holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
12,603 Commits 104 Branches 736 Tags 54 MiB
2b579d2dff
Commit Graph

2888 Commits

Author SHA1 Message Date
Tom Eastep
2b579d2dff Small efficiency change in helper processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 12:48:22 -07:00
Tom Eastep
fc3e3dbf3c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-03 10:53:33 -07:00
Tom Eastep
81acedd1b3 Reword the 'unreachable' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 17:13:41 -07:00
Tom Eastep
d8f53cc0a9 Merge branch '4.5.17' 
Conflicts:
	Shorewall/Perl/Shorewall/Chains.pm
 2013-06-02 15:31:45 -07:00
Tom Eastep
481811d29f Merge NFACCT and EXPENSIVE matches during optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 13:29:13 -07:00
Tom Eastep
3867902b27 Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 07:31:32 -07:00
Tom Eastep
adf51d0059 Revise the unreachable warning stuff. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 16:32:46 -07:00
Tom Eastep
7dbd50708b Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:35 -07:00
Tom Eastep
4340bcffb1 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:25 -07:00
Tom Eastep
4a05e56d6d Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:16 -07:00
Tom Eastep
2d8078033c Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:03:10 -07:00
Tom Eastep
c5f2eeea80 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:02:39 -07:00
Tom Eastep
5343243f6b Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:01:55 -07:00
Tom Eastep
4865899018 Avoid a forward jump for local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:52:09 -07:00
Tom Eastep
9b68204865 Generate an 'unreachable rule(s)' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:17:22 -07:00
Tom Eastep
a550dd3eed Issue a warning when a rule is dropped do to terminated chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 21:01:07 -07:00
Tom Eastep
f0aa29222f Correct minor IPv6 TPROXY bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 07:18:46 -07:00
Tom Eastep
eaf1d0e5c2 Another error check for hosts files and loopback zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 10:00:07 -07:00
Tom Eastep
446f764d19 Allow config with only local and firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:44 -07:00
Tom Eastep
9b0b3d4b70 Correct ICMPV6 type name translation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:19 -07:00
Tom Eastep
a48a4b7a2e Don't allow fowarding between local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 06:14:44 -07:00
Tom Eastep
8743b64e00 Export 'shorewall' from the Config module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-27 06:52:45 -07:00
Tom Eastep
2de0fbf7d0 Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 14:06:51 -07:00
Tom Eastep
f89c704d01 Disallow 'virtual' physical interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:47:44 -07:00
Tom Eastep
0b5a316cfc Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:03:54 -07:00
Tom Eastep
31f9ea5b93 Add progess and warning messages to 'update -D' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:55 -07:00
Tom Eastep
dde1f0a779 Only enable helpers during a 'clear' operation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:27 -07:00
Tom Eastep
60d0a50d9d Add some warning/progress messages to help understand 'update -D' behavior. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 13:20:12 -07:00
Tom Eastep
064f9f974c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-23 09:49:25 -07:00
Tom Eastep
fd11eb7d82 Omit fw->fw jumps when there is a local zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 09:19:34 -07:00
Tom Eastep
9e77bb5499 Ensure correct match ordering with trivial exclusion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 08:46:22 -07:00
Tom Eastep
8df8fe990a Allow 'local' zone to work with 'destonly' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 07:34:04 -07:00
Tom Eastep
ac02c484f5 Change 'local' interface option to a zone type. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-19 15:35:20 -07:00
Tom Eastep
5ec72dad6c Add routes for standard tables when there are no providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 15:32:05 -07:00
Tom Eastep
f6a55bbf05 Allow the '-V' option in the CLI programs. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 14:29:36 -07:00
Tom Eastep
739f3779f5 Generate warnings for local->non-firewall and non-firewall->local rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 07:51:12 -07:00
Tom Eastep
2e293dd356 Make 'local,destonly' work correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 14:36:51 -07:00
Tom Eastep
a5412cff38 Issue a warning when a rule will be optimized away due to 'destonly'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 09:30:59 -07:00
Tom Eastep
46a6a7b258 Correct earlier optimization. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 07:27:57 -07:00
Tom Eastep
105d1db85d Cosmetic change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 11:24:09 -07:00
Tom Eastep
200d347ac8 Small Efficiency Change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 10:52:04 -07:00
Tom Eastep
c8133145e6 Add support for "all+" in the policy file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 09:01:12 -07:00
Tom Eastep
9178ecbab0 Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:38:44 -07:00
Tom Eastep
d06a7b55b6 Add a 'destonly' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:37:40 -07:00
Tom Eastep
2fb01bec8d Don't assume 'destonly' with 'local'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:58:37 -07:00
Tom Eastep
6551d67b2e Call delete_chain_and_references recursively. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:29:29 -07:00
Tom Eastep
4b76d8c462 Handle optimize level 0 in the IPV6 nat table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:28:25 -07:00
Tom Eastep
1bb5b89ee1 Add the 'local' interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:27:12 -07:00
Tom Eastep
c3901f1161 Release mutex on error. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-09 09:57:09 -07:00
Tom Eastep
56318e6cc8 Try to ensure that cp doesn't copy the firewall script to itself. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-06 09:22:16 -07:00