holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

dash compatibility fixes; add 'ipsec' zone type

Browse Source 
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1549 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep 2004-08-17 18:00:22 +00:00
parent bac33d7c78
commit da3746e38f
4 changed files with 45 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
Shorewall2/firewall
View File

@ -611,9 +611,10 @@ verify_interface()
# #
match_ipsec_in() # $1 = zone, $2 = host match_ipsec_in() # $1 = zone, $2 = host
{ {
eval local is_ipsec=\$${1}_is_ipsec
eval local hosts=\"\$${1}_ipsec_hosts\" eval local hosts=\"\$${1}_ipsec_hosts\"
if list_search $2 $hosts; then if [ -n "$is_ipsec" ] || list_search $2 $hosts; then
echo "-m policy --pol ipsec --dir in" echo "-m policy --pol ipsec --dir in"
elif [ -n "$POLICY_MATCH" ]; then elif [ -n "$POLICY_MATCH" ]; then
echo "-m policy --pol none --dir in" echo "-m policy --pol none --dir in"
@ -625,9 +626,10 @@ match_ipsec_in() # $1 = zone, $2 = host
# #
match_ipsec_out() # $1 = zone, $2 = host match_ipsec_out() # $1 = zone, $2 = host
{ {
eval local is_ipsec=\$${1}_is_ipsec
eval local hosts=\"\$${1}_ipsec_hosts\" eval local hosts=\"\$${1}_ipsec_hosts\"
if list_search $2 $hosts; then if [ -n "$is_ipsec" ] || list_search $2 $hosts; then
echo "-m policy --pol ipsec --dir out" echo "-m policy --pol ipsec --dir out"
elif [ -n "$POLICY_MATCH" ]; then elif [ -n "$POLICY_MATCH" ]; then
echo "-m policy --pol none --dir out" echo "-m policy --pol none --dir out"
@ -1830,7 +1832,7 @@ setup_mac_lists() {
for hosts in $maclist_hosts; do for hosts in $maclist_hosts; do
ipsec=${hosts%^*} ipsec=${hosts%^*}
hosts=${hosts#*^} hosts=${hosts#*^}
[ -n $POLICY_MATCH ] && policy="-m policy --pol $ipsec --dir in" || policy= [ -n "$POLICY_MATCH" ] && policy="-m policy --pol $ipsec --dir in" || policy=
interface=${hosts%%:*} interface=${hosts%%:*}
hosts=${hosts#*:} hosts=${hosts#*:}
for chain in $(first_chains $interface) ; do for chain in $(first_chains $interface) ; do
@ -4876,7 +4878,7 @@ setup_blacklist() {
for host in $hosts; do for host in $hosts; do
ipsec=${host%^*} ipsec=${host%^*}
host=${host#*^} host=${host#*^}
[ -n $POLICY_MATCH ] && policy="-m policy --pol $ipsec --dir in" || policy= [ -n "$POLICY_MATCH" ] && policy="-m policy --pol $ipsec --dir in" || policy=
interface=${host%%:*} interface=${host%%:*}
network=${host#*:} network=${host#*:}
@ -5209,7 +5211,7 @@ initialize_netfilter () {
for host in $(find_hosts_by_option newnotsyn); do for host in $(find_hosts_by_option newnotsyn); do
ipsec=${host%^*} ipsec=${host%^*}
host=${host#*^} host=${host#*^}
[ -n $POLICY_MATCH ] && policy="-m policy --pol $ipsec --dir in" || policy= [ -n "$POLICY_MATCH" ] && policy="-m policy --pol $ipsec --dir in" || policy=
interface=${host%%:*} interface=${host%%:*}
network=${host#*:} network=${host#*:}
run_iptables -A newnotsyn -i $interface $(match_source_hosts $network) $policy -p tcp --tcp-flags ACK ACK -j ACCEPT run_iptables -A newnotsyn -i $interface $(match_source_hosts $network) $policy -p tcp --tcp-flags ACK ACK -j ACCEPT
@ -5340,7 +5342,7 @@ add_common_rules() {
for host in $hosts; do for host in $hosts; do
ipsec=${host%^*} ipsec=${host%^*}
host=${host#*^} host=${host#*^}
[ -n $POLICY_MATCH ] && policy="-m policy --pol $ipsec --dir in" || policy= [ -n "$POLICY_MATCH" ] && policy="-m policy --pol $ipsec --dir in" || policy=
interface=${host%%:*} interface=${host%%:*}
network=${host#*:} network=${host#*:}
@ -5440,7 +5442,7 @@ add_common_rules() {
for host in $hosts; do for host in $hosts; do
ipsec=${host%^*} ipsec=${host%^*}
host=${host#*^} host=${host#*^}
[ -n $POLICY_MATCH ] && policy="-m policy --pol $ipsec --dir in" || policy= [ -n "$POLICY_MATCH" ] && policy="-m policy --pol $ipsec --dir in" || policy=
interface=${host%%:*} interface=${host%%:*}
networks=${host#*:} networks=${host#*:}
@ -5489,7 +5491,7 @@ add_common_rules() {
for host in $hosts; do for host in $hosts; do
ipsec=${host%^*} ipsec=${host%^*}
host=${host#*^} host=${host#*^}
[ -n $POLICY_MATCH ] && policy="-m policy --pol $ipsec --dir in" || policy= [ -n "$POLICY_MATCH" ] && policy="-m policy --pol $ipsec --dir in" || policy=
interface=${host%%:*} interface=${host%%:*}
network=${host#*:} network=${host#*:}
@ -5546,7 +5548,7 @@ add_common_rules() {
for host in $hosts; do for host in $hosts; do
ipsec=${host%^*} ipsec=${host%^*}
host=${host#*^} host=${host#*^}
[ -n $POLICY_MATCH ] && policy="-m policy --pol $ipsec --dir in" || policy= [ -n "$POLICY_MATCH" ] && policy="-m policy --pol $ipsec --dir in" || policy=
interface=${host%%:*} interface=${host%%:*}
network=${host#*:} network=${host#*:}
@ -6077,7 +6079,7 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
{ {
local base interface host newhost zone z h z1 z2 chain terminator local base interface host newhost zone z h z1 z2 chain terminator
local dhcp_interfaces blacklist_interfaces maclist_interfaces tcpflags_interfaces local dhcp_interfaces blacklist_interfaces maclist_interfaces tcpflags_interfaces
local rulenum source_chain dest_hosts iface hosts local rulenum source_chain dest_hosts iface hosts is_ipsec policyin= policyout=
nat_chain_exists() # $1 = chain name nat_chain_exists() # $1 = chain name
{ {
@ -6114,7 +6116,17 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
validate_zone $zone || startup_error "Unknown zone: $zone" validate_zone $zone || startup_error "Unknown zone: $zone"
[ "$zone" = $FW ] && startup_error "Can't add $1 to firewall zone" [ "$zone" = $FW ] && startup_error "Can't add $1 to firewall zone"
eval is_ipsec=\$${zone}_is_ipsec
if [ -n "$is_ipsec" ]; then
[ -n "$POLICY_MATCH" ] || startup_error "Your kernel and/or iptables lacks policy match support"
policyin="-m policy --pol ipsec --dir in"
policyout="-m policy --pol ipsec --dir out"
elif [ -n "$POLICY_MATCH" ]; then
policyin="-m policy --pol none --dir in"
policyout="-m policy --pol none --dir out"
fi
# #
# Be sure that Shorewall has been restarted using a DZ-aware version of the code # Be sure that Shorewall has been restarted using a DZ-aware version of the code
# #
@ -6169,7 +6181,7 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
chain=${zone}_dnat chain=${zone}_dnat
if nat_chain_exists $chain; then if nat_chain_exists $chain; then
do_iptables -t nat -A $(dynamic_in $interface) -s $host -j $chain do_iptables -t nat -A $(dynamic_in $interface) -s $host $policyin -j $chain
fi fi
# #
# Insert new rules into the filter table for the passed interface # Insert new rules into the filter table for the passed interface
@ -6177,7 +6189,7 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
while read z1 z2 chain; do while read z1 z2 chain; do
if [ "$z1" = "$zone" ]; then if [ "$z1" = "$zone" ]; then
if [ "$z2" = "$FW" ]; then if [ "$z2" = "$FW" ]; then
do_iptables -A $(dynamic_in $interface) -s $host -j $chain do_iptables -A $(dynamic_in $interface) -s $host $policyin -j $chain
else else
source_chain=$(dynamic_fwd $interface) source_chain=$(dynamic_fwd $interface)
eval dest_hosts=\"\$${z2}_hosts\" eval dest_hosts=\"\$${z2}_hosts\"
@ -6187,7 +6199,7 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
hosts=${h#*:} hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
do_iptables -A $source_chain -s $host -o $iface $(match_dest_hosts $hosts) -j $chain do_iptables -A $source_chain -s $host -o $iface $(match_dest_hosts $hosts) $policyout -j $chain
fi fi
done done
fi fi
@ -6196,7 +6208,7 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
# #
# Add a rule to the dynamic out chain for the interface # Add a rule to the dynamic out chain for the interface
# #
do_iptables -A $(dynamic_out $interface) -d $host -j $chain do_iptables -A $(dynamic_out $interface) -d $host $policyout -j $chain
else else
eval source_hosts=\"\$${z1}_hosts\" eval source_hosts=\"\$${z1}_hosts\"
@ -6205,7 +6217,7 @@ add_to_zone() # $1 = <interface>[:<hosts>] $2 = zone
hosts=${h#*:} hosts=${h#*:}
if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then
do_iptables -A $(dynamic_fwd $iface) $rulenum $(match_source_hosts $hosts) -o $interface -d $host -j $chain do_iptables -A $(dynamic_fwd $iface) $rulenum $(match_source_hosts $hosts) -o $interface -d $host $policyout -j $chain
fi fi
done done
fi fi

12
Shorewall2/functions
View File

@ -266,12 +266,22 @@ determine_zones()
multi_display=Multi-zone multi_display=Multi-zone
strip_file zones $zonefile strip_file zones $zonefile
zones=$(find_zones $TMP_DIR/zones) zones=$(find_zones $TMP_DIR/zones)
zones=$(echo $zones) # Remove extra trash newzones=
for zone in $zones; do for zone in $zones; do
dsply=$(find_display $zone $TMP_DIR/zones) dsply=$(find_display $zone $TMP_DIR/zones)
case $zone in
*:ipsec)
zone=${zone%:*}
eval ${zone}_is_ipsec=Yes
;;
*)
esac
eval ${zone}_display=\$dsply eval ${zone}_display=\$dsply
newzones="$newzones $zone"
done done
zones=${newzones# }
} }
# #

4
Shorewall2/hosts
View File

@ -124,8 +124,8 @@
# This option has no effect if # This option has no effect if
# NEWNOTSYN=Yes. # NEWNOTSYN=Yes.
# #
# ipsec - The zone is accessed over a # ipsec - The zone is accessed via a
# kernel 2.6 ipsec tunnel # kernel 2.6 ipsec SA.
# #
#ZONE HOST(S) OPTIONS #ZONE HOST(S) OPTIONS
#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS LINE -- DO NOT REMOVE

6
Shorewall2/zones
View File

@ -3,7 +3,9 @@
# #
# This file determines your network zones. Columns are: # This file determines your network zones. Columns are:
# #
# ZONE Short name of the zone (5 Characters or less in length). # ZONE Short name of the zone (5 Characters or less in length).
# If all hosts in the zone are accessed using kernel 2.6
# ipsec SAs then follow the zone name with ":ipsec".
# DISPLAY Display name of the zone # DISPLAY Display name of the zone
# COMMENTS Comments about the zone # COMMENTS Comments about the zone
# #
@ -12,5 +14,5 @@
# #
# See http://www.shorewall.net/Documentation.htm#Nested # See http://www.shorewall.net/Documentation.htm#Nested
# #
#ZONE DISPLAY COMMENTS #ZONE DISPLAY COMMENTS
#LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE #LAST LINE - ADD YOUR ENTRIES ABOVE THIS ONE - DO NOT REMOVE