forked from extern/shorewall_code
Add 'dbl' interface option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
56b6db1a3d
commit
e71fb3249a
@ -6185,8 +6185,10 @@ sub get_configuration( $$$$ ) {
|
||||
require_capability( 'IPSET_V5', 'DYNAMIC_BLACKLIST=ipset...', 's' );
|
||||
|
||||
} else {
|
||||
default_yes_no( 'DYNAMIC_BLACKLIST' , 'Yes' );
|
||||
default_yes_no( 'DYNAMIC_BLACKLIST', 'Yes' );
|
||||
}
|
||||
} else {
|
||||
default_yes_no( 'DYNAMIC_BLACKLIST', 'Yes' );
|
||||
}
|
||||
|
||||
default_yes_no 'REQUIRE_INTERFACE' , '';
|
||||
|
||||
@ -866,15 +866,30 @@ sub add_common_rules ( $ ) {
|
||||
}
|
||||
}
|
||||
|
||||
if ( $dbl_ipset && ! get_interface_option( $interface, 'nodbl' ) ) {
|
||||
add_ijump_extended( $filter_table->{input_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset src" );
|
||||
add_ijump_extended( $filter_table->{output_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset dst" ) if $dbl_type =~ /,src-dst$/;
|
||||
add_ijump_extended( $filter_table->{forward_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset src" );
|
||||
add_ijump_extended( $filter_table->{forward_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset dst" ) if $dbl_type =~ /,src-dst$/;
|
||||
if ( $dbl_ipset && ( ( my $setting = get_interface_option( $interface, 'dbl' ) ) ne '0:0' ) ) {
|
||||
|
||||
my ( $in, $out ) = split /:/, $setting;
|
||||
|
||||
if ( $in == 1 ) {
|
||||
#
|
||||
# src
|
||||
#
|
||||
add_ijump_extended( $filter_table->{input_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset src" );
|
||||
add_ijump_extended( $filter_table->{forward_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset src" );
|
||||
} elsif ( $in == 2 ) {
|
||||
add_ijump_extended( $filter_table->{forward_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset dst" );
|
||||
}
|
||||
|
||||
if ( $out == 2 ) {
|
||||
#
|
||||
# dst
|
||||
#
|
||||
add_ijump_extended( $filter_table->{output_option_chain($interface)}, j => $dbl_target, $origin{DYNAMIC_BLACKLIST}, @state, set => "--match-set $dbl_ipset dst" );
|
||||
}
|
||||
}
|
||||
|
||||
for ( option_chains( $interface ) ) {
|
||||
add_ijump_extended( $filter_table->{$_}, j => $dynamicref, $origin{DYNAMIC_BLACKLIST}, @state ) if $dynamicref && ! get_interface_option( $interface, 'nodbl' );
|
||||
add_ijump_extended( $filter_table->{$_}, j => $dynamicref, $origin{DYNAMIC_BLACKLIST}, @state ) if $dynamicref && ( get_interface_option( $interface, 'dbl' ) ne '0:0' );
|
||||
add_ijump_extended( $filter_table->{$_}, j => 'ACCEPT', $origin{FASTACCEPT}, state_imatch $faststate )->{comment} = '' if $config{FASTACCEPT};
|
||||
}
|
||||
}
|
||||
|
||||
@ -337,6 +337,7 @@ sub initialize( $$ ) {
|
||||
arp_ignore => ENUM_IF_OPTION,
|
||||
blacklist => SIMPLE_IF_OPTION + IF_OPTION_HOST,
|
||||
bridge => SIMPLE_IF_OPTION,
|
||||
dbl => ENUM_IF_OPTION,
|
||||
destonly => SIMPLE_IF_OPTION + IF_OPTION_HOST,
|
||||
detectnets => OBSOLETE_IF_OPTION,
|
||||
dhcp => SIMPLE_IF_OPTION,
|
||||
@ -387,6 +388,7 @@ sub initialize( $$ ) {
|
||||
%validinterfaceoptions = ( accept_ra => NUMERIC_IF_OPTION,
|
||||
blacklist => SIMPLE_IF_OPTION + IF_OPTION_HOST,
|
||||
bridge => SIMPLE_IF_OPTION,
|
||||
dbl => ENUM_IF_OPTION,
|
||||
destonly => SIMPLE_IF_OPTION + IF_OPTION_HOST,
|
||||
dhcp => SIMPLE_IF_OPTION,
|
||||
ignore => NUMERIC_IF_OPTION + IF_OPTION_WILDOK,
|
||||
@ -1191,6 +1193,7 @@ sub process_interface( $$ ) {
|
||||
my %options;
|
||||
|
||||
$options{port} = 1 if $port;
|
||||
$options{dbl} = $config{DYNAMIC_BLACKLIST} =~ /^ipset(-only)?,src-dst/ ? '1:2' : $config{DYNAMIC_BLACKLIST} ? '1:0' : '0:0';
|
||||
|
||||
my $hostoptionsref = {};
|
||||
|
||||
@ -1234,6 +1237,8 @@ sub process_interface( $$ ) {
|
||||
} else {
|
||||
warning_message "The 'blacklist' option is ignored on multi-zone interfaces";
|
||||
}
|
||||
} elsif ( $option eq 'nodbl' ) {
|
||||
$options{dbl} = '0:0';
|
||||
} else {
|
||||
$options{$option} = 1;
|
||||
$hostoptions{$option} = 1 if $hostopt;
|
||||
@ -1256,6 +1261,11 @@ sub process_interface( $$ ) {
|
||||
} else {
|
||||
$options{arp_ignore} = 1;
|
||||
}
|
||||
} elsif ( $option eq 'dbl' ) {
|
||||
my %values = ( none => '0:0', src => '1:0', dst => '2:0', 'src-dst' => '1:2' );
|
||||
|
||||
fatal_error q(The 'dbl' option requires a value) unless defined $value;
|
||||
fatal_error qq(Invalid setting ($value) for 'dbl') unless defined ( $options{dbl} = $values{$value} );
|
||||
} else {
|
||||
assert( 0 );
|
||||
}
|
||||
@ -1906,7 +1916,7 @@ sub verify_required_interfaces( $ ) {
|
||||
|
||||
my $returnvalue = 0;
|
||||
|
||||
my $interfaces = find_interfaces_by_option 'wait';
|
||||
my $interfaces = find_interfaces_by_option( 'wait');
|
||||
|
||||
if ( @$interfaces ) {
|
||||
my $first = 1;
|
||||
@ -1972,7 +1982,7 @@ sub verify_required_interfaces( $ ) {
|
||||
|
||||
}
|
||||
|
||||
$interfaces = find_interfaces_by_option 'required';
|
||||
$interfaces = find_interfaces_by_option( 'required' );
|
||||
|
||||
if ( @$interfaces ) {
|
||||
|
||||
|
||||
@ -306,6 +306,72 @@ loc eth2 -</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis
|
||||
role="bold">dbl={none|src|dst|src-dst}</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>Added in Shorewall 5.0.10. This option defined whether
|
||||
or not dynamic blacklisting is applied to packets entering the
|
||||
firewall through this interface and whether the source address
|
||||
and/or destination address is to be compared against the
|
||||
ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
|
||||
<ulink
|
||||
url="manpages/shorewall.conf.html">shorewall.conf(5)</ulink>).
|
||||
The default is determine by the setting of
|
||||
DYNAMIC_BLACKLIST:</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=No</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis role="bold">none</emphasis>
|
||||
(e.g., no dynamic blacklist checking).</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=Yes</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis role="bold">src</emphasis>
|
||||
(e.g., the source IP address is checked).</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=ipset[-only]</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis
|
||||
role="bold">src</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=ipset[-only],src-dst...</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis
|
||||
role="bold">src-dst</emphasis> (e.g., the source IP
|
||||
addresses in checked against the ipset on input and the
|
||||
destination IP address is checked against the ipset on
|
||||
packets originating from the firewall and leaving
|
||||
through this interface).</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
<para>The normal setting for this option will be <emphasis
|
||||
role="bold">dst</emphasis> or <emphasis
|
||||
role="bold">none</emphasis> for internal interfaces and
|
||||
<emphasis role="bold">src</emphasis> or <emphasis
|
||||
role="bold">src-dst</emphasis> for Internet-facing
|
||||
interfaces.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">destonly</emphasis></term>
|
||||
|
||||
@ -348,7 +414,7 @@ loc eth2 -</programlisting>
|
||||
url="../bridge-Shorewall-perl.html">Shorewall-perl for
|
||||
firewall/bridging</ulink>, then you need to include
|
||||
DHCP-specific rules in <ulink
|
||||
url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(8).
|
||||
url="/manpages/shorewall-rules.html">shorewall-rules</ulink>(5).
|
||||
DHCP uses UDP ports 67 and 68.</para>
|
||||
</note>
|
||||
</listitem>
|
||||
@ -493,7 +559,10 @@ loc eth2 -</programlisting>
|
||||
|
||||
<listitem>
|
||||
<para>Added in Shorewall 5.0.8. When specified, dynamic
|
||||
blacklisting is disabled on the interface.</para>
|
||||
blacklisting is disabled on the interface. Beginning with
|
||||
Shorewall 5.0.10, <emphasis role="bold">nodbl</emphasis> is
|
||||
equivalent to <emphasis
|
||||
role="bold">dbl=none</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
||||
@ -237,6 +237,66 @@ loc eth2 -</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis
|
||||
role="bold">dbl={none|src|dst|src-dst}</emphasis></term>
|
||||
|
||||
<listitem>
|
||||
<para>Added in Shorewall 5.0.10. This option defined whether
|
||||
or not dynamic blacklisting is applied to packets entering the
|
||||
firewall through this interface and whether the source address
|
||||
and/or destination address is to be compared against the
|
||||
ipset-based dynamic blacklist (DYNAMIC_BLACKLIST=ipset... in
|
||||
<ulink
|
||||
url="manpages6/shorewall6.conf.html">shorewall6.conf(5)</ulink>).
|
||||
The default is determine by the setting of
|
||||
DYNAMIC_BLACKLIST:</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=No</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis role="bold">none</emphasis>
|
||||
(e.g., no dynamic blacklist checking).</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=Yes</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis role="bold">src</emphasis>
|
||||
(e.g., the source IP address is checked against the
|
||||
ipset).</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=ipset[-only]</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis
|
||||
role="bold">src</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>DYNAMIC_BLACKLIST=ipset[-only],src-dst...</term>
|
||||
|
||||
<listitem>
|
||||
<para>Default is <emphasis
|
||||
role="bold">src-dst</emphasis> (e.g., the source IP
|
||||
addresses in checked against the ipset on input and the
|
||||
destination IP address is checked against the ipset on
|
||||
packets originating from the firewall and leaving
|
||||
through this interface).</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">destonly</emphasis></term>
|
||||
|
||||
@ -370,7 +430,10 @@ loc eth2 -</programlisting>
|
||||
|
||||
<listitem>
|
||||
<para>Added in Shorewall 5.0.8. When specified, dynamic
|
||||
blacklisting is disabled on the interface.</para>
|
||||
blacklisting is disabled on the interface. Beginning with
|
||||
Shorewall 5.0.10, <emphasis role="bold">nodbl</emphasis> is
|
||||
equivalent to <emphasis
|
||||
role="bold">dbl=none</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user