holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Shorewall 1.4.10f

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1420 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-06-28 18:49:16 +00:00
parent 62445a7b5a
commit ce7ce85d32
13 changed files with 1390 additions and 1592 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
Lrp/sbin/shorewall
View File

@ -109,7 +109,7 @@ showfirstchain() # $1 = name of chain
/^Chain/ {if ( prnt == 1 ) { rslt=0; exit 0; }; };\ /^Chain/ {if ( prnt == 1 ) { rslt=0; exit 0; }; };\
/Chain '$1'/ { prnt=1; }; \ /Chain '$1'/ { prnt=1; }; \
{ if (prnt == 1) print; };\ { if (prnt == 1) print; };\
END { exit rslt; }' /tmp/chains-$$ END { exit rslt; }' $TMPFILE
} }
showchain() # $1 = name of chain showchain() # $1 = name of chain
@ -124,7 +124,7 @@ showchain() # $1 = name of chain
/^$|^ pkts/ { next; };\ /^$|^ pkts/ { next; };\
/^Chain/ {if ( prnt == 1 ) exit; };\ /^Chain/ {if ( prnt == 1 ) exit; };\
/Chain '$1'/ { prnt=1; };\ /Chain '$1'/ { prnt=1; };\
{ if (prnt == 1) print; }' /tmp/chains-$$ { if (prnt == 1) print; }' $TMPFILE
fi fi
} }
@ -169,14 +169,18 @@ get_config() {
# #
display_chains() display_chains()
{ {
trap "rm -f /tmp/chains-$$; exit 1" 1 2 3 4 5 6 9 trap "rm -f $TMPFILE; exit 1" 1 2 3 4 5 6 9
if [ "$haveawk" = "Yes" ]; then if [ "$haveawk" = "Yes" ]; then
# #
# Send the output to a temporary file since ash craps if we try to store # Send the output to a temporary file since ash craps if we try to store
# the output in a variable. # the output in a variable.
# #
iptables -L -n -v > /tmp/chains-$$ TMPFILE=$(mktempfile)
[ -n "$TMPFILE" ] || { echo "Cannot create a temporary file" >&2; exit 2; }
iptables -L -n -v >> $TMPFILE
clear clear
echo "$banner `date`" echo "$banner `date`"
@ -197,7 +201,7 @@ display_chains()
echo "Input Chains" echo "Input Chains"
echo echo
chains=`grep '^Chain.*_[in|fwd]' /tmp/chains-$$ | cut -d' ' -f 2` chains=`grep '^Chain.*_[in|fwd]' $TMPFILE | cut -d' ' -f 2`
for chain in $chains; do for chain in $chains; do
showchain $chain showchain $chain
@ -207,7 +211,7 @@ display_chains()
for zone in $zones; do for zone in $zones; do
if [ -n "`grep "^Chain \.*${zone}" /tmp/chains-$$`" ] ; then if [ -n "`grep "^Chain \.*${zone}" $TMPFILE`" ] ; then
clear clear
echo "$banner `date`" echo "$banner `date`"
echo echo
@ -257,7 +261,7 @@ display_chains()
showchain dynamic showchain dynamic
timed_read timed_read
qt rm -f /tmp/chains-$$ qt rm -f $TMPFILE
else else
iptables -L -n -v iptables -L -n -v
timed_read timed_read
@ -373,8 +377,8 @@ monitor_firewall() # $1 = timeout -- if negative, prompt each time that
if qt which awk; then if qt which awk; then
TMP_DIR=/tmp/shorewall-$$ TMP_DIR=$(mktempdir)
mkdir $TMP_DIR [ -n "$TMP_DIR" ] || { echo "Unable to create a temporary directory" >&2; exit 2; }
haveawk=Yes haveawk=Yes
determine_zones determine_zones
rm -rf $TMP_DIR rm -rf $TMP_DIR
@ -897,7 +901,7 @@ case "$1" in
[ $# -ne 1 ] && usage 1 [ $# -ne 1 ] && usage 1
mutex_on mutex_on
if qt iptables -L shorewall -n; then if qt iptables -L shorewall -n; then
[ -d /var/lib/shorewall ] || mkdir /var/lib/shorewall [ -d /var/lib/shorewall ] || { mkdir /var/lib/shorewall; chmod 700 /var/lib/shorewall; }
if iptables -L dynamic -n > /var/lib/shorewall/save; then if iptables -L dynamic -n > /var/lib/shorewall/save; then
echo "Dynamic Rules Saved" echo "Dynamic Rules Saved"

2609
Lrp/usr/share/shorewall/firewall
View File

File diff suppressed because it is too large Load Diff

63
Lrp/usr/share/shorewall/functions
View File

@ -175,6 +175,69 @@ mutex_off()
rm -f $STATEDIR/lock rm -f $STATEDIR/lock
} }
#
# Determine which version of mktemp is present (if any) and set MKTEMP accortingly:
#
# None - No mktemp
# BSD - BSD mktemp (Mandrake)
# STD - mktemp.org mktemp
#
find_mktemp() {
local mktemp=`which mktemp 2> /dev/null`
if [ -n "$mktemp" ]; then
if qt mktemp -V ; then
MKTEMP=STD
else
MKTEMP=BSD
fi
else
MKTEMP=None
fi
}
#
# create a temporary file. If a directory name is passed, the file will be created in
# that directory. Otherwise, it will be created in a temporary directory.
#
mktempfile() {
[ -z "$MKTEMP" ] && find_mktemp
if [ $# -gt 0 ]; then
case "$MKTEMP" in
BSD)
mktemp $1/shorewall.XXXXXX
;;
STD)
mktemp -p $1 shorewall.XXXXXX
;;
None)
mkdir $1/shorewall-$$ && echo $1/shorewall-$$
;;
*)
echo " ERROR:Internal error in mktempfile"
;;
esac
else
case "$MKTEMP" in
BSD)
mktemp /tmp/shorewall.XXXXXX
;;
STD)
mktemp -t shorewall.XXXXXX
;;
None)
rm -f /tmp/shorewall-$$
> /tmp/shorewall-$$ && echo /tmp/shorewall-$$
;;
*)
echo " ERROR:Internal error in mktempfile"
;;
esac
fi
}
# #
# Read a file and handle "INCLUDE" directives # Read a file and handle "INCLUDE" directives
# #

2
Lrp/usr/share/shorewall/version
View File

@ -1 +1 @@
1.4.10a 1.4.10f

2
Lrp/var/lib/lrpkg/shorwall.version
View File

@ -1 +1 @@
1.4.10a 1.4.10f

2
STABLE/fallback.sh
View File

@ -28,7 +28,7 @@
# shown below. Simply run this script to revert to your prior version of # shown below. Simply run this script to revert to your prior version of
# Shoreline Firewall. # Shoreline Firewall.
VERSION=1.4.10e VERSION=1.4.10f
usage() # $1 = exit status usage() # $1 = exit status
{ {

14
STABLE/firewall
View File

@ -5568,13 +5568,6 @@ do_initialize() {
nonat_seq=1 nonat_seq=1
aliases_to_add= aliases_to_add=
TMP_DIR=/tmp/shorewall-$$
rm -rf $TMP_DIR
mkdir -p $TMP_DIR && chmod 700 $TMP_DIR || \
startup_error "Can't create $TMP_DIR"
trap "rm -rf $TMP_DIR; my_mutex_off; exit 2" 1 2 3 4 5 6 9
FUNCTIONS=$SHARED_DIR/functions FUNCTIONS=$SHARED_DIR/functions
if [ -f $FUNCTIONS ]; then if [ -f $FUNCTIONS ]; then
@ -5584,6 +5577,13 @@ do_initialize() {
startup_error "$FUNCTIONS does not exist!" startup_error "$FUNCTIONS does not exist!"
fi fi
TMP_DIR=$(mktempdir)
[ -n "$TMP_DIR" ] && chmod 700 $TMP_DIR || \
startup_error "Can't create a temporary directory"
trap "rm -rf $TMP_DIR; my_mutex_off; exit 2" 1 2 3 4 5 6 9
VERSION_FILE=$SHARED_DIR/version VERSION_FILE=$SHARED_DIR/version
[ -f $VERSION_FILE ] && version=`cat $VERSION_FILE` [ -f $VERSION_FILE ] && version=`cat $VERSION_FILE`

63
STABLE/functions
View File

@ -175,6 +175,69 @@ mutex_off()
rm -f $STATEDIR/lock rm -f $STATEDIR/lock
} }
#
# Determine which version of mktemp is present (if any) and set MKTEMP accortingly:
#
# None - No mktemp
# BSD - BSD mktemp (Mandrake)
# STD - mktemp.org mktemp
#
find_mktemp() {
local mktemp=`which mktemp 2> /dev/null`
if [ -n "$mktemp" ]; then
if qt mktemp -V ; then
MKTEMP=STD
else
MKTEMP=BSD
fi
else
MKTEMP=None
fi
}
#
# create a temporary file. If a directory name is passed, the file will be created in
# that directory. Otherwise, it will be created in a temporary directory.
#
mktempfile() {
[ -z "$MKTEMP" ] && find_mktemp
if [ $# -gt 0 ]; then
case "$MKTEMP" in
BSD)
mktemp $1/shorewall.XXXXXX
;;
STD)
mktemp -p $1 shorewall.XXXXXX
;;
None)
mkdir $1/shorewall-$$ && echo $1/shorewall-$$
;;
*)
echo " ERROR:Internal error in mktempfile"
;;
esac
else
case "$MKTEMP" in
BSD)
mktemp /tmp/shorewall.XXXXXX
;;
STD)
mktemp -t shorewall.XXXXXX
;;
None)
rm -f /tmp/shorewall-$$
> /tmp/shorewall-$$ && echo /tmp/shorewall-$$
;;
*)
echo " ERROR:Internal error in mktempfile"
;;
esac
fi
}
# #
# Read a file and handle "INCLUDE" directives # Read a file and handle "INCLUDE" directives
# #

2
STABLE/install.sh
View File

@ -54,7 +54,7 @@
# /etc/rc.d/rc.local file is modified to start the firewall. # /etc/rc.d/rc.local file is modified to start the firewall.
# #
VERSION=1.4.10e VERSION=1.4.10f
usage() # $1 = exit status usage() # $1 = exit status
{ {

24
STABLE/shorewall
View File

@ -109,7 +109,7 @@ showfirstchain() # $1 = name of chain
/^Chain/ {if ( prnt == 1 ) { rslt=0; exit 0; }; };\ /^Chain/ {if ( prnt == 1 ) { rslt=0; exit 0; }; };\
/Chain '$1'/ { prnt=1; }; \ /Chain '$1'/ { prnt=1; }; \
{ if (prnt == 1) print; };\ { if (prnt == 1) print; };\
END { exit rslt; }' /tmp/chains-$$ END { exit rslt; }' $TMPFILE
} }
showchain() # $1 = name of chain showchain() # $1 = name of chain
@ -124,7 +124,7 @@ showchain() # $1 = name of chain
/^$|^ pkts/ { next; };\ /^$|^ pkts/ { next; };\
/^Chain/ {if ( prnt == 1 ) exit; };\ /^Chain/ {if ( prnt == 1 ) exit; };\
/Chain '$1'/ { prnt=1; };\ /Chain '$1'/ { prnt=1; };\
{ if (prnt == 1) print; }' /tmp/chains-$$ { if (prnt == 1) print; }' $TMPFILE
fi fi
} }
@ -169,14 +169,18 @@ get_config() {
# #
display_chains() display_chains()
{ {
trap "rm -f /tmp/chains-$$; exit 1" 1 2 3 4 5 6 9 trap "rm -f $TMPFILE; exit 1" 1 2 3 4 5 6 9
if [ "$haveawk" = "Yes" ]; then if [ "$haveawk" = "Yes" ]; then
# #
# Send the output to a temporary file since ash craps if we try to store # Send the output to a temporary file since ash craps if we try to store
# the output in a variable. # the output in a variable.
# #
iptables -L -n -v > /tmp/chains-$$ TMPFILE=$(mktempfile)
[ -n "$TMPFILE" ] || { echo "Cannot create a temporary file" >&2; exit 2; }
iptables -L -n -v >> $TMPFILE
clear clear
echo "$banner `date`" echo "$banner `date`"
@ -197,7 +201,7 @@ display_chains()
echo "Input Chains" echo "Input Chains"
echo echo
chains=`grep '^Chain.*_[in|fwd]' /tmp/chains-$$ | cut -d' ' -f 2` chains=`grep '^Chain.*_[in|fwd]' $TMPFILE | cut -d' ' -f 2`
for chain in $chains; do for chain in $chains; do
showchain $chain showchain $chain
@ -207,7 +211,7 @@ display_chains()
for zone in $zones; do for zone in $zones; do
if [ -n "`grep "^Chain \.*${zone}" /tmp/chains-$$`" ] ; then if [ -n "`grep "^Chain \.*${zone}" $TMPFILE`" ] ; then
clear clear
echo "$banner `date`" echo "$banner `date`"
echo echo
@ -257,7 +261,7 @@ display_chains()
showchain dynamic showchain dynamic
timed_read timed_read
qt rm -f /tmp/chains-$$ qt rm -f $TMPFILE
else else
iptables -L -n -v iptables -L -n -v
timed_read timed_read
@ -373,8 +377,8 @@ monitor_firewall() # $1 = timeout -- if negative, prompt each time that
if qt which awk; then if qt which awk; then
TMP_DIR=/tmp/shorewall-$$ TMP_DIR=$(mktempdir)
mkdir $TMP_DIR [ -n "$TMP_DIR" ] || { echo "Unable to create a temporary directory" >&2; exit 2; }
haveawk=Yes haveawk=Yes
determine_zones determine_zones
rm -rf $TMP_DIR rm -rf $TMP_DIR
@ -897,7 +901,7 @@ case "$1" in
[ $# -ne 1 ] && usage 1 [ $# -ne 1 ] && usage 1
mutex_on mutex_on
if qt iptables -L shorewall -n; then if qt iptables -L shorewall -n; then
[ -d /var/lib/shorewall ] || mkdir /var/lib/shorewall [ -d /var/lib/shorewall ] || { mkdir /var/lib/shorewall; chmod 700 /var/lib/shorewall; }
if iptables -L dynamic -n > /var/lib/shorewall/save; then if iptables -L dynamic -n > /var/lib/shorewall/save; then
echo "Dynamic Rules Saved" echo "Dynamic Rules Saved"

4
STABLE/shorewall.spec
View File

@ -1,5 +1,5 @@
%define name shorewall %define name shorewall
%define version 1.4.10e %define version 1.4.10f
%define release 1 %define release 1
%define prefix /usr %define prefix /usr
@ -109,6 +109,8 @@ fi
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
%changelog %changelog
* Mon Jun 28 2004 Tom Eastep <tom@shorewall.net>
- Changed version to 1.4.10f-1
* Tue Apr 13 2004 Tom Eastep <tom@shorewall.net> * Tue Apr 13 2004 Tom Eastep <tom@shorewall.net>
- Changed version to 1.4.10e-1 - Changed version to 1.4.10e-1
* Tue Mar 16 2004 Tom Eastep <tom@shorewall.net> * Tue Mar 16 2004 Tom Eastep <tom@shorewall.net>

2
STABLE/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Seattle Firewall # shown below. Simply run this script to remove Seattle Firewall
VERSION=1.4.10e VERSION=1.4.10f
usage() # $1 = exit status usage() # $1 = exit status
{ {

15
Shorewall-docs/errata.xml
View File

@ -13,7 +13,7 @@
</author> </author>
</authorgroup> </authorgroup>
<pubdate>2004-04-16</pubdate> <pubdate>2004-06-28</pubdate>
<copyright> <copyright>
<year>2001-2004</year> <year>2001-2004</year>
@ -115,9 +115,15 @@ DNAT z1!z2,z3 z4:192.168.4.5 tcp 22</programlisting></para
<para>Thanks to Sean Mathews, a long-standing problem with Proxy ARP <para>Thanks to Sean Mathews, a long-standing problem with Proxy ARP
and IPSEC has been corrected.</para> and IPSEC has been corrected.</para>
</listitem> </listitem>
<listitem>
<para>A potentially exploitable vulnerability in the way that
Shorewall handles temporary files and directories has been found by
Javier Fernández-Sanguino Peña.</para>
</listitem>
</itemizedlist> </itemizedlist>
<para>These problems have been corrected in <ulink <para>The first seven problems have been corrected in <ulink
url="http://shorewall.net/pub/shorewall/errata/1.4.10/firewall">this url="http://shorewall.net/pub/shorewall/errata/1.4.10/firewall">this
firewall script</ulink> which may be installed in firewall script</ulink> which may be installed in
/usr/share/shorewall/firewall as described above.</para> /usr/share/shorewall/firewall as described above.</para>
@ -134,7 +140,10 @@ DNAT z1!z2,z3 z4:192.168.4.5 tcp 22</programlisting></para
<para>The first six problem corrections were included in Shorewall <para>The first six problem corrections were included in Shorewall
update 1.4.10d.</para> update 1.4.10d.</para>
<para>All problem corrections were included in Shorewall update 1.4.10e.</para> <para>The first seven problems corrections were included in Shorewall
update 1.4.10e;</para>
<para>All problem corrections were included in Shorewall update 1.4.10f.</para>
</section> </section>
<section> <section>