holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Disallow CONTINUE rules with exclusion

Browse Source
This commit is contained in:
Tom Eastep 2010-08-29 20:20:52 -07:00
parent 9125f4611c
commit 4089349eba
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -3380,7 +3380,7 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
# We have non-trivial exclusion -- need to create an exclusion chain # We have non-trivial exclusion -- need to create an exclusion chain
# #
fatal_error "Exclusion is not possible in ACCEPT+/CONTINUE/NONAT rules" if $disposition eq 'RETURN'; fatal_error "Exclusion is not possible in ACCEPT+/CONTINUE/NONAT rules" if $disposition eq 'RETURN' || $disposition eq 'CONTINUE';
# #
# Create the Exclusion Chain # Create the Exclusion Chain

2
Shorewall/known_problems.txt
View File

@ -106,7 +106,7 @@
rules (tcrules and rules files). The generated iptables (ip6tables) rules (tcrules and rules files). The generated iptables (ip6tables)
rules do not work as expected. rules do not work as expected.
Workaround: Don't use exclusion in CONTINUE rules. Corrected in Shorewall 4.4.11.4.
16) Exclusion in blacklist file entries is correctly validated but is 16) Exclusion in blacklist file entries is correctly validated but is
then ignored when generating iptables (ip6tables) input. then ignored when generating iptables (ip6tables) input.

4
Shorewall/releasenotes.txt
View File

@ -236,6 +236,10 @@ I I I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E
5) Previously, the interface option combination of 'optional' and 5) Previously, the interface option combination of 'optional' and
'upnpclient' did not work correctly. 'upnpclient' did not work correctly.
6) Earlier releases allowed CONTINUE rules with exclusion. These rules
generated valid but incorrect iptables (ip6tables) input. Such
rules are now disallowed.
4.4.11.3 4.4.11.3
1) When 'any' was used in the rules SOURCE column, a duplicate rule 1) When 'any' was used in the rules SOURCE column, a duplicate rule