diff --git a/Shorewall/Perl/Shorewall/Chains.pm b/Shorewall/Perl/Shorewall/Chains.pm index 93badcd87..9a631d26b 100644 --- a/Shorewall/Perl/Shorewall/Chains.pm +++ b/Shorewall/Perl/Shorewall/Chains.pm @@ -66,6 +66,7 @@ our @EXPORT = qw( get_action_logging %chain_table + %helpers $raw_table $rawpost_table $nat_table @@ -281,6 +282,7 @@ our $rawpost_table; our $nat_table; our $mangle_table; our $filter_table; +our %helpers; my $comment; my @comments; my $export; @@ -554,7 +556,21 @@ sub initialize( $$$ ) { $hashlimitset = 0; $ipset_rules = 0 if $hard; - %ipset_exists = (); + %ipset_exists = (); + + %helpers = ( amanda => 1, + ftp => 1, + h323 => 1, + irc => 1, + netbios_ns => 1, + netlink => 1, + proto_gre => 1, + proto_sctp => 1, + pptp => 1, + proto_udplite => 1, + sane => 1, + sip => 1, + tftp => 1 ); # # The chain table is initialized via a call to initialize_chain_table() after the configuration and capabilities have been determined. # @@ -3986,6 +4002,8 @@ sub do_helper( $ ) { return '' if $helper eq '-'; + warning_message "Unrecognized helper ($helper)" unless $helpers{$helper}; + qq(-m helper --helper "$helper" ); } diff --git a/Shorewall/Perl/Shorewall/Config.pm b/Shorewall/Perl/Shorewall/Config.pm index eed51588f..5ca4092de 100644 --- a/Shorewall/Perl/Shorewall/Config.pm +++ b/Shorewall/Perl/Shorewall/Config.pm @@ -2769,7 +2769,7 @@ our %detect_capability = CONNMARK => \&Connmark, CONNMARK_MATCH => \&Connmark_Match, CONNTRACK_MATCH => \&Conntrack_Match, - CT_MATCH => \&Ct_Target, + CT_TARGET => \&Ct_Target, ENHANCED_REJECT => \&Enhanced_Reject, EXMARK => \&Exmark, FLOW_FILTER => \&Flow_Filter, diff --git a/Shorewall/Perl/Shorewall/Raw.pm b/Shorewall/Perl/Shorewall/Raw.pm index ce2d20729..a96381bdd 100644 --- a/Shorewall/Perl/Shorewall/Raw.pm +++ b/Shorewall/Perl/Shorewall/Raw.pm @@ -74,7 +74,11 @@ sub process_notrack_rule( $$$$$$$ ) { } else { fatal_error "Invalid or missing CT option and arguments" unless supplied $option && supplied $args; - if ( $option eq 'ctevents' ) { + if ( $option eq 'helper' ) { + fatal_error "Invalid helper' ($args)" if $args =~ /,/; + warning_message "Unrecognized helper ($args)" unless $helpers{$args}; + $action = "CT --helper $args"; + } elsif ( $option eq 'ctevents' ) { for ( split ',', $args ) { fatal_error "Invalid 'ctevents' event ($_)" unless $valid_ctevent{$_}; } @@ -85,7 +89,7 @@ sub process_notrack_rule( $$$$$$$ ) { } elsif ( $option eq 'zone' ) { fatal_error "Invalid zone id ($args)" unless $args =~ /^\d+$/; } else { - fatal_error "Invalid CT optio ($option)"; + fatal_error "Invalid CT option ($option)"; } } } diff --git a/Shorewall/helpers b/Shorewall/helpers index a44654fe3..598bdb60a 100644 --- a/Shorewall/helpers +++ b/Shorewall/helpers @@ -48,6 +48,7 @@ loadmodule nf_conntrack_netlink loadmodule nf_conntrack_pptp loadmodule nf_conntrack_proto_gre loadmodule nf_conntrack_proto_sctp +loadmodule nf_conntrack_proto_udplite loadmodule nf_conntrack_sip sip_direct_media=0 loadmodule nf_conntrack_tftp loadmodule nf_conntrack_sane