forked from extern/shorewall_code
Convert dropInvalid and allowInvalid to inline actions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
aa528dd075
commit
aae6e001fe
@ -252,9 +252,9 @@ sub initialize( $ ) {
|
||||
@columnstack = ();
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn dropInvalid allowInvalid allowinUPnP forwardUPnP Limit/;
|
||||
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn allowinUPnP forwardUPnP Limit/;
|
||||
} else {
|
||||
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn dropInvalid allowInvalid/;
|
||||
@builtins = qw/dropBcast allowBcast dropNotSyn rejNotSyn/;
|
||||
}
|
||||
}
|
||||
|
||||
@ -1520,28 +1520,6 @@ sub rejNotSyn ( $$$$ ) {
|
||||
add_ijump $chainref , j => $target, p => '6 ! --syn';
|
||||
}
|
||||
|
||||
sub dropInvalid ( $$$$ ) {
|
||||
my ($chainref, $level, $tag, $audit) = @_;
|
||||
|
||||
warning_message "dropInvalid is deprecated in favor of Invalid(DROP)";
|
||||
|
||||
my $target = require_audit( 'DROP', $audit );
|
||||
|
||||
log_rule_limit $level, $chainref, 'dropInvalid' , 'DROP', '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
|
||||
add_ijump $chainref , j => $target, state_imatch 'INVALID';
|
||||
}
|
||||
|
||||
sub allowInvalid ( $$$$ ) {
|
||||
my ($chainref, $level, $tag, $audit) = @_;
|
||||
|
||||
warning_message "allowInvalid is deprecated in favor of Invalid(ACCEPT)";
|
||||
|
||||
my $target = require_audit( 'ACCEPT', $audit );
|
||||
|
||||
log_rule_limit $level, $chainref, 'allowInvalid' , 'ACCEPT', '', $tag, 'add', "$globals{STATEMATCH} INVALID " if $level ne '';
|
||||
add_ijump $chainref , j => $target, state_imatch 'INVALID';
|
||||
}
|
||||
|
||||
sub forwardUPnP ( $$$$ ) {
|
||||
my $chainref = set_optflags( 'forwardUPnP', DONT_OPTIMIZE );
|
||||
|
||||
@ -1604,8 +1582,6 @@ my %builtinops = ( 'dropBcast' => \&dropBcast,
|
||||
'allowBcast' => \&allowBcast,
|
||||
'dropNotSyn' => \&dropNotSyn,
|
||||
'rejNotSyn' => \&rejNotSyn,
|
||||
'dropInvalid' => \&dropInvalid,
|
||||
'allowInvalid' => \&allowInvalid,
|
||||
'allowinUPnP' => \&allowinUPnP,
|
||||
'forwardUPnP' => \&forwardUPnP,
|
||||
'Limit' => \&Limit,
|
||||
|
||||
55
Shorewall/action.allowInvalid
Normal file
55
Shorewall/action.allowInvalid
Normal file
@ -0,0 +1,55 @@
|
||||
#
|
||||
# Shorewall 4 - allowInvalid Action
|
||||
#
|
||||
# /usr/share/shorewall/action.allowInvalid
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
|
||||
#
|
||||
# (c) 2011 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# allowInvalid[([audit])]
|
||||
#
|
||||
# Default action is DROP
|
||||
#
|
||||
##########################################################################################
|
||||
?FORMAT 2
|
||||
|
||||
DEFAULTS -
|
||||
|
||||
?BEGIN PERL;
|
||||
|
||||
use strict;
|
||||
use Shorewall::IPAddrs;
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
|
||||
my $action = 'ACCEPT';
|
||||
|
||||
my ( $audit ) = get_action_params( 1 );
|
||||
|
||||
if ( supplied $audit ) {
|
||||
fatal_error "Invalid parameter ($audit) to action allowInvalid" if $audit ne 'audit';
|
||||
$action = "A_ACCEPT";
|
||||
}
|
||||
|
||||
perl_action_tcp_helper( "Invalid($action)", '' );
|
||||
|
||||
1;
|
||||
|
||||
?END PERL;
|
||||
55
Shorewall/action.dropInvalid
Normal file
55
Shorewall/action.dropInvalid
Normal file
@ -0,0 +1,55 @@
|
||||
#
|
||||
# Shorewall 4 - dropInvalid Action
|
||||
#
|
||||
# /usr/share/shorewall/action.dropInvalid
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
|
||||
#
|
||||
# (c) 2011 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# dropInvalid[([audit])]
|
||||
#
|
||||
# Default action is DROP
|
||||
#
|
||||
##########################################################################################
|
||||
?FORMAT 2
|
||||
|
||||
DEFAULTS -
|
||||
|
||||
?BEGIN PERL;
|
||||
|
||||
use strict;
|
||||
use Shorewall::IPAddrs;
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
|
||||
my $action = 'DROP';
|
||||
|
||||
my ( $audit ) = get_action_params( 1 );
|
||||
|
||||
if ( supplied $audit ) {
|
||||
fatal_error "Invalid parameter ($audit) to action dropInvalid" if $audit ne 'audit';
|
||||
$action = "A_DROP";
|
||||
}
|
||||
|
||||
perl_action_tcp_helper( "Invalid($action)", '' );
|
||||
|
||||
1;
|
||||
|
||||
?END PERL;
|
||||
@ -15,19 +15,11 @@
|
||||
# dropBcast # Silently Drop Broadcast/multicast
|
||||
# dropNotSyn # Silently Drop Non-syn TCP packets
|
||||
# rejNotSyn # Silently Reject Non-syn TCP packets
|
||||
# dropInvalid # Silently Drop packets that are in the INVALID
|
||||
# # conntrack state.
|
||||
# allowInvalid # Accept packets that are in the INVALID
|
||||
# # conntrack state.
|
||||
# allowoutUPnP # Allow traffic from local command 'upnpd' (does not
|
||||
# # work with kernel 2.6.14 and later).
|
||||
# allowinUPnP # Allow UPnP inbound (to firewall) traffic
|
||||
# forwardUPnP # Allow traffic that upnpd has redirected from
|
||||
# # 'upnp' interfaces.
|
||||
# drop1918src # Drop packets with an RFC 1918 source address
|
||||
# drop1918dst # Drop packets with an RFC 1918 original dest address
|
||||
# rej1918src # Reject packets with an RFC 1918 source address
|
||||
# rej1918dst # Reject packets with an RFC 1918 original dest address
|
||||
# Limit # Limit the rate of connections from each individual
|
||||
# # IP address
|
||||
#
|
||||
@ -35,8 +27,10 @@
|
||||
#ACTION
|
||||
A_Drop # Audited Default Action for DROP policy
|
||||
A_Reject # Audited Default action for REJECT policy
|
||||
allowInvalid inline # Accepts packets in the INVALID conntrack state
|
||||
Broadcast noinline # Handles Broadcast/Multicast/Anycast
|
||||
Drop # Default Action for DROP policy
|
||||
dropInvalid inline # Drops packets in the INVALID conntrack state
|
||||
DropSmurfs noinline # Drop smurf packets
|
||||
Established inline # Handles packets in the ESTABLISHED state
|
||||
Invalid inline # Handles packets in the INVALID conntrack state
|
||||
|
||||
@ -12,10 +12,6 @@
|
||||
# dropBcasts # Silently Drop multicast and anycast packets
|
||||
# dropNotSyn # Silently Drop Non-syn TCP packets
|
||||
# rejNotSyn # Silently Reject Non-syn TCP packets
|
||||
# dropInvalid # Silently Drop packets that are in the INVALID
|
||||
# # conntrack state.
|
||||
# allowInvalid # Accept packets that are in the INVALID
|
||||
# # conntrack state.
|
||||
#
|
||||
###############################################################################
|
||||
#ACTION
|
||||
@ -23,8 +19,10 @@ A_Drop # Audited Default Action for DROP policy
|
||||
A_Reject # Audited Default Action for REJECT policy
|
||||
A_AllowICMPs # Audited Accept needed ICMP6 types
|
||||
AllowICMPs # Accept needed ICMP6 types
|
||||
allowInvalid inline # Accepts packets in the INVALID conntrack state
|
||||
Broadcast noinline # Handles Broadcast/Multicast/Anycast
|
||||
Drop # Default Action for DROP policy
|
||||
dropInvalid inline # Drops packets in the INVALID conntrack state
|
||||
DropSmurfs noinline # Handles packets with a broadcast source address
|
||||
Established inline # Handles packets in the ESTABLISHED state
|
||||
Invalid inline # Handles packets in the INVALID conntrack state
|
||||
|
||||
Loading…
Reference in New Issue
Block a user