Commit Graph

359 Commits

Author SHA1 Message Date
Tom Eastep
5b26f1939b
Correct 'sed' command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-22 09:56:59 -07:00
Tom Eastep
49fae96b09
Update the manpages for 'blacklist' verbosity
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-10 19:45:42 -07:00
Tom Eastep
b3e59322b6
Clean up the output of 'blacklist'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-10 13:26:01 -07:00
Tom Eastep
eb6ae5e186
Correct handling of DYNAMIC_BLACKLIST options
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-05 16:56:29 -07:00
Tom Eastep
ca7ca4bdfe
Add a 'timeout' option to DYNAMIC_BLACKLIST
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-05 12:56:47 -07:00
Tom Eastep
c19e732e42
Correct typo
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-04 10:00:00 -07:00
Tom Eastep
8d731c81e4
Add 'disconnect' option to ipset-based dynamic blacklisting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-04 09:09:45 -07:00
Tom Eastep
1b032f7524
Correct permissions of files created by the 'save' command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-01 13:49:35 -07:00
Tom Eastep
e81a4788c6
Implement DEFAULT_PAGER in shorewallrc
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-09-21 10:20:48 -07:00
Tom Eastep
4a6338d857
Correct/complete Scott Sumate's LOGFILE enhancement
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-07-15 14:25:02 -07:00
Scott Shumate
55ee0113ea Added support for systemd logging by configuring LOGFILE=systemd 2016-07-15 13:40:23 -05:00
Tom Eastep
544be8c937
Change SuSE shorewallrc to use systemd
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-21 13:50:10 -07:00
Tom Eastep
56b6db1a3d
Make the allow command work with both ipset and chain dynamic blacklisting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-14 13:42:20 -07:00
Tom Eastep
f979ccb16d
Merge branch '5.0.9' 2016-06-09 14:47:44 -07:00
Tom Eastep
4869f61a25
'allow' now works with ipset-based dynamic blacklisting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-09 08:44:25 -07:00
Matt Darfeuille
0925636995
(Fwd) [Shorewall-users] Shorewall-lite on OpenWRT
On 7 Jun 2016 at 8:21, Tom Eastep wrote:

> On 06/07/2016 06:40 AM, Matt Darfeuille wrote:
> > On 5 Jun 2016 at 12:53, Tom Eastep wrote:
> >
> >> On 06/05/2016 12:33 PM, Matt Darfeuille wrote:
> >>> On 5 Jun 2016 at 7:57, Tom Eastep wrote:
> >>>
> >>>> On 05/29/2016 02:00 AM, Matt Darfeuille wrote:
> >>>>
> >>>> Hi Matt,
> >>>>
> >>>>>
> >>>>> -------------- Enclosure number 1 ----------------
> >>>>> >From 6ff651108df33ab8be4562caef03a8582e9eac5e Mon Sep 17 00:00:00 2001
> >>>>> From: Matt Darfeuille <matdarf@gmail.com>
> >>>>> Date: Tue, 24 May 2016 13:10:28 +0200
> >>>>> Subject: [PATCH 1/8] Emulate 'ps -p' using grep to work on openwrt
> >>>>>
> >>>>> Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
> >>>>> ---
> >>>>>  Shorewall-core/lib.common | 2 +-
> >>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>>>>
> >>>>> diff --git a/Shorewall-core/lib.common b/Shorewall-core/lib.common
> >>>>> index 03ecb2a..fcb02ee 100644
> >>>>> --- a/Shorewall-core/lib.common
> >>>>> +++ b/Shorewall-core/lib.common
> >>>>> @@ -776,7 +776,7 @@ mutex_on()
> >>>>>  		error_message "WARNING: Stale lockfile ${lockf} removed"
> >>>>>  	    elif [ $lockpid -eq $$ ]; then
> >>>>>                  return 0
> >>>>> -	    elif ! qt ps p ${lockpid}; then
> >>>>> +	    elif ! qt ps | grep -v grep | grep ${lockpid}; then
> >>>>
> >>>> I don't see how this can work -- 'qt ps' will produce no output yet the
> >>>> code pipes into tandem greps.
> >>>>
> >>>> Do you really want this instead?
> >>>>
> >>>> elif ! ps | grep -v grep | qt grep ${lockpid}; then
> >>>>
> >>>
> >>> Oops sorry Tom, that's what I meant(do you want the corrected
> >>> patch?)!
> >>
> >> Yes, please.
> >>
> >
> > Tom, along with correcting this faulty commit I realize, after some
> > more testing, that I've also sent unnecessary commits.
> >
> > Should I revert these 3 commits(git revert ...):
> > Set proper permissions for the LOCKFILE on openwrt
> > 2ded346cb557212389212fd5adcd4c6800edbb62
> > Create lockfile before using openwrt's lock utility
> > 08e8796ff1abc3b24b8bbd40bf5e0a2b36464d61
> > Emulate 'ps -p' using grep to work on openwrt
> > 6ff651108df33ab8be4562caef03a8582e9eac5e
> >
> > or should I simply create new commits that will correct these faulty
> > commits?
> >
> > In other words what's the best way to correct submited commits.
> >
>
> Matt,
>
> Either way is fine.
>

Hopefully these 3 commits will do it(code-fixes.patch):

Patch 1 will correct the error you have point out!
On OpenWRT the lock utility doesn't allow to append the pid of the
currently running script to the LOCKFILE that's why I've simply
deleted that line(patch 2).
I've also reordered the permissions line to be added after the line
that will lock the file specified by the LOCKFILE variable(patch 3).

and two other patches:
While installing shorewall-init using the DESTDIR variable on debian,
'mkdir' would complain if the directory ${DESTDIR}/${etc}/default
already exist; corrected using 'mkdir -p ...'(patch 4).
The last patch will correct a typo in the blacklisting_support
article.

-Matt

-------------- Enclosure number 1 ----------------
>From 1a2ff15c8dc994030e819d2882570d188b99c501 Mon Sep 17 00:00:00 2001
From: Matt Darfeuille <matdarf@gmail.com>
Date: Wed, 8 Jun 2016 09:09:46 +0200
Subject: [PATCH 1/5] Correct pid detection mutex_on()

Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-08 15:40:48 -07:00
Matt Darfeuille
cd4e9654d8
(Fwd) [Shorewall-users] Shorewall-lite on OpenWRT
------- Forwarded message follows -------
From:	istvan@istvan.org
To:	shorewall-users@lists.sourceforge.net
Date sent:	Thu, 19 May 2016 09:10:21 +0200
Subject:	[Shorewall-users] Shorewall-lite on OpenWRT
Send reply to:	Shorewall Users <shorewall-users@lists.sourceforge.net>
	<mailto:shorewall-users-request@lists.sourceforge.net?subject=unsubscribe>
	<mailto:shorewall-users-request@lists.sourceforge.net?subject=subscribe>

Hi there,

I use Shorewall on an OpenWRT distribution and I experience 2
problems.
I have solved them myself and report them here to help others with
it.

Shorewall version: shorewall[6]-lite 5.0.4
OpenWRT version: Chaos Calmer 15.05, r46767

Problem 1:
Shorewall uses the lock utility from openwrt. I believe it is used in

the wrong way. File lib.common line 775
First it passes arguments which the utility doesn't use/know. The
util
accepts them dumbly and continues to create a lockfile. It has no
time-out functionality. I do not know the meaning of the r1 argument.
Second the mutex_off simply deletes the lockfile by using the utility

rm. This way a stale lock process keeps running. After a while the
router is running a high number of stale processes which has impact
on
the load of the router. The correct way is to use "lock -u
/lib/shorewall-lite/lock". This way the lockfile will be removed and
the
process will be terminated accordingly. To make it work for me, I no
more let shorewall use the lock utility by using an ugly hack.

Problem 2:
An fgrep on the output of the type utility is wrongly coded. The
output
of the type command probably has been changed. File lib.cli line 4343
It is coded: "if type $1 2> /dev/null | fgrep -q 'is a function';
then"
To make it work for me, it should be coded: "if type $1 2> /dev/null
|
fgrep -q 'is a shell function'; then"

With regards,

Stefan
------- End of forwarded message -------

Tom, attached as code.patch, are the patches that I  believe will
correct those issues

In addition to those patches I've also added 3 patches:
- Patch 1 will emulate the -p flag of the ps utility which is not
available on openwrt.
- The last two patches will add "file" to the progress message of
SYSCONFFILE to make it more consistent among the installers.

In shorewall-init/install.sh the else clause between  the line 586
and 597 will only work for a sysvinit script.
Should I make it also work for a systemd service script or can't we
simply remove that else clause?

In the compiled firewall script the comments before and after the
functions imported from lib.common have two slashes in the path:
$ grep -H lib.common firewall
firewall:#   Functions imported from /usr/share/shorewall//lib.common
firewall:#   End of imports from /usr/share/shorewall//lib.common

-Matt

-------------- Enclosure number 1 ----------------
>From 6ff651108df33ab8be4562caef03a8582e9eac5e Mon Sep 17 00:00:00 2001
From: Matt Darfeuille <matdarf@gmail.com>
Date: Tue, 24 May 2016 13:10:28 +0200
Subject: [PATCH 1/8] Emulate 'ps -p' using grep to work on openwrt

Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-08 15:40:36 -07:00
Tom Eastep
ec23ca67f8 Remove the parentheses from around the start/stop time
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-29 15:32:17 -07:00
Tom Eastep
a2345325dd Move show_status() to before its first reference
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-29 15:31:55 -07:00
Tom Eastep
1308560aba Display compilation date/time in 'status -a' output
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-29 14:12:53 -07:00
Tom Eastep
41923cb80e Improve compile time/date implementation
- Rename the command from 'date' to 'info'
- Return the complete date/time/version string in the command

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-29 12:31:17 -07:00
Tom Eastep
2a40012fc4 Include compile time and date in the output of 'shorewall status'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-27 16:25:21 -07:00
Matt Darfeuille
05a15c6f8b patches and request
Tom,

Some patches for the trunk repo(fixes.patch):

Patch1: Fix a typo in the path being printed for the standard actions
file.
Patch2: Will only install the shorewall's manpages if the variable
MANDIR is none-empty(I did it only for the sake of completeness)!
Patch3: Will only install the shorewall-lite's manpages if the
variable MANDIR is none-empty.
Patch4: Correct multiple product name's typos in
shorewall-init/install.sh.
Patch5: Remove ~/.shorewallrc when shorewall-core is uninstalled.

And two other  patches for the release repo(changelog-1.patch):

Patch1: Changed restart to reload for the line: 'Update DHCP
article(refresh -> restart).
Patch2: Rephrased the line for the newly added ?WARNING and ?INFO
directives.

Request:
Could the date of the compiled firewall script also be displayed when
'shorewall status' is executed?

-Matt

-------------- Enclosure number 2 ----------------
>From a5ae24bbe9b25aefdbcc4d7c8e5d013a36b03078 Mon Sep 17 00:00:00 2001
From: Matt Darfeuille <matdarf@gmail.com>
Date: Sat, 23 Apr 2016 14:44:19 +0200
Subject: [PATCH 1/5] Fix typo in printed path for standard actions file

Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-27 15:07:44 -07:00
Tom Eastep
47edfaf093 Create standard error messages in the CLI
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-27 10:13:24 -07:00
Tom Eastep
524838ae47 Implement $SW_LOGGERTAG
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-15 14:29:51 -07:00
Tom Eastep
fc2b555cdb Correct date formatting in startup_error()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-11 15:24:35 -07:00
Tom Eastep
8dc88898c8 Tidy up the output of 'shorewall[6][-lite] show bl'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-10 17:22:22 -07:00
Tom Eastep
05e4049174 Ipset-based blacklisting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-04-10 16:07:56 -07:00
Tom Eastep
3c544b20e6 Convert the state actions to use the 'state' action option
- Also avoid the CLI having to know about builtin actions

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-03-14 14:54:09 -07:00
Tom Eastep
c56ba534d6 Yet more PAGER fixes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-03-02 12:34:39 -08:00
Tom Eastep
90bc894200 More PAGER fixes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-03-02 08:58:26 -08:00
Tom Eastep
90d254f0c3 Add PAGER option
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-03-02 08:32:49 -08:00
Tom Eastep
a95de8d092 Page the output of verbose commands
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-03-01 15:12:54 -08:00
Tom Eastep
8a02624f05 Update copyrights in the install and uninstall scripts
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-29 11:03:09 -08:00
Tom Eastep
bf8c131545 Add a local variable
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-15 10:36:53 -08:00
Tom Eastep
1553e6b831 Sort the output of 'show actions'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-10 08:37:47 -08:00
Tom Eastep
9aa915a5e0 Avoid errors from 'status -i' when there are no optional interfaces
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-15 16:39:47 -08:00
Tom Eastep
2f59ea5ca3 Implement the WAIT_OPTION capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-05 09:28:24 -08:00
Tom Eastep
0c66e5f1b2 More Openwrt support in Shorewall-init from Matt Darfeuille
- Also, various cleanup in install/uninstall scripts

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-04 15:45:21 -08:00
Tom Eastep
89d91d37a1 Add Shorewall-init installer support for OpenWRT
- Supply sysconfig files for all products

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-27 16:47:31 -08:00
Tom Eastep
fc426923b1 Accept host=debian.* in the configure scripts (Matt Darfeuille)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-12 08:10:34 -08:00
Tom Eastep
5bc471ff03 Another fix to configure.pl from Matt Darfeuille
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-11 14:37:52 -08:00
Tom Eastep
0bc250ba11 More configure/install/uninstall fixes from Matt Darfeuille
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-06 12:04:34 -08:00
Tom Eastep
09af9130df Correct syntax error in lib.cli
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-05 08:42:34 -08:00
Tom Eastep
4139c932a4 More configure/install/uninstall fixes from Matt Darfeuille
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-05 08:31:22 -08:00
Tom Eastep
8e7f001f7e Update manpages for column renaming
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-04 14:53:26 -08:00
Tom Eastep
f4fef3a931 Configure script corrections for Debian
- Matt Darfeuille and Tom Eastep

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-11-29 09:06:39 -08:00
Tom Eastep
b087cee7f0 Redefine MODULESDIR
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-11-28 08:36:12 -08:00
Tom Eastep
dab780368f Use netstat if ss isn't installed
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-11-16 15:02:47 -08:00
Tom Eastep
8ae6e3ff57 A couple more OpenWRT fixes
- Detect OpenWRT in the configure script
- Fix the Shorewall6-lite uninstaller
2015-11-07 07:20:44 -08:00