holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code

Browse Source
This commit is contained in:
Tuomo Soini 2016-02-10 16:03:40 +02:00
commit a27a39af0b
4 changed files with 24 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -623,9 +623,12 @@ our %ipset_exists;
# Omitted, if target is ''.
# target => Rule target, if jump is 'j' or 'g'.
# targetopts => Target options. Only included if non-empty
# matches => List of matches in the rule
# <option> => iptables/ip6tables -A options (e.g., i => eth0)
# <match> => iptables match. Value may be a scalar or array.
# if an array, multiple "-m <match>"s will be generated
# <origin> => configuration file and line number that generated the rule
# May be empty.
# }
#
# The following constants and hash are used to classify keys in a rule hash
@ -1251,6 +1254,8 @@ sub set_irule_comment( $$ ) {
our $rule_comments;
$ruleref->{origin} ||= $chainref->{origin};
if ( $rule_comments ) {
$ruleref->{comment} = $ruleref->{origin} || $comment;
} else {
@ -6347,7 +6352,7 @@ sub log_rule_limit( $$$$$$$$;$ ) {
$ruleref = insert_rule1 ( $chainref , 0 , $matches . $prefix );
}
$ruleref->{origin} = $origin if $origin;
$ruleref->{origin} = $origin if reftype( $ruleref ) && $origin;
$ruleref;
}

17
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -1028,7 +1028,7 @@ sub finish_chain_section ($$$) {
for ( qw( ESTABLISHED RELATED INVALID UNTRACKED ) ) {
if ( $state{$_} ) {
my ( $char, $level, $tag, $target ) = @{$statetable{$_}};
my ( $char, $level, $tag, $target , $origin, $level_origin ) = @{$statetable{$_}};
my $twochains = substr( $chainref->{name}, 0, 1 ) eq $char;
if ( $twochains || $level || $target ne 'ACCEPT' ) {
@ -1048,17 +1048,18 @@ sub finish_chain_section ($$$) {
$globals{LOGLIMIT},
$tag ,
'add' ,
'');
'',
$level_origin );
$target = ensure_audit_chain( $target ) if ( $targets{$target} || 0 ) & AUDIT;
add_ijump( $chain2ref, g => $target ) if $target;
add_ijump_extended( $chain2ref, g => $target , $origin ) if $target;
$target = $chain2ref->{name} unless $twochains;
}
if ( $twochains ) {
add_ijump $chainref, g => $target if $target;
add_ijump_extended $chainref, g => $target , $origin if $target;
delete $state{$_};
last;
}
@ -1073,7 +1074,7 @@ sub finish_chain_section ($$$) {
delete $state{ESTABLISHED};
}
add_ijump( $chainref, j => $target, state_imatch $_ );
add_ijump_extended( $chainref, j => $target, $origin, state_imatch $_ );
}
delete $state{$_};
@ -3454,9 +3455,9 @@ sub process_rules() {
# Populate the state table
#
%statetable = ( ESTABLISHED => [ '^', '', '', 'ACCEPT' ] ,
RELATED => [ '+', $config{RELATED_LOG_LEVEL}, $globals{RELATED_LOG_TAG}, $globals{RELATED_TARGET} ] ,
INVALID => [ '_', $config{INVALID_LOG_LEVEL}, $globals{INVALID_LOG_TAG}, $globals{INVALID_TARGET} ] ,
UNTRACKED => [ '&', $config{UNTRACKED_LOG_LEVEL}, $globals{UNTRACKED_LOG_TAG}, $globals{UNTRACKED_TARGET} ] ,
RELATED => [ '+', $config{RELATED_LOG_LEVEL}, $globals{RELATED_LOG_TAG}, $globals{RELATED_TARGET} , $origin{RELATED_DISPOSITION} , $origin{RELATED_LOG_LEVEL} ] ,
INVALID => [ '_', $config{INVALID_LOG_LEVEL}, $globals{INVALID_LOG_TAG}, $globals{INVALID_TARGET} , $origin{INVALID_DISPOSITION} , $origin{INVALID_LOG_LEVEL} ] ,
UNTRACKED => [ '&', $config{UNTRACKED_LOG_LEVEL}, $globals{UNTRACKED_LOG_TAG}, $globals{UNTRACKED_TARGET} , $origin{UNTRACKED_DISPOSITION} , $origin{UNTRACKED_LOG_LEVEL} ] ,
);
%section_states = ( BLACKLIST_SECTION , $globals{BLACKLIST_STATES},
ESTABLISHED_SECTION, 'ESTABLISHED',

10
docs/FAQ.xml
View File

@ -20,7 +20,7 @@
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
<copyright>
<year>2001-2014</year>
<year>2001-2016</year>
<holder>Thomas M. Eastep</holder>
</copyright>
@ -62,7 +62,9 @@
Shorewall 4.4.0 or later, you must install the <emphasis
role="bold">shorewall</emphasis> package. If you want to configure an
IPv6 firewall, you must also install <emphasis
role="bold">shorewall6</emphasis>.</para>
role="bold">shorewall6</emphasis>. Beginning with Shorewall 4.5, you
must first install the <emphasis role="bold">shorewall-core</emphasis>
package.</para>
<section id="faq92a">
<title>(FAQ 92a) Someone once told me to install shorewall-perl;
@ -123,7 +125,9 @@
<firstterm>shorewall-shell</firstterm> package was discontinued. The
<firstterm>shorewall-common</firstterm> and
<firstterm>shorewall-perl</firstterm> packages were combined to form a
single <firstterm>shorewall</firstterm> package.</para>
single <firstterm>shorewall</firstterm> package. In Shorewall 4.5, the
<firstterm>shorewall-core</firstterm> package was added and all of the
other packages depend on shorewall-core.</para>
</section>
</section>

2
docs/upgrade_issues.xml
View File

@ -35,6 +35,8 @@
<year>2013</year>
<year>2015</year>
<holder>Thomas M. Eastep</holder>
<holder/>