holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Clean up MAC Verification Code

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@310 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2002-10-23 15:58:53 +00:00
parent d26c6a5e92
commit a997c16a42
1 changed files with 30 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
Shorewall/firewall
View File

@ -344,6 +344,16 @@ input_chain() # $1 = interface
echo `chain_base $1`_in echo `chain_base $1`_in
} }
################################################################################
# Input Chains (input and forward) for an interface #
################################################################################
input_chains() # $1 = interface
{
local base=`chain_base $1`
echo ${base}_in ${base}_fwd
}
################################################################################ ################################################################################
# Output Chain for an interface # # Output Chain for an interface #
################################################################################ ################################################################################
@ -360,6 +370,14 @@ masq_chain() # $1 = interface
echo `chain_base $1`_masq echo `chain_base $1`_masq
} }
################################################################################
# MAC Verification Chain for an interface #
################################################################################
mac_chain() # $1 = interface
{
echo `chain_base $1`_mac
}
################################################################################ ################################################################################
# DNAT Chain from a zone # # DNAT Chain from a zone #
################################################################################ ################################################################################
@ -1301,7 +1319,7 @@ setup_proxy_arp() {
} }
############################################################################### ###############################################################################
# Set up MAC List Chains # # Set up MAC Verification #
############################################################################### ###############################################################################
setup_mac_lists() { setup_mac_lists() {
local interface local interface
@ -1340,7 +1358,7 @@ setup_mac_lists() {
;; ;;
esac esac
createchain ${interface}_mac no createchain `mac_chain $interface` no
done done
# #
# Process the maclist file producing the verification rules # Process the maclist file producing the verification rules
@ -1350,7 +1368,7 @@ setup_mac_lists() {
while read interface mac address; do while read interface mac address; do
expandv interface mac address expandv interface mac address
chain=${interface}_mac chain=`mac_chain $interface`
if ! havechain $chain ; then if ! havechain $chain ; then
fatal_error "Error: No hosts on $interface have the maclist option specified" fatal_error "Error: No hosts on $interface have the maclist option specified"
@ -1358,7 +1376,7 @@ setup_mac_lists() {
[ -n "$address" ] && addr_match="-s $address" || addr_match= [ -n "$address" ] && addr_match="-s $address" || addr_match=
run_iptables -A ${interface}_mac `mac_match $mac` $addr_match -j RETURN run_iptables -A $chain `mac_match $mac` $addr_match -j RETURN
done < $TMP_DIR/maclist done < $TMP_DIR/maclist
# #
# Setup Logging variables # Setup Logging variables
@ -1373,7 +1391,7 @@ setup_mac_lists() {
# chains # chains
# #
for interface in $maclist_interfaces; do for interface in $maclist_interfaces; do
chain=${interface}_mac chain=`mac_chain $interface`
blob=`ip addr show $interface 2> /dev/null | grep inet | sed 's/inet //; s/brd //; s/scope.*//;'` blob=`ip addr show $interface 2> /dev/null | grep inet | sed 's/inet //; s/brd //; s/scope.*//;'`
[ -z "$blob" ] && \ [ -z "$blob" ] && \
@ -1406,16 +1424,13 @@ setup_mac_lists() {
# #
# Generate jumps from the input and forward chains # Generate jumps from the input and forward chains
# #
for blob in $maclist_hosts; do for hosts in $maclist_hosts; do
chain=${blob%:*}_mac interface=${hosts%:*}
hosts=${blob#*:} hosts=${hosts#*:}
# for chain in `input_chains $interface` ; do
# Evil reuse of 'blob' run_iptables -A $chain -s $hosts -m state --state NEW \
# -j `mac_chain $interface`
blob="-s $hosts -m state --state NEW -j $chain" done
run_iptables -A `input_chain $interface` $blob
run_iptables -A `forward_chain $interface` $blob
done done
} }