holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Shorewall-2.1.1

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1473 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-07-13 00:43:38 +00:00
parent 6148b62256
commit 978b47bd43
4 changed files with 102 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
LrpN/etc/shorewall/masq
View File

@ -20,6 +20,20 @@
# This may be qualified by adding the character # This may be qualified by adding the character
# ":" followed by a destination host or subnet. # ":" followed by a destination host or subnet.
# #
# If you wish to inhibit the action of ADD_SNAT_ALIASES
# for this entry then include the ":" but omit the digit:
#
# eth0:
# eth2::192.0.2.32/27
#
# Normally Masq/SNAT rules are evaluated after those for
# one-to-one NAT (/etc/shorewall/nat file). If you want
# the rule to be applied before one-to-one NAT rules,
# prefix the interface name with "+":
#
# +eth0
# +eth0:192.0.2.32/27
# +eth0:2
# #
# SUBNET -- Subnet that you wish to masquerade. You can specify this as # SUBNET -- Subnet that you wish to masquerade. You can specify this as
# a subnet or as an interface. If you give the name of an # a subnet or as an interface. If you give the name of an
@ -130,5 +144,5 @@
# #
############################################################################### ###############################################################################
#INTERFACE SUBNET ADDRESS PROTO PORT(S) #INTERFACE SUBNET ADDRESS PROTO PORT(S)
eth0 eth1 eth0 eth1
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE

15
LrpN/etc/shorewall/shorewall.conf
View File

@ -325,9 +325,8 @@ ADD_SNAT_ALIASES=No
# #
# If you say "Yes" or "yes" here, Traffic Shaping is enabled in the firewall. If # If you say "Yes" or "yes" here, Traffic Shaping is enabled in the firewall. If
# you say "No" or "no" then traffic shaping is not enabled. If you enable traffic # you say "No" or "no" then traffic shaping is not enabled. If you enable traffic
# shaping you must have iproute[2] installed (the "ip" and "tc" utilities) and # shaping you must have iproute[2] installed (the "ip" and "tc" utilities).
# you must enable packet mangling above.
#
TC_ENABLED=No TC_ENABLED=No
# #
@ -605,6 +604,16 @@ BRIDGING=No
# set DYNAMIC_ZONES=Yes. Otherwise, set DYNAMIC_ZONES=No. # set DYNAMIC_ZONES=Yes. Otherwise, set DYNAMIC_ZONES=No.
DYNAMIC_ZONES=No DYNAMIC_ZONES=No
#
# USE PKTTYPE MATCH
#
# Some users have reported problems with the PKTTYPE match extension not being
# able to patch certail broadcast packets. If you set PKTTYPE=No then Shorewall
# will use IP addresses to detect broadcasts rather than pkttype. If not given
# or if given as empty (PKTTYPE="") then PKTTYPE=Yes is assumed.
PKTTYPE=Yes
################################################################################ ################################################################################
# P A C K E T D I S P O S I T I O N # P A C K E T D I S P O S I T I O N
################################################################################ ################################################################################

90
LrpN/usr/share/shorewall/firewall
View File

@ -437,6 +437,14 @@ masq_chain() # $1 = interface
echo $(chain_base $1)_masq echo $(chain_base $1)_masq
} }
#
# SNAT Chain for an interface
#
snat_chain() # $1 = interface
{
echo $(chain_base $1)_snat
}
# #
# MAC Verification Chain for an interface # MAC Verification Chain for an interface
# #
@ -1220,6 +1228,21 @@ disable_ipv6() {
fi fi
} }
disable_ipv6_1() {
local foo=$(ip -f inet6 addr ls 2> /dev/null)
if [ -n "$foo" ]; then
if qt which ip6tables; then
progress_message "Disabling IPV6..."
ip6tables -P FORWARD DROP
ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
else
error_message "WARNING: DISABLE_IPV6=Yes in shorewall.conf but this system does not appear to have ip6tables"
fi
fi
}
# #
# Stop the Firewall # Stop the Firewall
# #
@ -1271,7 +1294,7 @@ stop_firewall() {
delete_proxy_arp delete_proxy_arp
[ -n "$CLEAR_TC" ] && delete_tc1 [ -n "$CLEAR_TC" ] && delete_tc1
[ -n "$DISABLE_IPV6" ] && disable_ipv6 [ -n "$DISABLE_IPV6" ] && disable_ipv6_1
if [ -z "$ADMINISABSENTMINDED" ]; then if [ -z "$ADMINISABSENTMINDED" ]; then
for chain in INPUT OUTPUT FORWARD; do for chain in INPUT OUTPUT FORWARD; do
@ -2441,7 +2464,7 @@ refresh_tc() {
# Add one Filter Rule from an action -- Helper function for the action file processor # Add one Filter Rule from an action -- Helper function for the action file processor
# #
# The caller has established the following variables: # The caller has established the following variables:
# check = current command. If 'check', we're executing a 'check' # COMMAND = current command. If 'check', we're executing a 'check'
# which only goes through the motions. # which only goes through the motions.
# client = SOURCE IP or MAC # client = SOURCE IP or MAC
# server = DESTINATION IP or interface # server = DESTINATION IP or interface
@ -2884,6 +2907,13 @@ process_actions2() {
log_action() { log_action() {
[ "$COMMAND" != check ] && log_rule ${LOGNEWNOTSYN:-info} $1 $2 "" "" -p tcp ! --syn [ "$COMMAND" != check ] && log_rule ${LOGNEWNOTSYN:-info} $1 $2 "" "" -p tcp ! --syn
} }
drop_broadcasts() {
for address in $(find_broadcasts) 255.255.255.255 224.0.0.0/4 ; do
run_iptables -A dropBcast -d $address -j DROP
done
}
# #
# Generate the transitive closure of $USEDACTIONS # Generate the transitive closure of $USEDACTIONS
# #
@ -2909,14 +2939,16 @@ process_actions2() {
case $xaction in case $xaction in
dropBcast) dropBcast)
if [ "$COMMAND" != check ]; then if [ "$COMMAND" != check ]; then
qt iptables -A dropBcast -m pkttype --pkt-type broadcast -j DROP if [ -n "$PKTTYPE" ]; then
if ! qt iptables -A dropBcast -m pkttype --pkt-type multicast -j DROP; then qt iptables -A dropBcast -m pkttype --pkt-type broadcast -j DROP
# if ! qt iptables -A dropBcast -m pkttype --pkt-type multicast -j DROP; then
# No pkttype support -- do it the hard way #
# # No pkttype support -- do it the hard way
for address in $(find_broadcasts) 255.255.255.255 224.0.0.0/4 ; do #
run_iptables -A dropBcast -d $address -j DROP drop_broadcasts
done fi
else
drop_broadcasts
fi fi
fi fi
;; ;;
@ -2941,7 +2973,7 @@ process_actions2() {
log_action dLogNotSyn DROP log_action dLogNotSyn DROP
;; ;;
dropInvalid) dropInvalid)
[ "COMMAND" != check ] && run_iptables -A dropInvalid -m state --state INVALID -j DROP [ "$COMMAND" != check ] && run_iptables -A dropInvalid -m state --state INVALID -j DROP
;; ;;
*) *)
f=action.$xaction f=action.$xaction
@ -2960,7 +2992,7 @@ process_actions2() {
# Add a NAT rule - Helper function for the rules file processor # Add a NAT rule - Helper function for the rules file processor
# #
# The caller has established the following variables: # The caller has established the following variables:
# command = The current command -- if 'check', we just go through # COMMAND = The current command -- if 'check', we just go through
# the motions. # the motions.
# cli = Source IP, interface or MAC Specification # cli = Source IP, interface or MAC Specification
# serv = Destination IP Specification # serv = Destination IP Specification
@ -3148,7 +3180,7 @@ add_nat_rule() {
# Add one Filter Rule -- Helper function for the rules file processor # Add one Filter Rule -- Helper function for the rules file processor
# #
# The caller has established the following variables: # The caller has established the following variables:
# command = current command. If 'check', we're executing a 'check' # COMMAND = current command. If 'check', we're executing a 'check'
# which only goes through the motions. # which only goes through the motions.
# client = SOURCE IP or MAC # client = SOURCE IP or MAC
# server = DESTINATION IP or interface # server = DESTINATION IP or interface
@ -4166,6 +4198,7 @@ get_routed_networks() # $1 = interface name
ip route show dev $1 2> /dev/null | ip route show dev $1 2> /dev/null |
while read address rest; do while read address rest; do
if [ "x$address" = xdefault ]; then if [ "x$address" = xdefault ]; then
//*-+9
error_message "Warning: default route ignored on interface $1" error_message "Warning: default route ignored on interface $1"
else else
[ "$address" = "${address%/*}" ] && address="${address}/32" [ "$address" = "${address%/*}" ] && address="${address}/32"
@ -4180,14 +4213,31 @@ get_routed_networks() # $1 = interface name
setup_masq() setup_masq()
{ {
setup_one() { setup_one() {
local using local add_snat_aliases=$ADD_SNAT_ALIASES, pre_nat=
case $fullinterface in case $fullinterface in
+*)
pre_nat=Yes
fullinterface=${fullinterface#+}
;;
esac
case $fullinterface in
*::*)
add_snat_aliases=
destnets="${fullinterface##*:}"
fullinterface="${fullinterface%:*}"
;;
*:*:*) *:*:*)
# Both alias name and networks # Both alias name and networks
destnets="${fullinterface##*:}" destnets="${fullinterface##*:}"
fullinterface="${fullinterface%:*}" fullinterface="${fullinterface%:*}"
;; ;;
*:)
add_snat_aliases=
funninterface=${fullinterface%:}
destnets="0.0.0.0/0"
;;
*:*) *:*)
# Alias name OR networks # Alias name OR networks
case ${fullinterface#*:} in case ${fullinterface#*:} in
@ -4235,7 +4285,7 @@ setup_masq()
[ "x$addresses" = x- ] && addresses= [ "x$addresses" = x- ] && addresses=
if [ -n "$addresses" -a -n "$ADD_SNAT_ALIASES" ]; then if [ -n "$addresses" -a -n "$add_snat_aliases" ]; then
for address in $(separate_list $addresses); do for address in $(separate_list $addresses); do
for addr in $(ip_range_explicit $address) ; do for addr in $(ip_range_explicit $address) ; do
if ! list_search $addr $aliases_to_add; then if ! list_search $addr $aliases_to_add; then
@ -4297,7 +4347,7 @@ setup_masq()
destination=$destnets destination=$destnets
chain=$(masq_chain $interface) [ -z "$pre_nat" ] && chain=$(masq_chain $interface) || chain=$(snat_chain $interface)
case $destnets in case $destnets in
!*) !*)
@ -5324,6 +5374,12 @@ activate_rules()
rm -f $TMP_DIR/physdev rm -f $TMP_DIR/physdev
fi fi
} }
#
# Add early SNAT jumps
#
for interface in $all_interfaces; do
addrulejump POSTROUTING $(snat_chain $interface) -o $interface
done
# #
# Add jumps for dynamic nat chains # Add jumps for dynamic nat chains
@ -6032,6 +6088,7 @@ do_initialize() {
DISABLE_IPV6= DISABLE_IPV6=
BRIDGING= BRIDGING=
DYNAMIC_ZONES= DYNAMIC_ZONES=
PKTTYPE=
RESTOREBASE= RESTOREBASE=
TMP_DIR= TMP_DIR=
@ -6204,6 +6261,7 @@ do_initialize() {
DISABLE_IPV6=$(added_param_value_no DISABLE_IPV6 $DISABLE_IPV6) DISABLE_IPV6=$(added_param_value_no DISABLE_IPV6 $DISABLE_IPV6)
BRIDGING=$(added_param_value_no BRIDGING $BRIDGING) BRIDGING=$(added_param_value_no BRIDGING $BRIDGING)
DYNAMIC_ZONES=$(added_param_value_no DYNAMIC_ZONES $DYNAMIC_ZONES) DYNAMIC_ZONES=$(added_param_value_no DYNAMIC_ZONES $DYNAMIC_ZONES)
PKTTYPE=$(added_param_value_no PKTTYPE $PKTTYPE)
# #
# Strip the files that we use often # Strip the files that we use often

2
LrpN/usr/share/shorewall/version
View File

@ -1 +1 @@
2.1.0 2.1.1