holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Eliminate ?begin perl ... ?end Perl in many actions

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2016-03-12 12:15:07 -08:00
parent 3960fa6e0e
commit bb7b3123df
9 changed files with 62 additions and 180 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
Shorewall/Perl/Shorewall/Config.pm
View File

@ -2506,10 +2506,10 @@ sub join_parts( $$$ ) {
}
#
# Evaluate an expression in an ?IF, ?ELSIF or ?SET directive
# Evaluate an expression in an ?IF, ?ELSIF, ?SET or ?ERROR directive
#
sub evaluate_expression( $$$ ) {
my ( $expression , $filename , $linenumber ) = @_;
sub evaluate_expression( $$$$ ) {
my ( $expression , $filename , $linenumber, $just_expand ) = @_;
my $val;
my $count = 0;
my $chain = $actparms{chain};
@ -2565,7 +2565,7 @@ sub evaluate_expression( $$$ ) {
print "EXPR=> $expression\n" if $debug;
if ( $expression =~ /^\d+$/ ) {
if ( $just_expand || $expression =~ /^\d+$/ ) {
$val = $expression
} else {
#
@ -2602,7 +2602,7 @@ sub process_compiler_directive( $$$$ ) {
print "CD===> $line\n" if $debug;
directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber ) unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*)(.*)$/i;
directive_error( "Invalid compiler directive ($line)" , $filename, $linenumber ) unless $line =~ /^\s*\?(IF\s+|ELSE|ELSIF\s+|ENDIF|SET\s+|RESET\s+|FORMAT\s+|COMMENT\s*|ERROR\s+)(.*)$/i;
my ($keyword, $expression) = ( uc $1, $2 );
@ -2620,7 +2620,7 @@ sub process_compiler_directive( $$$$ ) {
my %directives =
( IF => sub() {
directive_error( "Missing IF expression" , $filename, $linenumber ) unless supplied $expression;
my $nextomitting = $omitting || ! evaluate_expression( $expression , $filename, $linenumber );
my $nextomitting = $omitting || ! evaluate_expression( $expression , $filename, $linenumber , 0 );
push @ifstack, [ 'IF', $omitting, ! $nextomitting, $linenumber ];
$omitting = $nextomitting;
} ,
@ -2632,7 +2632,7 @@ sub process_compiler_directive( $$$$ ) {
#
# We can only change to including if we were previously omitting
#
$omitting = $prioromit || ! evaluate_expression( $expression , $filename, $linenumber );
$omitting = $prioromit || ! evaluate_expression( $expression , $filename, $linenumber, 0 );
$included = ! $omitting;
} else {
#
@ -2671,12 +2671,14 @@ sub process_compiler_directive( $$$$ ) {
directive_error( "Shorewall variables may only be SET in the body of an action", $filename, $linenumber ) unless $actparms{0};
my $val = $actparms{$var} = evaluate_expression ( $expression,
$filename,
$linenumber );
$linenumber,
0 );
$parmsmodified = PARMSMODIFIED;
} else {
$variables{$2} = evaluate_expression( $expression,
$filename,
$linenumber );
$linenumber,
0 );
}
}
} ,
@ -2736,8 +2738,16 @@ sub process_compiler_directive( $$$$ ) {
directive_error ( "?COMMENT is not allowed in this file", $filename, $linenumber );
}
}
}
} ,
ERROR => sub() {
directive_error( evaluate_expression( $expression ,
$filename ,
$linenumber ,
1 ) ,
$filename ,
$linenumber ) unless $omitting;
}
);
if ( my $function = $directives{$keyword} ) {
@ -3436,7 +3446,7 @@ sub read_a_line($) {
#
# Handle directives
#
if ( /^\s*\?(?:IF|ELSE|ELSIF|ENDIF|SET|RESET|FORMAT|COMMENT)/i ) {
if ( /^\s*\?(?:IF|ELSE|ELSIF|ENDIF|SET|RESET|FORMAT|COMMENT|ERROR)/i ) {
$omitting = process_compiler_directive( $omitting, $_, $currentfilename, $. );
next;
}

2
Shorewall/action.DNSAmp
View File

@ -30,4 +30,4 @@
DEFAULTS DROP
IPTABLES(@1) - - udp 53 ; -m u32 --u32 "0>>22&0x3C\@8&0xffff=0x0100 && 0>>22&0x3C\@12&0xffff0000=0x00010000"
@1 - - udp 53 ;; -m u32 --u32 "0>>22&0x3C\@8&0xffff=0x0100 && 0>>22&0x3C\@12&0xffff0000=0x00010000"

30
Shorewall/action.Drop
View File

@ -28,30 +28,16 @@
# IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
#
###############################################################################
#
# The following magic provides different defaults for @2 thru @5, when @1 is
# 'audit'.
#
?begin perl;
use Shorewall::Config;
my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
if ( defined $p1 ) {
if ( $p1 eq 'audit' ) {
set_action_param( 3, 'A_DROP') unless supplied $p3;
set_action_param( 4, 'A_ACCEPT' ) unless supplied $p4;
set_action_param( 5, 'A_DROP' ) unless supplied $p5;
} else {
fatal_error "Invalid value ($p1) for first Drop parameter" if supplied $p1;
}
}
1;
?end perl;
if @1 ne '' && @1 ne '-'
?if @1 eq 'audit'
DEFAULTS -,-,A_DROP,A_ACCEPT,A_DROP
?else
?error The first parameter to Drop must be 'audit' or '-'
?endif
?else
DEFAULTS -,-,DROP,ACCEPT,DROP
?endif
#TARGET SOURCE DEST PROTO DPORT SPORT
#

19
Shorewall/action.GlusterFS
View File

@ -11,20 +11,11 @@
DEFAULTS 2,0
?begin perl
use Shorewall::Config qw(:DEFAULT :internal);
use Shorewall::Chains;
use Shorewall::Rules;
use strict;
my ( $bricks, $ib ) = get_action_params( 2 );
fatal_error "Invalid value for Bricks ( $bricks )" unless $bricks =~ /^\d+$/ && $bricks > 1 && $bricks < 1024;
fatal_error "Invalid value for IB ( $ib )" unless $ib =~ /^[01]$/;
?end perl
?if @1 !~ /^\d+/ || ! @1 || @1 > 1024
?error Invalid value for Bricks (@1)
?elsif @2 !~ /^[01]$/
?error Invalid value for IB (@2)
?endif
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP

44
Shorewall/action.NotSyn
View File

@ -1,52 +1,14 @@
#
# Shorewall 4 - NotSyn Action
# Shorewall - NotSyn Action
#
# /usr/share/shorewall/action.NotSyn
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2011 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# NotSyn[([<action>])]
#
# Default action is DROP
#
##########################################################################################
DEFAULTS DROP,-
DEFAULTS DROP
?begin perl;
use strict;
use Shorewall::IPAddrs;
use Shorewall::Config;
use Shorewall::Chains;
use Shorewall::Rules;
my ( $action, $audit ) = get_action_params( 2 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action NotSyn" if $audit ne 'audit';
$action = "A_$action";
}
perl_action_tcp_helper( $action, '-p 6 ! --syn' );
1;
?end perl;
@1 - - tcp ;; ! --syn

40
Shorewall/action.RST
View File

@ -3,48 +3,12 @@
#
# /usr/share/shorewall/action.RST
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 2012 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# RST[([<action>])]
#
# Default action is DROP
#
##########################################################################################
DEFAULTS DROP,-
DEFAULTS DROP
?begin perl;
use Shorewall::Config;
use Shorewall::Chains;
use Shorewall::Rules;
my ( $action, $audit ) = get_action_params( 2 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action RST" if $audit ne 'audit';
$action = "A_$action";
}
perl_action_tcp_helper( $action, '-p 6 --tcp-flags RST RST' );
1;
?end perl;
@1 - - tcp ;; --tcp-flags RST RST

30
Shorewall/action.Reject
View File

@ -27,30 +27,16 @@
#
# IF YOU ARE HAVING CONNECTION PROBLEMS, CHANGING THIS FILE WON'T HELP!!!!!!!!!
###############################################################################
#
# The following magic provides different defaults for @2 thru @5, when @1 is
# 'audit'.
#
?begin perl;
use Shorewall::Config;
my ( $p1, $p2, $p3 , $p4, $p5 ) = get_action_params( 5 );
if ( defined $p1 ) {
if ( $p1 eq 'audit' ) {
set_action_param( 3, 'A_REJECT') unless supplied $p3;
set_action_param( 4, 'A_ACCEPT' ) unless supplied $p4;
set_action_param( 5, 'A_DROP' ) unless supplied $p5;
} else {
fatal_error "Invalid value ($p1) for first Reject parameter" if supplied $p1;
}
}
1;
?end perl;
?if @1 ne '' && @1 ne '-'
?if @1 eq 'audit'
DEFAULTS -,-,A_REJECT,A_ACCEPT,A_DROP
?else
?error The first parameter to Reject must be 'audit' or '-'
?endif
?else
DEFAULTS -,-,REJECT,ACCEPT,DROP
?endif
#TARGET SOURCE DEST PROTO
#

5
Shorewall/action.SetEvent
View File

@ -12,11 +12,6 @@
#
# For additional information, see http://www.shorewall.net/Events.html
#
#######################################################################################################
# DO NOT REMOVE THE FOLLOWING LINE
#################################################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
# PORT PORT(S) DEST LIMIT GROUP
DEFAULTS -,ACCEPT,src

40
Shorewall/action.TCPFlags
View File

@ -10,32 +10,20 @@
#
#################################################################################
DEFAULTS -
?begin perl;
use strict;
use Shorewall::Config qw(:DEFAULT F_IPV4 F_IPV6);
use Shorewall::Chains;
use Shorewall::Rules;
my $action = 'DROP';
my ( $audit ) = get_action_params( 1 );
if ( supplied $audit ) {
fatal_error "Invalid parameter ($audit) to action TCPFlags" if $audit ne 'audit';
$action = "A_DROP";
}
perl_action_tcp_helper( $action, '-p tcp --tcp-flags ALL FIN,URG,PSH' );
perl_action_tcp_helper( $action, '-p tcp --tcp-flags ALL NONE' );
perl_action_tcp_helper( $action, '-p tcp --tcp-flags SYN,RST SYN,RST' );
perl_action_tcp_helper( $action, '-p tcp --tcp-flags SYN,FIN SYN,FIN' );
perl_action_tcp_helper( $action, '-p tcp --syn --sport 0' );
?end perl;
?if @1 ne '-' && @1 ne ''
?if @1 eq 'audit'
DEFAULTS A_DROP
?else
?error "The first parameter to TCPFlags must be 'audit' or '-'
?endif
?else
DEFAULTS DROP
?endif
@1 - - tcp ;; --tcp-flags ALL FIN,URG,PSH
@1 - - tcp ;; --tcp-flags ALL NONE
@1 - - tcp ;; --tcp-flags SYN,RST SYN,RST
@1 - - tcp ;; --tcp-flags SYN,FIN SYN,FIN
@1 - - tcp ;; --syn --sport 0