holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Merge branch '4.4.19' of ssh://shorewall.git.sourceforge.net/gitroot/shorewall/shorewall into 4.4.19

Browse Source
This commit is contained in:
Tom Eastep 2011-05-08 05:59:13 -07:00
commit 631a2a7092
23 changed files with 69 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall-init/install.sh
View File

@ -23,7 +23,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

4
Shorewall-init/shorewall-init.spec
View File

@ -1,6 +1,6 @@
%define name shorewall-init %define name shorewall-init
%define version 4.4.19 %define version 4.4.19
%define release 2 %define release 3
Summary: Shorewall-init adds functionality to Shoreline Firewall (Shorewall). Summary: Shorewall-init adds functionality to Shoreline Firewall (Shorewall).
Name: %{name} Name: %{name}
@ -119,6 +119,8 @@ fi
%doc COPYING changelog.txt releasenotes.txt %doc COPYING changelog.txt releasenotes.txt
%changelog %changelog
* Sat May 07 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-3
* Sat Apr 16 2011 Tom Eastep tom@shorewall.net * Sat Apr 16 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-2 - Updated to 4.4.19-2
* Wed Apr 13 2011 Tom Eastep tom@shorewall.net * Wed Apr 13 2011 Tom Eastep tom@shorewall.net

2
Shorewall-init/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall-lite/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

4
Shorewall-lite/shorewall-lite.spec
View File

@ -1,6 +1,6 @@
%define name shorewall-lite %define name shorewall-lite
%define version 4.4.19 %define version 4.4.19
%define release 2 %define release 3
Summary: Shoreline Firewall Lite is an iptables-based firewall for Linux systems. Summary: Shoreline Firewall Lite is an iptables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -103,6 +103,8 @@ fi
%doc COPYING changelog.txt releasenotes.txt %doc COPYING changelog.txt releasenotes.txt
%changelog %changelog
* Sat May 07 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-3
* Sat Apr 16 2011 Tom Eastep tom@shorewall.net * Sat Apr 16 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-2 - Updated to 4.4.19-2
* Wed Apr 13 2011 Tom Eastep tom@shorewall.net * Wed Apr 13 2011 Tom Eastep tom@shorewall.net

2
Shorewall-lite/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

32
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -2870,7 +2870,7 @@ sub conditional_rule_end( $ ) {
add_commands( $chainref , "fi\n" ); add_commands( $chainref , "fi\n" );
} }
sub mysplit( $$ ); sub mysplit( $;$ );
# #
# Match a Source. # Match a Source.
@ -3229,7 +3229,7 @@ sub addnatjump( $$$ ) {
# Split a comma-separated source or destination host list but keep [...] together. Used for spliting address lists # Split a comma-separated source or destination host list but keep [...] together. Used for spliting address lists
# where an element of the list might be +ipset[flag,...] or +[ipset[flag,...],...] # where an element of the list might be +ipset[flag,...] or +[ipset[flag,...],...]
# #
sub mysplit( $$ ) { sub mysplit( $;$ ) {
my ( $input, $loose ) = @_; my ( $input, $loose ) = @_;
my @input = split_list $input, 'host'; my @input = split_list $input, 'host';
@ -3638,7 +3638,7 @@ sub handle_network_list( $$ ) {
my $nets = ''; my $nets = '';
my $excl = ''; my $excl = '';
my @nets = mysplit $list, 0; my @nets = mysplit $list;
for ( @nets ) { for ( @nets ) {
if ( /!/ ) { if ( /!/ ) {
@ -3954,7 +3954,7 @@ sub expand_rule( $$$$$$$$$$;$ )
} }
unless ( $onets ) { unless ( $onets ) {
my @oexcl = mysplit $oexcl, 0; my @oexcl = mysplit $oexcl;
if ( @oexcl == 1 ) { if ( @oexcl == 1 ) {
$rule .= match_orig_dest( "!$oexcl" ); $rule .= match_orig_dest( "!$oexcl" );
$oexcl = ''; $oexcl = '';
@ -4029,19 +4029,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
my $exclude = '-j MARK --or-mark ' . in_hex( $globals{EXCLUSION_MASK} ); my $exclude = '-j MARK --or-mark ' . in_hex( $globals{EXCLUSION_MASK} );
for ( mysplit $iexcl, 0 ) { for ( mysplit $iexcl ) {
my $cond = conditional_rule( $chainref, $_ ); my $cond = conditional_rule( $chainref, $_ );
add_rule $chainref, ( match_source_net $_ , $restriction, $mac ) . $exclude; add_rule $chainref, ( match_source_net $_ , $restriction, $mac ) . $exclude;
conditional_rule_end( $chainref ) if $cond; conditional_rule_end( $chainref ) if $cond;
} }
for ( mysplit $dexcl, 0 ) { for ( mysplit $dexcl ) {
my $cond = conditional_rule( $chainref, $_ ); my $cond = conditional_rule( $chainref, $_ );
add_rule $chainref, ( match_dest_net $_ ) . $exclude; add_rule $chainref, ( match_dest_net $_ ) . $exclude;
conditional_rule_end( $chainref ) if $cond; conditional_rule_end( $chainref ) if $cond;
} }
for ( mysplit $oexcl, 0 ) { for ( mysplit $oexcl ) {
my $cond = conditional_rule( $chainref, $_ ); my $cond = conditional_rule( $chainref, $_ );
add_rule $chainref, ( match_orig_dest $_ ) . $exclude; add_rule $chainref, ( match_orig_dest $_ ) . $exclude;
conditional_rule_end( $chainref ) if $cond; conditional_rule_end( $chainref ) if $cond;
@ -4060,19 +4060,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
# Use the current rule and send all possible matches to the exclusion chain # Use the current rule and send all possible matches to the exclusion chain
# #
for my $onet ( mysplit $onets , 0 ) { for my $onet ( mysplit $onets ) {
my $cond = conditional_rule( $chainref, $onet ); my $cond = conditional_rule( $chainref, $onet );
$onet = match_orig_dest $onet; $onet = match_orig_dest $onet;
for my $inet ( mysplit $inets , 0 ) { for my $inet ( mysplit $inets ) {
my $cond = conditional_rule( $chainref, $inet ); my $cond = conditional_rule( $chainref, $inet );
my $source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' ); my $source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' );
for my $dnet ( mysplit $dnets , 0 ) { for my $dnet ( mysplit $dnets ) {
$source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' ); $source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' );
add_jump( $chainref, $echainref, 0, join( '', $rule, $source_match, match_dest_net( $dnet ), $onet ), 1 ); add_jump( $chainref, $echainref, 0, join( '', $rule, $source_match, match_dest_net( $dnet ), $onet ), 1 );
} }
@ -4085,19 +4085,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
# Generate RETURNs for each exclusion # Generate RETURNs for each exclusion
# #
for ( mysplit $iexcl , 0 ) { for ( mysplit $iexcl ) {
my $cond = conditional_rule( $echainref, $_ ); my $cond = conditional_rule( $echainref, $_ );
add_rule $echainref, ( match_source_net $_ , $restriction, $mac ) . '-j RETURN'; add_rule $echainref, ( match_source_net $_ , $restriction, $mac ) . '-j RETURN';
conditional_rule_end( $echainref ) if $cond; conditional_rule_end( $echainref ) if $cond;
} }
for ( mysplit $dexcl , 0 ) { for ( mysplit $dexcl ) {
my $cond = conditional_rule( $echainref, $_ ); my $cond = conditional_rule( $echainref, $_ );
add_rule $echainref, ( match_dest_net $_ ) . '-j RETURN'; add_rule $echainref, ( match_dest_net $_ ) . '-j RETURN';
conditional_rule_end( $echainref ) if $cond; conditional_rule_end( $echainref ) if $cond;
} }
for ( mysplit $oexcl , 0 ) { for ( mysplit $oexcl ) {
my $cond = conditional_rule( $echainref, $_ ); my $cond = conditional_rule( $echainref, $_ );
add_rule $echainref, ( match_orig_dest $_ ) . '-j RETURN'; add_rule $echainref, ( match_orig_dest $_ ) . '-j RETURN';
conditional_rule_end( $echainref ) if $cond; conditional_rule_end( $echainref ) if $cond;
@ -4127,19 +4127,19 @@ sub expand_rule( $$$$$$$$$$;$ )
# #
# No non-trivial exclusions or we're using marks to handle them # No non-trivial exclusions or we're using marks to handle them
# #
for my $onet ( mysplit $onets , 0 ) { for my $onet ( mysplit $onets ) {
my $cond = conditional_rule( $chainref, $onet ); my $cond = conditional_rule( $chainref, $onet );
$onet = match_orig_dest $onet; $onet = match_orig_dest $onet;
for my $inet ( mysplit $inets , 0 ) { for my $inet ( mysplit $inets ) {
my $source_match; my $source_match;
my $cond = conditional_rule( $chainref, $inet ); my $cond = conditional_rule( $chainref, $inet );
$source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' ); $source_match = match_source_net( $inet, $restriction, $mac ) if have_capability( 'KLUDGEFREE' );
for my $dnet ( mysplit $dnets , 0 ) { for my $dnet ( mysplit $dnets ) {
$source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' ); $source_match = match_source_net( $inet, $restriction, $mac ) unless have_capability( 'KLUDGEFREE' );
my $dest_match = match_dest_net( $dnet ); my $dest_match = match_dest_net( $dnet );
my $matches = join( '', $rule, $source_match, $dest_match, $onet ); my $matches = join( '', $rule, $source_match, $dest_match, $onet );

2
Shorewall/Perl/Shorewall/Config.pm
View File

@ -412,7 +412,7 @@ sub initialize( $ ) {
EXPORT => 0, EXPORT => 0,
STATEMATCH => '-m state --state', STATEMATCH => '-m state --state',
UNTRACKED => 0, UNTRACKED => 0,
VERSION => "4.4.19.2", VERSION => "4.4.19.3",
CAPVERSION => 40417 , CAPVERSION => 40417 ,
); );
# #

1
Shorewall/Perl/Shorewall/Providers.pm
View File

@ -466,6 +466,7 @@ sub add_a_provider( ) {
if ( $gateway ) { if ( $gateway ) {
$address = get_interface_address $interface unless $address; $address = get_interface_address $interface unless $address;
emit "run_ip route replace $gateway src $address dev $physical ${mtu}";
emit "run_ip route replace $gateway src $address dev $physical ${mtu}table $number $realm"; emit "run_ip route replace $gateway src $address dev $physical ${mtu}table $number $realm";
emit "run_ip route add default via $gateway src $address dev $physical ${mtu}table $number $realm"; emit "run_ip route add default via $gateway src $address dev $physical ${mtu}table $number $realm";
} }

8
Shorewall/Perl/prog.header
View File

@ -509,10 +509,10 @@ undo_routing() {
# #
save_default_route() { save_default_route() {
awk \ awk \
'BEGIN {default=0;}; \ 'BEGIN {defroute=0;};
/^default / {default=1; print; next}; \ /^default / {deroute=1; print; next};
/nexthop/ {if (default == 1 ) {print ; next} }; \ /nexthop/ {if (defroute == 1 ) {print ; next} };
{ default=0; };' { defroute=0; };'
} }
# #

8
Shorewall/Perl/prog.header6
View File

@ -497,10 +497,10 @@ undo_routing() {
# #
save_default_route() { save_default_route() {
awk \ awk \
'BEGIN {default=0;}; \ 'BEGIN {defroute=0;};
/^default / {default=1; print; next}; \ /^default / {defroute=1; print; next};
/nexthop/ {if (default == 1 ) {print ; next} }; \ /nexthop/ {if (defroute == 1 ) {print ; next} };
{ default=0; };' { defroute=0; };'
} }
# #

4
Shorewall/changelog.txt
View File

@ -1,3 +1,7 @@
Changes in Shorewall 4.4.19.3
1) Eliminate issue with 'gawk'.
Changes in Shorewall 4.4.19.2 Changes in Shorewall 4.4.19.2
1) Restore the ability to have IPSET names in the ORIGINAL DEST column 1) Restore the ability to have IPSET names in the ORIGINAL DEST column

2
Shorewall/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

11
Shorewall/releasenotes.txt
View File

@ -1,5 +1,5 @@
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
S H O R E W A L L 4 . 4 . 1 9 . 2 S H O R E W A L L 4 . 4 . 1 9 . 3
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
I. PROBLEMS CORRECTED IN THIS RELEASE I. PROBLEMS CORRECTED IN THIS RELEASE
@ -13,6 +13,15 @@ VI. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES
I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
4.4.19.3
1) The changes in 4.4.19.1 that corrected long-standing issues with
default route save/restore were incompatible with 'gawk'. When
'gawk' was installed (rather than 'mawk'), awk syntax errors having
to do with the symbol 'default' were issued.
This incompatibility has been corrected.
4.4.19.2 4.4.19.2
1) In Shorewall-shell, there was the ability to specify IPSET names in 1) In Shorewall-shell, there was the ability to specify IPSET names in

4
Shorewall/shorewall.spec
View File

@ -1,6 +1,6 @@
%define name shorewall %define name shorewall
%define version 4.4.19 %define version 4.4.19
%define release 2 %define release 3
Summary: Shoreline Firewall is an iptables-based firewall for Linux systems. Summary: Shoreline Firewall is an iptables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -109,6 +109,8 @@ fi
%doc COPYING INSTALL changelog.txt releasenotes.txt Contrib/* Samples %doc COPYING INSTALL changelog.txt releasenotes.txt Contrib/* Samples
%changelog %changelog
* Sat May 07 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-3
* Sat Apr 16 2011 Tom Eastep tom@shorewall.net * Sat Apr 16 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-2 - Updated to 4.4.19-2
* Wed Apr 13 2011 Tom Eastep tom@shorewall.net * Wed Apr 13 2011 Tom Eastep tom@shorewall.net

2
Shorewall/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall6-lite/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

4
Shorewall6-lite/shorewall6-lite.spec
View File

@ -1,6 +1,6 @@
%define name shorewall6-lite %define name shorewall6-lite
%define version 4.4.19 %define version 4.4.19
%define release 2 %define release 3
Summary: Shoreline Firewall 6 Lite is an ip6tables-based firewall for Linux systems. Summary: Shoreline Firewall 6 Lite is an ip6tables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -94,6 +94,8 @@ fi
%doc COPYING changelog.txt releasenotes.txt %doc COPYING changelog.txt releasenotes.txt
%changelog %changelog
* Sat May 07 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-3
* Sat Apr 16 2011 Tom Eastep tom@shorewall.net * Sat Apr 16 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-2 - Updated to 4.4.19-2
* Wed Apr 13 2011 Tom Eastep tom@shorewall.net * Wed Apr 13 2011 Tom Eastep tom@shorewall.net

2
Shorewall6-lite/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall6/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

4
Shorewall6/shorewall6.spec
View File

@ -1,6 +1,6 @@
%define name shorewall6 %define name shorewall6
%define version 4.4.19 %define version 4.4.19
%define release 2 %define release 3
Summary: Shoreline Firewall 6 is an ip6tables-based firewall for Linux systems. Summary: Shoreline Firewall 6 is an ip6tables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -98,6 +98,8 @@ fi
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel ipsecvpn ipv6 Samples6 %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel ipsecvpn ipv6 Samples6
%changelog %changelog
* Sat May 07 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-3
* Sat Apr 16 2011 Tom Eastep tom@shorewall.net * Sat Apr 16 2011 Tom Eastep tom@shorewall.net
- Updated to 4.4.19-2 - Updated to 4.4.19-2
* Wed Apr 13 2011 Tom Eastep tom@shorewall.net * Wed Apr 13 2011 Tom Eastep tom@shorewall.net

2
Shorewall6/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.19.2 VERSION=4.4.19.3
usage() # $1 = exit status usage() # $1 = exit status
{ {

7
docs/starting_and_stopping_shorewall.xml
View File

@ -652,9 +652,10 @@
<entry>firewall stop</entry> <entry>firewall stop</entry>
<entry>Only traffic to/from hosts listed in /etc/shorewall/hosts <entry>Only traffic to/from hosts listed in
is passed to/from/through the firewall. If ADMINISABSENTMINDED=Yes /etc/shorewall/routestopped is passed to/from/through the
in /etc/shorewall/shorewall.conf then in addition, all existing firewall. If ADMINISABSENTMINDED=Yes in
/etc/shorewall/shorewall.conf then in addition, all existing
connections are retained and all connection requests from the connections are retained and all connection requests from the
firewall are accepted.</entry> firewall are accepted.</entry>
</row> </row>