holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
15,647 Commits 104 Branches 736 Tags 54 MiB
450a16f730
Commit Graph

4183 Commits

Author SHA1 Message Date
Tom Eastep
b9bed00123 Correct handling of a physical name in a masq rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-31 12:52:30 -07:00
Tom Eastep
38aa7797c4 Allow protocol and user lists in actions and macros 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-30 08:34:42 -07:00
Tom Eastep
404540ffe1 Merge branch '5.0.7' 2016-03-30 08:17:19 -07:00
Tom Eastep
dd3c0daa08 Handle inline matches correctly in the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 13:33:47 -07:00
Tom Eastep
4fddfcfba0 More complete fix for inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 13:15:01 -07:00
Tom Eastep
421d5f6043 Move Raw matches to last. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 09:31:27 -07:00
Tom Eastep
382ab380a2 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2016-03-29 07:36:49 -07:00
Tuomo Soini
2342c7cd9c Perl/Shorewall/Chains.pm: Fix warning with older perl 2016-03-29 09:58:33 +03:00
Tom Eastep
66ae4975b2 Allow :R with DIVERT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-28 15:52:49 -07:00
Tom Eastep
5b7a9db170 Correct clearing of inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-28 15:48:59 -07:00
Tom Eastep
ad87d94e33 Small efficiency change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-26 13:12:33 -07:00
Tom Eastep
f86abf9552 Eliminate @columnstack -- simple save the columns array on the call stack. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-22 10:49:40 -07:00
Tom Eastep
9fe1a34412 Tighten up editing of configuration options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-21 12:03:45 -07:00
Tom Eastep
abe533b6e3 Correct the action on ingress filters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 13:45:33 -07:00
Tom Eastep
1c3140789c Add stab to ingress qdiscs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 13:25:39 -07:00
Tom Eastep
0399a346d0 Replace a silly line of code. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 12:05:45 -07:00
Tom Eastep
6ed3861d76 Correct Mangle Action Handling for second visit to the same action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 15:25:52 -07:00
Tom Eastep
7a18847c14 Correct handling of log level in a _DEFAULT setting. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 15:25:14 -07:00
Tom Eastep
273c89a753 Implement MARK and CONNMARK in the rules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:42:58 -07:00
Tom Eastep
2bebf1c95a Make '&' and '|' work with CONNMARK 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:30:52 -07:00
Tom Eastep
18573037f9 More 'check -r' fixes around Docker 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:09:39 -07:00
Tom Eastep
818628138b Add MARK and CONNMARK to the %targets table 
- Also, sort the table entries

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 10:21:35 -07:00
Tom Eastep
2adec0eb65 Implement a filename cache for find_file() 
- Don't need to search the CONFIG_PATH for re-open of same file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 09:45:41 -07:00
Tom Eastep
6ae94767b7 Correct a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 08:31:52 -07:00
Tom Eastep
9ab2310dc8 Correct an incorrect comment in process_rules() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-17 08:47:33 -07:00
Tom Eastep
da0653cb2f Declare passed() in Shorewall::User rather than importing it from Config 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 14:16:15 -07:00
Tom Eastep
65ce6ed226 Update modules to use passed() for parameter testing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 12:06:32 -07:00
Tom Eastep
eb9dd3e485 Implement passed() in Config.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 12:00:56 -07:00
Tom Eastep
796f191d48 Don't re-stat action files in process_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 09:03:36 -07:00
Tom Eastep
71c26beab4 Remove dead code (caused by bad test) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 17:56:34 -07:00
Tom Eastep
6f04902963 Make use of 'state=' in actions a fatal error 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 17:55:54 -07:00
Tom Eastep
901c6d34f6 Correct typo in Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:56:57 -07:00
Tom Eastep
741da14789 Ignore 'state' in the actions file with a warning 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:46:29 -07:00
Tom Eastep
dd547c90a8 Implement the 'state' action option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 14:30:36 -07:00
Tom Eastep
35fac8c2ea Avoid repeated %actions lookup in process_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 12:37:45 -07:00
Tom Eastep
513b828788 Pass '$prerule' to process_inline() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:56:07 -07:00
Tom Eastep
28e0cb5335 Use filename stored in the actions table 
- Avoid a find_file call on each action invocation

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:55:39 -07:00
Tom Eastep
c631173310 Eliminate the %inlines table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:47:18 -07:00
Tom Eastep
2c14b7c9e3 Rename %actparms to %actparams 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 15:36:38 -07:00
Tom Eastep
8e7af2e95e Additional editing of audit action parameters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 15:28:49 -07:00
Tom Eastep
44c0bffcd3 Add 'audit' option to actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 14:39:46 -07:00
Tom Eastep
2c3644a510 Make Action/Inline binary options into a bitmap 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 14:15:43 -07:00
Tom Eastep
407bc8f8db More prerule fixes in expand_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 12:57:23 -07:00
Tom Eastep
2743a411ae Add a jump to DOCKER from OUTPUT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 12:51:36 -07:00
Tom Eastep
c2fd48c4c6 Include pre-rule matches when the target is a chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 10:08:17 -07:00
Tom Eastep
5f01bc75bd Better fix for $current_param in the INLINE block of process_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 18:28:27 -08:00
Tom Eastep
0e59b82503 Handle '+' in inline matches the mangle and masq files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 17:14:15 -08:00
Tom Eastep
90ace544eb Implement '+' to specify inline matches as "early" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 16:39:46 -08:00
Tom Eastep
c36cee28fb Save/Restore $current_param in process_inline() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 16:39:08 -08:00
Tom Eastep
ec2ebee0e6 Clear inline matches between calls to process_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 15:08:47 -08:00
Tom Eastep
a50c52675b Correct a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 15:08:04 -08:00
Tom Eastep
bb7b3123df Eliminate ?begin perl ... ?end Perl in many actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 12:15:07 -08:00
Tom Eastep
3960fa6e0e Performance tweak to read_a_line() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 09:05:30 -08:00
Tom Eastep
a7fda02d88 Print lines copied into the generated script when tracing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-11 15:59:49 -08:00
Tom Eastep
68a324c62c Small tweaks to read_a_line() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-11 13:56:03 -08:00
Tom Eastep
6779c8307f Optimize chain resolution in process_mangle_rule1() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 15:26:52 -08:00
Tom Eastep
147c7e284f Fix a couple of Mangle Action blunders 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 13:59:29 -08:00
Tom Eastep
8d657775af Fix 'check -r' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 13:41:59 -08:00
Tom Eastep
b14bf0e779 Remove unused globals from the Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 11:14:51 -08:00
Tom Eastep
dc286c472c More tidying up of Mangle Actions 
- Delete an inadvertently-added blank line
- Move $convert declaration back to the Tc module
- Add comments in the Tc module about key moved declarations

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 15:51:54 -08:00
Tom Eastep
87f63b7160 Allow USE_DEFAULT_RT with NetworkManager 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 14:17:40 -08:00
Tom Eastep
617218f8ea Merge branch '5.0.6' 2016-03-09 11:36:46 -08:00
Tom Eastep
09c3be0adb Correct typo that cases restart failure. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 11:18:05 -08:00
Tom Eastep
ec9148637f Inline mangle actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-09 10:28:02 -08:00
Tom Eastep
991d8d2d3f Move convert_tos() back to the Tc module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-08 11:17:14 -08:00
Tom Eastep
301bce5d34 Clean up mangle actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-08 09:27:43 -08:00
Tom Eastep
a4aa020a84 Add R chain designator 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-07 13:51:49 -08:00
Tom Eastep
81c16d2d67 More Mangle Action Changes 
- Move open_mangle_for_output() back to the Tc module
- Eliminate global variables in process_mangle_rule1()
- Allow creation of mangle action chains
- Minor (but needed) logic changes

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-07 13:51:28 -08:00
Tom Eastep
bbbf54f7c3 Merge branch '5.0.6' 2016-03-07 08:59:17 -08:00
Tom Eastep
c37e41ee9c Avoid duplicate route rules from 'disable' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-06 15:48:33 -08:00
Tom Eastep
ba6dc9c5c0 First cut at mangle actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-06 12:42:22 -08:00
Tom Eastep
89b2c2fb55 Move mangle processing into the Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-06 08:59:37 -08:00
Tom Eastep
2bb143b28c Save/restore nat OUTPUT jump to DOCKER 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 12:21:45 -08:00
Tom Eastep
99f83da3ab Avoid duplicate rules after reload 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 11:09:53 -08:00
Tom Eastep
89e3e959dc Revert bad change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 10:20:55 -08:00
Tom Eastep
9e41264671 Go back to generating docker0 rules when it is defined to Shorewall 
- Avoids issues after 'stop'

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 09:27:47 -08:00
Tom Eastep
3fb715740d Avoid duplicated code blocks in save_dynamic_chains() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-04 09:27:04 -08:00
Tom Eastep
ed6ff96aa0 Replace another $VARDIR instance 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 14:11:57 -08:00
Tom Eastep
18dac19d86 Remove dead code from save_dynamic_chains() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 14:09:55 -08:00
Tom Eastep
d5ea876e93 Replace $VARDIR with ${VARDIR} for consistency 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 11:54:14 -08:00
Tom Eastep
f7a6ad1412 Clean up formatting in define_firewall() and stop_firewall() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-03 09:24:43 -08:00
Tom Eastep
b279869629 Fix DOCKER issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-02 20:59:44 -08:00
Tom Eastep
c56ba534d6 Yet more PAGER fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-02 12:34:39 -08:00
Tom Eastep
90d254f0c3 Add PAGER option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-02 08:32:49 -08:00
Tom Eastep
a95de8d092 Page the output of verbose commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-01 15:12:54 -08:00
Tom Eastep
68cce5ff73 Eliminate some sillyness in normalize_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-29 11:17:15 -08:00
Tom Eastep
1c1881859f Delete untrue comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-29 08:45:47 -08:00
Tom Eastep
5b163e9bc2 Save/restore docker0 rules when it isn't defined to Shorewall 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-27 14:09:29 -08:00
Tom Eastep
71d64ab380 Add DOCKER network support 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-27 13:36:47 -08:00
Tom Eastep
36d8518562 Code compaction 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-26 13:13:56 -08:00
Tom Eastep
6c88eb6916 Add an ECN action to shorewall-mangle(8) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-26 09:33:16 -08:00
Tom Eastep
6e1cc0f1d0 Correct stop/start Docker handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-25 13:37:44 -08:00
Tom Eastep
ee5ef07035 Correct another silly typo -- this time in allowBcast() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-24 14:58:10 -08:00
Tom Eastep
3c8696b91d Correct silly typo in setup_ecn() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-24 09:35:13 -08:00
Tom Eastep
fd4de0c66a Create more compact DOCKER conditional rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-22 14:46:35 -08:00
Tom Eastep
49536562e2 Emit more compact code when conditionally adding DOCKER chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-22 13:49:22 -08:00
Tom Eastep
36b6863b02 Update copyright date on lib.core 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-22 13:48:48 -08:00
Tom Eastep
63b501996e Require ADDRTYPE for DOCKER=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-21 12:26:39 -08:00
Tom Eastep
7a9e9ad945 Decommit DOCKER=Yes in IPv6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-21 12:03:41 -08:00
Tom Eastep
f4312a38b9 Add all Docker rules in the stopped state 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-21 10:33:45 -08:00
Tom Eastep
fc6a1f6d0d Don't create Docker chains/rules if Docker isn't running 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-21 09:54:37 -08:00
Tom Eastep
83b899b030 Save/Restore Docker-generated rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-20 14:02:54 -08:00
Tom Eastep
61f6cacc30 Infrastructure required by Docker 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-20 14:01:48 -08:00
Tom Eastep
caba1cd770 DOCKER=Yes requires IPTABLES_S 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-20 10:03:06 -08:00
Tom Eastep
4306ff1029 Correct 'save_dynamic_chains' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-20 09:57:11 -08:00
Tom Eastep
663f82c158 Move nat POSTROUTING rules to SHOREWALL if DOCKER=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-20 09:24:06 -08:00
Tom Eastep
e66d9f6547 Add DOCKER option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-19 17:42:54 -08:00
Tom Eastep
f33f333937 Make 'default' and 'none' case insensitive in the GATEWAY column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-17 15:25:46 -08:00
Tom Eastep
94cfe54f92 Allow routing tables with no default route 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-17 11:49:09 -08:00
Tom Eastep
8ac0f96029 Delete blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-09 18:20:00 -08:00
Tom Eastep
894a98f24e Improve optimizer handling of origin during rule merge 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-04 12:00:05 -08:00
Tom Eastep
bd9e8142b9 Ensure that the chain origin is used when there is no rule origin 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-03 10:43:10 -08:00
Tom Eastep
916a392fb0 Improve chain-completion rule tracking 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-02-02 14:57:47 -08:00
Tom Eastep
28983a0194 Add comment describing the origin member of a rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-31 09:29:24 -08:00
Tom Eastep
2cd098ba31 Update heading versions and copyrights 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-28 13:46:34 -08:00
Tom Eastep
9188f7efa3 Don't export shortlineinfo2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-28 13:38:26 -08:00
Tom Eastep
95a029316a Improve get_keys*() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-28 12:51:23 -08:00
Tom Eastep
d4bea3d3ec Optimize TRACK_RULES handling in the Chains module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-28 11:38:48 -08:00
Tom Eastep
6085c6092f Add origin comments to command-mode rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-28 10:58:09 -08:00
Tom Eastep
48df3d9627 Add origin member to the providers table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-28 10:34:36 -08:00
Tom Eastep
94442abfcf Correct check for duplicate interface in providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-28 10:34:16 -08:00
Tom Eastep
86f2e23f33 Invoke add_irule_extended rather than a hack that predated that function 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-27 19:01:23 -08:00
Tom Eastep
6e9d5f45ec Avoid spurious comment in jump to interface option chains. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-27 16:50:03 -08:00
Tom Eastep
039fd6ddd8 Move origin handling into log_[i]rule_limit 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-27 14:24:56 -08:00
Tom Eastep
57288086bf Unify TRACK_RULES handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-27 12:55:21 -08:00
Tom Eastep
f999acda63 Eliminate shortlineinfo1() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-27 10:21:08 -08:00
Tom Eastep
b4723da07c Eliminate $globals{TRACK_GLOBALS} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-26 16:45:47 -08:00
Tom Eastep
3860a1dc72 Ensure that %origin is populated 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-26 16:31:04 -08:00
Tom Eastep
e756820ca1 Revert "Unify TRACK_RULES settings implementation" 
This reverts commit 866cb04cbb.
 2016-01-26 11:49:26 -08:00
Tom Eastep
866cb04cbb Unify TRACK_RULES settings implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-25 18:07:46 -08:00
Tom Eastep
6ef136a546 Add origin information for entries in shorewall[6].conf 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-25 15:49:18 -08:00
Tom Eastep
9b3b4579a2 Change TRACK_RULES setting from Internal to File 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-24 16:15:36 -08:00
Tom Eastep
3e404b765f Make .ip[6]tables-restore-input comments conditional 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-23 17:04:52 -08:00
Tom Eastep
2235641c9f Add origin to the ip[6]tables input. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-23 15:13:12 -08:00
Tom Eastep
3fe4619f66 Fix origin in interfaces and hosts 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-23 13:49:52 -08:00
Tom Eastep
247698a14d Add origin in some rules from the Misc module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-23 12:31:53 -08:00
Tom Eastep
73b20c832c Add 'origin' member to rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-23 10:45:26 -08:00
Tom Eastep
8ac754caed Add 'origin' member to the interface and hosts tables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-21 17:08:19 -08:00
Tom Eastep
1abb77d66d Remove restrictions on -m geoip 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-18 22:30:15 -08:00
Tom Eastep
a28f3012d5 Correct $VERSION setting in Raw.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-18 09:38:35 -08:00
Tom Eastep
7d443b5e2e Eliminate return value from process_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-18 09:08:35 -08:00
Tom Eastep
a945b3e0dd Tweak the process_action() changes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-17 17:03:46 -08:00
Tom Eastep
ec6c233666 Centralize Rules module handling of @CALLER in actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-17 16:29:35 -08:00
Tom Eastep
4059e9de95 Clean up use_policy_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-17 12:35:12 -08:00
Tom Eastep
1ee645cd79 Another determinism fix -- red and codel options are now sorted 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-17 09:50:34 -08:00
Tom Eastep
1fedb26f1d Handle @CALLER in policy chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-17 09:42:01 -08:00
Tom Eastep
031371f259 Improve maintainability of action-tuple code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-16 17:26:16 -08:00
Tom Eastep
742c15b289 Improve @CALLER fix to create unique chains per caller 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-16 17:12:03 -08:00
Tom Eastep
726d1492cd Correct error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-13 17:08:57 -08:00
Tom Eastep
12513e24a3 Revert "Implement dynamic actions" 
This reverts commit 8075ba719a.
 2016-01-13 11:04:41 -08:00
Tom Eastep
21765d618d Create unique chains when @caller is used 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-13 11:04:23 -08:00
Tom Eastep
de21c59885 Correct hashlimit in logging rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-13 09:49:22 -08:00
Tom Eastep
8075ba719a Implement dynamic actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-13 09:33:38 -08:00
Tom Eastep
3828eb856b Rename HADIVERT to DIVERTHA 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-08 15:36:10 -08:00
Tom Eastep
ad2f20b824 Finish HAProxy support 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-06 09:12:33 -08:00
Tom Eastep
4c33c2b957 Add support for HAProxy 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-06 08:27:50 -08:00
Tom Eastep
2f59ea5ca3 Implement the WAIT_OPTION capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-05 09:28:24 -08:00
Tom Eastep
e695e08009 A couple of corrections to the IP[6]TABLE transparency change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-04 14:13:58 -08:00
Tom Eastep
c91b78a875 Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2016-01-04 13:10:48 -08:00
Tom Eastep
70a9240de6 Make IP[6]TABLES transparent 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-04 13:10:03 -08:00
Tom Eastep
06dd5dc38f Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2016-01-02 12:37:43 -08:00
Tom Eastep
fad41e262a Support the DROP command in the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-01-02 12:36:38 -08:00
Tom Eastep
694dc64900 Allow comma in disposition when LOGTAGONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-12-23 09:06:43 -08:00
Tom Eastep
54b6488113 Allow a timeout to be specified in ADD rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-12-23 08:24:00 -08:00
Tom Eastep
8429f68897 Handle MAC addresses in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-12-07 15:15:28 -08:00
Tom Eastep
3ddc2a8f8b Add parentheses for readability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-12-07 08:02:35 -08:00
Tom Eastep
e75c88219f Start optional interfaces when there are no providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-11-05 18:07:31 -08:00
Tom Eastep
460f4bc5b7 Correct defect in processing the 'persistent' route option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-31 08:15:10 -07:00
Tom Eastep
5a3589b9a6 Add some comments in get_params() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-30 08:18:45 -07:00
Tom Eastep
3973cdf0da Merge branch '5.0.1' 2015-10-28 14:35:27 -07:00
Tom Eastep
e39d405e86 More tweaks to params processing and exporting 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-28 14:33:55 -07:00
Tom Eastep
239560be8d Add Cygwin-specific code in get_params() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-28 13:47:40 -07:00
Tom Eastep
3873ebe06a More param handling fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-28 09:37:52 -07:00
Tom Eastep
081cf30447 Don't export variables with parentheses in their names 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-27 17:45:22 -07:00
Tom Eastep
c2768a2d64 Correct error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-26 13:08:09 -07:00
Tom Eastep
4f4358d4db Correct error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-26 13:07:40 -07:00
Tom Eastep
f822afef99 Issue warning if a persistent provider isn't optional 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-26 13:07:28 -07:00
Tom Eastep
56bf8b1572 Don't configure persistence if the interface has no address 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-26 07:42:47 -07:00
Tom Eastep
69dd7ce0b9 Add 'persistent' provider option - Phase II 
- Also allow the creation of 'persistent' routing rules and routes

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-25 16:45:11 -07:00
Tom Eastep
46c3db4f32 Add 'persistent' provider option - Phase I 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-22 06:58:32 -07:00
Tom Eastep
8dc16268a7 Delete main default routes when there are 'load=' or 'fallback=' interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-13 09:34:58 -07:00
Tom Eastep
7388ff5154 Fix RESTART 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-12 14:08:24 -07:00
Tom Eastep
72d4637c22 Replace LEGACY_RESTART with RESTART 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-12 11:45:58 -07:00
Tom Eastep
bb538a7c10 Merge branch 'master' into 5.0.0 
Conflicts:
	Shorewall-core/lib.common
	Shorewall-core/shorewallrc.debian.systemd
	Shorewall-lite/shorewall-lite.service.debian
	Shorewall/Perl/Shorewall/Chains.pm
	Shorewall/Perl/Shorewall/Compiler.pm
	Shorewall/Perl/Shorewall/Config.pm
	Shorewall/Perl/Shorewall/Misc.pm
	Shorewall/Perl/Shorewall/Raw.pm
	Shorewall/Perl/Shorewall/Tc.pm
	Shorewall/Perl/compiler.pl
	Shorewall/Perl/prog.footer
	Shorewall/lib.cli-std
	Shorewall/manpages/shorewall-mangle.xml
	Shorewall/manpages/shorewall.conf.xml
	Shorewall/manpages/shorewall.xml
	Shorewall/shorewall.service.debian
	Shorewall6-lite/shorewall6-lite.service.debian
	Shorewall6/manpages/shorewall6-mangle.xml
	Shorewall6/manpages/shorewall6.conf.xml
	Shorewall6/manpages/shorewall6.xml
	Shorewall6/shorewall6.service.debian
	docs/MultiISP.xml
	docs/Shorewall_Squid_Usage.xml
 2015-10-12 10:55:36 -07:00
Tom Eastep
97e821d12d Use %e rather than %_d for busybox compatibility 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-08 13:16:32 -07:00
Tom Eastep
af18896851 Remove options from 'update' warning messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-10-05 08:19:09 -07:00
Tom Eastep
85e44c70eb Add the Meta-connection to Tinc 
- Both the macro and the tunnel type are updated

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-17 09:17:35 -07:00
Tom Eastep
888444f210 Add the Meta-connection to Tinc 
- Both the macro and the tunnel type are updated

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-17 09:16:33 -07:00
Tom Eastep
03d99de8d5 Correct handling of reset 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-11 15:02:32 -07:00
Tom Eastep
1b571f3d86 Correct the reset command 
- Also allow chain names to be specified a la the refresh command

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-11 14:16:16 -07:00
Tom Eastep
7be4190e4c Man page updates for the PROBABILITY column in the masq files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-08 18:00:53 -07:00
Tom Eastep
ddb325a662 Code changes for a PROBABILITY column in the masq file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-08 17:20:46 -07:00
Tom Eastep
e8ebfb5a11 Correct PSH,FIN check 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-07 15:46:14 -07:00
Tom Eastep
242080c59c Rename SMALL_MASK to SMALL_MAX 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-07 13:10:44 -07:00
Tom Eastep
0aa5cb5086 Allow non-experts to use the user bits in the fw mark 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-07 11:35:47 -07:00
Tom Eastep
4b14924b99 Allow non-experts to use the user bits in the fw mark 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-07 11:29:24 -07:00
Tom Eastep
17d1caf8c5 Allow tags in global LOG_LEVELs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-06 16:08:59 -07:00
Tom Eastep
fcd5b30ca8 Add FIN,RST and PSH,FIN to the tcpflags set 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-06 11:49:29 -07:00
Tom Eastep
e6ec52c711 Move a line of code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-06 10:33:36 -07:00
Tom Eastep
eddd58d459 Move a line of code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-06 10:33:09 -07:00
Tom Eastep
1bf13e5fda Provide default for SHOREWALL_SHELL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-06 10:29:36 -07:00
Tom Eastep
dbf2c89083 Provide default for SHOREWALL_SHELL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-06 10:28:44 -07:00
Tom Eastep
6554f7fe28 Disable bare SECTION in the rules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-04 11:16:07 -07:00
Tom Eastep
8f86e2df19 Correct typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-02 13:07:33 -07:00
Tom Eastep
59aeafba3a Delimit inline matches by ';;' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-02 10:24:31 -07:00
Tom Eastep
9e98d30c92 Correct handling of log levels with default actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-02 08:55:18 -07:00
Tom Eastep
582755edf4 Unconditionally get inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-02 08:03:22 -07:00
Tom Eastep
c6ec9990e7 Unconditionally get inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-02 08:02:02 -07:00
Tom Eastep
dea1f853ea Correct progress messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-01 12:42:01 -07:00
Tom Eastep
a30708519d Correct progress messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-09-01 11:57:28 -07:00
Tom Eastep
f5d9e87c59 Remove anacronistic logic from the Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 16:02:22 -07:00
Tom Eastep
ed90360b4c Remove all of the update-specific options from the update command 
Leave -i and -A

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 14:21:41 -07:00
Tom Eastep
6a374b80e0 Correct INLINE handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 12:36:05 -07:00
Tom Eastep
9638033e24 Cosmetic changes to first_entry() calls 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:
	Shorewall/Perl/Shorewall/Tc.pm
 2015-08-31 11:33:32 -07:00
Tom Eastep
87ef6f730f Correct a typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 11:21:37 -07:00
Tom Eastep
53223e1440 Uniform mechanism for inserting conversion comments 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:
	Shorewall/Perl/Shorewall/Tc.pm
 2015-08-31 11:21:18 -07:00
Tom Eastep
9b886a99af Fix $convert/$tcrules mess 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:
	Shorewall/Perl/Shorewall/Tc.pm
 2015-08-31 11:19:42 -07:00
Tom Eastep
c77d18965a Place a header in a created mangle file during update -t 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:
	Shorewall/Perl/Shorewall/Tc.pm
 2015-08-31 11:16:45 -07:00
Tom Eastep
5a6586e06c Don't enforce FASTACCEPT/BLACKLISTNEWONLY on convert 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 11:14:49 -07:00
Tom Eastep
df73f4b925 Assume EXPORTMODULES=No if it doesn't exist in old file during update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 11:14:26 -07:00
Tom Eastep
be81ace811 Read capabilities file before the .conf file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 11:11:25 -07:00
Tom Eastep
e15a6f452e Cosmetic changes to first_entry() calls 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 10:54:30 -07:00
Tom Eastep
656eaabce9 Correct a typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-31 09:39:40 -07:00
Tom Eastep
f42dc6def1 Uniform mechanism for inserting conversion comments 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-30 15:35:05 -07:00
Tom Eastep
6e303aef69 Fix $convert/$tcrules mess 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-29 18:52:11 -07:00
Tom Eastep
ab260dc5b1 Place a header in a created mangle file during update -t 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-29 12:52:21 -07:00
Tom Eastep
55ab498291 Don't enforce FASTACCEPT/BLACKLISTNEWONLY on convert 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-29 12:51:52 -07:00
Tom Eastep
de74273dbb Assume EXPORTMODULES=No if it doesn't exist in old file during update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-27 15:15:03 -07:00
Tom Eastep
af1e2f6c8b Read capabilities file before the .conf file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-27 11:26:26 -07:00
Tom Eastep
dc2406d25b update -t also converts the 'tos' file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-26 13:51:02 -07:00
Tom Eastep
e0734a45ee Allow 'seconds' and 'minutes' in LOGLIMIT specifications 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-26 12:53:36 -07:00
Tom Eastep
28df894add Improve 'update' 
- convert BLACKLISTNEWONLY
- convert LOGRATE and LOGBURST
- default USE_DEFAULT_RT to No

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-26 12:50:56 -07:00
Tom Eastep
b0bf726c7e Let 'update' default USE_DEFAULT_RT to 'No' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-26 12:40:16 -07:00
Tom Eastep
ad06ec3eef Correct IPV6 range parsing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-26 11:52:51 -07:00
Tom Eastep
71611233fb Correct IPV6 range parsing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-26 11:51:29 -07:00
Tom Eastep
7a98c7b9e5 More 'update' fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-25 15:55:49 -07:00
Tom Eastep
dc73832570 Delete unneeded 'my' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-25 14:36:53 -07:00
Tom Eastep
f5d1ec0243 Delete EXPORTPARAMS from %config 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-25 14:36:14 -07:00
Tom Eastep
f9ae28aeea The -t option also converts the 'tos' file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-24 14:56:24 -07:00
Tom Eastep
f4776bf388 Eliminate WIDE_TC_MARKS, HIGH_ROUTE_MARKS and BLACKLISTNEWONLY 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-21 12:42:19 -07:00
Tom Eastep
80acdd2836 Disallow bare COMMENT, SECTION and FORMAT lines 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-21 11:18:40 -07:00
Tom Eastep
40d1d86d2c Drop support for the 'tos' file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-20 15:35:03 -07:00
Tom Eastep
5af5c67c75 Update a message to refer to the 'mangle' file rather than 'tcrules' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-20 14:54:54 -07:00
Tom Eastep
7956c5f6e0 Update a message to refer to the 'mangle' file rather than 'tcrules' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-20 14:48:29 -07:00
Tom Eastep
82330395e9 Correct grammer in an error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-20 09:25:32 -07:00
Tom Eastep
9f2958fd27 Correct wording of an error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-20 09:21:20 -07:00
Tom Eastep
39982c20c4 Restore the text of tcrules warning message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-19 12:34:35 -07:00
Tom Eastep
2b1f33c391 Don't unlink the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-19 11:48:23 -07:00
Tom Eastep
1c33717cf5 Reverse the change to delete host routes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-19 11:06:28 -07:00
Tom Eastep
cd8fe38c85 Delete host routes added to the main routing table for providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-19 10:44:37 -07:00
Tom Eastep
d525419c65 Correct wording of an error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-19 10:44:00 -07:00
Tom Eastep
9d3f35a22d Enable new update options in compiler.pl 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-16 11:57:36 -07:00
Tom Eastep
6bdf90631c Fix a couple of bugs in 5.0.0 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-16 10:05:21 -07:00
Tom Eastep
c604823053 Default to FORMAT-2 macros and actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-14 16:11:41 -07:00
Tom Eastep
12f8cbae29 Correct the test for the existence of the routestopped file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-14 15:29:52 -07:00
Tom Eastep
4de6638385 Correct handling of termination after .conf file not updated 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-14 09:32:27 -07:00
Tom Eastep
0cef7fad35 Add conversion version and date to the converted files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-14 09:32:17 -07:00
Tom Eastep
ea2a35415e Correct convert_blacklist() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-14 09:32:01 -07:00
Tom Eastep
4cc7a1b87d Correct tcrules update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>

Conflicts:
	Shorewall/Perl/Shorewall/Tc.pm
 2015-08-14 09:31:36 -07:00
Tom Eastep
7c2a969de0 Correct handling of notrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-14 09:26:45 -07:00
Tom Eastep
fd46c0ffed Correct handling of termination after .conf file not updated 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-13 15:42:38 -07:00
Tom Eastep
60acddbb37 Add conversion version and date to the converted files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-13 14:37:13 -07:00
Tom Eastep
306dc34b31 Correct convert_blacklist() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-13 13:22:14 -07:00
Tom Eastep
f5c6a6fe82 Correct tcrules update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-13 13:21:51 -07:00
Tom Eastep
af2b7910bd Port update changes from 5.0.0 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-12 12:33:09 -07:00
Tom Eastep
2ab8bd3040 More update fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-09 14:31:47 -07:00
Tom Eastep
0d635632e3 Add conversion of notrack to conntrack 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-08 16:46:58 -07:00
Tom Eastep
fb2d261cdb More Fixes for update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-08 12:42:32 -07:00
Tom Eastep
88f9a3e255 Allow zero-valued options on multi-zoned interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-07 14:30:21 -07:00
Tom Eastep
4c4c5a436a Allow zero-valued options on multi-zoned interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-07 14:09:08 -07:00
Tom Eastep
73c8b563a1 Add -s option to update to convert the routestopped file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-07 13:46:16 -07:00
Tom Eastep
0f61bd34e6 Drop support for the 'blacklist' zone option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-03 14:45:52 -07:00
Tom Eastep
f4620606b3 Drop support for the 'blacklist' file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-03 14:35:51 -07:00
Tom Eastep
65baa7e3b8 Drop support for the tcrules file 
- The upgrade -t option is still available

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-03 12:34:22 -07:00
Tom Eastep
e5c7ded951 Drop support for the 'notrack' file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-03 11:36:54 -07:00
Tom Eastep
8bed5c9d65 Drop support for the IPSECFILE option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-08-03 10:11:52 -07:00
Tom Eastep
85648bded1 Deimplement several .conf options 
- LOGRATE/LOGBURST
- EXPORTPARAMS
- LEGACY_FASTSTART
 2015-08-01 11:11:35 -07:00
Tom Eastep
67589cab69 More version changes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-28 10:59:11 -07:00
Tom Eastep
fa7248c58c Add the LEGACY_RESTART option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-27 09:19:52 -07:00
Tom Eastep
0a7c65ae0d Allow connlimit by destination 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-26 14:26:58 -07:00
Tom Eastep
6e0fb1ab88 Correct syntax error 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-26 14:16:12 -07:00
Tom Eastep
a00bf196a3 Remove all workarounds 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-26 10:27:30 -07:00
Tom Eastep
f9ec0c6930 New 'reload' and 'restart' semantics 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-26 09:59:49 -07:00
Tom Eastep
d0fc7f6547 Add some comments to the Zones module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-13 12:57:00 -07:00
Tom Eastep
5704438a44 Second Wave of changes to make script output reproducable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-12 15:00:41 -07:00
Tom Eastep
014ec1af1d First phase of producing consistent scripts with Perl >= 5.18.0 
Beginning with Perl 5.18.0, the order of elements returned by the 'keys'
and 'each' iterators is no longer deterministic. This is the first wave
of Shorewall changes to compensate for this irrational behavior.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-12 10:54:48 -07:00
Tom Eastep
4995456563 Clean up compiler PATH fix 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-03 14:33:20 -07:00
Tom Eastep
c6f48a77e0 Only add dhcp rule if one rpfilter interface has the 'dhcp' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-03 12:21:04 -07:00
Tom Eastep
e7792fc868 Exempt IPv4 DHCP broadcasts from rpfilter 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-03 10:03:03 -07:00
Tom Eastep
c47abe416a Add default PATH to current PATH in the compiler 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-07-03 09:38:06 -07:00
Tom Eastep
9f08726794 Eliminate running the script twice is some cases 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-06-26 14:32:43 -07:00
Tom Eastep
116e85e040 Cosmetic cleanup of the Compiler module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-06-08 11:27:37 -07:00
Tom Eastep
2956698298 Corrections to WORKAROUNDS implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-06-06 12:15:03 -07:00
Tom Eastep
eb6be0e84d Remove old comment that now makes no sense 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-06-01 15:55:06 -07:00
Tom Eastep
019e49b481 Implement WORKAROUNDS option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-06-01 12:59:25 -07:00
Tom Eastep
9a3c43b6d3 Make NFQUEUE parsing more robust 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-30 07:01:30 -07:00
Tom Eastep
0a45c7a646 Another Tweak to the NFQUEUE parser 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-30 06:38:21 -07:00
Tom Eastep
f227250959 Fix NFQUEUE parsing and documentation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-29 18:19:35 -07:00
Tom Eastep
29a0c92918 Fix ancient bug in old parameter syntax 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-29 14:39:48 -07:00
Tuomo Soini
4edd6026f0 prog.footer: disabling already disabled inteface is not an error. 
Neither is enabling already enabled interface

Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2015-05-29 22:15:55 +03:00
Tom Eastep
18348ef6f1 Clean up distribute_load() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-27 06:58:10 -07:00
Tom Eastep
93c7e2c2f7 Change the way in which a warning message is suppressed 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-26 15:54:41 -07:00
Tom Eastep
602315938c Correct the load distribution algorithm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-26 14:59:20 -07:00
Tom Eastep
ca35f565e0 Return success exit status when no ipsets are saved by the script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-25 07:36:00 -07:00
Tom Eastep
631ebdecb8 load= enhancements 
- Normalize loads to 0.nnnnnnnn
- Issue warning if the loads don't sum to 1.000000

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-23 08:05:58 -07:00
Tom Eastep
c851e03313 Don't try to use a probibility >= 1.00000000 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-23 07:06:31 -07:00
Tom Eastep
c7ca3119ef Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2015-05-22 07:20:51 -07:00
Tom Eastep
ba7afcaeae Make 'call' a supported command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-21 10:38:35 -07:00
Tom Eastep
809e56cef6 Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2015-05-21 09:04:35 -07:00
Tom Eastep
e3805b0ada Implement 'call' in the compiled script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-21 09:00:11 -07:00
Tom Eastep
f1b6e71e56 Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2015-05-20 10:59:06 -07:00
Tom Eastep
f77d649ac7 Make policy descriptions match what the user entered rather than what was generated by the compiler 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-20 10:58:57 -07:00
Tom Eastep
267637f139 NFQUEUE enhancements 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-20 10:55:21 -07:00
Tom Eastep
acd921cd08 Don't require a helper for ctevents and expevents 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-16 13:40:40 -07:00
Tom Eastep
9329e7c36c Don't require a helper in the CT action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-16 09:08:32 -07:00
Tom Eastep
50d1a719f9 Delete superfluous test 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-08 09:48:58 -07:00
Tom Eastep
3bb1f74283 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code into 4.6.9 2015-05-05 11:28:13 -07:00
Tuomo Soini
87eca92b10 lib.core: use consisten indenting 2015-05-05 20:40:17 +03:00
Tom Eastep
b58aadad01 Correct Syntax error in the generated code. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-04 08:23:42 -07:00
Tom Eastep
6dcd8174ee Don't require interfaces on stop, clear, etc. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-05-04 08:23:10 -07:00
Tom Eastep
3f17a8cf24 Update the program header information in lib.core 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-28 13:13:06 -07:00
Tom Eastep
2cea78e6df Add the 'reenable' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-28 13:02:12 -07:00
Tom Eastep
0abd51c796 Fix module versioning 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-28 11:59:01 -07:00
Tom Eastep
86e053be7a More optimization of detect_configuration() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-28 11:32:45 -07:00
Tom Eastep
75d18139f7 Optimize detect_configuration() for enable/disable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-25 15:46:19 -07:00
Tom Eastep
42f75f7ba2 Correct SetEvent and ResetEvent 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-25 12:56:36 -07:00
Tom Eastep
0e8b427778 Remove false comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-18 14:31:07 -07:00
Tom Eastep
4fd8aa692d Add comment to setting of TCPMSS_TARGET with old caps file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-04 09:34:23 -07:00
Tom Eastep
8c3dda80a3 Simplify previous change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-03 16:35:50 -07:00
Tom Eastep
9f96f58a0d Default TCPMSS_TARGET to 1 in old capabilities files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-04-03 14:46:50 -07:00
Tom Eastep
7442c2189d Implement TCPMSS_TARGET capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-03-31 15:53:05 -07:00
Tom Eastep
468167f9e5 Apply nfw's fix for IP[6]TABLES in the conntrack file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-03-24 09:23:15 -07:00
Tom Eastep
b00a7af619 Allow a comma-separated list in the rtrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-03-18 15:16:25 -07:00
Tom Eastep
0c11870e46 Implement the 'savesets' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-03-17 10:03:12 -07:00
Tom Eastep
2817060edb Improvements to the 'open' and 'close' commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-03-06 08:13:44 -08:00
Tom Eastep
cdc2d52208 Implement ADD and DEL in the mangle file. 
- Also document the parameter to SAME

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-02-18 12:04:01 -08:00
Tom Eastep
18c8f1f835 Remove blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-02-17 20:10:25 -08:00
Tom Eastep
aff8623a44 Allow TTL to be specified in the SAME action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-02-17 19:11:28 -08:00
Tom Eastep
b14e7c54f9 Merge branch '4.6.6' 2015-02-07 08:29:44 -08:00
Orion Poplawski
9ad0b297e2 Supporting xz compressed kernel modules 
- I've attached a patch that adds xz support to the default MODULE_SUFFIX.
- I'm wondering it wouldn't be better to not have MODULE_SUFFX=ko in various
sample configs so that the default value is used instead:

./Shorewall/configfiles/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/Universal/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/three-interfaces/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/two-interfaces/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/one-interface/shorewall.conf:MODULE_SUFFIX=ko
./docs/MultiISP.xml:MODULE_SUFFIX=ko
./docs/MyNetwork.xml:MODULE_SUFFIX=ko
./Shorewall6/configfiles/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/Universal/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/three-interfaces/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/two-interfaces/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/one-interface/shorewall6.conf:MODULE_SUFFIX=ko

- Is:

MODULE_SUFFIX=

sufficient to use the default value or does it need to be commented out?

Thanks,

  Orion

--
Orion Poplawski
Technical Manager                     303-415-9701 x222
NWRA, Boulder/CoRA Office             FAX: 303-415-9702
3380 Mitchell Lane                       orion@nwra.com
Boulder, CO 80301                   http://www.nwra.com

>From f13edf8fc07c7b62825408b8665b10d6014d368d Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@cora.nwra.com>
Date: Mon, 26 Jan 2015 09:48:48 -0700
Subject: [PATCH] Support xz compressed modules

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-02-06 12:51:00 -08:00
Tom Eastep
40104d0c86 Correct handling of +set[n] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-26 07:53:41 -08:00
Tom Eastep
c7cd0060f0 Merge branch '4.6.6' 2015-01-23 09:07:28 -08:00
Tom Eastep
e3b96862ef Propagate the LOCKFILE setting to the generated script. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-23 08:18:30 -08:00
Tom Eastep
a060f683cc Correct file name in mangle 'split_line' error messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-22 08:34:47 -08:00
Tom Eastep
c2b6d974e7 Protect 'enable' and 'disable' with mutex 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-22 08:34:28 -08:00
Tom Eastep
7ab055e61e Correct file name in mangle 'split_line' error messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-22 08:31:51 -08:00
Tom Eastep
08a184d95b Protect 'enable' and 'disable' with mutex 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-22 08:30:05 -08:00
Tom Eastep
50a0103e89 Merge branch '4.6.6' 2015-01-20 08:11:07 -08:00
Tom Eastep
a7cacdfee3 Allow SAVE and RESTORE in the INPUT chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-20 08:09:09 -08:00
Tom Eastep
28ac76bde4 Add tinc tunnel support 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-13 13:28:37 -08:00
Tom Eastep
111c454193 Make leading SHELL case-sensitive 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-13 07:04:20 -08:00
Tom Eastep
97846e14de Correct handling of ipsets in one of the PORTS columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-09 09:28:08 -08:00
Tom Eastep
07c21b8968 Add 'primary' provider option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-06 09:06:27 -08:00
Tom Eastep
668759edad Catch parameter problems with TARPIT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-04 11:09:39 -08:00
Tom Eastep
0f1f54b57b Tweak loopback change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-04 11:00:02 -08:00
Tom Eastep
60d5a177a3 Use the 'Iface Match' capability for loopback traffic. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-04 09:46:39 -08:00
Tom Eastep
3ed5ced581 Correct syntax error introduced in Beta 2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-04 08:35:33 -08:00
Tom Eastep
7dd9ccd06b Add the 'loopback' interface option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-03 09:22:40 -08:00
Tom Eastep
4a4bfe77ce Implement IFACE_MATCH capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-02 09:05:06 -08:00
Tom Eastep
3890b8a884 Infrastructure for detecting loopback interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-02 08:49:38 -08:00
Tom Eastep
551a16d18f Document TARPIT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2015-01-01 09:14:00 -08:00
Tom Eastep
d1b597394f Correct typo (TARPIT_MATCH -> TARPIT_TARGET) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-30 10:22:33 -08:00
Tom Eastep
15a2fd14f9 Implement TARPIT target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-28 15:23:30 -08:00
Tom Eastep
f96baca780 Use the readable representation of the SHA1 digest in the chain table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-27 11:13:10 -08:00
Tom Eastep
1b5f439609 Rewrite 'process_actions' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-27 09:28:02 -08:00
Tom Eastep
1655054de2 Rename 'externalize' to 'external_name' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-27 09:19:00 -08:00
Tom Eastep
89877ed3f7 Rename 'policy_rules' to 'add_policy_rules' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-26 15:58:13 -08:00
Tom Eastep
9649107a8e Rename 'apply_policy_rules' to 'complete_policy_chains' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-26 15:53:50 -08:00
Tom Eastep
33eb47a48a Reorder parameters and change identifiers in set_policy_chain() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-26 15:47:50 -08:00
Tom Eastep
6a15cead52 Cosmetic/commentary changes to the Config Module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-23 15:25:20 -08:00
Tom Eastep
f925358872 Minor Compiler Reorganization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-23 12:27:37 -08:00
Tom Eastep
35fc7b34b8 Minor code tweak 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-20 15:09:21 -08:00
Tom Eastep
79430673b8 Correct handling of duplicate states in the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-16 19:08:25 -08:00
Tom Eastep
695db284c0 Improve Mark Range Implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-15 11:19:23 -08:00
Tom Eastep
807b9ca627 Revert "Improve handling of mark ranges" 
This reverts commit 62f480897e.
 2014-12-15 09:39:24 -08:00
Tom Eastep
62f480897e Improve handling of mark ranges 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-14 09:13:41 -08:00
Tom Eastep
2d7025dcc3 Correct mark range handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-13 08:31:31 -08:00
Tom Eastep
a833815b31 Correct IPv6 handling of LOG_BACKEND=LOG 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-15 08:56:42 -08:00
Tom Eastep
9241552c52 Make emacs sh-mode work better with lib.core 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-14 16:28:44 -08:00
Tom Eastep
16c1809ef2 Apply Alan Barrett's dhclient patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-14 13:39:23 -08:00
Tom Eastep
9a6047b3c4 Correct reversed naming of SHA chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-06 08:18:52 -08:00
Tom Eastep
5b4e3bc07c Accomodate new module names for LOG_BACKEND 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-05 12:51:24 -08:00
Tom Eastep
dc3f163e71 Change the names of the sha1 chains for uniqueness 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-04 17:54:38 -08:00
Tom Eastep
8c0c1bd1e0 Omit the 'shorewall' chain from .ip[6]tables-restore-input 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-02 08:16:47 -08:00
Tom Eastep
8b825c4c4c Avoid failure of ip[6]tables-restore. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-02 07:56:05 -08:00
Tom Eastep
9598ac6fad Correct a couple of problems with -C 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-01 10:09:04 -07:00
Tom Eastep
8fb73026c8 Replace SAVE_COUNTERS with the -C command option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-01 09:37:57 -07:00
Tom Eastep
4546cbaff7 Use chains with names derived from a digest to identify ruleset 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-31 11:36:53 -07:00
Tom Eastep
a83c146636 Cleanup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 20:27:06 -07:00
Tom Eastep
2ffc97867c Correct syntax error in the generated script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 19:59:20 -07:00
Tom Eastep
f08803e293 Preserve counts on 'restart' without compilation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 18:38:45 -07:00
Tom Eastep
3454e10525 Add SAVE_COUNTERS option. 
- Also implement recover command

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 08:57:56 -07:00
Tom Eastep
edc30fcc8d Process the params file with SHOREWALL_SHELL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-29 12:22:00 -07:00
Tom Eastep
85e5669fc7 Rename function interface_up() to interface_enabled() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-27 18:38:22 -07:00
Tom Eastep
f5bdc9e7f4 Allow two limits in the RATE LIMIT columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-22 11:21:43 -07:00
Tom Eastep
3bae6e61cf Eliminate syntax errors in the generated script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-07 07:53:26 -07:00
Tom Eastep
5204cbc95f Suppress 'No ipsets were saved' warning when SAVE_IPSETS=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-07 07:50:12 -07:00
Tom Eastep
ea1b8ac63a Correct handling of empty LOG_BACKEND 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-07 07:34:55 -07:00
Tom Eastep
820c769499 Correct silly bug in last change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-29 07:08:39 -07:00
Tom Eastep
e6b0666ac9 Save ipsets during normal stop (duh) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 18:43:11 -07:00
Tom Eastep
3174454300 Correct SAVE_IPSETS logic in Config.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 14:38:01 -07:00
Tom Eastep
ce1c367d1d Re-commit the fix that saves only the appropriate family 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 14:09:20 -07:00
Tom Eastep
3e2c903a41 Revert "Only save ipsets of the proper family" 
This reverts commit b053cab630.
 2014-09-28 13:32:32 -07:00
Tom Eastep
b053cab630 Only save ipsets of the proper family 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 12:58:52 -07:00
Tom Eastep
6f7d063921 Remove the target file before saving ipsets in the savesets command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 11:53:52 -07:00
Tom Eastep
3858683e94 Allow saving a specified list of ipsets 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 11:19:41 -07:00
Tom Eastep
38a18ac9ac Allow indefinite alternative to 'yes' and 'no' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-27 15:06:18 -07:00
Tom Eastep
a09484356c Support 'yes', 'no, <other> values for simple config options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-27 07:57:46 -07:00
Tom Eastep
bc8588a68e Fix rule numbers in trace output 
- Don't increment $number needlessly when not tracing

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-27 07:57:09 -07:00
Tom Eastep
4989f694cd Correct trace output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-25 14:47:00 -07:00
Tom Eastep
053df2a5fb Go back to original insert_irule() fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-25 09:21:20 -07:00
Tom Eastep
976a1f3deb Merge branch '4.6.3' 
Conflicts:
	Shorewall/Perl/Shorewall/Misc.pm
 2014-09-25 08:06:16 -07:00
Tom Eastep
ea40068c10 Fix ADMINISABSENTMINDED=No used with stoppedrules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-25 08:03:35 -07:00
Tom Eastep
56649e2183 Don't compile routestopped during check if there is stoppedrules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 19:24:13 -07:00
Tom Eastep
520d21c056 Another tweak to LOG_BACKEND 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 17:12:05 -07:00
Tom Eastep
540eff24aa Correctons to LOG_BACKEND implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 16:35:41 -07:00
Tom Eastep
580e00dabd Implement LOG_BACKEND option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 15:26:13 -07:00
Tom Eastep
4815f7eba3 Correct warning message in stoppedrules processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 11:05:15 -07:00
Tom Eastep
7481514a97 Implement the 'terminating' action option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-23 09:29:13 -07:00
Tom Eastep
1f5439257a Revert "Implement the 'terminating' action option" 
This reverts commit 6851744cb7.
 2014-09-23 07:39:25 -07:00
Tom Eastep
d97d45f4ad Merge branch '4.6.3' 2014-09-23 07:10:17 -07:00
Tom Eastep
f9d98b74a2 Merge branch '4.6.2' into 4.6.3 
Conflicts:
	Shorewall/Perl/Shorewall/Providers.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-16 08:09:20 -07:00
Tom Eastep
0d23b9c542 Don't verify required interfaces during 'stop' or 'clear'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-14 09:29:04 -07:00
Tom Eastep
a7bdfcc47b Refine the rule reduction fix 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-11 20:58:01 -07:00
Tom Eastep
988ee64621 Eliminate Redundant Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-11 10:17:01 -07:00
Tom Eastep
9947f4d968 Re-enable SECTION PREROUTING in the accounting file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-10 12:53:08 -07:00
Tom Eastep
9e039e30e5 Issue warning message when /etc/iproute2/rt_tables is not writeable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-02 08:11:33 -07:00
Tom Eastep
6851744cb7 Implement the 'terminating' action option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-01 08:16:42 -07:00
Tom Eastep
f963adccf5 Correct silly typo in Chains.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-31 16:57:24 -07:00
Tom Eastep
fa8c3b3b6c Correct typo in error messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-24 08:34:33 -07:00
Tom Eastep
602ecad712 Cleaner code in expand_variables() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-20 11:25:49 -07:00
Tom Eastep
6f777098d7 Add 'wildcard' member to the interface table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-12 06:51:17 -07:00
Tom Eastep
e545329eb9 Modify the preceding fix to work with wildcard interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-12 06:50:59 -07:00
Tom Eastep
aedd9b5a76 Add 'wildcard' member to the interface table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-11 08:30:44 -07:00
Tom Eastep
427f38109e Some cosmetic cleanup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-10 07:20:23 -07:00
Tom Eastep
0e1a1a3f44 Modify the preceding fix to work with wildcard interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-08 10:34:29 -07:00
Tom Eastep
b6161b8be7 Merge branch '4.6.2' 2014-08-08 08:30:04 -07:00
Tom Eastep
d3209ca624 Correct handling of a physical name in the provider INTERFACE column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-08 08:15:26 -07:00
Tom Eastep
5ef5aa8cdb Allow inline matches in an action file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-05 07:34:24 -07:00
Tom Eastep
0ca12bd86f Correct syntax error caused by replacing '%%' with '??' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-03 15:29:58 -07:00
Tom Eastep
a2f1c57246 Add DNSAmp action 
- Allow escaping '@' allowing u32 in action body
- Allow inline matches in actions

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-03 15:11:25 -07:00
Tom Eastep
fd42fa9f74 Make 'detect_configuration' work in the 'run' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-01 07:34:40 -07:00
Tom Eastep
e49832f4b5 Run the 'init' script in the 'run' command. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-30 10:25:00 -07:00
Tom Eastep
0bf80c15d8 Detect missing <commmand> in the generated scrip 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-29 11:35:32 -07:00
Tom Eastep
31e5aeeaea Refine the 'run' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-29 10:30:07 -07:00
Tom Eastep
a7b18ca875 Implement 'run' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-28 07:04:56 -07:00
Tom Eastep
ad6c91bcbd Allow optimize level 8 to work with Perl 5.20.0. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-25 21:03:48 -07:00
Tom Eastep
461f7b10ba Detect Arptables JF capability when LOAD_HELPERS_ONLY = No. 
- Move detection of Header Match to its proper ordinal.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-20 07:19:02 -07:00
Tom Eastep
2c9eda9cee Add some white space for readability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 18:33:02 -07:00
Tom Eastep
64fc3d2e43 Correct a typo that caused iset couter match to be mis-detected 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 10:27:29 -07:00
Tom Eastep
d0aed87546 Correct IPV6 ipset capabilities checking on 3.14 kernels 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 10:25:46 -07:00
Tom Eastep
56fa6bd78a Revert "Correct ipset detection on later kernels." 
This reverts commit b207f64a85.
 2014-07-19 10:22:12 -07:00
Tom Eastep
b207f64a85 Correct ipset detection on later kernels. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 08:55:02 -07:00
Tom Eastep
9f381209d5 Detect HEADER_MATCH when LOAD_MODULES_ONLY=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 07:20:28 -07:00
Tom Eastep
6771dc54ad Streamline some code from the last commit 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-18 12:58:49 -07:00
Tom Eastep
417bd0138e Correct two problems with tcrules processing: 
- SAVE and RESTORE didn't work
- '|' and '&' were ignored


Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-18 08:32:22 -07:00
Tom Eastep
2ed523101c Allow specification of the MAC address of a gateway 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-06 09:54:53 -07:00
Tom Eastep
c663a14c4d Correct TIME column handling in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-04 08:17:19 -07:00
Tom Eastep
8bfff55ed2 Add a TIME column to the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-04 08:01:14 -07:00
Tom Eastep
b1a6ec7f03 Merge branch '4.6.1' 2014-07-02 21:41:27 -07:00
Tom Eastep
cad8443e01 Allow SAVE/RESTORE rules in the OUTPUT chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-02 12:38:02 -07:00
Tom Eastep
2ad81f1a81 Apply Thibaut Chèze's patch for DSCP names 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-02 12:37:50 -07:00
Tom Eastep
166e1a3df9 Allow SAVE/RESTORE rules in the OUTPUT chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-01 06:54:54 -07:00
Tom Eastep
84437ea689 Apply Thibaut Chèze's patch for DSCP names 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-01 06:52:58 -07:00
Tom Eastep
7fdc398a5e Revert "Revert "Revert "Add a TIME column to the mangle file""" 
This reverts commit 1165b2689c.
 2014-06-27 08:23:04 -07:00
Tom Eastep
1165b2689c Revert "Revert "Add a TIME column to the mangle file"" 
This reverts commit 9c7fcd09fd.
 2014-06-27 08:14:28 -07:00
Tom Eastep
2701b0a756 Correct number of columns in split_line2() calls. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-25 08:22:09 -07:00
Tom Eastep
9c7fcd09fd Revert "Add a TIME column to the mangle file" 
This reverts commit 824b14b714.
 2014-06-25 07:33:42 -07:00
Tom Eastep
824b14b714 Add a TIME column to the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-25 07:05:12 -07:00
Tom Eastep
122d58b122 Clear inline matches in perl_action_tcp_helper 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-21 07:58:27 -07:00
Tom Eastep
61bb73fd8c Correct handling of matches in action_tcp_helper() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-20 14:28:17 -07:00
Tom Eastep
36e31ed839 Correct typo in error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-08 09:40:50 -07:00
Tom Eastep
b55b6a913c Insert the server address list into the error message in DNAT/REDIRECT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-08 09:36:18 -07:00
Tom Eastep
9c9ae04c86 Raise an error when a server list is specified in a DNAT or REDIRECT rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-08 08:52:41 -07:00
Tom Eastep
c898129ad6 Correct pi-rho's patch to not deal with the loopback interface 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-06 13:12:02 -07:00
Tom Eastep
2cd5c41ec0 Clean up white space in pi-rho's patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-06 10:44:33 -07:00
Tom Eastep
bea5434de6 Merge branch '4.5.21' 2014-06-06 10:05:02 -07:00
Tom Eastep
8657dd97f7 Apply pi-rho's patch for rpfilter. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-06 10:04:42 -07:00
Tom Eastep
954cddc37a Enable 1:1 NAT in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-25 12:50:00 -07:00
Tom Eastep
5a22b14947 Enable 1:1 NAT in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-25 08:57:01 -07:00
Tom Eastep
6d3b1d80d4 Make 'update -A' convert the tcrules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-16 14:46:15 -07:00
Tom Eastep
c6565f051e Clean up checking for chain designators with SOURCE $FW. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-16 07:18:35 -07:00
Tom Eastep
c9b6d4a670 Correct CHECKSUM handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-16 07:18:06 -07:00
Tom Eastep
d15956feea Deprecate FORMAT-1 actions and macros 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-08 14:30:33 -07:00
Tom Eastep
f717d097d7 Apply Tuomo Soini's Macro format patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-07 12:19:24 -07:00
Tom Eastep
ba3a7d0621 Do not deprecate USE_DEFAULT_RT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-19 07:53:18 -07:00
Tom Eastep
4d4e8b3df4 Do nothing when a rules file section is empty. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-18 14:13:34 -07:00
Tom Eastep
240d3d8cab Improve interface option inheritence 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-18 13:36:06 -07:00
Tom Eastep
acda5482c4 If USE_DEFAULT_RT isn't specified, make it 'No' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-18 13:22:58 -07:00
Tom Eastep
e731ea1ca8 Revert "Always inherit interface options" 
This reverts commit 65cde3475f.
 2014-04-15 11:54:58 -07:00
Tom Eastep
65cde3475f Always inherit interface options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-15 11:37:51 -07:00
Tom Eastep
b3cd9ab15a Default to LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-12 11:05:28 -07:00
Tom Eastep
58700b2301 Correct the behavior of rpfilter when FASTACCEPT=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-31 07:29:29 -07:00
Tom Eastep
a9ac9c274e Correct the behavior of rpfilter when FASTACCEPT=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-31 07:28:30 -07:00
Tom Eastep
72869adcd6 Correct missing comment in trace entry. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:55 -07:00
Tom Eastep
0c8365001d Avoid spurious comments on jumps to section chains. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:48 -07:00
Tom Eastep
6274f8444f Correct missing comment in trace entry. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:23 -07:00
Tom Eastep
05816e94ee Avoid spurious comments on jumps to section chains. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:00 -07:00
Tom Eastep
0561b10adb Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2014-03-22 08:58:20 -07:00
Tom Eastep
db1b25b4d7 Restore small mark verification. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-22 08:38:57 -07:00
Tom Eastep
4de651ff55 Add a comment line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-19 10:38:41 -07:00
Tom Eastep
5981ce59e3 Include -t <table> in debug_restore_input() error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-19 10:25:37 -07:00
Tom Eastep
54a5e4af52 A couple of minor tweaks to the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-19 10:24:30 -07:00
Tom Eastep
4bd8d9791c Include -t <table> in debug_restore_input() error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-18 07:28:14 -07:00
Tom Eastep
39b7527cb6 Include rule priority in delete of generated address route rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-10 08:25:59 -07:00
Tom Eastep
08d29edf1a Include rule priority in delete of generated address route rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-10 08:24:38 -07:00
Tom Eastep
093ff580b5 Deprecate USE_DEFAULT_RT=No. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-09 07:48:05 -07:00
Tom Eastep
cea237620a Change USE_DEFAULT_RT default to 'Yes'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-09 07:42:22 -07:00
Tom Eastep
c9d7370fb4 Merge branch '4.5.21' 
Conflicts:
	Shorewall/manpages/shorewall.conf.xml
	Shorewall6/manpages/shorewall6.conf.xml

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-05 09:00:34 -08:00
Tom Eastep
8b4d8bfa16 Finish ADMINISABSENDMINDED change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-05 08:57:03 -08:00
Tom Eastep
4eadec234a Revert "Correct the behavior of ADMINISABSENTMINDED" 
This reverts commit ded747a51a.
 2014-03-02 08:25:05 -08:00
Tom Eastep
2b489993ca Revert "Correct the behavior of ADMINISABSENTMINDED" 
This reverts commit df09e0ccc5.
 2014-03-02 08:23:23 -08:00
Tom Eastep
ded747a51a Correct the behavior of ADMINISABSENTMINDED 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-28 10:14:33 -08:00
Tom Eastep
df09e0ccc5 Correct the behavior of ADMINISABSENTMINDED 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-28 10:14:08 -08:00
Tom Eastep
454e53bcfa Reformat preceding patch and correct syntax errors. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-25 13:21:23 -08:00
Tom Eastep
66fdc9f6a7 Call directive_callback for directives without '?' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-25 12:48:25 -08:00
Tom Eastep
c74235a200 Correct typos 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-17 14:17:49 -08:00
Tom Eastep
1759fc75b0 Correctly handle alternate specification with ';' in 'update -t' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-17 14:10:17 -08:00
Tom Eastep
3e87efc82b Document -t option 
- Also copy compiler directives to the mangle file.
 2014-02-17 12:50:59 -08:00
Tom Eastep
a011ad8efe Add raw matches to the converted mangle file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-16 09:59:13 -08:00
Tom Eastep
0e40a42729 Allow SAVE and RESTORE in the postrouting chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-16 09:50:43 -08:00
Tom Eastep
669d15e2cf Implement the -t update option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-15 09:36:13 -08:00
Tom Eastep
2dbcd36a9c Implement BASIC_FILTERS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 16:34:03 -08:00
Tom Eastep
0383ca7de6 Correct semantics of ipset lists in tcfilters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 12:27:46 -08:00
Tom Eastep
7ddc65133e Support ipset lists in the tcfilters file. 
- Also document the fact that ipset match options are not available in
  the tcfilters file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 12:16:35 -08:00
Tom Eastep
1d4a87a0d0 Excape an opening parehthesis. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 12:15:35 -08:00
Tom Eastep
3b3608ad65 Correct ICMP handling in basic filters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 07:16:41 -08:00
Tom Eastep
081a387f1d Fix some bugs in basic filter generation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-03 14:59:27 -08:00
Tom Eastep
50fb8e3f2f Use HEX representation for matching IPv6 addresses in basic filters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-31 12:49:47 -08:00
Tom Eastep
f029f5b483 Correct handling of logging of a non-terminating target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-29 08:22:31 -08:00
Tom Eastep
86f667afd4 Correct handling of logging of a non-terminating target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-29 08:19:53 -08:00
Tom Eastep
8a63053c13 Correct defects found in unit testing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-21 20:19:56 -08:00
Tom Eastep
62557cb98e Correct defects found during testing of ematch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-21 12:53:33 -08:00
Tom Eastep
9c4089fc99 Initial basic filter implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-20 18:40:40 -08:00
Tom Eastep
fd28a12653 Allow DROP in the stoppedrules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-07 13:19:49 -08:00
Tom Eastep
7e6fc3229d Correct handling of default chain when a mark range is specified. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-07 13:15:51 -08:00
Tom Eastep
42dd8dfee9 Change license to GPLv2+ and update copyrights 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-04 09:48:27 -08:00
Tom Eastep
5a7e458104 Backout ematch stuff for now 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-03 12:01:56 -08:00
Tom Eastep
7e1a310929 Implement ipset matches in tcfilters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-03 09:35:34 -08:00
Tom Eastep
78ecf9bdc8 Finish up ipset extensions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-03 09:23:14 -08:00
Tom Eastep
1771bb75cf Finish ipset match option implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-02 14:43:55 -08:00
Tom Eastep
b4847d6a01 New IPSET MATCH extensions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-02 09:36:35 -08:00
Tom Eastep
48ceed9ecb Make tcpflags the default. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 15:10:38 -08:00
Tom Eastep
1083dd8c26 Allow ?COMMENT in the mangle file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 08:02:17 -08:00
Tom Eastep
5e7cd855c2 Correct typo in Tc.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:53:38 -08:00
Tom Eastep
2c2aaf262c Add IP[6]TABLES support for the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:18:36 -08:00
Tom Eastep
6c990a7253 Logically OR builtin definitions from the actions file if the builtin exists 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:18:00 -08:00
Tom Eastep
f7bbac6ea8 Make tcrules/mangle similar to notrack/conntrack. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:15:56 -08:00
Tom Eastep
4c1b83beef Tweaks to the Tc.pm module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-31 11:42:38 -08:00
Tom Eastep
ac6a506e35 Allow logging from the RAW table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-31 11:04:43 -08:00
Tom Eastep
11e61ec6e5 Add chain information to the builtin_target table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-31 08:22:58 -08:00
Tom Eastep
5985a6e9b3 Implement IP[6]TABLES in the rules files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 13:46:58 -08:00
Tom Eastep
66a04e4819 Allow inline matches with IP[6]TABLES 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 10:13:00 -08:00
Tom Eastep
1634267faa Rename JUMP to IP[6]TABLES. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 10:12:33 -08:00
Tom Eastep
c8866ef8bf Correct handling of columns with embedded spaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 08:56:14 -08:00
Tom Eastep
6fe06c82c8 More switch from tcrules to mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-28 15:24:05 -08:00
Tom Eastep
543446f8d7 Integrate tcrules and mangle processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-28 14:24:36 -08:00
Tom Eastep
a1222d10cb change 'marks' file to 'mangle' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-28 10:03:23 -08:00
Tom Eastep
3dba1f5bee Tested version of the marks file handler 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-27 12:38:22 -08:00
Tom Eastep
3960aaee4c Consolidate declarations in process_mark_rule(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-24 09:49:10 -08:00
Tom Eastep
5419109880 Correct syntax errors in new mars handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-24 09:04:54 -08:00
Tom Eastep
584b0ac50e Some small tweaks to the marks file processing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-24 07:25:40 -08:00
Tom Eastep
4c2cedb670 Add get_target_param1() that doesn't accept the <action>/<param> syntax 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-19 09:17:11 -08:00
Tom Eastep
f32a777099 Fix INLINE in tcrles 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-18 09:19:35 -08:00
Tom Eastep
cd5be38cfb Eliminate silly extra loop in accounting processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-18 09:19:16 -08:00
Tom Eastep
2894bb9656 Move INLINE processing into the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-16 12:31:35 -08:00
Tom Eastep
fad3b42bd3 Correct line split in the Accounting module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-16 07:40:41 -08:00
Tom Eastep
4e4e7cac1d Redefine the -i option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-15 11:23:20 -08:00
Tom Eastep
6d72cb3138 Correct update inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-15 09:32:09 -08:00
Tom Eastep
9abe60bc27 Implement the -i option of upgrade 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-14 17:54:10 -08:00
Tom Eastep
33c5893bdb Implement INLINE_MATCHES 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-14 13:35:01 -08:00
Tom Eastep
2bc329aa1d Add INLINE support to the masq file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-13 15:44:16 -08:00
Tom Eastep
95abeaea24 Finish INLINE in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-01 09:25:32 -08:00
Tom Eastep
75258083e3 Cleanup of column splitting change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-01 09:24:49 -08:00
Tom Eastep
bf44e514e3 Keep parentheses balanced when splitting a line. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-30 14:13:42 -08:00
Tom Eastep
e5d250750b Correct handling of ?SECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-27 07:53:33 -08:00
Tom Eastep
d63262a0cb change ZONE2ZONE default to '-'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-24 08:16:28 -08:00
Tom Eastep
3870157898 Issue warning on bare SECTION headings. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-24 07:58:02 -08:00
Tom Eastep
80d54ec40b Implement ?SECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-18 06:57:54 -08:00
Tom Eastep
855cb6e7f4 Correct handling of HFSC classes with DMAX but no UMAX 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-16 08:07:23 -08:00
Tom Eastep
e14d92c5ac Add DROP support in tcrules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-04 10:50:11 -08:00
Tom Eastep
ca3385d1be Remove superfluous '[' from character set. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-21 09:28:21 -07:00
Tom Eastep
5823411091 Correct typo in a regular expression. 
- Re-enable |<mark> in the tctrules file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-21 07:04:23 -07:00
Tom Eastep
66c2fca2b0 Eradicate the use of 'fgrep' 
- Busybox on Leaf Bering does not have fgrep

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-14 07:15:08 -07:00
Tom Eastep
b27e3d2fff Merge branch '4.5.21' 2013-10-08 13:17:41 -07:00
Tom Eastep
5e67808abd Don't add host route in default table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 11:27:41 -07:00
Tom Eastep
fa500b9ea2 Correct H323 and netbios-ns handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:24:52 -07:00
Tom Eastep
b6d7e9ea96 Work around emacs bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:24:40 -07:00
Tom Eastep
0e61c2f210 Correct H323 and netbios-ns handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:20:46 -07:00
Tom Eastep
3c9d984835 Correct typo 
- list_split s/b split_list

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:19:07 -07:00
Tom Eastep
4917500f12 Work around emacs bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 07:13:01 -07:00
Tom Eastep
50b7a81b13 Correct typo 
- list_split s/b split_list

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 06:56:16 -07:00
Tom Eastep
8c4bbf0c85 Implement REAP_OPTION capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-07 07:54:52 -07:00
Tom Eastep
5b515f007b Fix 'monthdays' in the TIME column. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-30 15:43:17 -07:00
Tom Eastep
d7cbd1da21 Allow actions to manipulate the current comment from Perl. 
- Added set_comment()
- moved push/pop_comment() to the :DEFAULT export
 2013-09-23 12:21:44 -07:00
Tom Eastep
eb75d0eef4 Add 'nohostroute' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-18 16:49:54 -07:00
Tom Eastep
5dbcdd65e2 Force 'inline' for REJECT_ACTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-10 07:37:53 -07:00
Tom Eastep
dc5c0dc069 Validate default log levels 
- Name the .conf option involved in error messages

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-06 16:00:15 -07:00
Tom Eastep
87ae801c15 Use the -w ip[6]tables option when available. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-04 10:16:36 -07:00
Tom Eastep
67603c5eb3 Implement REJECT_ACTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-01 09:14:10 -07:00
Tom Eastep
1540e50cce Remove blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-31 10:07:41 -07:00
Tom Eastep
0a2f6c18cc Correct typo in prog.footer 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-13 07:03:20 -07:00
Tom Eastep
32763e998b Make -v work with the status command 
- Also document exit status

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-13 06:52:46 -07:00
Tom Eastep
a10aea280b Add some abbreviations for common commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-06 07:05:47 -07:00
Tom Eastep
ceffc000eb Correct Typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-05 08:32:17 -07:00
Tom Eastep
6615c1f736 Clarify usage of Interface Option Chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-04 09:01:09 -07:00
Tom Eastep
83d1aa6682 Allow OPTIMIZE=All 
- Remove use of literal 4096 from OPTIMIZATION checks.
- Moved constant declarations to the Config module.
- Documented that level 1 is ignored when level 4 is specified.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-29 10:08:35 -07:00
Tom Eastep
aabb22a50f Add the TRACK_RULES option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-24 07:22:51 -07:00
Tom Eastep
7aa33c140d Add an AutoBL action with helper AutoBLL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-17 10:19:18 -07:00
Tom Eastep
891e3e0e1d Use the --reap option in sticky recent rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 14:46:39 -07:00
Tom Eastep
5c7500e13e Display the current time as an integer in 'show event[s]' output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 09:46:08 -07:00
Tom Eastep
09240da55a Change the external name of MARK_ANYWHERE to 'Mark in the filter table' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 09:45:20 -07:00
Tom Eastep
89f16bdb37 Include a current time event in /proc/net/xt_recent/ 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 07:14:22 -07:00
Tom Eastep
8e30831385 Resolve merge conflicts 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-11 14:20:38 -07:00
Tom Eastep
d2725fcd87 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2013-07-11 14:16:19 -07:00
Tom Eastep
9535a7d7df Rename 'Trigger' to 'Event' and document 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-11 10:39:21 -07:00
Tom Eastep
3c6df56b57 Implement Triggers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-10 13:27:58 -07:00
Tom Eastep
411ca87ec3 Allow logging rules with more than 15 ports 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-08 15:59:54 -07:00
Tom Eastep
948a7fccc2 Enhance a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-07 12:52:04 -07:00
Tom Eastep
73060a3761 Correct typo in dropBcast() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-06 07:58:21 -07:00
Tom Eastep
cd83d7727c Restore handle_original_dest(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:51:06 -07:00
Tom Eastep
5121634457 Add ihandle_original_dest() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:37:24 -07:00
Tom Eastep
131c1f432b Add iverify_source_interface() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:07:09 -07:00
Tom Eastep
03885f71d3 Create add_expanded_ijump() that breaks long lines 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-03 15:13:48 -07:00
Tom Eastep
b735b93378 Re-factor irule generation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-03 10:59:09 -07:00
Tom Eastep
5ce5d5e607 Delete superfluous blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 15:03:50 -07:00
Tom Eastep
00c5985458 Rename clone_rule() to clone_irule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:38:16 -07:00
Tom Eastep
1a44b66656 Cleaner handling of trailing spaces from log_irule_limit. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:32:35 -07:00
Tom Eastep
b215cf379a Generate a warning when Limit is invoked. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:31:29 -07:00
Tom Eastep
3ec6745df9 Use log_irule_limit() internally where possible. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 11:48:02 -07:00
Tom Eastep
55be5b0119 Add log_irule_limit() and log_irule() functions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 11:47:19 -07:00
Tom Eastep
42a649d093 Create $globals{LOGILIMIT} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 09:00:36 -07:00
Tom Eastep
18e7e43b2f Eliminate globals{STATEMATCH} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-01 16:01:57 -07:00
Tom Eastep
6803ce5d41 Add constants for %used values. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-01 15:36:16 -07:00
Tom Eastep
565fb74795 Correct bridge detection and 'qt' implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 13:07:38 -07:00
Tom Eastep
fc754040d5 Avoid shell error when detecting owner name match 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 09:51:32 -07:00
Tom Eastep
cc5a59231b Make qt() work correctly when tracing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 07:17:15 -07:00
Tom Eastep
25f96e6a88 Reword unreachable warning (again) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-20 10:50:28 -07:00
Tom Eastep
71bcd11ab6 Make ?...shell/perl directives case insensitive 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-20 10:39:39 -07:00
Tom Eastep
4bd35a0b93 Allow 'routeback=0' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-16 08:37:53 -07:00
Tom Eastep
cb132e2421 Include the chain name in the 'unreachable' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-11 06:29:07 -07:00
Tom Eastep
53f1cd40df Add 'unmanaged' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-10 12:36:18 -07:00
Tom Eastep
c653d9ce83 Only issue one 'unreachable' warning per chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-08 10:02:19 -07:00
Tom Eastep
254d2037ef Delete unused variable. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 15:34:25 -07:00
Tom Eastep
cb8e76b1d2 Add sub get_opttype to emphasize where rule option types are used. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 12:49:20 -07:00
Tom Eastep
2b579d2dff Small efficiency change in helper processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 12:48:22 -07:00
Tom Eastep
fc3e3dbf3c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-03 10:53:33 -07:00
Tom Eastep
81acedd1b3 Reword the 'unreachable' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 17:13:41 -07:00
Tom Eastep
d8f53cc0a9 Merge branch '4.5.17' 
Conflicts:
	Shorewall/Perl/Shorewall/Chains.pm
 2013-06-02 15:31:45 -07:00
Tom Eastep
481811d29f Merge NFACCT and EXPENSIVE matches during optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 13:29:13 -07:00
Tom Eastep
3867902b27 Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 07:31:32 -07:00
Tom Eastep
adf51d0059 Revise the unreachable warning stuff. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 16:32:46 -07:00
Tom Eastep
7dbd50708b Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:35 -07:00
Tom Eastep
4340bcffb1 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:25 -07:00
Tom Eastep
4a05e56d6d Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:16 -07:00
Tom Eastep
2d8078033c Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:03:10 -07:00
Tom Eastep
c5f2eeea80 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:02:39 -07:00
Tom Eastep
5343243f6b Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:01:55 -07:00
Tom Eastep
4865899018 Avoid a forward jump for local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:52:09 -07:00
Tom Eastep
9b68204865 Generate an 'unreachable rule(s)' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:17:22 -07:00
Tom Eastep
a550dd3eed Issue a warning when a rule is dropped do to terminated chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 21:01:07 -07:00
Tom Eastep
f0aa29222f Correct minor IPv6 TPROXY bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 07:18:46 -07:00
Tom Eastep
eaf1d0e5c2 Another error check for hosts files and loopback zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 10:00:07 -07:00
Tom Eastep
446f764d19 Allow config with only local and firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:44 -07:00
Tom Eastep
9b0b3d4b70 Correct ICMPV6 type name translation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:19 -07:00
Tom Eastep
a48a4b7a2e Don't allow fowarding between local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 06:14:44 -07:00
Tom Eastep
8743b64e00 Export 'shorewall' from the Config module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-27 06:52:45 -07:00
Tom Eastep
2de0fbf7d0 Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 14:06:51 -07:00
Tom Eastep
f89c704d01 Disallow 'virtual' physical interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:47:44 -07:00
Tom Eastep
0b5a316cfc Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:03:54 -07:00
Tom Eastep
31f9ea5b93 Add progess and warning messages to 'update -D' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:55 -07:00
Tom Eastep
dde1f0a779 Only enable helpers during a 'clear' operation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:27 -07:00
Tom Eastep
60d0a50d9d Add some warning/progress messages to help understand 'update -D' behavior. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 13:20:12 -07:00
Tom Eastep
064f9f974c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-23 09:49:25 -07:00
Tom Eastep
fd11eb7d82 Omit fw->fw jumps when there is a local zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 09:19:34 -07:00
Tom Eastep
9e77bb5499 Ensure correct match ordering with trivial exclusion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 08:46:22 -07:00
Tom Eastep
8df8fe990a Allow 'local' zone to work with 'destonly' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 07:34:04 -07:00
Tom Eastep
ac02c484f5 Change 'local' interface option to a zone type. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-19 15:35:20 -07:00
Tom Eastep
5ec72dad6c Add routes for standard tables when there are no providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 15:32:05 -07:00
Tom Eastep
f6a55bbf05 Allow the '-V' option in the CLI programs. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 14:29:36 -07:00
Tom Eastep
739f3779f5 Generate warnings for local->non-firewall and non-firewall->local rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 07:51:12 -07:00
Tom Eastep
2e293dd356 Make 'local,destonly' work correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 14:36:51 -07:00
Tom Eastep
a5412cff38 Issue a warning when a rule will be optimized away due to 'destonly'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 09:30:59 -07:00
Tom Eastep
46a6a7b258 Correct earlier optimization. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 07:27:57 -07:00
Tom Eastep
105d1db85d Cosmetic change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 11:24:09 -07:00
Tom Eastep
200d347ac8 Small Efficiency Change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 10:52:04 -07:00
Tom Eastep
c8133145e6 Add support for "all+" in the policy file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 09:01:12 -07:00
Tom Eastep
9178ecbab0 Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:38:44 -07:00
Tom Eastep
d06a7b55b6 Add a 'destonly' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:37:40 -07:00
Tom Eastep
2fb01bec8d Don't assume 'destonly' with 'local'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:58:37 -07:00
Tom Eastep
6551d67b2e Call delete_chain_and_references recursively. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:29:29 -07:00
Tom Eastep
4b76d8c462 Handle optimize level 0 in the IPV6 nat table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:28:25 -07:00
Tom Eastep
1bb5b89ee1 Add the 'local' interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:27:12 -07:00
Tom Eastep
c3901f1161 Release mutex on error. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-09 09:57:09 -07:00
Tom Eastep
56318e6cc8 Try to ensure that cp doesn't copy the firewall script to itself. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-06 09:22:16 -07:00
Tom Eastep
13c90e2aef Correct my update to Mr-4's bup patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 18:40:14 -07:00
Tom Eastep
fdfdb49951 Apply Mr-4's priority->perf patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 14:05:03 -07:00
Tom Eastep
61cb105c02 Apply Mr-4's noautosrc patch (modified) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 14:00:25 -07:00
Tom Eastep
4621dccd53 Apply Mr-4's special route handling in COPY (modified). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 13:27:34 -07:00
Tom Eastep
b83ca4812b Include trailing space in a regular expression. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-03 08:36:38 -07:00