|
||||
#
|
||||
chain_base() #$1 = interface
|
||||
{
|
||||
|
||||
@ -54,7 +54,7 @@
|
||||
# /etc/rc.d/rc.local file is modified to start the firewall.
|
||||
#
|
||||
|
||||
VERSION=1.4.6-20030813
|
||||
VERSION=1.4.6-20030821
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
@ -553,19 +553,29 @@ if [ -f ${PREFIX}/etc/shorewall/ecn ]; then
|
||||
else
|
||||
run_install -o $OWNER -g $GROUP -m 0600 ecn ${PREFIX}/etc/shorewall/ecn
|
||||
echo
|
||||
echo "ECN file installed as ${PREFIX}/etc/shorewall/ecn"
|
||||
echo "ECN file installed as ${PREFIX}/etc/shorewall/ecn"
|
||||
fi
|
||||
##
|
||||
#
|
||||
# Install the Accounting file
|
||||
#
|
||||
if [ -f ${PREFIX}/etc/shorewall/accounting ]; then
|
||||
backup_file /etc/shorewall/accounting
|
||||
else
|
||||
run_install -o $OWNER -g $GROUP -m 0600 ecn ${PREFIX}/etc/shorewall/accounting
|
||||
run_install -o $OWNER -g $GROUP -m 0600 accounting ${PREFIX}/etc/shorewall/accounting
|
||||
echo
|
||||
echo "Accounting file installed as ${PREFIX}/etc/shorewall/accounting"
|
||||
fi
|
||||
#
|
||||
# Install the User Sets file
|
||||
#
|
||||
if [ -f ${PREFIX}/etc/shorewall/usersets ]; then
|
||||
backup_file /etc/shorewall/usersets
|
||||
else
|
||||
run_install -o $OWNER -g $GROUP -m 0600 usersets ${PREFIX}/etc/shorewall/usersets
|
||||
echo
|
||||
echo "User sets file installed as ${PREFIX}/etc/shorewall/usersets"
|
||||
fi
|
||||
#
|
||||
# Backup the version file
|
||||
#
|
||||
if [ -z "$PREFIX" ]; then
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
%define name shorewall
|
||||
%define version 1.4.6_20030813
|
||||
%define version 1.4.6_20030821
|
||||
%define release 1
|
||||
%define prefix /usr
|
||||
|
||||
@ -99,6 +99,7 @@ fi
|
||||
%attr(0600,root,root) %config(noreplace) /etc/shorewall/stopped
|
||||
%attr(0600,root,root) %config(noreplace) /etc/shorewall/ecn
|
||||
%attr(0600,root,root) %config(noreplace) /etc/shorewall/accounting
|
||||
%attr(0600,root,root) %config(noreplace) /etc/shorewall/usersets
|
||||
%attr(0544,root,root) /sbin/shorewall
|
||||
%attr(0444,root,root) /usr/share/shorewall/functions
|
||||
%attr(0544,root,root) /usr/share/shorewall/firewall
|
||||
@ -107,6 +108,9 @@ fi
|
||||
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
|
||||
|
||||
%changelog
|
||||
* Thu Aug 21 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.6_20030821-1
|
||||
- Added /etc/shorewall/usersets
|
||||
* Wed Aug 13 2003 Tom Eastep <tom@shorewall.net>
|
||||
- Changed version to 1.4.6_20030813-1
|
||||
* Sat Aug 09 2003 Tom Eastep <tom@shorewall.net>
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Seattle Firewall
|
||||
|
||||
VERSION=1.4.6-20030813
|
||||
VERSION=1.4.6-20030821
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
@ -99,7 +99,8 @@ if [ -n "$FIREWALL" ]; then
|
||||
rm -f ${FIREWALL}-*.bkout
|
||||
fi
|
||||
|
||||
remove_file /sbin/shorewall
|
||||
rm -f /sbin/shorewall
|
||||
rm -f /sbin/shorewall-*.bkout
|
||||
|
||||
if [ -n "$VERSION" ]; then
|
||||
restore_file /etc/rc.d/rc.local
|
||||
|
||||
28
Shorewall/usersets
Normal file
28
Shorewall/usersets
Normal file
@ -0,0 +1,28 @@
|
||||
#
|
||||
# Shorewall version 1.4 - User Sets File
|
||||
#
|
||||
# /etc/shorewall/usersets
|
||||
#
|
||||
# This file is used to define Shorewall "User Sets". A user set is a
|
||||
# list of <user>, <group> or <user:group> names and can be used to
|
||||
# control access by individual users to other network hosts from the
|
||||
# firewall system.
|
||||
#
|
||||
# Columns are:
|
||||
#
|
||||
# USERSET The name of a user set. May be up to 6 characters in
|
||||
# length and must be a valid shell identifier.
|
||||
#
|
||||
# USER A Linux user name or number defined in /etc/passwd.
|
||||
#
|
||||
# GROUP A linux group name or number defined in /etc/groups.
|
||||
#
|
||||
# The GROUP may be omitted. If it is supplied, then the USER may be
|
||||
# entered as "-" in which case all members of the specified group are
|
||||
# included in the USERSET.
|
||||
#
|
||||
################################################################################
|
||||
#USERSET USER GROUP
|
||||
#
|
||||
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
|
||||
|
||||
Loading…
Reference in New Issue
Block a user