holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Add an ALL section to the rules files.

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2011-08-15 15:32:24 -07:00
parent d5290fc881
commit bc706324e9
14 changed files with 63 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Samples/Universal/rules
View File

@ -9,6 +9,7 @@
#################################################################################################################################################### ####################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED #SECTION ESTABLISHED
#SECTION RELATED #SECTION RELATED
SECTION NEW SECTION NEW

4
Samples/one-interface/rules
View File

@ -13,6 +13,10 @@
############################################################################################################# #############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded.. # Drop Ping from the "bad" net zone.. and prevent your log from being flooded..

5
Samples/three-interfaces/rules
View File

@ -13,6 +13,11 @@
############################################################################################################# #############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #
Invalid(DROP) net all Invalid(DROP) net all

5
Samples/two-interfaces/rules
View File

@ -13,6 +13,11 @@
############################################################################################################# #############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #
Invalid(DROP) net all Invalid(DROP) net all

1
Samples6/Universal/rules
View File

@ -9,6 +9,7 @@
#################################################################################################################################################### ####################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED #SECTION ESTABLISHED
#SECTION RELATED #SECTION RELATED
SECTION NEW SECTION NEW

4
Samples6/one-interface/rules
View File

@ -13,6 +13,10 @@
############################################################################################################# #############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
# Drop Ping from the "bad" net zone.. and prevent your log from being flooded.. # Drop Ping from the "bad" net zone.. and prevent your log from being flooded..

5
Samples6/three-interfaces/rules
View File

@ -13,6 +13,11 @@
############################################################################################################# #############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #
Invalid(DROP) net all Invalid(DROP) net all

5
Samples6/two-interfaces/rules
View File

@ -13,6 +13,11 @@
############################################################################################################# #############################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED
#SECTION RELATED
SECTION NEW
# Don't allow connection pickup from the net # Don't allow connection pickup from the net
# #
Invalid(DROP) net all Invalid(DROP) net all

4
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -2929,7 +2929,9 @@ sub port_count( $ ) {
sub state_imatch( $ ) { sub state_imatch( $ ) {
my $state = shift; my $state = shift;
have_capability 'CONNTRACK_MATCH' ? ( conntrack => "--ctstate $state" ) : ( state => "--state $state" ); unless ( $state eq 'ALL' ) {
have_capability 'CONNTRACK_MATCH' ? ( conntrack => "--ctstate $state" ) : ( state => "--state $state" );
}
} }
# #

13
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -130,7 +130,8 @@ sub initialize( $ ) {
# #
# These are set to 1 as sections are encountered. # These are set to 1 as sections are encountered.
# #
%sections = ( ESTABLISHED => 0, %sections = ( ALL => 0,
ESTABLISHED => 0,
RELATED => 0, RELATED => 0,
NEW => 0 NEW => 0
); );
@ -1940,7 +1941,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$ ) {
unless ( $section eq 'NEW' || $inaction ) { unless ( $section eq 'NEW' || $inaction ) {
fatal_error "Entries in the $section SECTION of the rules file not permitted with FASTACCEPT=Yes" if $config{FASTACCEPT}; fatal_error "Entries in the $section SECTION of the rules file not permitted with FASTACCEPT=Yes" if $config{FASTACCEPT};
fatal_error "$basictarget rules are not allowed in the $section SECTION" if $actiontype & ( NATRULE | NONAT ); fatal_error "$basictarget rules are not allowed in the $section SECTION" if $actiontype & ( NATRULE | NONAT );
$rule .= "$globals{STATEMATCH} $section " $rule .= "$globals{STATEMATCH} $section " unless $section eq 'ALL';
} }
# #
@ -2230,11 +2231,13 @@ sub process_section ($) {
fatal_error "Duplicate or out of order SECTION $sect" if $sections{$sect}; fatal_error "Duplicate or out of order SECTION $sect" if $sections{$sect};
$sections{$sect} = 1; $sections{$sect} = 1;
if ( $sect eq 'RELATED' ) { if ( $sect eq 'ESTABLISHED' ) {
$sections{ESTABLISHED} = 1; $sections{ALL} = 1;
elsif ( $sect eq 'RELATED' ) {
@sections{'ALL','ESTABLISHED'} = ( 1, 1);
finish_section 'ESTABLISHED'; finish_section 'ESTABLISHED';
} elsif ( $sect eq 'NEW' ) { } elsif ( $sect eq 'NEW' ) {
@sections{'ESTABLISHED','RELATED'} = ( 1, 1 ); @sections{'ALL','ESTABLISHED','RELATED'} = ( 1, 1, 1 );
finish_section ( ( $section eq 'RELATED' ) ? 'RELATED' : 'ESTABLISHED,RELATED' ); finish_section ( ( $section eq 'RELATED' ) ? 'RELATED' : 'ESTABLISHED,RELATED' );
} }

1
Shorewall/configfiles/rules
View File

@ -9,6 +9,7 @@
#################################################################################################################################################################### ####################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED #SECTION ESTABLISHED
#SECTION RELATED #SECTION RELATED
SECTION NEW SECTION NEW

1
Shorewall6/configfiles/rules
View File

@ -9,6 +9,7 @@
####################################################################################################################################################################### #######################################################################################################################################################################
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS #ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS
# PORT PORT(S) DEST LIMIT GROUP # PORT PORT(S) DEST LIMIT GROUP
#SECTION ALL
#SECTION ESTABLISHED #SECTION ESTABLISHED
#SECTION RELATED #SECTION RELATED
SECTION NEW SECTION NEW

10
manpages/shorewall-rules.xml
View File

@ -46,6 +46,16 @@
<para>Sections are as follows and must appear in the order listed:</para> <para>Sections are as follows and must appear in the order listed:</para>
<variablelist> <variablelist>
<varlistentry>
<term><emphasis role="bold">ALL</emphasis></term>
<listitem>
<para>This section was added in Shorewall 4.4.23. rules in this
section are applied, regardless of the connection tracking state of
the packet.</para>
</listitem>
</varlistentry>
<varlistentry> <varlistentry>
<term><emphasis role="bold">ESTABLISHED</emphasis></term> <term><emphasis role="bold">ESTABLISHED</emphasis></term>

10
manpages6/shorewall6-rules.xml
View File

@ -39,6 +39,16 @@
<para>Sections are as follows and must appear in the order listed:</para> <para>Sections are as follows and must appear in the order listed:</para>
<variablelist> <variablelist>
<varlistentry>
<term><emphasis role="bold">ALL</emphasis></term>
<listitem>
<para>This section was added in Shorewall 4.4.23. rules in this
section are applied, regardless of the connection tracking state of
the packet.</para>
</listitem>
</varlistentry>
<varlistentry> <varlistentry>
<term><emphasis role="bold">ESTABLISHED</emphasis></term> <term><emphasis role="bold">ESTABLISHED</emphasis></term>