holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
12,213 Commits 104 Branches 736 Tags 54 MiB
1b94c3651d
Commit Graph

5516 Commits

Author SHA1 Message Date
Tom Eastep
61d67a4741 Remove extraneous comment from the rule generated by action.RST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-06 15:13:46 -08:00
Tom Eastep
5f48e4e531 Handle nested parens when pushing action parameters. 
- Add an optional argument to split_list1 that causes parens to be retained.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-06 15:13:14 -08:00
Tom Eastep
0a31d9ba41 Remove extraneous comment from the rule generated by action.RST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-06 15:10:53 -08:00
Tom Eastep
fdadb57e82 Minor readability improvement 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-05 19:41:18 -08:00
Tom Eastep
56d7b6248b Begin Action Documentaiton Update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-05 19:07:42 -08:00
Tom Eastep
8139f2ad91 Rename process_conditional() to process_compiler_directive() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-05 14:53:03 -08:00
Tom Eastep
189cd59650 Improve expression evaluation 
- Only quote values when there is not an odd number of preceding quotes
- Make address family test return a numeric value
- Unconditionally trace the generated expression if debugging is set.
- Convert an empty expression into '' rather than generate an error.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-05 08:37:50 -08:00
Tom Eastep
4ec47783f1 Detect missing target in merge_levels() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-05 07:52:07 -08:00
Tom Eastep
2875fbb521 Cosmetic change (add a blank line). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-05 07:51:41 -08:00
Tom Eastep
25c53f5a60 Detect missing target in merge_levels() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-05 07:51:21 -08:00
Tom Eastep
c61c9ba7eb Make expression evaluation more deterministic. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 18:10:19 -08:00
Tom Eastep
2fbbc70e83 Only do SET and RESET when we aren't omitting. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 16:27:18 -08:00
Tom Eastep
c18996b6f5 Implement ?set and ?reset directives 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 14:28:03 -08:00
Tom Eastep
02cbd72a91 Merge branch '4.5.10' 2012-12-04 10:56:09 -08:00
Tom Eastep
60012d1208 Add additional space for the OPTIONS column 
- actions and actions.std problem

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 10:54:32 -08:00
Tom Eastep
903e25a91a Add ALLOWUNKNOWNVARIABLES to the sample configurations. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 09:04:34 -08:00
Tom Eastep
8f1e8bf475 Add 'ALLOWUNKNOWNVARIABLES' to the manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 08:50:23 -08:00
Tom Eastep
fb2d876683 Rename $loglevel and $logtag to $_loglevel and $_logtag respectively. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 08:49:59 -08:00
Tom Eastep
a25b3c68ee Rename %symbols to %variables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-04 08:49:25 -08:00
Tom Eastep
314632f1f4 Unified symbol table for shell variables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-03 17:18:21 -08:00
Tom Eastep
409f5f2aab Expand variables from the shorewallrc1 then shorewallrc hashes 2012-12-03 15:33:33 -08:00
Tom Eastep
fb0035bdf3 Add ALLOWUNKNOWNVARIABLES option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-03 14:43:35 -08:00
Tom Eastep
72aabef0fa Add $logaction and $logtag as variables usable within actions 
- Also make action variables usable in ?if and ?elsif expressions.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-03 12:31:47 -08:00
Tom Eastep
fc3606a489 Prepare for multiple options in actions files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-03 08:17:55 -08:00
Tom Eastep
ad4709cb6d Small effeciency improvement 
- Don't check for 'bad match' until it is known that the matches are the same.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-03 06:54:44 -08:00
Tom Eastep
c0abdc1fe8 Add some comments in and around delete_duplicates() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-02 17:31:13 -08:00
Tom Eastep
cd5e9be467 Carefully suppress duplicate rules in all tables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-02 12:20:24 -08:00
Tom Eastep
c05c928c6c Delete adjacent duplicate rules in tables other than 'raw' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-02 09:21:04 -08:00
Tom Eastep
a33cf5cc91 Fix AUTOCOMMENT=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-02 08:26:54 -08:00
Tom Eastep
9da507ae98 Remove error messages from 6 actions regarding in-line. 
- The compiler now ignores 'inline' for these actions.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-02 07:13:09 -08:00
Tom Eastep
e0e7b2a9f2 Correct action.DropSmurfs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-02 07:11:58 -08:00
Tom Eastep
65676cb865 Support passing log levels inside parameters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 15:06:51 -08:00
Tom Eastep
8ebbdee20f Only look for numerics if a shell variable begins with a number. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 12:52:26 -08:00
Tom Eastep
6c1a5b8051 Be more agressive about detecting action recursion. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 12:10:06 -08:00
Tom Eastep
cc657e571d Update action templates with new columns. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 10:25:10 -08:00
Tom Eastep
f358a78eca Revise the description of 'noinline' to match the changed implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 09:33:38 -08:00
Tom Eastep
b9adc2ebec Remove another vestage of CONDITION_INIT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 09:33:01 -08:00
Tom Eastep
44f00cd0aa Restore original $actionfile logic in process_actions() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 08:09:20 -08:00
Tom Eastep
ae5680401f Remove questionable autocreate of an action in createlogactionchain() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 08:04:29 -08:00
Tom Eastep
8cbe26e32c Ignore 'inline' for certain actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-12-01 07:54:42 -08:00
Tom Eastep
146402d9be Yet another correction to the same line :-( 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-30 09:55:24 -08:00
Tom Eastep
70f26d8bb2 Correct line in prior commit. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-30 09:30:27 -08:00
Tom Eastep
893d054cb8 Reduce the block levels in define_firewall() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-30 08:46:49 -08:00
Tom Eastep
53fd0e7c8c Don't require functions called from Shorewall::Compiler::compiler to know the current indentation. 
Also, add an optional 'times' parameter to push_indent() and pop_indent().

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-30 07:49:42 -08:00
Tom Eastep
6702bb1989 Revert condition initialization patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-30 07:31:29 -08:00
Tom Eastep
e60369728a Only initialize switches that survived optimization 
- Also use push_indent to make things more readable

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 15:25:28 -08:00
Tom Eastep
7d4bc568d8 Include initialization in condition match if supported 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 14:54:09 -08:00
Tom Eastep
11d4e92a29 Correct check for leading zeros in action variables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 14:39:02 -08:00
Tom Eastep
409c427134 Add support for future condition initial values. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 12:15:15 -08:00
Tom Eastep
7bdce1bc97 Disallow superfluous leading zeros in action parameter numbers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 08:29:20 -08:00
Tom Eastep
e1524763ad Also substute the chain name for '@0'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 08:28:52 -08:00
Tom Eastep
15121e0743 Also substitute the chain name for '@0' in SWITCH names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 08:05:49 -08:00
Tom Eastep
9c0d8a2533 Use '@{0}' as the chain name surrogate in SWITCH columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-29 07:17:13 -08:00
Tom Eastep
bff91cd325 Allow overriding 'inline' on some standard actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-28 15:03:08 -08:00
Tom Eastep
8006d150f1 Allow switch initialization. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-27 16:17:43 -08:00
Tom Eastep
e44acdc6af Corrections to in-line actions. 
- Avoid reference to uninitialized variable.
- Remove another vestage of multi-parameter macros.
- Correct a typo.
- Correct handling of SOURCE and DEST in an in-line action body.
- Correct a comment.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-27 12:56:14 -08:00
Tom Eastep
e2297f2582 Remove meaningless type from an error message. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-27 12:53:47 -08:00
Tom Eastep
d7096ae52e Back out default-action macros and document in-line actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-27 10:53:18 -08:00
Tom Eastep
6bf996d4b8 Implement inline actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-27 10:32:48 -08:00
Tom Eastep
85a46690c0 Improve optimize level 16 fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 15:11:07 -08:00
Tom Eastep
a4dcd1071a Revert change to macro level merging. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 13:41:12 -08:00
Tom Eastep
78ba8bac50 Replace '@' by the chain name in SWITCH columns. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 13:28:23 -08:00
Tom Eastep
bf75b2b919 $0 expands to the current action chain name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 13:23:20 -08:00
Tom Eastep
7673b1ac4b Support multiple parameters in macros. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 11:04:19 -08:00
Tom Eastep
fc87576005 Back out silly change for output interfaces in the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 09:47:42 -08:00
Tom Eastep
3f550622bd Only use routing table for OUTPUT interface in the raw table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 07:51:55 -08:00
Tom Eastep
21c2963691 Correct Format-3 syntax for the SOURCE column of the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-26 07:48:43 -08:00
Tom Eastep
e7dee420ee Allow interfaces in the DEST column of the conntrack file when the chain is OUTPUT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 18:37:23 -08:00
Tom Eastep
e45fe53705 Correct another optimizer defect. 
- Don't declare command-mode rules as duplicates.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 18:00:26 -08:00
Tom Eastep
697fc001c3 Return to zone-based handling of 'all'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 16:31:05 -08:00
Tom Eastep
642f192b3d Disallow destination interface in the OUTPUT chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 15:37:53 -08:00
Tom Eastep
7b0578fa84 Fix AUDIT on IPv6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 12:09:18 -08:00
Tom Eastep
5acf0f60e7 Only apply log level to bare LOG rules in default-action macro. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 10:17:03 -08:00
Tom Eastep
fb3194d96b Correct handling of default-action macro when specified as "macro.Name" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 10:16:43 -08:00
Tom Eastep
629717f7cc Correct policy manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 09:33:46 -08:00
Tom Eastep
8e239c90c1 Update columns in the macro template file. 
- It was missing SWITCH and HELPER
 2012-11-25 08:54:19 -08:00
Tom Eastep
8c2db40783 Correct errors in the conntrack manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 08:52:51 -08:00
Tom Eastep
066a017420 Correct typo in Raw.pm 
- The OUTPUT chain designator test was using '0' (zero) rather than 'O'.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 08:52:33 -08:00
Tom Eastep
1870c281a9 Make AUDIT support params again. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 08:26:44 -08:00
Tom Eastep
dbfc805707 Add 'IU' state in secmarks 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-25 08:10:53 -08:00
Tom Eastep
748d532175 Correct the explaination of ULOG and NFLOG in the manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-24 09:11:28 -08:00
Tom Eastep
b7e2b28562 Transfer tag when merging into an NFLOG/ULOG rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-24 09:04:56 -08:00
Tom Eastep
67e1e6cf91 Allow WHITELIST in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 14:19:14 -08:00
Tom Eastep
cd2854cad0 Fix NFLOG/ULOG implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 13:49:43 -08:00
Tom Eastep
75c148a2dd Enable 'debug' on the try, stop and clear commands. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 11:46:14 -08:00
Tom Eastep
71bbc632ce Handle 'fw' correctly in the SOURCE column of the stoppedrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 08:35:51 -08:00
Tom Eastep
b6a1a7d538 Make NFLOG and ULOG built-ins. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-23 08:14:24 -08:00
Tom Eastep
30de211bda Implement format-3 conntrack files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 20:56:56 -08:00
Tom Eastep
3f7425b6a0 Purge %renamed before each table is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 17:27:09 -08:00
Tom Eastep
8a744de906 Document semantic change to 'all' handling in the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 09:10:07 -08:00
Tom Eastep
26dee73895 Support the audited targets on IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 08:24:51 -08:00
Tom Eastep
df7ce1a7d1 Add the AUDIT built-in and delete the Audit action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 08:24:33 -08:00
Tom Eastep
4a05571e7e Add forward prototype for process_macro() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-22 08:00:15 -08:00
Tom Eastep
b89e05740d Insure that nested zone exclusions go in the proper place in raw PREROUTING 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 14:49:21 -08:00
Tom Eastep
3040156981 Add SWITCH column to the conntrack file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 14:20:56 -08:00
Tom Eastep
54dadcc546 Ensure that zone-specific rules come before 'all' rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 14:20:30 -08:00
Tom Eastep
952aed225d Improve handling of 'all' in the conntrack file. 
- Also added 'all-' to represent all off-firewall zones.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 13:07:01 -08:00
Tom Eastep
7bfbf522bc Document that parameters are allowed in default actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 11:12:55 -08:00
Tom Eastep
1efd47a7e9 Apply Tuomo Soini's fix for RHEL5 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 10:34:00 -08:00
Tom Eastep
c0a2f19500 Add an Audit action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 10:24:14 -08:00
Tom Eastep
374489c3cf Revert "Fix RHEL5 issue with route marking." 
This reverts commit 77f342b0e0.
 2012-11-21 10:19:24 -08:00
Tom Eastep
77f342b0e0 Fix RHEL5 issue with route marking. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 09:08:15 -08:00
Tom Eastep
8f52c9744e Correct some issues with default action macros. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-21 08:29:35 -08:00
Tom Eastep
1957af04fd Don't create a _weight file for an optional non-provider interface. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 16:10:30 -08:00
Tom Eastep
a0faba2a03 Correct interface/provider handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 13:27:15 -08:00
Tom Eastep
c798200b20 Another correction to CHECKSUM detection. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 10:09:28 -08:00
Tom Eastep
67ae9df0f8 Correct handling of unknown interfaces in TC. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 08:07:42 -08:00
Tom Eastep
ebb4e1f6e4 Don't generate start/stop functions for wildcard optional interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 07:06:27 -08:00
Tom Eastep
f458e99390 Correct the compiler's CHECKSUM detection 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 06:59:40 -08:00
Tom Eastep
5b049d7e9e Improve readability in Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-20 06:59:13 -08:00
Tom Eastep
3b20c0db54 Allow Macros to be used as Default Actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 16:52:10 -08:00
Tom Eastep
0d8931e49f Don't use ':' as a join character in contatenated macro ACTION expansion. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 12:58:29 -08:00
Tom Eastep
47791add99 Fix formatting of a line of code. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 12:30:25 -08:00
Tom Eastep
be587726f4 Merge branch '4.5.9' 2012-11-19 08:22:05 -08:00
Tom Eastep
60a509c926 Add new macros and alphabetize the ACTION list in the rules manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 08:19:12 -08:00
Tom Eastep
b25ece75de Don't leave temporary chain in the raw table when LOAD_HELPERS_ONLY=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 08:18:32 -08:00
Tom Eastep
e9ef03f723 Add a ULOG Macro. 
- Also remove 'DEFAULT' from NFLOG macro.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-19 07:15:50 -08:00
Tom Eastep
0db7b6c58a Don't require a parameter with '&' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 15:45:58 -08:00
Tom Eastep
57e913d86e Merge branch '4.5.9' 2012-11-18 15:02:46 -08:00
Tom Eastep
263f4e57cb Add an NFLOG Macro 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 14:52:53 -08:00
Tom Eastep
a4294658b6 Add a capability to use log levels as a target. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 14:50:59 -08:00
Tom Eastep
65e1b1c9e7 Allow NFLOG as a target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 13:15:24 -08:00
Tom Eastep
a07cfb0885 Allow NFLOG as a target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 13:13:43 -08:00
Tom Eastep
9dac330756 Remove references to USE_ACTIONS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 13:13:20 -08:00
Tom Eastep
dfd02c932e Correct typo in shorewall(8) and shorewall6(8). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 13:12:03 -08:00
Tom Eastep
c6ffdd67e2 Add DROP target to the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 11:35:40 -08:00
Tom Eastep
5265cd5bb7 Add UNTRACKED match to the secmarks file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 11:01:49 -08:00
Tom Eastep
ab381ed95e Expand the description of enable/disable on optional non-provider interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 09:01:38 -08:00
Tom Eastep
0277d6628e Correct typo in shorewall(8) and shorewall6(8). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-18 08:30:47 -08:00
Tom Eastep
5712438bcb Eliminate Shell syntax error when a provider and its interface have the same name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-16 09:50:36 -08:00
Tom Eastep
a2b14c37ed Treat optional interfaces as pseudo-providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-16 09:48:21 -08:00
Tom Eastep
b1ffcd8628 Apply provider mask in 'routemark' chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-14 11:20:30 -08:00
Tom Eastep
34e3e4bf82 Merge branch '4.5.9' 2012-11-14 11:17:18 -08:00
Tom Eastep
06a4994488 Make exclusion work correctly with TPROXY. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-14 11:16:52 -08:00
Tom Eastep
391113dfe3 Apply provider mask in 'routemark' chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-13 06:55:59 -08:00
Tom Eastep
3c58d2180d Improve the efficiency of tcrule processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-13 06:55:35 -08:00
Tom Eastep
32c9e4274f Rename 'mysplit' to 'split_host_list' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-11 08:42:01 -08:00
Tom Eastep
896d874aab Set VARLIB in the script's initialize() function. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-09 12:29:19 -08:00
Tom Eastep
5fcdfd779c Don't default IPSET to 'ipset'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-09 08:54:54 -08:00
Tom Eastep
860ee6de27 Eliminate nonsensical warning message. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-06 07:36:36 -08:00
Tom Eastep
4b6fdf8b72 Update masq manpage to expunge exclusion with an interface name in the SOURCE column. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-04 09:11:37 -08:00
Tom Eastep
ec17ea1dee Remove superfluous check 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-03 08:19:46 -07:00
Tom Eastep
2e211bc2b6 Correct handling of wildcard interfaces in rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-03 07:24:41 -07:00
Tom Eastep
6e4632663b Correct heading comments in action.TCPFlags. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-11-01 07:20:50 -07:00
Tom Eastep
5f0b85b5b9 Replace a couple of more hard-coded directory names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-30 09:49:53 -07:00
Tom Eastep
86ae74005a Correct invalid information in shorewall[6]-tcclasses. 
- Delete part about an interface only appearing once.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-29 12:46:58 -07:00
Tom Eastep
3f1aeb33be Correct mark range with shifted mask. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-26 12:41:06 -07:00
Tom Eastep
e908473d29 Clean up description of CHECKSUM in the manpages. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-26 11:22:54 -07:00
Tom Eastep
e177916c12 Implement statistical marking in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-26 07:10:26 -07:00
Tom Eastep
0387b16983 Implement CHECKSUM action in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-22 15:42:13 -07:00
Tom Eastep
f24e194819 Don't display chains with no matched entries when -b 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-22 14:15:37 -07:00
Paul Gear
59a75512be Add Teredo macro 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-21 07:20:29 -07:00
Tom Eastep
5a103e8ec5 Make options consistent (add a '-' before 't') 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-20 07:15:44 -07:00
Paul Gear
cf68379c4c Document brief option for show command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-20 07:11:56 -07:00
Paul Gear
6c06302d2a Make formatting of interface options consistent 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-20 07:11:48 -07:00
Tom Eastep
b00dc658b2 Correct error messages in action.RST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-15 07:17:17 -07:00
Tom Eastep
6af16e0cda Allow quotes in parameter to run_iptables() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-14 13:26:08 -07:00
Tom Eastep
ab7975539c Correct typo in get_params() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-14 09:30:27 -07:00
Tom Eastep
dfd0692176 Omit IPv6-specific code from checkkernelversion() in IPv4 script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-13 07:28:37 -07:00
Tom Eastep
8b650358d6 Don't shout in compiler directives 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-13 07:14:51 -07:00
Paul Gear
78aab70dfb Add Puppet macro 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-13 07:04:55 -07:00
Tom Eastep
cc90a06958 Add RESTORE_ROUTEMARKS option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-11 07:34:57 -07:00
Tom Eastep
54e066ec3a Re-order logic in add_group_to_zone 
- Need to normalize the address prior to comparing it with ALLIP

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-08 08:54:54 -07:00
Tom Eastep
620f88b339 Merge branch '4.5.8' 2012-10-07 17:41:01 -07:00
Tom Eastep
b7e6b1aa41 Allow IP range in the hosts file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 17:40:42 -07:00
Tom Eastep
c84603cdc6 Merge branch '4.5.8' 
Conflicts:
	Shorewall/Perl/Shorewall/Zones.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 17:04:27 -07:00
Tom Eastep
e2b029b0ba More hosts file corrections. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 17:00:35 -07:00
Tom Eastep
0efc0451c1 Allow IP range in the hosts file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 15:59:30 -07:00
Tom Eastep
9dd66fc6ff Allow IP range in the hosts file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 15:55:00 -07:00
Tom Eastep
1195661264 Document new Dynamic Zone implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 12:20:36 -07:00
Tom Eastep
0c9cc4a233 Change the 'dynamic' zone option to 'dynamic_shared' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-07 09:18:18 -07:00
Tom Eastep
c228668500 Implement logic associated with 'dynamic' zone option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-06 07:52:06 -07:00
Tom Eastep
afaba46aa3 Add 'dynamic' zone option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-06 07:21:49 -07:00
Tom Eastep
1f38a36acf Delete extraneous logic 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:

	Shorewall/Perl/Shorewall/Zones.pm
 2012-10-04 09:45:25 -07:00
Tom Eastep
526f72216a Correct handling of dash characters in interface/ipset names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-04 07:34:41 -07:00
Tom Eastep
642ff1be15 Correct handling of dash characters in interface/ipset names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-02 10:09:23 -07:00
Tom Eastep
92d39dc56d Expunge the g_perllib variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-01 06:59:39 -07:00
Tom Eastep
a8e9296473 Expunge the g_sbindir variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-01 06:55:48 -07:00
Tom Eastep
749e239d15 Expunge the g_libexec variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-10-01 06:51:36 -07:00
Tom Eastep
30d4ba67cc Revert "Allow '-' in the interface for dynamic zone." 
This reverts commit b68b34b820.
 2012-09-30 16:25:35 -07:00
Tom Eastep
4ef81041be Delete extraneous logic 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-30 16:09:34 -07:00
Tom Eastep
b68b34b820 Allow '-' in the interface for dynamic zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-30 16:04:38 -07:00
Tom Eastep
4311dc5ddf Merge branch '4.5.8' 2012-09-29 09:03:12 -07:00
Tom Eastep
38faa3e071 Correct handling of new ipv6 net syntax in the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-29 09:01:17 -07:00
Tom Eastep
81f92546d8 Merge branch '4.5.8' 2012-09-29 08:08:00 -07:00
Tom Eastep
91e2c31a58 Correct handling of new ipv6 net syntax in the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-27 14:51:28 -07:00
Tom Eastep
9c893a0e21 Restore the original calling sequences of validate_[46]net() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-27 07:22:40 -07:00
Tom Eastep
c8c1585dfc Merge branch '4.5.8' 2012-09-26 15:48:44 -07:00
Tom Eastep
ffcf262de4 Ensure that the 1:1 NAT chain jumps always come last in PREROUTING. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-26 15:46:52 -07:00
Tom Eastep
ca79147db3 Merge branch '4.5.8' 2012-09-25 11:07:49 -07:00
Tom Eastep
bac0f36818 Yet another fix for TTL/HL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 16:23:15 -07:00
Tom Eastep
a8f324b25c Ensure that the .service files run the utility in ${SBINDIR} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 14:32:20 -07:00
Tom Eastep
b451e10dd8 More fixes for HL and TTL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 14:25:31 -07:00
Togan Muftuoglu
58e277f48b Systemd service files usrmove 
On 09/24/2012 10:19 PM, Tom Eastep wrote:
> On 09/24/2012 02:31 AM, Jonathan Underwood wrote:
>> Such a change is something I've been meaning to submit a (trivial) patch
>> for - from a fedora perspective this would be a welcome change.
>
> Okay -- if one of you would send me a patch, I'll apply it. 4.5.8 is
> about to be released, so I would like the patch ASAP if you want it
> included in 4.5.8.

Hope not late and it works, see attached

Togan

>From 3ec45217b6ac93437d002315c56a1b3354160ff2 Mon Sep 17 00:00:00 2001
From: Togan Muftuoglu <toganm@opensuse.org>
Date: Sun, 23 Sep 2012 14:26:07 +0200
Subject: [PATCH] Fix sbin

The service files need to be executed from /usr/sbin not from /sbin

Signed-off-by: Togan Muftuoglu <toganm@opensuse.org>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 14:03:55 -07:00
Tom Eastep
6d0142525c Merge branch '4.5.8' 2012-09-24 08:44:07 -07:00
Tom Eastep
cf130a7e16 Correct handling of {+-}0 in the TTL and HL tcrule actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-24 07:14:44 -07:00
Tom Eastep
e1309b06b1 Correct PPTP Macro 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-23 12:19:41 -07:00
Tom Eastep
70c76f577c Permit "[<ipv6 address>]/vlsm" in addition to "[<ipv6 address>/vlsm]" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-23 12:16:17 -07:00
Tom Eastep
86c35339cd Merge branch '4.5.8' 2012-09-23 07:07:37 -07:00
Tom Eastep
f23fb1535d Correct PPTP control port number in conntrack files (1729->1723). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-09-23 07:04:43 -07:00