holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Infrastructure for more powerful action handling

Browse Source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep 2013-01-27 12:37:10 -08:00
parent 1b94c3651d
commit cbbcfe355e
1 changed files with 48 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
Shorewall/Perl/Shorewall/Rules.pm
View File

@ -53,7 +53,7 @@ our @EXPORT = qw(
verify_audit verify_audit
); );
our @EXPORT_OK = qw( initialize ); our @EXPORT_OK = qw( initialize process_rule1 );
our $VERSION = 'MODULEVERSION'; our $VERSION = 'MODULEVERSION';
# #
# Globals are documented in the initialize() function # Globals are documented in the initialize() function
@ -608,7 +608,7 @@ sub process_policies()
# #
# Policy Rule application # Policy Rule application
# #
sub process_inline ($$$$$$$$$$$$$$$$$$$$); sub process_inline ($$$$$$$$$$$$$$$$$$$$$);
sub policy_rules( $$$$$ ) { sub policy_rules( $$$$$ ) {
my ( $chainref , $target, $loglevel, $default, $dropmulticast ) = @_; my ( $chainref , $target, $loglevel, $default, $dropmulticast ) = @_;
@ -627,6 +627,7 @@ sub policy_rules( $$$$$ ) {
process_inline( $action, #Inline process_inline( $action, #Inline
$chainref, #Chain $chainref, #Chain
'', #Matches
$loglevel, #Log Level and Tag $loglevel, #Log Level and Tag
$default, #Target $default, #Target
$param || '', #Param $param || '', #Param
@ -1635,7 +1636,7 @@ sub process_actions() {
} }
sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ); sub process_rule1 ( $$$$$$$$$$$$$$$$$$$ );
# #
# Populate an action invocation chain. As new action tuples are encountered, # Populate an action invocation chain. As new action tuples are encountered,
@ -1690,6 +1691,7 @@ sub process_action($$) {
} }
process_rule1( $chainref, process_rule1( $chainref,
'',
$nolog ? $target : merge_levels( join(':', @actparms{'chain','loglevel','logtag'}), $target ), $nolog ? $target : merge_levels( join(':', @actparms{'chain','loglevel','logtag'}), $target ),
'', '',
$source, $source,
@ -1744,8 +1746,8 @@ sub use_policy_action( $$ ) {
# #
# Expand a macro rule from the rules file # Expand a macro rule from the rules file
# #
sub process_macro ($$$$$$$$$$$$$$$$$$$) { sub process_macro ($$$$$$$$$$$$$$$$$$$$) {
my ($macro, $chainref, $target, $param, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $helper, $wildcard ) = @_; my ($macro, $chainref, $matches, $target, $param, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $helper, $wildcard ) = @_;
my $generated = 0; my $generated = 0;
@ -1833,6 +1835,7 @@ sub process_macro ($$$$$$$$$$$$$$$$$$$) {
$generated |= process_rule1( $generated |= process_rule1(
$chainref, $chainref,
$matches,
$mtarget, $mtarget,
$param, $param,
$msource, $msource,
@ -1865,8 +1868,8 @@ sub process_macro ($$$$$$$$$$$$$$$$$$$) {
# #
# Expand an inline action rule from the rules file # Expand an inline action rule from the rules file
# #
sub process_inline ($$$$$$$$$$$$$$$$$$$$) { sub process_inline ($$$$$$$$$$$$$$$$$$$$$) {
my ($inline, $chainref, $loglevel, $target, $param, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $helper, $wildcard ) = @_; my ($inline, $chainref, $matches, $loglevel, $target, $param, $source, $dest, $proto, $ports, $sports, $origdest, $rate, $user, $mark, $connlimit, $time, $headers, $condition, $helper, $wildcard ) = @_;
my $generated = 0; my $generated = 0;
@ -1950,6 +1953,7 @@ sub process_inline ($$$$$$$$$$$$$$$$$$$$) {
$generated |= process_rule1( $generated |= process_rule1(
$chainref, $chainref,
$matches,
$mtarget, $mtarget,
$param, $param,
$msource, $msource,
@ -2002,8 +2006,9 @@ sub verify_audit($;$$) {
# reference is also passed when rules are being generated during processing of a macro used as a default action. # reference is also passed when rules are being generated during processing of a macro used as a default action.
# #
sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) { sub process_rule1 ( $$$$$$$$$$$$$$$$$$$ ) {
my ( $chainref, #reference to Action Chain if we are being called from process_action(); undef otherwise my ( $chainref, #reference to Action Chain if we are being called from process_action(); undef otherwise
$rule, #Matches
$target, $target,
$current_param, $current_param,
$source, $source,
@ -2024,13 +2029,13 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
my ( $action, $loglevel) = split_action $target; my ( $action, $loglevel) = split_action $target;
my ( $basictarget, $param ) = get_target_param $action; my ( $basictarget, $param ) = get_target_param $action;
my $rule = '';
my $optimize = $wildcard ? ( $basictarget =~ /!$/ ? 0 : $config{OPTIMIZE} & 5 ) : 0; my $optimize = $wildcard ? ( $basictarget =~ /!$/ ? 0 : $config{OPTIMIZE} & 5 ) : 0;
my $inaction = ''; # Set to true when we are process rules in an action file my $inaction = ''; # Set to true when we are process rules in an action file
my $inchain = ''; # Set to true when a chain reference is passed. my $inchain = ''; # Set to true when a chain reference is passed.
my $normalized_target; my $normalized_target;
my $normalized_action; my $normalized_action;
my $blacklist = ( $section == BLACKLIST_SECTION ); my $blacklist = ( $section == BLACKLIST_SECTION );
my $matches = $rule;
if ( $inchain = defined $chainref ) { if ( $inchain = defined $chainref ) {
( $inaction, undef, undef, undef ) = split /:/, $normalized_action = $chainref->{action}, 4 if $chainref->{action}; ( $inaction, undef, undef, undef ) = split /:/, $normalized_action = $chainref->{action}, 4 if $chainref->{action};
@ -2059,6 +2064,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
my $generated = process_macro( $basictarget, my $generated = process_macro( $basictarget,
$chainref, $chainref,
$rule,
$target, $target,
$current_param, $current_param,
$source, $source,
@ -2405,6 +2411,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
my $generated = process_inline( $basictarget, my $generated = process_inline( $basictarget,
$chainref, $chainref,
$rule,
$loglevel, $loglevel,
$target, $target,
$current_param, $current_param,
@ -2436,38 +2443,38 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
# Either a DNAT, REDIRECT or ACCEPT+ rule or an Action with NAT; # Either a DNAT, REDIRECT or ACCEPT+ rule or an Action with NAT;
# don't apply rate limiting twice # don't apply rate limiting twice
# #
$rule = join( '', $rule .= join( '',
do_proto($proto, $ports, $sports), do_proto($proto, $ports, $sports),
do_user( $user ) , do_user( $user ) ,
do_test( $mark , $globals{TC_MASK} ) , do_test( $mark , $globals{TC_MASK} ) ,
do_connlimit( $connlimit ), do_connlimit( $connlimit ),
do_time( $time ) , do_time( $time ) ,
do_headers( $headers ) , do_headers( $headers ) ,
do_condition( $condition , $chain ) , do_condition( $condition , $chain ) ,
); );
} elsif ( $section & ( INVALID_SECTION | RELATED_SECTION | UNTRACKED_SECTION ) ) { } elsif ( $section & ( INVALID_SECTION | RELATED_SECTION | UNTRACKED_SECTION ) ) {
$rule = join( '', $rule .= join( '',
do_proto($proto, $ports, $sports), do_proto($proto, $ports, $sports),
do_ratelimit( $ratelimit, $basictarget ) , do_ratelimit( $ratelimit, $basictarget ) ,
do_user( $user ) , do_user( $user ) ,
do_test( $mark , $globals{TC_MASK} ) , do_test( $mark , $globals{TC_MASK} ) ,
do_connlimit( $connlimit ), do_connlimit( $connlimit ),
do_time( $time ) , do_time( $time ) ,
do_headers( $headers ) , do_headers( $headers ) ,
do_condition( $condition , $chain ) , do_condition( $condition , $chain ) ,
do_helper( $helper ) , do_helper( $helper ) ,
); );
} else { } else {
$rule = join( '', $rule .= join( '',
do_proto($proto, $ports, $sports), do_proto($proto, $ports, $sports),
do_ratelimit( $ratelimit, $basictarget ) , do_ratelimit( $ratelimit, $basictarget ) ,
do_user( $user ) , do_user( $user ) ,
do_test( $mark , $globals{TC_MASK} ) , do_test( $mark , $globals{TC_MASK} ) ,
do_connlimit( $connlimit ), do_connlimit( $connlimit ),
do_time( $time ) , do_time( $time ) ,
do_headers( $headers ) , do_headers( $headers ) ,
do_condition( $condition , $chain ) , do_condition( $condition , $chain ) ,
); );
} }
unless ( $section & ( NEW_SECTION | DEFAULTACTION_SECTION ) || unless ( $section & ( NEW_SECTION | DEFAULTACTION_SECTION ) ||
@ -2534,6 +2541,7 @@ sub process_rule1 ( $$$$$$$$$$$$$$$$$$ ) {
# #
unless ( $actiontype & NATONLY ) { unless ( $actiontype & NATONLY ) {
$rule = join( '', $rule = join( '',
$matches,
do_proto( $proto, $ports, $sports ), do_proto( $proto, $ports, $sports ),
do_ratelimit( $ratelimit, 'ACCEPT' ), do_ratelimit( $ratelimit, 'ACCEPT' ),
do_user $user, do_user $user,
@ -2745,6 +2753,7 @@ sub process_rule ( ) {
for my $proto ( @protos ) { for my $proto ( @protos ) {
for my $user ( @users ) { for my $user ( @users ) {
$generated |= process_rule1( undef, $generated |= process_rule1( undef,
'',
$target, $target,
'', '',
$source, $source,