holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Convert dropInvalid and allowInvalid to inline actions.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-02-07 11:21:13 -08:00
parent aa528dd075
commit aae6e001fe
5 changed files with 133 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -252,9 +252,9 @@ sub initialize( $ ) {
@columnstack = ();
if ( $family == F_IPV4 ) {
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn dropInvalid allowInvalid allowinUPnP forwardUPnP Limit/;
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn allowinUPnP forwardUPnP Limit/;
} else {
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn dropInvalid allowInvalid/;
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn/;
}
}
@ -1520,28 +1520,6 @@ sub rejNotSyn ( $$$$ ) {
add_ijump $chainref , j => $target, p => '6 ! --syn';
}
sub dropInvalid ( $$$$ ) {
my ($chainref, $level, $tag, $audit) = @_;
warning_message "dropInvalid is deprecated in favor of Invalid(DROP)";
my $target = require_audit( 'DROP', $audit );
log_rule_limit $level, $chainref, 'dropInvalid' , 'DROP', '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
add_ijump $chainref , j => $target, state_imatch 'INVALID';
}
sub allowInvalid ( $$$$ ) {
my ($chainref, $level, $tag, $audit) = @_;
warning_message "allowInvalid is deprecated in favor of Invalid(ACCEPT)";
my $target = require_audit( 'ACCEPT', $audit );
log_rule_limit $level, $chainref, 'allowInvalid' , 'ACCEPT', '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
add_ijump $chainref , j => $target, state_imatch 'INVALID';
}
sub forwardUPnP ( $$$$ ) {
my $chainref = set_optflags( 'forwardUPnP', DONT_OPTIMIZE );
@ -1604,8 +1582,6 @@ my %builtinops = ( 'dropBcast' => \&dropBcast,
'allowBcast' => \&allowBcast,
'dropNotSyn' => \&dropNotSyn,
'rejNotSyn' => \&rejNotSyn,
'dropInvalid' => \&dropInvalid,
'allowInvalid' => \&allowInvalid,
'allowinUPnP' => \&allowinUPnP,
'forwardUPnP' => \&forwardUPnP,
'Limit' => \&Limit,

55
Shorewall/action.allowInvalid Normal file
View File

@ -0,0 +1,55 @@
#
# Shorewall 4 - allowInvalid Action
#
# /usr/share/shorewall/action.allowInvalid
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2011 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# allowInvalid[([audit])]
#
# Default action is DROP
#
##########################################################################################
?FORMAT 2
DEFAULTS -
?BEGIN PERL;
use strict;
use Shorewall::IPAddrs;
use Shorewall::Config;
use Shorewall::Chains;
use Shorewall::Rules;
my $action = 'ACCEPT';
my ( $audit ) = get_action_params( 1 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action allowInvalid" if $audit ne 'audit';
$action = "A_ACCEPT";
}
perl_action_tcp_helper( "Invalid($action)", '' );
1;
?END PERL;

55
Shorewall/action.dropInvalid Normal file
View File

@ -0,0 +1,55 @@
#
# Shorewall 4 - dropInvalid Action
#
# /usr/share/shorewall/action.dropInvalid
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2011 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# dropInvalid[([audit])]
#
# Default action is DROP
#
##########################################################################################
?FORMAT 2
DEFAULTS -
?BEGIN PERL;
use strict;
use Shorewall::IPAddrs;
use Shorewall::Config;
use Shorewall::Chains;
use Shorewall::Rules;
my $action = 'DROP';
my ( $audit ) = get_action_params( 1 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action dropInvalid" if $audit ne 'audit';
$action = "A_DROP";
}
perl_action_tcp_helper( "Invalid($action)", '' );
1;
?END PERL;

26
Shorewall/actions.std
View File

@ -15,19 +15,11 @@
# dropBcast # Silently Drop Broadcast/multicast
# dropNotSyn # Silently Drop Non-syn TCP packets
# rejNotSyn # Silently Reject Non-syn TCP packets
# dropInvalid # Silently Drop packets that are in the INVALID
# # conntrack state.
# allowInvalid # Accept packets that are in the INVALID
# # conntrack state.
# allowoutUPnP # Allow traffic from local command 'upnpd' (does not
# # work with kernel 2.6.14 and later).
# allowinUPnP # Allow UPnP inbound (to firewall) traffic
# forwardUPnP # Allow traffic that upnpd has redirected from
# # 'upnp' interfaces.
# drop1918src # Drop packets with an RFC 1918 source address
# drop1918dst # Drop packets with an RFC 1918 original dest address
# rej1918src # Reject packets with an RFC 1918 source address
# rej1918dst # Reject packets with an RFC 1918 original dest address
# Limit # Limit the rate of connections from each individual
# # IP address
#
@ -35,15 +27,17 @@
#ACTION
A_Drop # Audited Default Action for DROP policy
A_Reject # Audited Default action for REJECT policy
Broadcast noinline # Handles Broadcast/Multicast/Anycast
allowInvalid inline # Accepts packets in the INVALID conntrack state
Broadcast noinline # Handles Broadcast/Multicast/Anycast
Drop # Default Action for DROP policy
DropSmurfs noinline # Drop smurf packets
Established inline # Handles packets in the ESTABLISHED state
Invalid inline # Handles packets in the INVALID conntrack state
New inline # Handles packets in the NEW conntrack state
NotSyn inline # Handles TCP packets which do not have SYN=1 and ACK=0
dropInvalid inline # Drops packets in the INVALID conntrack state
DropSmurfs noinline # Drop smurf packets
Established inline # Handles packets in the ESTABLISHED state
Invalid inline # Handles packets in the INVALID conntrack state
New inline # Handles packets in the NEW conntrack state
NotSyn inline # Handles TCP packets which do not have SYN=1 and ACK=0
Reject # Default Action for REJECT policy
Related inline # Handles packets in the RELATED conntrack state
RST inline # Handle packets with RST set
Related inline # Handles packets in the RELATED conntrack state
RST inline # Handle packets with RST set
TCPFlags # Handle bad flag combinations.
Untracked inline # Handles packets in the UNTRACKED conntrack state

24
Shorewall6/actions.std
View File

@ -12,10 +12,6 @@
# dropBcasts # Silently Drop multicast and anycast packets
# dropNotSyn # Silently Drop Non-syn TCP packets
# rejNotSyn # Silently Reject Non-syn TCP packets
# dropInvalid # Silently Drop packets that are in the INVALID
# # conntrack state.
# allowInvalid # Accept packets that are in the INVALID
# # conntrack state.
#
###############################################################################
#ACTION
@ -23,15 +19,17 @@ A_Drop # Audited Default Action for DROP policy
A_Reject # Audited Default Action for REJECT policy
A_AllowICMPs # Audited Accept needed ICMP6 types
AllowICMPs # Accept needed ICMP6 types
Broadcast noinline # Handles Broadcast/Multicast/Anycast
allowInvalid inline # Accepts packets in the INVALID conntrack state
Broadcast noinline # Handles Broadcast/Multicast/Anycast
Drop # Default Action for DROP policy
DropSmurfs noinline # Handles packets with a broadcast source address
Established inline # Handles packets in the ESTABLISHED state
Invalid inline # Handles packets in the INVALID conntrack state
New inline # Handles packets in the NEW conntrack state
NotSyn inline # Handles TCP packets that do not have SYN=1 and ACK=0
dropInvalid inline # Drops packets in the INVALID conntrack state
DropSmurfs noinline # Handles packets with a broadcast source address
Established inline # Handles packets in the ESTABLISHED state
Invalid inline # Handles packets in the INVALID conntrack state
New inline # Handles packets in the NEW conntrack state
NotSyn inline # Handles TCP packets that do not have SYN=1 and ACK=0
Reject # Default Action for REJECT policy
Related inline # Handles packets in the RELATED conntrack state
RST inline # Handle packets with RST set
Related inline # Handles packets in the RELATED conntrack state
RST inline # Handle packets with RST set
TCPFlags # Handles bad flags combinations
Untracked inline # Handles packets in the UNTRACKED conntrack state
Untracked inline # Handles packets in the UNTRACKED conntrack state