holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Replace 'subnet' with 'network' in the code

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1221 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-03-22 23:20:45 +00:00
parent c789d7ac7a
commit d95f629b62
3 changed files with 82 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall2/changelog.txt
View File

@ -19,3 +19,5 @@ Changes since 2.0.0
9) Improve zone-definition checking. 9) Improve zone-definition checking.
10) Add additional options to hosts file 10) Add additional options to hosts file
11) Replace 'subnet' with 'network' in the code

154
Shorewall2/firewall
View File

@ -564,20 +564,20 @@ determine_hosts() {
for interface in $interfaces; do for interface in $interfaces; do
if interface_has_option $interface detectnets; then if interface_has_option $interface detectnets; then
subnets=$(get_routed_subnets $interface) networks=$(get_routed_networks $interface)
else else
subnets=0.0.0.0/0 networks=0.0.0.0/0
fi fi
for subnet in $subnets; do for networks in $networks; do
if [ -z "$hosts" ]; then if [ -z "$hosts" ]; then
hosts=$interface:$subnet hosts=$interface:$networks
else else
hosts="$hosts $interface:$subnet" hosts="$hosts $interface:$networks"
fi fi
if list_search routeback $options; then if list_search routeback $options; then
eval ${zone}_routeback=\"$interface:$subnet \$${zone}_routeback\" eval ${zone}_routeback=\"$interface:$networks \$${zone}_routeback\"
fi fi
done done
done done
@ -634,11 +634,11 @@ validate_zone1() # $1 = zone
validate_interfaces_file() { validate_interfaces_file() {
local wildcard local wildcard
local found_obsolete_option= local found_obsolete_option=
local z interface subnet options r iface option local z interface networks options r iface option
while read z interface subnet options; do while read z interface networks options; do
expandv z interface subnet options expandv z interface networks options
r="$z $interface $subnet $options" r="$z $interface $networks $options"
[ "x$z" = "x-" ] && z= [ "x$z" = "x-" ] && z=
@ -664,7 +664,7 @@ validate_interfaces_file() {
options=$(separate_list $options) options=$(separate_list $options)
iface=$(chain_base $interface) iface=$(chain_base $interface)
eval ${iface}_broadcast="$subnet" eval ${iface}_broadcast="$networks"
eval ${iface}_zone="$z" eval ${iface}_zone="$z"
eval ${iface}_options=\"$options\" eval ${iface}_options=\"$options\"
@ -1209,13 +1209,13 @@ stop_firewall() {
for host in $hosts; do for host in $hosts; do
interface=${host%:*} interface=${host%:*}
subnet=${host#*:} networks=${host#*:}
iptables -A INPUT -i $interface -s $subnet -j ACCEPT iptables -A INPUT -i $interface -s $networks -j ACCEPT
[ -z "$ADMINISABSENTMINDED" ] && \ [ -z "$ADMINISABSENTMINDED" ] && \
iptables -A OUTPUT -o $interface -d $subnet -j ACCEPT iptables -A OUTPUT -o $interface -d $networks -j ACCEPT
for host1 in $hosts; do for host1 in $hosts; do
[ "$host" != "$host1" ] && iptables -A FORWARD -i $interface -s $subnet -o ${host1%:*} -d ${host1#*:} -j ACCEPT [ "$host" != "$host1" ] && iptables -A FORWARD -i $interface -s $networks -o ${host1%:*} -d ${host1#*:} -j ACCEPT
done done
done done
@ -3545,7 +3545,7 @@ process_tos_rule() {
[ -n "$src" ] && case "$src" in [ -n "$src" ] && case "$src" in
*.*.*) *.*.*)
# #
# IP Address or subnet # IP Address or networks
# #
src="-s $src" src="-s $src"
;; ;;
@ -3588,7 +3588,7 @@ process_tos_rule() {
[ -n "$dst" ] && case "$dst" in [ -n "$dst" ] && case "$dst" in
*.*.*) *.*.*)
# #
# IP Address or subnet # IP Address or networks
# #
;; ;;
*) *)
@ -3910,9 +3910,9 @@ rules_chain() # $1 = source zone, $2 = destination zone
} }
# #
# echo the list of subnets routed out of a given interface # echo the list of networks routed out of a given interface
# #
get_routed_subnets() # $1 = interface name get_routed_networks() # $1 = interface name
{ {
local address local address
local rest local rest
@ -3938,15 +3938,15 @@ setup_masq()
case $fullinterface in case $fullinterface in
*:*:*) *:*:*)
# Both alias name and subnet # Both alias name and networks
destnets="${fullinterface##*:}" destnets="${fullinterface##*:}"
fullinterface="${fullinterface%:*}" fullinterface="${fullinterface%:*}"
;; ;;
*:*) *:*)
# Alias name OR subnet # Alias name OR networks
case ${fullinterface#*:} in case ${fullinterface#*:} in
*.*) *.*)
# It's a subnet # It's a networks
destnets="${fullinterface#*:}" destnets="${fullinterface#*:}"
fullinterface="${fullinterface%:*}" fullinterface="${fullinterface%:*}"
;; ;;
@ -3967,23 +3967,23 @@ setup_masq()
fatal_error "Unknown interface $interface" fatal_error "Unknown interface $interface"
fi fi
if [ "$subnet" = "${subnet%!*}" ]; then if [ "$networks" = "${networks%!*}" ]; then
nomasq= nomasq=
else else
nomasq="${subnet#*!}" nomasq="${networks#*!}"
subnet="${subnet%!*}" networks="${networks%!*}"
fi fi
source="$subnet" source="$networks"
case $subnet in case $networks in
*.*.*) *.*.*)
;; ;;
*) *)
subnets=$(get_routed_subnets $subnet) networks=$(get_routed_networks $networks)
[ -z "$subnets" ] && fatal_error "Unable to determine the routes through interface $subnet" [ -z "$networks" ] && fatal_error "Unable to determine the routes through interface $networks"
subnet="$subnets" networks="$networks"
;; ;;
esac esac
@ -4016,11 +4016,11 @@ setup_masq()
addnatrule $newchain -d $destnet -j RETURN addnatrule $newchain -d $destnet -j RETURN
done done
if [ -n "$subnet" ]; then if [ -n "$networks" ]; then
for s in $subnet; do for s in $networks; do
addnatrule $chain -s $s -j $newchain addnatrule $chain -s $s -j $newchain
done done
subnet= networks=
else else
addnatrule $chain -j $newchain addnatrule $chain -j $newchain
fi fi
@ -4041,8 +4041,8 @@ setup_masq()
newchain=masq${masq_seq} newchain=masq${masq_seq}
createnatchain $newchain createnatchain $newchain
if [ -n "$subnet" ]; then if [ -n "$networks" ]; then
for s in $subnet; do for s in $networks; do
for destnet in $(separate_list $destnets); do for destnet in $(separate_list $destnets); do
addnatrule $chain -d $destnet -s $s -j $newchain addnatrule $chain -d $destnet -s $s -j $newchain
done done
@ -4055,7 +4055,7 @@ setup_masq()
masq_seq=$(($masq_seq + 1)) masq_seq=$(($masq_seq + 1))
chain=$newchain chain=$newchain
subnet= networks=
destnets=0.0.0.0/0 destnets=0.0.0.0/0
for addr in $(separate_list $nomasq); do for addr in $(separate_list $nomasq); do
@ -4074,8 +4074,8 @@ setup_masq()
done done
fi fi
if [ -n "$subnet" ]; then if [ -n "$networks" ]; then
for s in $subnet; do for s in $networks; do
if [ -n "$addresses" ]; then if [ -n "$addresses" ]; then
for destnet in $(separate_list $destnets); do for destnet in $(separate_list $destnets); do
addnatrule $chain -s $s -d $destnet -j SNAT $addrlist addnatrule $chain -s $s -d $destnet -j SNAT $addrlist
@ -4104,10 +4104,10 @@ setup_masq()
strip_file masq $1 strip_file masq $1
[ -n "$NAT_ENABLED" ] && echo "Masqueraded Subnets and Hosts:" [ -n "$NAT_ENABLED" ] && echo "Masqueraded Networks and Hosts:"
while read fullinterface subnet addresses; do while read fullinterface networks addresses; do
expandv fullinterface subnet addresses expandv fullinterface networks addresses
[ -n "$NAT_ENABLED" ] && setup_one || \ [ -n "$NAT_ENABLED" ] && setup_one || \
error_message "Warning: NAT disabled; masq rule ignored" error_message "Warning: NAT disabled; masq rule ignored"
done < $TMP_DIR/masq done < $TMP_DIR/masq
@ -4131,7 +4131,7 @@ add_blacklist_rule() {
# #
# Process a record from the blacklist file # Process a record from the blacklist file
# #
# $subnet = address/subnet # $networks = address/networks
# $protocol = Protocol Number/Name # $protocol = Protocol Number/Name
# $port = Port Number/Name # $port = Port Number/Name
# #
@ -4141,7 +4141,7 @@ process_blacklist_rec() {
local proto local proto
local dport local dport
for addr in $(separate_list $subnet); do for addr in $(separate_list $networks); do
case $addr in case $addr in
~*) ~*)
addr=$(echo $addr | sed 's/~//;s/-/:/g') addr=$(echo $addr | sed 's/~//;s/-/:/g')
@ -4235,8 +4235,8 @@ setup_blacklist() {
[ "$disposition" = REJECT ] && disposition=reject [ "$disposition" = REJECT ] && disposition=reject
while read subnet protocol ports; do while read networks protocol ports; do
expandv subnet protocol ports expandv networks protocol ports
process_blacklist_rec process_blacklist_rec
done < $TMP_DIR/blacklist done < $TMP_DIR/blacklist
@ -4259,8 +4259,8 @@ refresh_blacklist() {
run_iptables -F blacklst run_iptables -F blacklst
while read subnet protocol ports; do while read networks protocol ports; do
expandv subnet protocol ports expandv networks protocol ports
process_blacklist_rec process_blacklist_rec
done < $TMP_DIR/blacklist done < $TMP_DIR/blacklist
fi fi
@ -4299,14 +4299,14 @@ add_ip_aliases()
# decoration on these IP addresses that they see when their # decoration on these IP addresses that they see when their
# distro's net config tool adds them. In an attempt to reduce # distro's net config tool adds them. In an attempt to reduce
# the anxiety level, we have the following code which sets # the anxiety level, we have the following code which sets
# the VLSM and BRD from an existing address in the same subnet # the VLSM and BRD from an existing address in the same networks
# #
# Get all of the lines that contain inet addresses # Get all of the lines that contain inet addresses
# #
ip -f inet addr show $interface 2> /dev/null | grep 'inet' | while read inet cidr rest ; do ip -f inet addr show $interface 2> /dev/null | grep 'inet' | while read inet cidr rest ; do
case $cidr in case $cidr in
*/*) */*)
if in_subnet $external $cidr; then if in_networks $external $cidr; then
echo "/${cidr#*/} brd $(broadcastaddress $cidr)" echo "/${cidr#*/} brd $(broadcastaddress $cidr)"
break break
fi fi
@ -4618,7 +4618,7 @@ add_common_rules() {
for host in $hosts; do for host in $hosts; do
interface=${host%%:*} interface=${host%%:*}
subnet=${host#*:} network=${host#*:}
for chain in $(first_chains $interface); do for chain in $(first_chains $interface); do
run_iptables -A $chain -m state --state NEW $(match_source_hosts $network) -j smurfs run_iptables -A $chain -m state --state NEW $(match_source_hosts $network) -j smurfs
@ -4677,7 +4677,7 @@ add_common_rules() {
run_iptables -t mangle -A rfc1918 -j DROP run_iptables -t mangle -A rfc1918 -j DROP
fi fi
while read subnet target; do while read networks target; do
case $target in case $target in
logdrop) logdrop)
target=rfc1918 target=rfc1918
@ -4685,36 +4685,36 @@ add_common_rules() {
DROP|RETURN) DROP|RETURN)
;; ;;
*) *)
fatal_error "Invalid target ($target) for $subnet" fatal_error "Invalid target ($target) for $networks"
;; ;;
esac esac
run_iptables2 -A norfc1918 -s $subnet -j $target run_iptables2 -A norfc1918 -s $networks -j $target
if [ -n "$CONNTRACK_MATCH" ]; then if [ -n "$CONNTRACK_MATCH" ]; then
# #
# We have connection tracking match -- match on the original destination # We have connection tracking match -- match on the original destination
# #
run_iptables2 -A norfc1918 -m conntrack --ctorigdst $subnet -j $target run_iptables2 -A norfc1918 -m conntrack --ctorigdst $networks -j $target
elif [ -n "$MANGLE_ENABLED" ]; then elif [ -n "$MANGLE_ENABLED" ]; then
# #
# No connection tracking match but we have mangling -- add a rule to # No connection tracking match but we have mangling -- add a rule to
# the mangle table # the mangle table
# #
run_iptables2 -t mangle -A man1918 -d $subnet -j $target run_iptables2 -t mangle -A man1918 -d $networks -j $target
fi fi
done < $TMP_DIR/rfc1918 done < $TMP_DIR/rfc1918
for host in $hosts; do for host in $hosts; do
interface=${host%%:*} interface=${host%%:*}
subnet=${host#*:} networks=${host#*:}
for chain in $(first_chains $interface); do for chain in $(first_chains $interface); do
run_iptables -A $chain -m state --state NEW $(match_source_hosts $subnet) -j norfc1918 run_iptables -A $chain -m state --state NEW $(match_source_hosts $networks) -j norfc1918
done done
[ -n "$MANGLE_ENABLED" -a -z "$CONNTRACK_MATCH" ] && \ [ -n "$MANGLE_ENABLED" -a -z "$CONNTRACK_MATCH" ] && \
run_iptables -t mangle -A PREROUTING -m state --state NEW -i $interface $(match_source_hosts $subnet) -j man1918 run_iptables -t mangle -A PREROUTING -m state --state NEW -i $interface $(match_source_hosts $networks) -j man1918
done done
fi fi
# #
@ -4735,7 +4735,7 @@ add_common_rules() {
run_iptables -A bogons -j DROP run_iptables -A bogons -j DROP
while read subnet target; do while read networks target; do
case $target in case $target in
logdrop) logdrop)
target=bogons target=bogons
@ -4743,11 +4743,11 @@ add_common_rules() {
DROP|RETURN) DROP|RETURN)
;; ;;
*) *)
fatal_error "Invalid target ($target) for $subnet" fatal_error "Invalid target ($target) for $networks"
;; ;;
esac esac
run_iptables2 -A nobogons -s $subnet -j $target run_iptables2 -A nobogons -s $networks -j $target
done < $TMP_DIR/bogons done < $TMP_DIR/bogons
@ -5008,24 +5008,24 @@ activate_rules()
for host in $source_hosts; do for host in $source_hosts; do
interface=${host%%:*} interface=${host%%:*}
subnet=${host#*:} networks=${host#*:}
run_iptables -A OUTPUT -o $interface $(match_dest_hosts $subnet) -j $chain1 run_iptables -A OUTPUT -o $interface $(match_dest_hosts $networks) -j $chain1
# #
# Add jumps from the builtin chains for DNAT and SNAT rules # Add jumps from the builtin chains for DNAT and SNAT rules
# #
addrulejump PREROUTING $(dnat_chain $zone) -i $interface $(match_source_hosts $subnet) addrulejump PREROUTING $(dnat_chain $zone) -i $interface $(match_source_hosts $networks)
addrulejump POSTROUTING $(snat_chain $zone) -o $interface $(match_dest_hosts $subnet) addrulejump POSTROUTING $(snat_chain $zone) -o $interface $(match_dest_hosts $networks)
run_iptables -A $(input_chain $interface) $(match_source_hosts $subnet) -j $chain2 run_iptables -A $(input_chain $interface) $(match_source_hosts $networks) -j $chain2
[ -n "$complex" ] && \ [ -n "$complex" ] && \
run_iptables -A $(forward_chain $interface) $(match_source_hosts $subnet) -j $frwd_chain run_iptables -A $(forward_chain $interface) $(match_source_hosts $networks) -j $frwd_chain
case $subnet in case $networks in
*.*.*.*) *.*.*.*)
if [ "$subnet" != 0.0.0.0/0 ]; then if [ "$networks" != 0.0.0.0/0 ]; then
if ! list_search $interface $need_broadcast ; then if ! list_search $interface $need_broadcast ; then
interface_has_option $interface detectnets && need_broadcast="$need_broadcast $interface" interface_has_option $interface detectnets && need_broadcast="$need_broadcast $interface"
fi fi
@ -5068,25 +5068,25 @@ activate_rules()
if [ -n "$complex" ]; then if [ -n "$complex" ]; then
for host1 in $dest_hosts; do for host1 in $dest_hosts; do
interface1=${host1%%:*} interface1=${host1%%:*}
subnet1=${host1#*:} networks1=${host1#*:}
if [ $zone != $zone1 -o $num_ifaces -gt 1 ] || list_search $host1 $routeback ; then if [ $zone != $zone1 -o $num_ifaces -gt 1 ] || list_search $host1 $routeback ; then
run_iptables -A $frwd_chain -o $interface1 $(match_dest_hosts $subnet1) -j $chain run_iptables -A $frwd_chain -o $interface1 $(match_dest_hosts $networks1) -j $chain
fi fi
done done
else else
for host in $source_hosts; do for host in $source_hosts; do
interface=${host%%:*} interface=${host%%:*}
subnet=${host#*:} networks=${host#*:}
chain1=$(forward_chain $interface) chain1=$(forward_chain $interface)
for host1 in $dest_hosts; do for host1 in $dest_hosts; do
interface1=${host1%%:*} interface1=${host1%%:*}
subnet1=${host1#*:} networks1=${host1#*:}
if [ "$host" != "$host1" ] || list_search $host $routeback; then if [ "$host" != "$host1" ] || list_search $host $routeback; then
run_iptables -A $chain1 $(match_source_hosts $subnet) -o $interface1 $(match_dest_hosts $subnet1) -j $chain run_iptables -A $chain1 $(match_source_hosts $networks) -o $interface1 $(match_dest_hosts $networks1) -j $chain
fi fi
done done
done done
@ -5288,7 +5288,7 @@ refresh_firewall()
} }
# #
# Add a host or subnet to a zone # Add a host or networks to a zone
# #
add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
{ {
@ -5509,12 +5509,12 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
} }
# #
# Delete a host or subnet from a zone # Delete a host or networks from a zone
# #
delete_from_zone() # $1 = <interface>[:<hosts>] $2 = zone delete_from_zone() # $1 = <interface>[:<hosts>] $2 = zone
{ {
# #
# Delete the subnect host(s) from the zone state file # Delete the subject host(s) from the zone state file
# #
delete_from_zones_file() delete_from_zones_file()
{ {

6
Shorewall2/functions
View File

@ -470,9 +470,9 @@ broadcastaddress() {
} }
# #
# Test for subnet membership # Test for network membership
# #
in_subnet() # $1 = IP address, $2 = CIDR network in_network() # $1 = IP address, $2 = CIDR network
{ {
local netmask=$(ip_netmask $2) local netmask=$(ip_netmask $2)
@ -571,7 +571,7 @@ find_rt_interface() {
ip route ls | while read addr rest; do ip route ls | while read addr rest; do
case $addr in case $addr in
*/*) */*)
in_subnet ${1%/*} $addr && echo $(find_device $rest) in_network ${1%/*} $addr && echo $(find_device $rest)
;; ;;
default) default)
;; ;;