diff --git a/Shorewall-perl/Shorewall/Actions.pm b/Shorewall-perl/Shorewall/Actions.pm index 55856beac..6fb10e804 100644 --- a/Shorewall-perl/Shorewall/Actions.pm +++ b/Shorewall-perl/Shorewall/Actions.pm @@ -266,7 +266,7 @@ sub createlogactionchain( $$ ) { $chain = substr $chain, 0, 28 if ( length $chain ) > 28; - while ( $chain_table{'%' . $chain . $actionref->{actchain}} ) { + while ( $chain_table->{'%' . $chain . $actionref->{actchain}} ) { $chain = substr $chain, 0, 27 if $actionref->{actchain} == 10 and length $chain == 28; } diff --git a/Shorewall-perl/Shorewall/Chains.pm b/Shorewall-perl/Shorewall/Chains.pm index 8b2ed2af2..a9493be33 100644 --- a/Shorewall-perl/Shorewall/Chains.pm +++ b/Shorewall-perl/Shorewall/Chains.pm @@ -118,7 +118,8 @@ our @EXPORT = qw( STANDARD create_netfilter_load create_chainlist_reload - %chain_table + $chain_table + $ipv $nat_table $mangle_table $filter_table @@ -132,27 +133,28 @@ our $VERSION = '4.04'; # # Chain Table # -# %chain_table { => { => { name => -# table =>
-# is_policy => 0|1 -# is_optional => 0|1 -# referenced => 0|1 -# log => -# policy => -# policychain => -- self-reference if this is a policy chain -# policypair => [ , ] -- Used for reporting duplicated policies -# loglevel => -# synparams => -# synchain => -# default => -# cmdlevel => -# rules => [ -# -# ... -# ] -# } , -# => ... -# } +# %chains { <4|6> => {
=> { => { name => +# table =>
+# is_policy => 0|1 +# is_optional => 0|1 +# referenced => 0|1 +# log => +# policy => +# policychain => -- self-reference if this is a policy chain +# policypair => [ , ] -- Used for reporting duplicated policies +# loglevel => +# synparams => +# synchain => +# default => +# cmdlevel => +# rules => [ +# +# ... +# ] +# } , +# => ... +# } +# } # } # # 'is_optional' only applies to policy chains; when true, indicates that this is a provisional policy chain which might be @@ -162,7 +164,10 @@ our $VERSION = '4.04'; # # 'loglevel', 'synparams', 'synchain' and 'default' only apply to policy chains. # -our %chain_table; + +our %chains; +our $ipv; +our $chain_table; our $nat_table; our $mangle_table; our $filter_table; @@ -229,14 +234,13 @@ our $mode; # sub initialize() { - %chain_table = ( raw => {} , - mangle => {}, - nat => {}, - filter => {} ); - - $nat_table = $chain_table{nat}; - $mangle_table = $chain_table{mangle}; - $filter_table = $chain_table{filter}; + %chains = ( 4 => { raw => {} , + mangle => {} , + nat => {} , + filter => {} } , + 6 => { raw => {} , + mangle => {} , + filter => {} } ); # # These get set to 1 as sections are encountered. @@ -308,8 +312,31 @@ sub initialize() { %interfacebcasts = (); } +sub switch_to_ipv4() { + $ipv = 4; + + $chain_table = $chains{4}; + + $nat_table = $chain_table->{nat}; + $mangle_table = $chain_table->{mangle}; + $filter_table = $chain_table->{filter}; + +} + +sub switch_to_ipv6() { + $ipv = 6; + + $chain_table = $chains{6}; + + $nat_table = undef; + $mangle_table = $chain_table->{mangle}; + $filter_table = $chain_table->{filter}; + +} + INIT { initialize; + switch_to_ipv4; } # @@ -574,14 +601,15 @@ sub new_chain($$) { my ($table, $chain) = @_; - warning_message "Internal error in new_chain()" if $chain_table{$table}{$chain}; + warning_message "Internal error in new_chain()" if $chain_table->{$table}{$chain}; - $chain_table{$table}{$chain} = { name => $chain, - rules => [], - table => $table, - loglevel => '', - log => 1, - cmdlevel => 0 }; + $chain_table->{$table}{$chain} = { name => $chain, + rules => [], + table => $table, + ipv => $ipv, + loglevel => '', + log => 1, + cmdlevel => 0 }; } # @@ -601,7 +629,7 @@ sub ensure_chain($$) { my ($table, $chain) = @_; - my $ref = $chain_table{$table}{$chain}; + my $ref = $chain_table->{$table}{$chain}; return $ref if $ref; @@ -735,7 +763,7 @@ sub finish_section ( $ ) { for my $zone ( all_zones ) { for my $zone1 ( all_zones ) { - my $chainref = $chain_table{'filter'}{"${zone}2${zone1}"}; + my $chainref = $chain_table->{'filter'}{"${zone}2${zone1}"}; if ( $chainref->{referenced} ) { finish_chain_section $chainref, $sections; } @@ -1964,7 +1992,7 @@ sub create_netfilter_load() { # iptables-restore seems to be quite picky about the order of the builtin chains # for my $chain ( @builtins ) { - my $chainref = $chain_table{$table}{$chain}; + my $chainref = $chain_table->{$table}{$chain}; if ( $chainref ) { fatal_error "Internal error in create_netfilter_load()" if $chainref->{cmdlevel}; emit_unindented ":$chain $chainref->{policy} [0:0]"; @@ -1974,8 +2002,8 @@ sub create_netfilter_load() { # # First create the chains in the current table # - for my $chain ( grep $chain_table{$table}{$_}->{referenced} , ( sort keys %{$chain_table{$table}} ) ) { - my $chainref = $chain_table{$table}{$chain}; + for my $chain ( grep $chain_table->{$table}{$_}->{referenced} , ( sort keys %{$chain_table->{$table}} ) ) { + my $chainref = $chain_table->{$table}{$chain}; unless ( $chainref->{builtin} ) { fatal_error "Internal error in create_netfilter_load()" if $chainref->{cmdlevel}; emit_unindented ":$chainref->{name} - [0:0]"; @@ -2058,7 +2086,7 @@ sub create_chainlist_reload($) { ( $table , $chain ) = split ':', $chain if $chain =~ /:/; fatal_error "Invalid table ( $table )" unless $table =~ /^(nat|mangle|filter)$/; - fatal_error "No $table chain found with name $chain" unless $chain_table{$table}{$chain}; + fatal_error "No $table chain found with name $chain" unless $chain_table->{$table}{$chain}; $chains{$table} = [] unless $chains{$table}; @@ -2070,7 +2098,7 @@ sub create_chainlist_reload($) { emit_unindented "*$table"; - my $tableref=$chain_table{$table}; + my $tableref=$chain_table->{$table}; @chains = sort @{$chains{$table}}; diff --git a/Shorewall-perl/Shorewall/Rules.pm b/Shorewall-perl/Shorewall/Rules.pm index e606b32c6..8f5f2f4ca 100644 --- a/Shorewall-perl/Shorewall/Rules.pm +++ b/Shorewall-perl/Shorewall/Rules.pm @@ -756,7 +756,7 @@ sub setup_mac_lists( $ ) { fatal_error "No hosts on $interface have the maclist option specified"; } - my $chainref = $chain_table{$table}{( $ttl ? macrecent_target $interface : mac_chain $interface )}; + my $chainref = $chain_table->{$table}{( $ttl ? macrecent_target $interface : mac_chain $interface )}; $mac = '' unless $mac && ( $mac ne '-' ); $addresses = '' unless $addresses && ( $addresses ne '-' ); @@ -802,7 +802,7 @@ sub setup_mac_lists( $ ) { } } else { for my $interface ( @maclist_interfaces ) { - my $chainref = $chain_table{$table}{( $ttl ? macrecent_target $interface : mac_chain $interface )}; + my $chainref = $chain_table->{$table}{( $ttl ? macrecent_target $interface : mac_chain $interface )}; my $chain = $chainref->{name}; if ( $level ne '' || $disposition ne 'ACCEPT' ) { @@ -1867,7 +1867,7 @@ sub generate_matrix() { for my $chain ( @{$builtins{$table}} ) { log_rule_limit $config{LOGALLNEW} , - $chain_table{$table}{$chain} , + $chain_table->{$table}{$chain} , $table , $chain , '' , diff --git a/Shorewall-perl/Shorewall/Zones.pm b/Shorewall-perl/Shorewall/Zones.pm index 4d666f91f..098cc0b9a 100644 --- a/Shorewall-perl/Shorewall/Zones.pm +++ b/Shorewall-perl/Shorewall/Zones.pm @@ -129,7 +129,7 @@ our %reservedName = ( all => 1, # Zone Types # use constant { ZT_IPV4 => 1, - ZT_IPV6 => 2 + ZT_IPV6 => 2, ZT_FIREWALL => 3, #ZT_IPV4 + ZT_IPV6 ZT_IPSEC => 4, ZT_IPSEC4 => 5, #ZT_IPV4 + ZT_IPSEC