forked from extern/shorewall_code
Shorewall 2.0.16
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1934 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
839964351c
commit
f5aea0ea03
@ -622,6 +622,41 @@ DYNAMIC_ZONES=No
|
||||
# (PKTTYPE="") then PKTTYPE=Yes is assumed.
|
||||
|
||||
PKTTYPE=Yes
|
||||
|
||||
#
|
||||
# DROP INVALID PACKETS
|
||||
#
|
||||
# Netfilter classifies packets relative to its connection tracking table into
|
||||
# four states:
|
||||
#
|
||||
# NEW - thes packet initiates a new connection
|
||||
# ESTABLISHED - thes packet is part of an established connection
|
||||
# RELATED - thes packet is related to an established connection; it may
|
||||
# establish a new connection
|
||||
# INVALID - the packet does not related to the table in any sensible way.
|
||||
#
|
||||
# Recent 2.6 kernels include code that evaluates TCP packets based on TCP
|
||||
# Window analysis. This can cause packets that were previously classified as
|
||||
# NEW or ESTABLISHED to be classified as INVALID.
|
||||
#
|
||||
# The new kernel code can be disabled by including this command in your
|
||||
# /etc/shorewall/init file:
|
||||
#
|
||||
# echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_be_liberal
|
||||
#
|
||||
# Additional kernel logging about INVALID TCP packets may be obtained by
|
||||
# adding this command to /etc/shorewall/init:
|
||||
#
|
||||
# echo 1 > /proc/sys/net/ipv4/netfilter/ip_conntrack_log_invalid
|
||||
#
|
||||
# Traditionally, Shorewall has dropped INVALID TCP packets early. The DROPINVALID
|
||||
# option allows INVALID packets to be passed through the normal rules chains by
|
||||
# setting DROPINVALID=No.
|
||||
#
|
||||
# If not specified or if specified as empty (e.g., DROPINVALID="") then
|
||||
# DROPINVALID=Yes is assumed.
|
||||
|
||||
DROPINVALID=No
|
||||
################################################################################
|
||||
# P A C K E T D I S P O S I T I O N
|
||||
################################################################################
|
||||
|
||||
@ -9,9 +9,11 @@
|
||||
# rejNonSyn #Silently Reject Non-syn TCP packets
|
||||
# logNonSyn #Log Non-syn TCP packets with disposition LOG
|
||||
# dLogNonSyn #Log Non-syn TCP packets with disposition DROP
|
||||
# rLogNonSyn #Log Non-syn TCP packets with disposition REJECT
|
||||
# rLogNonSyn #Log Non-syn TCP packets with disposition REJECT
|
||||
# dropInvalid #Silently Drop packets that are in the INVALID
|
||||
# #conntrack state.
|
||||
# allowInvalid #Accept packets that are in the INVALID conntrack
|
||||
# #state
|
||||
#
|
||||
# The NonSyn logging builtins log at the level specified by LOGNEWNOTSYN in
|
||||
# shorewall.conf. If that option isn't specified then 'info' is used.
|
||||
|
||||
@ -2807,7 +2807,7 @@ createactionchain() # $1 = chain name
|
||||
|
||||
process_actions1() {
|
||||
|
||||
ACTIONS="dropBcast dropNonSyn dropNotSyn rejNotSyn logNotSyn rLogNotSyn dLogNotSyn dropInvalid"
|
||||
ACTIONS="dropBcast dropNonSyn dropNotSyn rejNotSyn logNotSyn rLogNotSyn dLogNotSyn dropInvalid allowInvalid"
|
||||
USEDACTIONS=
|
||||
|
||||
strip_file actions
|
||||
@ -2952,6 +2952,9 @@ process_actions2() {
|
||||
dropInvalid)
|
||||
[ "$COMMAND" != check ] && run_iptables -A dropInvalid -m state --state INVALID -j DROP
|
||||
;;
|
||||
allowInvalid)
|
||||
[ "$COMMAND" != check ] && run_iptables -A dropInvalid -m state --state INVALID -j ACCEPT
|
||||
;;
|
||||
*)
|
||||
f=action.$xaction
|
||||
fn=$(find_file $f)
|
||||
@ -4831,7 +4834,8 @@ initialize_netfilter () {
|
||||
|
||||
for chain in INPUT OUTPUT FORWARD; do
|
||||
run_iptables -A $chain -p udp --dport 53 -j ACCEPT
|
||||
run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP
|
||||
[ -n "$DROPINVALID" ] && \
|
||||
run_iptables -A $chain -p ! icmp -m state --state INVALID -j DROP
|
||||
done
|
||||
|
||||
[ -n "$CLAMPMSS" ] && \
|
||||
@ -6061,6 +6065,7 @@ do_initialize() {
|
||||
BRIDGING=
|
||||
DYNAMIC_ZONES=
|
||||
PKTTYPE=
|
||||
DROPINVALID=
|
||||
RESTOREBASE=
|
||||
TMP_DIR=
|
||||
|
||||
@ -6234,7 +6239,7 @@ do_initialize() {
|
||||
BRIDGING=$(added_param_value_no BRIDGING $BRIDGING)
|
||||
DYNAMIC_ZONES=$(added_param_value_no DYNAMIC_ZONES $DYNAMIC_ZONES)
|
||||
PKTTYPE=$(added_param_value_yes PKTTYPE $PKTTYPE)
|
||||
|
||||
DROPINVALID=$(added_param_value_yes DROPINVALID $DROPINVALID)
|
||||
#
|
||||
# Strip the files that we use often
|
||||
#
|
||||
|
||||
@ -1 +1 @@
|
||||
2.0.15
|
||||
2.0.16
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=2.0.15
|
||||
VERSION=2.0.16
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -22,7 +22,7 @@
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
|
||||
VERSION=2.0.15
|
||||
VERSION=2.0.16
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
%define name shorewall
|
||||
%define version 2.0.15
|
||||
%define version 2.0.16
|
||||
%define release 1
|
||||
%define prefix /usr
|
||||
|
||||
@ -141,6 +141,8 @@ fi
|
||||
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
|
||||
|
||||
%changelog
|
||||
* Tue Feb 01 2005 Tom Eastep tom@shorewall.net
|
||||
- Updated to 2.0.16-1
|
||||
* Wed Jan 12 2005 Tom Eastep tom@shorewall.net
|
||||
- Updated to 2.0.15-1
|
||||
* Mon Jan 03 2005 Tom Eastep tom@shorewall.net
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Seattle Firewall
|
||||
|
||||
VERSION=2.0.15
|
||||
VERSION=2.0.16
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
Loading…
Reference in New Issue
Block a user