Commit Graph

4488 Commits

Author SHA1 Message Date
Tom Eastep
a077a9821d Implement rate estimation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-11 15:27:24 -07:00
Tom Eastep
25a6f10025 Fix complex traffic shaping
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-11 10:52:37 -07:00
Tom Eastep
ede17cb771 Restore lost function from merging 4.4.24
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-10 16:51:27 -07:00
Tom Eastep
6d56a8aa45 Merge branch '4.4.24'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-10 06:57:05 -07:00
Tom Eastep
a12a4a5a89 Add '6in4' as a synonym for '6to4'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-10 06:54:31 -07:00
Tom Eastep
99b21fdfc5 Implement HL manipulation for IPv6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-09 14:01:40 -07:00
Tom Eastep
668926c2a6 Add BALANCE_TABLE.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-09 09:00:14 -07:00
Tom Eastep
a5010ec9a6 Correct alternate specification in the tunnels file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-09 08:50:55 -07:00
Tom Eastep
31e0b186bf More fixes for 'fallback' without weight
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-09 07:53:59 -07:00
Tom Eastep
809f27decd More alternate-specification fixes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-09 07:06:01 -07:00
Tom Eastep
8115934adf More alternate-specification fixes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-09 07:05:08 -07:00
Tom Eastep
035db174d8 Fix 'fallback' without weight
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-09 06:58:41 -07:00
Tom Eastep
3afd6a3ad3 Correct proto column of the netmap file 2011-10-08 18:20:47 -07:00
Tom Eastep
2d6f5da6bc Correct proto column of the netmap file 2011-10-08 18:19:08 -07:00
Tom Eastep
c304661217 Fix earlier change 2011-10-08 17:10:23 -07:00
Tom Eastep
661606ef95 Merge branch '4.4.24'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-08 17:07:12 -07:00
Tom Eastep
b5963c6783 Fix alternate nat handling 2011-10-08 17:01:18 -07:00
Tom Eastep
e6b120a805 Implement BALANCE table
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-08 13:54:39 -07:00
Tom Eastep
e322e60d73 Fix 'fallback' 2011-10-08 12:32:29 -07:00
Tom Eastep
04c2007d53 Resolve merge conflicts
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-08 07:03:01 -07:00
Tom Eastep
5d4a0172b7 A bit of cleanup
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-05 09:32:26 -07:00
Tom Eastep
835a056eb8 Implement BLACKLIST section in the rules file
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-03 16:02:01 -07:00
Tom Eastep
e09aa8662b Correct title in action.TCPFlags
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-03 09:05:38 -07:00
Tom Eastep
57650e8dd9 Add two new actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-02 18:41:58 -07:00
Tom Eastep
0a5d5821ec Support additional forms of column/value pair specification
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-02 11:45:55 -07:00
Tom Eastep
e728d663f9 Implement IPTABLES_S capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-01 13:54:52 -07:00
Tom Eastep
2f0829596f Fix format-1 Actions 2011-10-01 12:17:29 -07:00
Tom Eastep
f6092ee52d Eliminate the maxcolumns argument to the split_line functions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-01 11:39:12 -07:00
Tom Eastep
072f4752fc Get rid of minimum column requirement
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-10-01 09:56:25 -07:00
Tom Eastep
c76957cc39 Reword an error message
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-26 08:51:05 -07:00
Tom Eastep
4c7f1a03a0 Catch multiple semicolons on a line.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-26 07:42:44 -07:00
Tom Eastep
9a4dfc4394 Implement an alternate way of specifying column contents.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-25 17:08:53 -07:00
Tom Eastep
da5b6b99d4 Implement TTL support in tcrules.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-24 16:17:52 -07:00
Tom Eastep
dbf5f17b41 More tweaks to switch implementation.
1) Switch names may be 30 characters long.
2) Switch settings are retained over restart.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-24 07:34:58 -07:00
Tom Eastep
40bc6df07a Correct handling of SWITCH column
- Handle exclusion
- Correctly detect CONDITION_MATCH at compile time
- Include condition match in the filter part of a NAT rule

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-23 15:01:40 -07:00
Tom Eastep
caddd65412 Rename condition->switch and add more documentation.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-23 12:33:55 -07:00
Tom Eastep
75b4540d26 Add support for condition match in the rules file
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-21 15:20:50 -07:00
Tom Eastep
7978993d2b Validate NET2 in IPv6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-20 16:24:39 -07:00
Tom Eastep
d005536fcc Merge branch 'master' of ssh://shorewall.git.sourceforge.net/gitroot/shorewall/shorewall
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-20 16:20:34 -07:00
Tom Eastep
a5e05c9e8e Don't allow long port lists or icmp lists in netmap 2011-09-19 13:27:27 -07:00
Tom Eastep
990d6e504d Correct icmp-type and icmpv6-type 2011-09-19 10:05:58 -07:00
Tom Eastep
fd1e996fb1 Correct call to dest_iexclusion()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-19 08:28:29 -07:00
Tom Eastep
e01276225c Correct port order in the netmap file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-19 06:17:02 -07:00
Tom Eastep
c2bcb08483 Add 'i' versions of exclusion functions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-18 14:12:22 -07:00
Tom Eastep
95a83f7fdf Allow exclusion in the netmap file's NET1 column 2011-09-17 09:20:15 -07:00
Tom Eastep
5aac5870a1 Call setup_netmap if IPv6
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-17 07:31:18 -07:00
Tom Eastep
86847957bf Merge branch '4.4.23' 2011-09-16 09:03:43 -07:00
Tom Eastep
76fc55d750 Fix TC_ENABLED=Shared
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-16 06:50:34 -07:00
Tom Eastep
be1765f44d Don't emit 'enable' code for required providers
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-15 14:46:29 -07:00
Tom Eastep
fcb8fa79c0 Don't emit 'enable' code for required providers
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-14 08:25:47 -07:00
Tom Eastep
e1afc645ba Allow IPv6 stateless NAT (undocumented)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-14 08:24:44 -07:00
Tom Eastep
fe9df4dfd1 Remove interface weight file if not balance or default.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-14 06:24:22 -07:00
Tom Eastep
8fe6425690 Correct DONT_LOAD
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-13 07:42:26 -07:00
Tom Eastep
ab1fac3fc6 Add some comments to getparams
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-11 09:52:12 -07:00
Tom Eastep
d4b37d1c52 Better way of handling environmental variables with embedded quotes.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-10 15:46:26 -07:00
Tom Eastep
fb6d4ffaf9 Merge branch '4.4.23' 2011-09-10 08:34:45 -07:00
Tom Eastep
8ce60ce825 Don't emit dangerous %ENV entries to the generated script
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-10 08:18:46 -07:00
Tom Eastep
7ed52360d5 Set all interfaces's 'routefilter' option if ROUTE_FILTER=on
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-07 12:19:13 -07:00
Tom Eastep
6f2fd75a8c Merge branch '4.4.23' 2011-09-07 11:14:11 -07:00
Tom Eastep
5f85646418 Fix disable of last balanced route
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-07 07:00:18 -07:00
Tom Eastep
6ae184ccc7 Update the released netmap file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-06 15:36:33 -07:00
Tom Eastep
b19a6f0bfd Merge branch '4.4.23' 2011-09-05 17:25:03 -07:00
Tom Eastep
77ca62835f Add PROTO and PORTS columns to netmap 2011-09-05 12:33:42 -07:00
Tom Eastep
02009ee060 Set 'use_..._chain' on interfaces with sfilters
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-05 06:23:18 -07:00
Tom Eastep
2285dce4d1 Fix debugging of ipv6 ruleset
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-03 13:58:05 -07:00
Tom Eastep
058b746f57 Use /sys/module/ to speed up module loading
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-03 11:49:31 -07:00
Tom Eastep
29e0f57928 Cosmetic/readability changes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-03 08:44:15 -07:00
Tom Eastep
d1fea7c682 Correct 'disable' with dynamic gateway
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-02 11:01:06 -07:00
Tom Eastep
46d9faa63a Correct sed invocation in add_gateway()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-02 10:28:41 -07:00
Tom Eastep
a63d4dad44 More sfilter tweaks
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-02 08:41:42 -07:00
Tom Eastep
6afd18646d Remove backslashes from routes before processing them.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-02 08:41:15 -07:00
Tom Eastep
f5c2e9b211 Make the sfilter logic cleaner and add a comment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-01 14:15:15 -07:00
Tom Eastep
a0bbd72a39 Avoid a calculation in a loop in the generated code
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-09-01 06:06:50 -07:00
Tom Eastep
3fa646845f Fix busybox anomaly 2011-08-31 16:38:58 -07:00
Tom Eastep
82a806d788 Merge branch 'master' of ssh://shorewall.git.sourceforge.net/gitroot/shorewall/shorewall
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-31 07:58:51 -07:00
Tom Eastep
b8951259bd Avoid emitting out-of-function statements.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-30 16:55:44 -07:00
Tom Eastep
78a25bb51b Avoid undefined value error.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-30 16:43:38 -07:00
Tom Eastep
abdd6bec27 More corrections to undo_routing
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-30 09:31:06 -07:00
Tom Eastep
3031c37edd Handle routes and rules for main and default
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-29 10:05:36 -07:00
Tom Eastep
45bc3a7ea0 Split add_a_provider() into two functions.
- Avoid generating add_xxx_routes() and add_xxx_rules
- Only configure tc during 'enable'
- Fix a bad bug (routes were actually rules)

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-28 08:04:06 -07:00
Tom Eastep
65fe958e8e Split add_a_provider() into two functions.
- Avoid generating add_xxx_routes() and add_xxx_rules
- Only configure tc during 'enable'
- Fix a bad bug (routes were actually rules)

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-28 07:54:47 -07:00
Tom Eastep
90f83fd9fd Clear device TC on 'disable'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-27 12:33:24 -07:00
Tom Eastep
ed7d70e54b Merge branch 'EdW' 2011-08-27 11:45:37 -07:00
Tom Eastep
0ef8e3b1d6 Give tcpri processing its own function. Add some comments
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-27 11:44:42 -07:00
Tom Eastep
eb9d798ad3 Correct traffic-shaping handling
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-27 11:17:08 -07:00
Tom Eastep
5d21b55ecc Configure /proc during 'enable' processing.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-27 09:21:02 -07:00
Tom Eastep
cedf203c21 Allow tc config during 'enable'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-27 08:29:55 -07:00
Tom Eastep
7d66b3e60f Correct typo in prog.footer
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-26 14:13:34 -07:00
Tom Eastep
a8d0f5f40b Fix the log message when 'enable' fails.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-26 11:02:42 -07:00
Tom Eastep
528f2b0aa2 Implement enable and disable commands for IPv4
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-25 16:00:27 -07:00
Tom Eastep
f6920cf061 Merge branch 'EdW' 2011-08-24 17:51:48 -07:00
Tom Eastep
2ef7dd5201 Re-factor Provider startup 2011-08-24 17:37:39 -07:00
Tom Eastep
971adc3d5b Add support for serviced in the installers
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-23 14:07:44 -07:00
Tom Eastep
33afe26a19 Add Redhat/Fedora init scripts from Jonathan Underwood
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-22 09:05:40 -07:00
Tom Eastep
4e15786156 Add copyright statements to the .service files 2011-08-22 06:53:04 -07:00
Tom Eastep
e6a6a1a609 Add .service files for systemd 2011-08-22 06:27:23 -07:00
Tom Eastep
24aacd67e6 Improve lockfile arguments
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-21 11:28:45 -07:00
Tom Eastep
56addf3d4c Remove stale lock files
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-21 10:53:24 -07:00
Tom Eastep
2963acee80 Remove stale lock files 2011-08-21 10:21:58 -07:00
Tom Eastep
8c8326fa58 Correct handling of Wildcard Providers
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-20 06:49:02 -07:00
Tom Eastep
8ae9b2948e Make 'start debug' work with the rawpost table.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-16 16:17:02 -07:00
Tom Eastep
ca8e99ed51 Correct implementation of the ALL section.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-16 14:10:21 -07:00
Tom Eastep
e5886abed1 Take care of oversights in the Stateless NAT implementation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-16 14:10:07 -07:00
Tom Eastep
c597eb25fc Delete QUOTA_MATCH
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-16 05:39:28 -07:00
Tom Eastep
bc706324e9 Add an ALL section to the rules files.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-15 15:32:24 -07:00
Tom Eastep
d5290fc881 Correct typo that caused an internal error
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-15 10:11:12 -07:00
Tom Eastep
0b2a8b12c7 Implement Stateless NAT support.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-14 12:01:17 -07:00
Tom Eastep
71480ff647 Validate nets in the netmap file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-13 15:59:42 -07:00
Tom Eastep
97121116a3 Add rawpost table detection
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-13 11:14:29 -07:00
Tom Eastep
37b08dd991 Merge branch '4.4.22' 2011-08-13 10:48:27 -07:00
Tom Eastep
dec4f4f186 Separate target and targetopts in add_ijump calls.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-13 09:56:14 -07:00
Tom Eastep
b1b323191c Merge branch '4.4.22' 2011-08-11 20:19:47 -07:00
Tom Eastep
786455b287 Unlink .bak file if no changes to .conf.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-11 20:19:30 -07:00
Tom Eastep
39c71418da Merge branch '4.4.22' 2011-08-10 09:34:37 -07:00
Tom Eastep
7708c251db Fix ECN when MANGLE_FORWARD is not available.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-10 09:34:15 -07:00
Tom Eastep
8eff66dcfd Fix handling or ORIGINAL DEST when CONNTRACK_MATCH is not available
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-10 07:12:13 -07:00
Tom Eastep
67c1fa1e63 Fix old state match 2011-08-08 20:35:55 -07:00
Tom Eastep
8fe064914b Fix old state match 2011-08-08 20:32:02 -07:00
Tom Eastep
4824c9b8ff Add QUOTA_MATCH capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-08 14:37:47 -07:00
Tom Eastep
35457f4e95 Remove she-bang from lib.*
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-03 07:54:46 -07:00
Tom Eastep
b0fe8e1e60 Merge branch '4.4.22' 2011-08-03 07:20:57 -07:00
Tom Eastep
a548bddea8 Remove she-bang from first line of prog.header*
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-03 07:20:34 -07:00
Tom Eastep
679de4ccf6 Apply Orion Poplawski's 'qtnoin' patch
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-02 16:51:49 -07:00
Tom Eastep
50a29f6858 Correct detection of OLD_IPSET_MATCH when LOAD_MODULES_ONLY=No
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-08-02 11:58:54 -07:00
Tom Eastep
ae0cffa588 Fix handling of zone names beginning with 'all' 2011-08-02 09:13:23 -07:00
Tom Eastep
d358285d56 Remove obsolete comment
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-31 11:34:46 -07:00
Tom Eastep
f675513383 Make 'build' work on a Mac
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-30 10:57:32 -07:00
Tom Eastep
512273fa91 Avoid undefined reference in Shorewall::rules::save_policies
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-30 07:04:42 -07:00
Tom Eastep
42ae3ba581 Cleaner fix for TCP_FLAGS_DISPOSITION
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-30 06:57:18 -07:00
Tom Eastep
d9fe6e7a42 Handle missing TCP_FLAGS_DISPOSITION setting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-28 15:56:34 -07:00
Tom Eastep
6c025d20c9 Fix Shorewall6 Kernel Version test
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-28 15:53:35 -07:00
Tom Eastep
a992ec594a Accomodate kernel version 3.0
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-27 17:03:27 -07:00
Tom Eastep
33f7822df9 Correct 'action' editing RE in parameterized actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-25 09:16:22 -07:00
Tom Eastep
a18c502796 Correct reference counting in one more place in expand_rule()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-25 07:42:01 -07:00
Tom Eastep
ecd2e2276e Add some comments and remove extra whitespace
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-25 06:56:05 -07:00
Tom Eastep
215e923562 A little cleanup
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 16:17:22 -07:00
Tom Eastep
703bc88bfd Move merge_rules() back to where it was.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 15:06:42 -07:00
Tom Eastep
6300d6cbfc Validate 'action' parameter to the new parameterized actions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 11:46:57 -07:00
Tom Eastep
ac5a6f4471 Cleanup of progress messages
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 09:13:46 -07:00
Tom Eastep
f2c9647579 Set empty target in rules created via add_irule()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 08:28:43 -07:00
Tom Eastep
e693665be1 Add correct reference counting to merge_rules()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-24 08:03:45 -07:00
Tom Eastep
ea4b8cdb6f Exempt policy chains from optimization level 8.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 16:34:01 -07:00
Tom Eastep
b789d825f8 Unify the setting of $targetref and $jump
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 14:47:16 -07:00
Tom Eastep
83e6e2f105 Another fix for reference counting.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 13:54:56 -07:00
Tom Eastep
028fc20741 Correct reference accounting when long port lists are split
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 07:31:58 -07:00
Tom Eastep
3d616980a6 Don't delete the {target} member in clear_rule_target() but instead set it to ''
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-23 07:30:56 -07:00
Tom Eastep
567993292f Some efficiency changes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 17:48:14 -07:00
Tom Eastep
5764e7899b Rename combined chains created by optimization level 8
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 14:12:03 -07:00
Tom Eastep
22463e451d More efficient method of generating rule strings for comparison
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 11:06:29 -07:00
Tom Eastep
1d24f28c83 Rename %special -> %opttype
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 11:06:03 -07:00
Tom Eastep
bfd63dcace Revert LOGLIMIT conversion change
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 07:53:30 -07:00
Tom Eastep
2adf2883d5 Revert addition of do_i functions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 07:23:13 -07:00
Tom Eastep
5e190f4e4e Implement '_i' equivalents of all do_ functions.
Also implements handling of long port lists in new-format rules.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-22 06:22:52 -07:00
Tom Eastep
0791ea6698 Make 'KLUDGEFREE' a global to make it faster to test.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-21 12:57:20 -07:00
Tom Eastep
4eeb233d95 A little reorg to prepare for moving long port list remediation to the new chain structure.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 18:52:20 -07:00
Tom Eastep
705ffbca49 Fix for LOGMARK(<list>)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 17:33:31 -07:00
Tom Eastep
a7ab53e135 Trap '!' in port columns.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 15:55:18 -07:00
Tom Eastep
32a8b254a0 Some optimizations in the new rule infrastructure
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 15:53:00 -07:00
Tom Eastep
ca655a6f52 Use add_ijump for all jump 'irules'.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-20 07:30:49 -07:00
Tom Eastep
12b5aa687b More conversion to new rule interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-19 11:58:10 -07:00
Tom Eastep
f8be76f471 Make LOGMARK work without a parameter.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-19 11:57:12 -07:00
Tom Eastep
8b56e16bf9 Fix LOGMARK
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-19 06:54:41 -07:00
Tom Eastep
58de3dd3c1 Fix :persistent and :random in /etc/shorewall/masq
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 15:35:07 -07:00
Tom Eastep
346df62cc6 Support long-form iptables options.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 13:47:52 -07:00
Tom Eastep
796f3b6668 Correct cmdlevel settings in irules.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 10:05:39 -07:00
Tom Eastep
1e89074bf8 Correct tracing of nested rules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 09:46:41 -07:00
Tom Eastep
a80b04bd74 Correct formatting of empty arguments to add_commands
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 09:45:59 -07:00
Tom Eastep
bfd69c33c7 Correctly format empty arguments to add_commands()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 09:19:52 -07:00
Tom Eastep
043fb8757c Convert Rules.pm infrastructure to use the new rule interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 08:29:42 -07:00
Tom Eastep
7aa7cd54c2 Convert Providers.pm to use the new rules interface.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 07:43:25 -07:00
Tom Eastep
3c60f107b7 Convert generate_matrix() to use the new rules interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-18 07:24:21 -07:00
Tom Eastep
2efa2796d3 More new rule interface calls in the Misc module
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 15:12:58 -07:00
Tom Eastep
b2305ca9cf Convert Tunnels file to use irules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 11:33:01 -07:00
Tom Eastep
a211f8fd0f Infrastructure for new rule interface
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 10:37:15 -07:00
Tom Eastep
f3f535abac POC of new rule interface
Also removed FAKE_AUDIT option

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-17 08:35:09 -07:00
Tom Eastep
950c32d46b Convert add_commands() calls to the equivalent add_rule() calls.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 16:31:29 -07:00
Tom Eastep
03913019d8 Mark DHCP rules for the convenience of move_rules().
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 15:34:57 -07:00
Tom Eastep
27621fa0f9 Impose some structure on setting rule options
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 14:46:34 -07:00
Tom Eastep
0f742187ae Implement intermediate rule representation
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-16 09:41:53 -07:00
Tom Eastep
9661b445f2 Make install/uninstall files version independent
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-13 07:29:47 -07:00
Tom Eastep
d1b8d7b953 Make perl modules version-neutral
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-10 15:10:27 -07:00
Tom Eastep
11c580de54 Fix exclusion in IPv6 hosts file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 17:27:09 -07:00
Tom Eastep
e21ff03339 Fix ipsets in IPv6 hosts file
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 16:17:35 -07:00
Tom Eastep
fbeddca6a4 Another IPv6 ipset issue (z:!+set in the DEST column)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 15:40:18 -07:00
Tom Eastep
a998476d00 Correct Accounting module version
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 07:08:47 -07:00
Tom Eastep
6c802d3353 Tighten up source and dest checking in expand_rule()
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-09 07:08:39 -07:00
Tom Eastep
1f30976790 Correct change that tightened editing of IPv6 addresses
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 18:34:33 -07:00
Tom Eastep
22f1d1ba89 Another fix for IPv6 and IPSETs
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 16:31:35 -07:00
Tom Eastep
a8daff0008 Correct handling of <interface>:+<ipset> in Shorewall6.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 15:57:08 -07:00
Tom Eastep
b70666eaf6 Move .spec files to release/
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 10:07:08 -07:00
Tom Eastep
27b99a62d0 Move known problems file to release sub-directory
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-08 09:14:54 -07:00
Tom Eastep
76c97a1cc4 Move release documents to their own directory 2011-07-07 15:51:50 -07:00
Tom Eastep
7fa59706c5 Correct TPROXY/IPv6 address fix
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-07 14:50:44 -07:00
Tom Eastep
3f903fe3f1 Allow IPv6 Address as the third argument to TPROXY
- also update the manpages to describe TPROXY

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-07 06:43:16 -07:00
Tom Eastep
cf5613441d Correct loading of xt_ipset
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-05 15:57:14 -07:00
Tom Eastep
95acabe97e Make load and reload use the .conf file in the CWD
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-05 15:56:38 -07:00
Tom Eastep
1c199a2644 Add semicolons in new actions.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 14:59:07 -07:00
Tom Eastep
20cee7649e Change quotes in action.Broadcast 2011-07-04 13:32:32 -07:00
Tom Eastep
a355141f40 Correct typo in .spec files
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2011-07-04 13:13:52 -07:00
Tom Eastep
87870ad121 Add new actions to the .spec file 2011-07-04 13:01:49 -07:00