Tom Eastep
fc6a1f6d0d
Don't create Docker chains/rules if Docker isn't running
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-21 09:54:37 -08:00
Tom Eastep
83b899b030
Save/Restore Docker-generated rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-20 14:02:54 -08:00
Tom Eastep
61f6cacc30
Infrastructure required by Docker
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-20 14:01:48 -08:00
Tom Eastep
caba1cd770
DOCKER=Yes requires IPTABLES_S
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-20 10:03:06 -08:00
Tom Eastep
4306ff1029
Correct 'save_dynamic_chains'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-20 09:57:11 -08:00
Tom Eastep
663f82c158
Move nat POSTROUTING rules to SHOREWALL if DOCKER=Yes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-20 09:24:06 -08:00
Tom Eastep
e66d9f6547
Add DOCKER option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-19 17:42:54 -08:00
Tom Eastep
f33f333937
Make 'default' and 'none' case insensitive in the GATEWAY column
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-17 15:25:46 -08:00
Tom Eastep
94cfe54f92
Allow routing tables with no default route
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-17 11:49:09 -08:00
Tom Eastep
8ac0f96029
Delete blank line
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-09 18:20:00 -08:00
Tom Eastep
894a98f24e
Improve optimizer handling of origin during rule merge
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-04 12:00:05 -08:00
Tom Eastep
bd9e8142b9
Ensure that the chain origin is used when there is no rule origin
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-03 10:43:10 -08:00
Tom Eastep
916a392fb0
Improve chain-completion rule tracking
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-02-02 14:57:47 -08:00
Tom Eastep
28983a0194
Add comment describing the origin member of a rule
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-31 09:29:24 -08:00
Tom Eastep
2cd098ba31
Update heading versions and copyrights
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-28 13:46:34 -08:00
Tom Eastep
9188f7efa3
Don't export shortlineinfo2
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-28 13:38:26 -08:00
Tom Eastep
95a029316a
Improve get_keys*()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-28 12:51:23 -08:00
Tom Eastep
d4bea3d3ec
Optimize TRACK_RULES handling in the Chains module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-28 11:38:48 -08:00
Tom Eastep
6085c6092f
Add origin comments to command-mode rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-28 10:58:09 -08:00
Tom Eastep
48df3d9627
Add origin member to the providers table
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-28 10:34:36 -08:00
Tom Eastep
94442abfcf
Correct check for duplicate interface in providers
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-28 10:34:16 -08:00
Tom Eastep
86f2e23f33
Invoke add_irule_extended rather than a hack that predated that function
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-27 19:01:23 -08:00
Tom Eastep
6e9d5f45ec
Avoid spurious comment in jump to interface option chains.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-27 16:50:03 -08:00
Tom Eastep
039fd6ddd8
Move origin handling into log_[i]rule_limit
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-27 14:24:56 -08:00
Tom Eastep
57288086bf
Unify TRACK_RULES handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-27 12:55:21 -08:00
Tom Eastep
f999acda63
Eliminate shortlineinfo1()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-27 10:21:08 -08:00
Tom Eastep
b4723da07c
Eliminate $globals{TRACK_GLOBALS}
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-26 16:45:47 -08:00
Tom Eastep
3860a1dc72
Ensure that %origin is populated
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-26 16:31:04 -08:00
Tom Eastep
e756820ca1
Revert "Unify TRACK_RULES settings implementation"
...
This reverts commit 866cb04cbb
.
2016-01-26 11:49:26 -08:00
Tom Eastep
866cb04cbb
Unify TRACK_RULES settings implementation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-25 18:07:46 -08:00
Tom Eastep
6ef136a546
Add origin information for entries in shorewall[6].conf
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-25 15:49:18 -08:00
Tom Eastep
9b3b4579a2
Change TRACK_RULES setting from Internal to File
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-24 16:15:36 -08:00
Tom Eastep
3e404b765f
Make .ip[6]tables-restore-input comments conditional
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-23 17:04:52 -08:00
Tom Eastep
2235641c9f
Add origin to the ip[6]tables input.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-23 15:13:12 -08:00
Tom Eastep
3fe4619f66
Fix origin in interfaces and hosts
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-23 13:49:52 -08:00
Tom Eastep
247698a14d
Add origin in some rules from the Misc module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-23 12:31:53 -08:00
Tom Eastep
73b20c832c
Add 'origin' member to rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-23 10:45:26 -08:00
Tom Eastep
8ac754caed
Add 'origin' member to the interface and hosts tables
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-21 17:08:19 -08:00
Tom Eastep
1abb77d66d
Remove restrictions on -m geoip
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-18 22:30:15 -08:00
Tom Eastep
a28f3012d5
Correct $VERSION setting in Raw.pm
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-18 09:38:35 -08:00
Tom Eastep
7d443b5e2e
Eliminate return value from process_action()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-18 09:08:35 -08:00
Tom Eastep
a945b3e0dd
Tweak the process_action() changes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-17 17:03:46 -08:00
Tom Eastep
ec6c233666
Centralize Rules module handling of @CALLER in actions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-17 16:29:35 -08:00
Tom Eastep
4059e9de95
Clean up use_policy_action()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-17 12:35:12 -08:00
Tom Eastep
1ee645cd79
Another determinism fix -- red and codel options are now sorted
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-17 09:50:34 -08:00
Tom Eastep
1fedb26f1d
Handle @CALLER in policy chains
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-17 09:42:01 -08:00
Tom Eastep
031371f259
Improve maintainability of action-tuple code
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-16 17:26:16 -08:00
Tom Eastep
742c15b289
Improve @CALLER fix to create unique chains per caller
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-16 17:12:03 -08:00
Tom Eastep
726d1492cd
Correct error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-13 17:08:57 -08:00
Tom Eastep
12513e24a3
Revert "Implement dynamic actions"
...
This reverts commit 8075ba719a
.
2016-01-13 11:04:41 -08:00
Tom Eastep
21765d618d
Create unique chains when @caller is used
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-13 11:04:23 -08:00
Tom Eastep
de21c59885
Correct hashlimit in logging rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-13 09:49:22 -08:00
Tom Eastep
8075ba719a
Implement dynamic actions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-13 09:33:38 -08:00
Tom Eastep
3828eb856b
Rename HADIVERT to DIVERTHA
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-08 15:36:10 -08:00
Tom Eastep
ad2f20b824
Finish HAProxy support
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-06 09:12:33 -08:00
Tom Eastep
4c33c2b957
Add support for HAProxy
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-06 08:27:50 -08:00
Tom Eastep
2f59ea5ca3
Implement the WAIT_OPTION capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-05 09:28:24 -08:00
Tom Eastep
e695e08009
A couple of corrections to the IP[6]TABLE transparency change
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-04 14:13:58 -08:00
Tom Eastep
c91b78a875
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code
2016-01-04 13:10:48 -08:00
Tom Eastep
70a9240de6
Make IP[6]TABLES transparent
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-04 13:10:03 -08:00
Tom Eastep
06dd5dc38f
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code
2016-01-02 12:37:43 -08:00
Tom Eastep
fad41e262a
Support the DROP command in the mangle file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-01-02 12:36:38 -08:00
Tom Eastep
694dc64900
Allow comma in disposition when LOGTAGONLY=Yes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-23 09:06:43 -08:00
Tom Eastep
54b6488113
Allow a timeout to be specified in ADD rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-23 08:24:00 -08:00
Tom Eastep
8429f68897
Handle MAC addresses in IPv6
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-07 15:15:28 -08:00
Tom Eastep
3ddc2a8f8b
Add parentheses for readability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-12-07 08:02:35 -08:00
Tom Eastep
e75c88219f
Start optional interfaces when there are no providers
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-11-05 18:07:31 -08:00
Tom Eastep
460f4bc5b7
Correct defect in processing the 'persistent' route option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-31 08:15:10 -07:00
Tom Eastep
5a3589b9a6
Add some comments in get_params()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-30 08:18:45 -07:00
Tom Eastep
3973cdf0da
Merge branch '5.0.1'
2015-10-28 14:35:27 -07:00
Tom Eastep
e39d405e86
More tweaks to params processing and exporting
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-28 14:33:55 -07:00
Tom Eastep
239560be8d
Add Cygwin-specific code in get_params()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-28 13:47:40 -07:00
Tom Eastep
3873ebe06a
More param handling fixes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-28 09:37:52 -07:00
Tom Eastep
081cf30447
Don't export variables with parentheses in their names
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-27 17:45:22 -07:00
Tom Eastep
c2768a2d64
Correct error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-26 13:08:09 -07:00
Tom Eastep
4f4358d4db
Correct error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-26 13:07:40 -07:00
Tom Eastep
f822afef99
Issue warning if a persistent provider isn't optional
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-26 13:07:28 -07:00
Tom Eastep
56bf8b1572
Don't configure persistence if the interface has no address
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-26 07:42:47 -07:00
Tom Eastep
69dd7ce0b9
Add 'persistent' provider option - Phase II
...
- Also allow the creation of 'persistent' routing rules and routes
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-25 16:45:11 -07:00
Tom Eastep
46c3db4f32
Add 'persistent' provider option - Phase I
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-22 06:58:32 -07:00
Tom Eastep
8dc16268a7
Delete main default routes when there are 'load=' or 'fallback=' interfaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-13 09:34:58 -07:00
Tom Eastep
7388ff5154
Fix RESTART
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-12 14:08:24 -07:00
Tom Eastep
72d4637c22
Replace LEGACY_RESTART with RESTART
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-12 11:45:58 -07:00
Tom Eastep
bb538a7c10
Merge branch 'master' into 5.0.0
...
Conflicts:
Shorewall-core/lib.common
Shorewall-core/shorewallrc.debian.systemd
Shorewall-lite/shorewall-lite.service.debian
Shorewall/Perl/Shorewall/Chains.pm
Shorewall/Perl/Shorewall/Compiler.pm
Shorewall/Perl/Shorewall/Config.pm
Shorewall/Perl/Shorewall/Misc.pm
Shorewall/Perl/Shorewall/Raw.pm
Shorewall/Perl/Shorewall/Tc.pm
Shorewall/Perl/compiler.pl
Shorewall/Perl/prog.footer
Shorewall/lib.cli-std
Shorewall/manpages/shorewall-mangle.xml
Shorewall/manpages/shorewall.conf.xml
Shorewall/manpages/shorewall.xml
Shorewall/shorewall.service.debian
Shorewall6-lite/shorewall6-lite.service.debian
Shorewall6/manpages/shorewall6-mangle.xml
Shorewall6/manpages/shorewall6.conf.xml
Shorewall6/manpages/shorewall6.xml
Shorewall6/shorewall6.service.debian
docs/MultiISP.xml
docs/Shorewall_Squid_Usage.xml
2015-10-12 10:55:36 -07:00
Tom Eastep
97e821d12d
Use %e rather than %_d for busybox compatibility
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-08 13:16:32 -07:00
Tom Eastep
af18896851
Remove options from 'update' warning messages
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-10-05 08:19:09 -07:00
Tom Eastep
85e44c70eb
Add the Meta-connection to Tinc
...
- Both the macro and the tunnel type are updated
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-17 09:17:35 -07:00
Tom Eastep
888444f210
Add the Meta-connection to Tinc
...
- Both the macro and the tunnel type are updated
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-17 09:16:33 -07:00
Tom Eastep
03d99de8d5
Correct handling of reset
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-11 15:02:32 -07:00
Tom Eastep
1b571f3d86
Correct the reset command
...
- Also allow chain names to be specified a la the refresh command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-11 14:16:16 -07:00
Tom Eastep
7be4190e4c
Man page updates for the PROBABILITY column in the masq files
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-08 18:00:53 -07:00
Tom Eastep
ddb325a662
Code changes for a PROBABILITY column in the masq file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-08 17:20:46 -07:00
Tom Eastep
e8ebfb5a11
Correct PSH,FIN check
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-07 15:46:14 -07:00
Tom Eastep
242080c59c
Rename SMALL_MASK to SMALL_MAX
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-07 13:10:44 -07:00
Tom Eastep
0aa5cb5086
Allow non-experts to use the user bits in the fw mark
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-07 11:35:47 -07:00
Tom Eastep
4b14924b99
Allow non-experts to use the user bits in the fw mark
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-07 11:29:24 -07:00
Tom Eastep
17d1caf8c5
Allow tags in global LOG_LEVELs
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-06 16:08:59 -07:00
Tom Eastep
fcd5b30ca8
Add FIN,RST and PSH,FIN to the tcpflags set
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-06 11:49:29 -07:00
Tom Eastep
e6ec52c711
Move a line of code
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-06 10:33:36 -07:00
Tom Eastep
eddd58d459
Move a line of code
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-06 10:33:09 -07:00
Tom Eastep
1bf13e5fda
Provide default for SHOREWALL_SHELL
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-06 10:29:36 -07:00
Tom Eastep
dbf2c89083
Provide default for SHOREWALL_SHELL
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-06 10:28:44 -07:00
Tom Eastep
6554f7fe28
Disable bare SECTION in the rules file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-04 11:16:07 -07:00
Tom Eastep
8f86e2df19
Correct typo
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-02 13:07:33 -07:00
Tom Eastep
59aeafba3a
Delimit inline matches by ';;'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-02 10:24:31 -07:00
Tom Eastep
9e98d30c92
Correct handling of log levels with default actions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-02 08:55:18 -07:00
Tom Eastep
582755edf4
Unconditionally get inline matches
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-02 08:03:22 -07:00
Tom Eastep
c6ec9990e7
Unconditionally get inline matches
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-02 08:02:02 -07:00
Tom Eastep
dea1f853ea
Correct progress messages
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-01 12:42:01 -07:00
Tom Eastep
a30708519d
Correct progress messages
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-09-01 11:57:28 -07:00
Tom Eastep
f5d9e87c59
Remove anacronistic logic from the Rules module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 16:02:22 -07:00
Tom Eastep
ed90360b4c
Remove all of the update-specific options from the update command
...
Leave -i and -A
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 14:21:41 -07:00
Tom Eastep
6a374b80e0
Correct INLINE handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 12:36:05 -07:00
Tom Eastep
9638033e24
Cosmetic changes to first_entry() calls
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
Conflicts:
Shorewall/Perl/Shorewall/Tc.pm
2015-08-31 11:33:32 -07:00
Tom Eastep
87ef6f730f
Correct a typo
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 11:21:37 -07:00
Tom Eastep
53223e1440
Uniform mechanism for inserting conversion comments
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
Conflicts:
Shorewall/Perl/Shorewall/Tc.pm
2015-08-31 11:21:18 -07:00
Tom Eastep
9b886a99af
Fix $convert/$tcrules mess
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
Conflicts:
Shorewall/Perl/Shorewall/Tc.pm
2015-08-31 11:19:42 -07:00
Tom Eastep
c77d18965a
Place a header in a created mangle file during update -t
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
Conflicts:
Shorewall/Perl/Shorewall/Tc.pm
2015-08-31 11:16:45 -07:00
Tom Eastep
5a6586e06c
Don't enforce FASTACCEPT/BLACKLISTNEWONLY on convert
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 11:14:49 -07:00
Tom Eastep
df73f4b925
Assume EXPORTMODULES=No if it doesn't exist in old file during update
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 11:14:26 -07:00
Tom Eastep
be81ace811
Read capabilities file before the .conf file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 11:11:25 -07:00
Tom Eastep
e15a6f452e
Cosmetic changes to first_entry() calls
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 10:54:30 -07:00
Tom Eastep
656eaabce9
Correct a typo
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-31 09:39:40 -07:00
Tom Eastep
f42dc6def1
Uniform mechanism for inserting conversion comments
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-30 15:35:05 -07:00
Tom Eastep
6e303aef69
Fix $convert/$tcrules mess
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-29 18:52:11 -07:00
Tom Eastep
ab260dc5b1
Place a header in a created mangle file during update -t
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-29 12:52:21 -07:00
Tom Eastep
55ab498291
Don't enforce FASTACCEPT/BLACKLISTNEWONLY on convert
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-29 12:51:52 -07:00
Tom Eastep
de74273dbb
Assume EXPORTMODULES=No if it doesn't exist in old file during update
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-27 15:15:03 -07:00
Tom Eastep
af1e2f6c8b
Read capabilities file before the .conf file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-27 11:26:26 -07:00
Tom Eastep
dc2406d25b
update -t also converts the 'tos' file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-26 13:51:02 -07:00
Tom Eastep
e0734a45ee
Allow 'seconds' and 'minutes' in LOGLIMIT specifications
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-26 12:53:36 -07:00
Tom Eastep
28df894add
Improve 'update'
...
- convert BLACKLISTNEWONLY
- convert LOGRATE and LOGBURST
- default USE_DEFAULT_RT to No
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-26 12:50:56 -07:00
Tom Eastep
b0bf726c7e
Let 'update' default USE_DEFAULT_RT to 'No'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-26 12:40:16 -07:00
Tom Eastep
ad06ec3eef
Correct IPV6 range parsing
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-26 11:52:51 -07:00
Tom Eastep
71611233fb
Correct IPV6 range parsing
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-26 11:51:29 -07:00
Tom Eastep
7a98c7b9e5
More 'update' fixes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-25 15:55:49 -07:00
Tom Eastep
dc73832570
Delete unneeded 'my'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-25 14:36:53 -07:00
Tom Eastep
f5d1ec0243
Delete EXPORTPARAMS from %config
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-25 14:36:14 -07:00
Tom Eastep
f9ae28aeea
The -t option also converts the 'tos' file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-24 14:56:24 -07:00
Tom Eastep
f4776bf388
Eliminate WIDE_TC_MARKS, HIGH_ROUTE_MARKS and BLACKLISTNEWONLY
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-21 12:42:19 -07:00
Tom Eastep
80acdd2836
Disallow bare COMMENT, SECTION and FORMAT lines
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-21 11:18:40 -07:00
Tom Eastep
40d1d86d2c
Drop support for the 'tos' file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-20 15:35:03 -07:00
Tom Eastep
5af5c67c75
Update a message to refer to the 'mangle' file rather than 'tcrules'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-20 14:54:54 -07:00
Tom Eastep
7956c5f6e0
Update a message to refer to the 'mangle' file rather than 'tcrules'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-20 14:48:29 -07:00
Tom Eastep
82330395e9
Correct grammer in an error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-20 09:25:32 -07:00
Tom Eastep
9f2958fd27
Correct wording of an error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-20 09:21:20 -07:00
Tom Eastep
39982c20c4
Restore the text of tcrules warning message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-19 12:34:35 -07:00
Tom Eastep
2b1f33c391
Don't unlink the tcrules file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-19 11:48:23 -07:00
Tom Eastep
1c33717cf5
Reverse the change to delete host routes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-19 11:06:28 -07:00
Tom Eastep
cd8fe38c85
Delete host routes added to the main routing table for providers
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-19 10:44:37 -07:00
Tom Eastep
d525419c65
Correct wording of an error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-19 10:44:00 -07:00
Tom Eastep
9d3f35a22d
Enable new update options in compiler.pl
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-16 11:57:36 -07:00
Tom Eastep
6bdf90631c
Fix a couple of bugs in 5.0.0
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-16 10:05:21 -07:00
Tom Eastep
c604823053
Default to FORMAT-2 macros and actions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-14 16:11:41 -07:00
Tom Eastep
12f8cbae29
Correct the test for the existence of the routestopped file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-14 15:29:52 -07:00
Tom Eastep
4de6638385
Correct handling of termination after .conf file not updated
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-14 09:32:27 -07:00
Tom Eastep
0cef7fad35
Add conversion version and date to the converted files.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-14 09:32:17 -07:00
Tom Eastep
ea2a35415e
Correct convert_blacklist()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-14 09:32:01 -07:00
Tom Eastep
4cc7a1b87d
Correct tcrules update
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
Conflicts:
Shorewall/Perl/Shorewall/Tc.pm
2015-08-14 09:31:36 -07:00
Tom Eastep
7c2a969de0
Correct handling of notrack file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-14 09:26:45 -07:00
Tom Eastep
fd46c0ffed
Correct handling of termination after .conf file not updated
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-13 15:42:38 -07:00
Tom Eastep
60acddbb37
Add conversion version and date to the converted files.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-13 14:37:13 -07:00
Tom Eastep
306dc34b31
Correct convert_blacklist()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-13 13:22:14 -07:00
Tom Eastep
f5c6a6fe82
Correct tcrules update
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-13 13:21:51 -07:00
Tom Eastep
af2b7910bd
Port update changes from 5.0.0
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-12 12:33:09 -07:00
Tom Eastep
2ab8bd3040
More update fixes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-09 14:31:47 -07:00
Tom Eastep
0d635632e3
Add conversion of notrack to conntrack
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-08 16:46:58 -07:00
Tom Eastep
fb2d261cdb
More Fixes for update
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-08 12:42:32 -07:00
Tom Eastep
88f9a3e255
Allow zero-valued options on multi-zoned interfaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-07 14:30:21 -07:00
Tom Eastep
4c4c5a436a
Allow zero-valued options on multi-zoned interfaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-07 14:09:08 -07:00
Tom Eastep
73c8b563a1
Add -s option to update to convert the routestopped file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-07 13:46:16 -07:00
Tom Eastep
0f61bd34e6
Drop support for the 'blacklist' zone option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-03 14:45:52 -07:00
Tom Eastep
f4620606b3
Drop support for the 'blacklist' file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-03 14:35:51 -07:00
Tom Eastep
65baa7e3b8
Drop support for the tcrules file
...
- The upgrade -t option is still available
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-03 12:34:22 -07:00
Tom Eastep
e5c7ded951
Drop support for the 'notrack' file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-03 11:36:54 -07:00
Tom Eastep
8bed5c9d65
Drop support for the IPSECFILE option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-08-03 10:11:52 -07:00
Tom Eastep
85648bded1
Deimplement several .conf options
...
- LOGRATE/LOGBURST
- EXPORTPARAMS
- LEGACY_FASTSTART
2015-08-01 11:11:35 -07:00
Tom Eastep
67589cab69
More version changes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-28 10:59:11 -07:00
Tom Eastep
fa7248c58c
Add the LEGACY_RESTART option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-27 09:19:52 -07:00
Tom Eastep
0a7c65ae0d
Allow connlimit by destination
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-26 14:26:58 -07:00
Tom Eastep
6e0fb1ab88
Correct syntax error
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-26 14:16:12 -07:00
Tom Eastep
a00bf196a3
Remove all workarounds
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-26 10:27:30 -07:00
Tom Eastep
f9ec0c6930
New 'reload' and 'restart' semantics
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-26 09:59:49 -07:00
Tom Eastep
d0fc7f6547
Add some comments to the Zones module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-13 12:57:00 -07:00
Tom Eastep
5704438a44
Second Wave of changes to make script output reproducable
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-12 15:00:41 -07:00
Tom Eastep
014ec1af1d
First phase of producing consistent scripts with Perl >= 5.18.0
...
Beginning with Perl 5.18.0, the order of elements returned by the 'keys'
and 'each' iterators is no longer deterministic. This is the first wave
of Shorewall changes to compensate for this irrational behavior.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-12 10:54:48 -07:00
Tom Eastep
4995456563
Clean up compiler PATH fix
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-03 14:33:20 -07:00
Tom Eastep
c6f48a77e0
Only add dhcp rule if one rpfilter interface has the 'dhcp' option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-03 12:21:04 -07:00
Tom Eastep
e7792fc868
Exempt IPv4 DHCP broadcasts from rpfilter
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-03 10:03:03 -07:00
Tom Eastep
c47abe416a
Add default PATH to current PATH in the compiler
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-07-03 09:38:06 -07:00
Tom Eastep
9f08726794
Eliminate running the script twice is some cases
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-06-26 14:32:43 -07:00
Tom Eastep
116e85e040
Cosmetic cleanup of the Compiler module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-06-08 11:27:37 -07:00
Tom Eastep
2956698298
Corrections to WORKAROUNDS implementation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-06-06 12:15:03 -07:00
Tom Eastep
eb6be0e84d
Remove old comment that now makes no sense
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-06-01 15:55:06 -07:00
Tom Eastep
019e49b481
Implement WORKAROUNDS option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-06-01 12:59:25 -07:00
Tom Eastep
9a3c43b6d3
Make NFQUEUE parsing more robust
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-30 07:01:30 -07:00
Tom Eastep
0a45c7a646
Another Tweak to the NFQUEUE parser
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-30 06:38:21 -07:00
Tom Eastep
f227250959
Fix NFQUEUE parsing and documentation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-29 18:19:35 -07:00
Tom Eastep
29a0c92918
Fix ancient bug in old parameter syntax
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-29 14:39:48 -07:00
Tuomo Soini
4edd6026f0
prog.footer: disabling already disabled inteface is not an error.
...
Neither is enabling already enabled interface
Signed-off-by: Tuomo Soini <tis@foobar.fi>
2015-05-29 22:15:55 +03:00
Tom Eastep
18348ef6f1
Clean up distribute_load()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-27 06:58:10 -07:00
Tom Eastep
93c7e2c2f7
Change the way in which a warning message is suppressed
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-26 15:54:41 -07:00
Tom Eastep
602315938c
Correct the load distribution algorithm
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-26 14:59:20 -07:00
Tom Eastep
ca35f565e0
Return success exit status when no ipsets are saved by the script
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-25 07:36:00 -07:00
Tom Eastep
631ebdecb8
load= enhancements
...
- Normalize loads to 0.nnnnnnnn
- Issue warning if the loads don't sum to 1.000000
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-23 08:05:58 -07:00
Tom Eastep
c851e03313
Don't try to use a probibility >= 1.00000000
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-23 07:06:31 -07:00
Tom Eastep
c7ca3119ef
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code
2015-05-22 07:20:51 -07:00
Tom Eastep
ba7afcaeae
Make 'call' a supported command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-21 10:38:35 -07:00
Tom Eastep
809e56cef6
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code
2015-05-21 09:04:35 -07:00
Tom Eastep
e3805b0ada
Implement 'call' in the compiled script
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-21 09:00:11 -07:00
Tom Eastep
f1b6e71e56
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code
2015-05-20 10:59:06 -07:00
Tom Eastep
f77d649ac7
Make policy descriptions match what the user entered rather than what was generated by the compiler
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-20 10:58:57 -07:00
Tom Eastep
267637f139
NFQUEUE enhancements
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-20 10:55:21 -07:00
Tom Eastep
acd921cd08
Don't require a helper for ctevents and expevents
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-16 13:40:40 -07:00
Tom Eastep
9329e7c36c
Don't require a helper in the CT action.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-16 09:08:32 -07:00
Tom Eastep
50d1a719f9
Delete superfluous test
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-08 09:48:58 -07:00
Tom Eastep
3bb1f74283
Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code into 4.6.9
2015-05-05 11:28:13 -07:00
Tuomo Soini
87eca92b10
lib.core: use consisten indenting
2015-05-05 20:40:17 +03:00
Tom Eastep
b58aadad01
Correct Syntax error in the generated code.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-04 08:23:42 -07:00
Tom Eastep
6dcd8174ee
Don't require interfaces on stop, clear, etc.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-05-04 08:23:10 -07:00
Tom Eastep
3f17a8cf24
Update the program header information in lib.core
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-28 13:13:06 -07:00
Tom Eastep
2cea78e6df
Add the 'reenable' command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-28 13:02:12 -07:00
Tom Eastep
0abd51c796
Fix module versioning
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-28 11:59:01 -07:00
Tom Eastep
86e053be7a
More optimization of detect_configuration()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-28 11:32:45 -07:00
Tom Eastep
75d18139f7
Optimize detect_configuration() for enable/disable
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-25 15:46:19 -07:00
Tom Eastep
42f75f7ba2
Correct SetEvent and ResetEvent
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-25 12:56:36 -07:00
Tom Eastep
0e8b427778
Remove false comment
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-18 14:31:07 -07:00
Tom Eastep
4fd8aa692d
Add comment to setting of TCPMSS_TARGET with old caps file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-04 09:34:23 -07:00
Tom Eastep
8c3dda80a3
Simplify previous change
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-03 16:35:50 -07:00
Tom Eastep
9f96f58a0d
Default TCPMSS_TARGET to 1 in old capabilities files.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-04-03 14:46:50 -07:00
Tom Eastep
7442c2189d
Implement TCPMSS_TARGET capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-03-31 15:53:05 -07:00
Tom Eastep
468167f9e5
Apply nfw's fix for IP[6]TABLES in the conntrack file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-03-24 09:23:15 -07:00
Tom Eastep
b00a7af619
Allow a comma-separated list in the rtrules file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-03-18 15:16:25 -07:00
Tom Eastep
0c11870e46
Implement the 'savesets' command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-03-17 10:03:12 -07:00
Tom Eastep
2817060edb
Improvements to the 'open' and 'close' commands
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-03-06 08:13:44 -08:00
Tom Eastep
cdc2d52208
Implement ADD and DEL in the mangle file.
...
- Also document the parameter to SAME
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-02-18 12:04:01 -08:00
Tom Eastep
18c8f1f835
Remove blank line
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-02-17 20:10:25 -08:00
Tom Eastep
aff8623a44
Allow TTL to be specified in the SAME action.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-02-17 19:11:28 -08:00
Tom Eastep
b14e7c54f9
Merge branch '4.6.6'
2015-02-07 08:29:44 -08:00
Orion Poplawski
9ad0b297e2
Supporting xz compressed kernel modules
...
- I've attached a patch that adds xz support to the default MODULE_SUFFIX.
- I'm wondering it wouldn't be better to not have MODULE_SUFFX=ko in various
sample configs so that the default value is used instead:
./Shorewall/configfiles/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/Universal/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/three-interfaces/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/two-interfaces/shorewall.conf:MODULE_SUFFIX=ko
./Shorewall/Samples/one-interface/shorewall.conf:MODULE_SUFFIX=ko
./docs/MultiISP.xml:MODULE_SUFFIX=ko
./docs/MyNetwork.xml:MODULE_SUFFIX=ko
./Shorewall6/configfiles/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/Universal/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/three-interfaces/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/two-interfaces/shorewall6.conf:MODULE_SUFFIX=ko
./Shorewall6/Samples6/one-interface/shorewall6.conf:MODULE_SUFFIX=ko
- Is:
MODULE_SUFFIX=
sufficient to use the default value or does it need to be commented out?
Thanks,
Orion
--
Orion Poplawski
Technical Manager 303-415-9701 x222
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane orion@nwra.com
Boulder, CO 80301 http://www.nwra.com
>From f13edf8fc07c7b62825408b8665b10d6014d368d Mon Sep 17 00:00:00 2001
From: Orion Poplawski <orion@cora.nwra.com>
Date: Mon, 26 Jan 2015 09:48:48 -0700
Subject: [PATCH] Support xz compressed modules
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-02-06 12:51:00 -08:00
Tom Eastep
40104d0c86
Correct handling of +set[n]
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-26 07:53:41 -08:00
Tom Eastep
c7cd0060f0
Merge branch '4.6.6'
2015-01-23 09:07:28 -08:00
Tom Eastep
e3b96862ef
Propagate the LOCKFILE setting to the generated script.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-23 08:18:30 -08:00
Tom Eastep
a060f683cc
Correct file name in mangle 'split_line' error messages
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-22 08:34:47 -08:00
Tom Eastep
c2b6d974e7
Protect 'enable' and 'disable' with mutex
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-22 08:34:28 -08:00
Tom Eastep
7ab055e61e
Correct file name in mangle 'split_line' error messages
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-22 08:31:51 -08:00
Tom Eastep
08a184d95b
Protect 'enable' and 'disable' with mutex
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-22 08:30:05 -08:00
Tom Eastep
50a0103e89
Merge branch '4.6.6'
2015-01-20 08:11:07 -08:00
Tom Eastep
a7cacdfee3
Allow SAVE and RESTORE in the INPUT chain
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-20 08:09:09 -08:00
Tom Eastep
28ac76bde4
Add tinc tunnel support
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-13 13:28:37 -08:00
Tom Eastep
111c454193
Make leading SHELL case-sensitive
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-13 07:04:20 -08:00
Tom Eastep
97846e14de
Correct handling of ipsets in one of the PORTS columns
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-09 09:28:08 -08:00
Tom Eastep
07c21b8968
Add 'primary' provider option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-06 09:06:27 -08:00
Tom Eastep
668759edad
Catch parameter problems with TARPIT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-04 11:09:39 -08:00
Tom Eastep
0f1f54b57b
Tweak loopback change
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-04 11:00:02 -08:00
Tom Eastep
60d5a177a3
Use the 'Iface Match' capability for loopback traffic.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-04 09:46:39 -08:00
Tom Eastep
3ed5ced581
Correct syntax error introduced in Beta 2
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-04 08:35:33 -08:00
Tom Eastep
7dd9ccd06b
Add the 'loopback' interface option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-03 09:22:40 -08:00
Tom Eastep
4a4bfe77ce
Implement IFACE_MATCH capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-02 09:05:06 -08:00
Tom Eastep
3890b8a884
Infrastructure for detecting loopback interfaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-02 08:49:38 -08:00
Tom Eastep
551a16d18f
Document TARPIT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2015-01-01 09:14:00 -08:00
Tom Eastep
d1b597394f
Correct typo (TARPIT_MATCH -> TARPIT_TARGET)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-30 10:22:33 -08:00
Tom Eastep
15a2fd14f9
Implement TARPIT target
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-28 15:23:30 -08:00
Tom Eastep
f96baca780
Use the readable representation of the SHA1 digest in the chain table
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-27 11:13:10 -08:00
Tom Eastep
1b5f439609
Rewrite 'process_actions'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-27 09:28:02 -08:00
Tom Eastep
1655054de2
Rename 'externalize' to 'external_name'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-27 09:19:00 -08:00
Tom Eastep
89877ed3f7
Rename 'policy_rules' to 'add_policy_rules'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-26 15:58:13 -08:00
Tom Eastep
9649107a8e
Rename 'apply_policy_rules' to 'complete_policy_chains'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-26 15:53:50 -08:00
Tom Eastep
33eb47a48a
Reorder parameters and change identifiers in set_policy_chain()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-26 15:47:50 -08:00
Tom Eastep
6a15cead52
Cosmetic/commentary changes to the Config Module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-23 15:25:20 -08:00
Tom Eastep
f925358872
Minor Compiler Reorganization
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-23 12:27:37 -08:00
Tom Eastep
35fc7b34b8
Minor code tweak
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-20 15:09:21 -08:00
Tom Eastep
79430673b8
Correct handling of duplicate states in the mangle file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-16 19:08:25 -08:00
Tom Eastep
695db284c0
Improve Mark Range Implementation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-15 11:19:23 -08:00
Tom Eastep
807b9ca627
Revert "Improve handling of mark ranges"
...
This reverts commit 62f480897e
.
2014-12-15 09:39:24 -08:00
Tom Eastep
62f480897e
Improve handling of mark ranges
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-14 09:13:41 -08:00
Tom Eastep
2d7025dcc3
Correct mark range handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-12-13 08:31:31 -08:00
Tom Eastep
a833815b31
Correct IPv6 handling of LOG_BACKEND=LOG
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-15 08:56:42 -08:00
Tom Eastep
9241552c52
Make emacs sh-mode work better with lib.core
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-14 16:28:44 -08:00
Tom Eastep
16c1809ef2
Apply Alan Barrett's dhclient patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-14 13:39:23 -08:00
Tom Eastep
9a6047b3c4
Correct reversed naming of SHA chains
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-06 08:18:52 -08:00
Tom Eastep
5b4e3bc07c
Accomodate new module names for LOG_BACKEND
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-05 12:51:24 -08:00
Tom Eastep
dc3f163e71
Change the names of the sha1 chains for uniqueness
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-04 17:54:38 -08:00
Tom Eastep
8c0c1bd1e0
Omit the 'shorewall' chain from .ip[6]tables-restore-input
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-02 08:16:47 -08:00
Tom Eastep
8b825c4c4c
Avoid failure of ip[6]tables-restore.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-02 07:56:05 -08:00
Tom Eastep
9598ac6fad
Correct a couple of problems with -C
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-01 10:09:04 -07:00
Tom Eastep
8fb73026c8
Replace SAVE_COUNTERS with the -C command option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-11-01 09:37:57 -07:00
Tom Eastep
4546cbaff7
Use chains with names derived from a digest to identify ruleset
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-31 11:36:53 -07:00
Tom Eastep
a83c146636
Cleanup
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-30 20:27:06 -07:00
Tom Eastep
2ffc97867c
Correct syntax error in the generated script
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-30 19:59:20 -07:00
Tom Eastep
f08803e293
Preserve counts on 'restart' without compilation.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-30 18:38:45 -07:00
Tom Eastep
3454e10525
Add SAVE_COUNTERS option.
...
- Also implement recover command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-30 08:57:56 -07:00
Tom Eastep
edc30fcc8d
Process the params file with SHOREWALL_SHELL
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-29 12:22:00 -07:00
Tom Eastep
85e5669fc7
Rename function interface_up() to interface_enabled()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-27 18:38:22 -07:00
Tom Eastep
f5bdc9e7f4
Allow two limits in the RATE LIMIT columns
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-22 11:21:43 -07:00
Tom Eastep
3bae6e61cf
Eliminate syntax errors in the generated script
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-07 07:53:26 -07:00
Tom Eastep
5204cbc95f
Suppress 'No ipsets were saved' warning when SAVE_IPSETS=No
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-07 07:50:12 -07:00
Tom Eastep
ea1b8ac63a
Correct handling of empty LOG_BACKEND
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-10-07 07:34:55 -07:00
Tom Eastep
820c769499
Correct silly bug in last change
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-29 07:08:39 -07:00
Tom Eastep
e6b0666ac9
Save ipsets during normal stop (duh)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-28 18:43:11 -07:00
Tom Eastep
3174454300
Correct SAVE_IPSETS logic in Config.pm
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-28 14:38:01 -07:00
Tom Eastep
ce1c367d1d
Re-commit the fix that saves only the appropriate family
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-28 14:09:20 -07:00
Tom Eastep
3e2c903a41
Revert "Only save ipsets of the proper family"
...
This reverts commit b053cab630
.
2014-09-28 13:32:32 -07:00
Tom Eastep
b053cab630
Only save ipsets of the proper family
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-28 12:58:52 -07:00
Tom Eastep
6f7d063921
Remove the target file before saving ipsets in the savesets command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-28 11:53:52 -07:00
Tom Eastep
3858683e94
Allow saving a specified list of ipsets
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-28 11:19:41 -07:00
Tom Eastep
38a18ac9ac
Allow indefinite alternative to 'yes' and 'no'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-27 15:06:18 -07:00
Tom Eastep
a09484356c
Support 'yes', 'no, <other> values for simple config options
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-27 07:57:46 -07:00
Tom Eastep
bc8588a68e
Fix rule numbers in trace output
...
- Don't increment $number needlessly when not tracing
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-27 07:57:09 -07:00
Tom Eastep
4989f694cd
Correct trace output
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-25 14:47:00 -07:00
Tom Eastep
053df2a5fb
Go back to original insert_irule() fix.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-25 09:21:20 -07:00
Tom Eastep
976a1f3deb
Merge branch '4.6.3'
...
Conflicts:
Shorewall/Perl/Shorewall/Misc.pm
2014-09-25 08:06:16 -07:00
Tom Eastep
ea40068c10
Fix ADMINISABSENTMINDED=No used with stoppedrules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-25 08:03:35 -07:00
Tom Eastep
56649e2183
Don't compile routestopped during check if there is stoppedrules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-24 19:24:13 -07:00
Tom Eastep
520d21c056
Another tweak to LOG_BACKEND
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-24 17:12:05 -07:00
Tom Eastep
540eff24aa
Correctons to LOG_BACKEND implementation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-24 16:35:41 -07:00
Tom Eastep
580e00dabd
Implement LOG_BACKEND option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-24 15:26:13 -07:00
Tom Eastep
4815f7eba3
Correct warning message in stoppedrules processing.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-24 11:05:15 -07:00
Tom Eastep
7481514a97
Implement the 'terminating' action option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-23 09:29:13 -07:00
Tom Eastep
1f5439257a
Revert "Implement the 'terminating' action option"
...
This reverts commit 6851744cb7
.
2014-09-23 07:39:25 -07:00
Tom Eastep
d97d45f4ad
Merge branch '4.6.3'
2014-09-23 07:10:17 -07:00
Tom Eastep
f9d98b74a2
Merge branch '4.6.2' into 4.6.3
...
Conflicts:
Shorewall/Perl/Shorewall/Providers.pm
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-16 08:09:20 -07:00
Tom Eastep
0d23b9c542
Don't verify required interfaces during 'stop' or 'clear'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-14 09:29:04 -07:00
Tom Eastep
a7bdfcc47b
Refine the rule reduction fix
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-11 20:58:01 -07:00
Tom Eastep
988ee64621
Eliminate Redundant Rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-11 10:17:01 -07:00
Tom Eastep
9947f4d968
Re-enable SECTION PREROUTING in the accounting file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-10 12:53:08 -07:00
Tom Eastep
9e039e30e5
Issue warning message when /etc/iproute2/rt_tables is not writeable
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-02 08:11:33 -07:00
Tom Eastep
6851744cb7
Implement the 'terminating' action option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-09-01 08:16:42 -07:00
Tom Eastep
f963adccf5
Correct silly typo in Chains.pm
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-31 16:57:24 -07:00
Tom Eastep
fa8c3b3b6c
Correct typo in error messages
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-24 08:34:33 -07:00
Tom Eastep
602ecad712
Cleaner code in expand_variables()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-20 11:25:49 -07:00
Tom Eastep
6f777098d7
Add 'wildcard' member to the interface table
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-12 06:51:17 -07:00
Tom Eastep
e545329eb9
Modify the preceding fix to work with wildcard interfaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-12 06:50:59 -07:00
Tom Eastep
aedd9b5a76
Add 'wildcard' member to the interface table
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-11 08:30:44 -07:00
Tom Eastep
427f38109e
Some cosmetic cleanup
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-10 07:20:23 -07:00
Tom Eastep
0e1a1a3f44
Modify the preceding fix to work with wildcard interfaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-08 10:34:29 -07:00
Tom Eastep
b6161b8be7
Merge branch '4.6.2'
2014-08-08 08:30:04 -07:00
Tom Eastep
d3209ca624
Correct handling of a physical name in the provider INTERFACE column
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-08 08:15:26 -07:00
Tom Eastep
5ef5aa8cdb
Allow inline matches in an action file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-05 07:34:24 -07:00
Tom Eastep
0ca12bd86f
Correct syntax error caused by replacing '%%' with '??'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-03 15:29:58 -07:00
Tom Eastep
a2f1c57246
Add DNSAmp action
...
- Allow escaping '@' allowing u32 in action body
- Allow inline matches in actions
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-03 15:11:25 -07:00
Tom Eastep
fd42fa9f74
Make 'detect_configuration' work in the 'run' command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-08-01 07:34:40 -07:00
Tom Eastep
e49832f4b5
Run the 'init' script in the 'run' command.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-30 10:25:00 -07:00
Tom Eastep
0bf80c15d8
Detect missing <commmand> in the generated scrip
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-29 11:35:32 -07:00
Tom Eastep
31e5aeeaea
Refine the 'run' command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-29 10:30:07 -07:00
Tom Eastep
a7b18ca875
Implement 'run' command
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-28 07:04:56 -07:00
Tom Eastep
ad6c91bcbd
Allow optimize level 8 to work with Perl 5.20.0.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-25 21:03:48 -07:00
Tom Eastep
461f7b10ba
Detect Arptables JF capability when LOAD_HELPERS_ONLY = No.
...
- Move detection of Header Match to its proper ordinal.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-20 07:19:02 -07:00
Tom Eastep
2c9eda9cee
Add some white space for readability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-19 18:33:02 -07:00
Tom Eastep
64fc3d2e43
Correct a typo that caused iset couter match to be mis-detected
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-19 10:27:29 -07:00
Tom Eastep
d0aed87546
Correct IPV6 ipset capabilities checking on 3.14 kernels
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-19 10:25:46 -07:00
Tom Eastep
56fa6bd78a
Revert "Correct ipset detection on later kernels."
...
This reverts commit b207f64a85
.
2014-07-19 10:22:12 -07:00
Tom Eastep
b207f64a85
Correct ipset detection on later kernels.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-19 08:55:02 -07:00
Tom Eastep
9f381209d5
Detect HEADER_MATCH when LOAD_MODULES_ONLY=No
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-19 07:20:28 -07:00
Tom Eastep
6771dc54ad
Streamline some code from the last commit
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-18 12:58:49 -07:00
Tom Eastep
417bd0138e
Correct two problems with tcrules processing:
...
- SAVE and RESTORE didn't work
- '|' and '&' were ignored
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-18 08:32:22 -07:00
Tom Eastep
2ed523101c
Allow specification of the MAC address of a gateway
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-06 09:54:53 -07:00
Tom Eastep
c663a14c4d
Correct TIME column handling in IPv6
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-04 08:17:19 -07:00
Tom Eastep
8bfff55ed2
Add a TIME column to the mangle file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-04 08:01:14 -07:00
Tom Eastep
b1a6ec7f03
Merge branch '4.6.1'
2014-07-02 21:41:27 -07:00
Tom Eastep
cad8443e01
Allow SAVE/RESTORE rules in the OUTPUT chain
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-02 12:38:02 -07:00
Tom Eastep
2ad81f1a81
Apply Thibaut Chèze's patch for DSCP names
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-02 12:37:50 -07:00
Tom Eastep
166e1a3df9
Allow SAVE/RESTORE rules in the OUTPUT chain
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-01 06:54:54 -07:00
Tom Eastep
84437ea689
Apply Thibaut Chèze's patch for DSCP names
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-07-01 06:52:58 -07:00
Tom Eastep
7fdc398a5e
Revert "Revert "Revert "Add a TIME column to the mangle file"""
...
This reverts commit 1165b2689c
.
2014-06-27 08:23:04 -07:00
Tom Eastep
1165b2689c
Revert "Revert "Add a TIME column to the mangle file""
...
This reverts commit 9c7fcd09fd
.
2014-06-27 08:14:28 -07:00
Tom Eastep
2701b0a756
Correct number of columns in split_line2() calls.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-25 08:22:09 -07:00
Tom Eastep
9c7fcd09fd
Revert "Add a TIME column to the mangle file"
...
This reverts commit 824b14b714
.
2014-06-25 07:33:42 -07:00
Tom Eastep
824b14b714
Add a TIME column to the mangle file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-25 07:05:12 -07:00
Tom Eastep
122d58b122
Clear inline matches in perl_action_tcp_helper
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-21 07:58:27 -07:00
Tom Eastep
61bb73fd8c
Correct handling of matches in action_tcp_helper()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-20 14:28:17 -07:00
Tom Eastep
36e31ed839
Correct typo in error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-08 09:40:50 -07:00
Tom Eastep
b55b6a913c
Insert the server address list into the error message in DNAT/REDIRECT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-08 09:36:18 -07:00
Tom Eastep
9c9ae04c86
Raise an error when a server list is specified in a DNAT or REDIRECT rule
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-08 08:52:41 -07:00
Tom Eastep
c898129ad6
Correct pi-rho's patch to not deal with the loopback interface
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-06 13:12:02 -07:00
Tom Eastep
2cd5c41ec0
Clean up white space in pi-rho's patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-06 10:44:33 -07:00
Tom Eastep
bea5434de6
Merge branch '4.5.21'
2014-06-06 10:05:02 -07:00
Tom Eastep
8657dd97f7
Apply pi-rho's patch for rpfilter.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-06-06 10:04:42 -07:00
Tom Eastep
954cddc37a
Enable 1:1 NAT in IPv6
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-05-25 12:50:00 -07:00
Tom Eastep
5a22b14947
Enable 1:1 NAT in IPv6
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-05-25 08:57:01 -07:00
Tom Eastep
6d3b1d80d4
Make 'update -A' convert the tcrules file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-05-16 14:46:15 -07:00
Tom Eastep
c6565f051e
Clean up checking for chain designators with SOURCE $FW.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-05-16 07:18:35 -07:00
Tom Eastep
c9b6d4a670
Correct CHECKSUM handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-05-16 07:18:06 -07:00
Tom Eastep
d15956feea
Deprecate FORMAT-1 actions and macros
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-05-08 14:30:33 -07:00
Tom Eastep
f717d097d7
Apply Tuomo Soini's Macro format patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-05-07 12:19:24 -07:00
Tom Eastep
ba3a7d0621
Do not deprecate USE_DEFAULT_RT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-04-19 07:53:18 -07:00
Tom Eastep
4d4e8b3df4
Do nothing when a rules file section is empty.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-04-18 14:13:34 -07:00
Tom Eastep
240d3d8cab
Improve interface option inheritence
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-04-18 13:36:06 -07:00
Tom Eastep
acda5482c4
If USE_DEFAULT_RT isn't specified, make it 'No'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-04-18 13:22:58 -07:00
Tom Eastep
e731ea1ca8
Revert "Always inherit interface options"
...
This reverts commit 65cde3475f
.
2014-04-15 11:54:58 -07:00
Tom Eastep
65cde3475f
Always inherit interface options
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-04-15 11:37:51 -07:00
Tom Eastep
b3cd9ab15a
Default to LOAD_HELPERS_ONLY=Yes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-04-12 11:05:28 -07:00
Tom Eastep
58700b2301
Correct the behavior of rpfilter when FASTACCEPT=Yes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-31 07:29:29 -07:00
Tom Eastep
a9ac9c274e
Correct the behavior of rpfilter when FASTACCEPT=Yes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-31 07:28:30 -07:00
Tom Eastep
72869adcd6
Correct missing comment in trace entry.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-28 08:55:55 -07:00
Tom Eastep
0c8365001d
Avoid spurious comments on jumps to section chains.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-28 08:55:48 -07:00
Tom Eastep
6274f8444f
Correct missing comment in trace entry.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-28 08:55:23 -07:00
Tom Eastep
05816e94ee
Avoid spurious comments on jumps to section chains.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-28 08:55:00 -07:00
Tom Eastep
0561b10adb
Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code
2014-03-22 08:58:20 -07:00
Tom Eastep
db1b25b4d7
Restore small mark verification.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-22 08:38:57 -07:00
Tom Eastep
4de651ff55
Add a comment line
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-19 10:38:41 -07:00
Tom Eastep
5981ce59e3
Include -t <table> in debug_restore_input() error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-19 10:25:37 -07:00
Tom Eastep
54a5e4af52
A couple of minor tweaks to the Chains module.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-19 10:24:30 -07:00
Tom Eastep
4bd8d9791c
Include -t <table> in debug_restore_input() error message
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-18 07:28:14 -07:00
Tom Eastep
39b7527cb6
Include rule priority in delete of generated address route rules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-10 08:25:59 -07:00
Tom Eastep
08d29edf1a
Include rule priority in delete of generated address route rules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-10 08:24:38 -07:00
Tom Eastep
093ff580b5
Deprecate USE_DEFAULT_RT=No.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-09 07:48:05 -07:00
Tom Eastep
cea237620a
Change USE_DEFAULT_RT default to 'Yes'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-09 07:42:22 -07:00
Tom Eastep
c9d7370fb4
Merge branch '4.5.21'
...
Conflicts:
Shorewall/manpages/shorewall.conf.xml
Shorewall6/manpages/shorewall6.conf.xml
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-05 09:00:34 -08:00
Tom Eastep
8b4d8bfa16
Finish ADMINISABSENDMINDED change
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-03-05 08:57:03 -08:00
Tom Eastep
4eadec234a
Revert "Correct the behavior of ADMINISABSENTMINDED"
...
This reverts commit ded747a51a
.
2014-03-02 08:25:05 -08:00
Tom Eastep
2b489993ca
Revert "Correct the behavior of ADMINISABSENTMINDED"
...
This reverts commit df09e0ccc5
.
2014-03-02 08:23:23 -08:00
Tom Eastep
ded747a51a
Correct the behavior of ADMINISABSENTMINDED
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-28 10:14:33 -08:00
Tom Eastep
df09e0ccc5
Correct the behavior of ADMINISABSENTMINDED
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-28 10:14:08 -08:00
Tom Eastep
454e53bcfa
Reformat preceding patch and correct syntax errors.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-25 13:21:23 -08:00
Tom Eastep
66fdc9f6a7
Call directive_callback for directives without '?'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-25 12:48:25 -08:00
Tom Eastep
c74235a200
Correct typos
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-17 14:17:49 -08:00
Tom Eastep
1759fc75b0
Correctly handle alternate specification with ';' in 'update -t'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-17 14:10:17 -08:00
Tom Eastep
3e87efc82b
Document -t option
...
- Also copy compiler directives to the mangle file.
2014-02-17 12:50:59 -08:00
Tom Eastep
a011ad8efe
Add raw matches to the converted mangle file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-16 09:59:13 -08:00
Tom Eastep
0e40a42729
Allow SAVE and RESTORE in the postrouting chain
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-16 09:50:43 -08:00
Tom Eastep
669d15e2cf
Implement the -t update option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-15 09:36:13 -08:00
Tom Eastep
2dbcd36a9c
Implement BASIC_FILTERS
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-04 16:34:03 -08:00
Tom Eastep
0383ca7de6
Correct semantics of ipset lists in tcfilters
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-04 12:27:46 -08:00
Tom Eastep
7ddc65133e
Support ipset lists in the tcfilters file.
...
- Also document the fact that ipset match options are not available in
the tcfilters file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-04 12:16:35 -08:00
Tom Eastep
1d4a87a0d0
Excape an opening parehthesis.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-04 12:15:35 -08:00
Tom Eastep
3b3608ad65
Correct ICMP handling in basic filters.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-04 07:16:41 -08:00
Tom Eastep
081a387f1d
Fix some bugs in basic filter generation.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-02-03 14:59:27 -08:00
Tom Eastep
50fb8e3f2f
Use HEX representation for matching IPv6 addresses in basic filters.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-31 12:49:47 -08:00
Tom Eastep
f029f5b483
Correct handling of logging of a non-terminating target
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-29 08:22:31 -08:00
Tom Eastep
86f667afd4
Correct handling of logging of a non-terminating target
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-29 08:19:53 -08:00
Tom Eastep
8a63053c13
Correct defects found in unit testing
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-21 20:19:56 -08:00
Tom Eastep
62557cb98e
Correct defects found during testing of ematch.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-21 12:53:33 -08:00
Tom Eastep
9c4089fc99
Initial basic filter implementation.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-20 18:40:40 -08:00
Tom Eastep
fd28a12653
Allow DROP in the stoppedrules file
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-07 13:19:49 -08:00
Tom Eastep
7e6fc3229d
Correct handling of default chain when a mark range is specified.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-07 13:15:51 -08:00
Tom Eastep
42dd8dfee9
Change license to GPLv2+ and update copyrights
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-04 09:48:27 -08:00
Tom Eastep
5a7e458104
Backout ematch stuff for now
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-03 12:01:56 -08:00
Tom Eastep
7e1a310929
Implement ipset matches in tcfilters
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-03 09:35:34 -08:00
Tom Eastep
78ecf9bdc8
Finish up ipset extensions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-03 09:23:14 -08:00
Tom Eastep
1771bb75cf
Finish ipset match option implementation.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-02 14:43:55 -08:00
Tom Eastep
b4847d6a01
New IPSET MATCH extensions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-02 09:36:35 -08:00
Tom Eastep
48ceed9ecb
Make tcpflags the default.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-01 15:10:38 -08:00
Tom Eastep
1083dd8c26
Allow ?COMMENT in the mangle file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-01 08:02:17 -08:00
Tom Eastep
5e7cd855c2
Correct typo in Tc.pm
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-01 07:53:38 -08:00
Tom Eastep
2c2aaf262c
Add IP[6]TABLES support for the conntrack file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-01 07:18:36 -08:00
Tom Eastep
6c990a7253
Logically OR builtin definitions from the actions file if the builtin exists
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-01 07:18:00 -08:00
Tom Eastep
f7bbac6ea8
Make tcrules/mangle similar to notrack/conntrack.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2014-01-01 07:15:56 -08:00
Tom Eastep
4c1b83beef
Tweaks to the Tc.pm module.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-31 11:42:38 -08:00
Tom Eastep
ac6a506e35
Allow logging from the RAW table
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-31 11:04:43 -08:00
Tom Eastep
11e61ec6e5
Add chain information to the builtin_target table.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-31 08:22:58 -08:00
Tom Eastep
5985a6e9b3
Implement IP[6]TABLES in the rules files.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-29 13:46:58 -08:00
Tom Eastep
66a04e4819
Allow inline matches with IP[6]TABLES
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-29 10:13:00 -08:00
Tom Eastep
1634267faa
Rename JUMP to IP[6]TABLES.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-29 10:12:33 -08:00
Tom Eastep
c8866ef8bf
Correct handling of columns with embedded spaces
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-29 08:56:14 -08:00
Tom Eastep
6fe06c82c8
More switch from tcrules to mangle
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-28 15:24:05 -08:00
Tom Eastep
543446f8d7
Integrate tcrules and mangle processing.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-28 14:24:36 -08:00
Tom Eastep
a1222d10cb
change 'marks' file to 'mangle'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-28 10:03:23 -08:00
Tom Eastep
3dba1f5bee
Tested version of the marks file handler
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-27 12:38:22 -08:00
Tom Eastep
3960aaee4c
Consolidate declarations in process_mark_rule().
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-24 09:49:10 -08:00
Tom Eastep
5419109880
Correct syntax errors in new mars handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-24 09:04:54 -08:00
Tom Eastep
584b0ac50e
Some small tweaks to the marks file processing
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-24 07:25:40 -08:00
Tom Eastep
4c2cedb670
Add get_target_param1() that doesn't accept the <action>/<param> syntax
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-19 09:17:11 -08:00
Tom Eastep
f32a777099
Fix INLINE in tcrles
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-18 09:19:35 -08:00
Tom Eastep
cd5be38cfb
Eliminate silly extra loop in accounting processing.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-18 09:19:16 -08:00
Tom Eastep
2894bb9656
Move INLINE processing into the Chains module.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-16 12:31:35 -08:00
Tom Eastep
fad3b42bd3
Correct line split in the Accounting module
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-16 07:40:41 -08:00
Tom Eastep
4e4e7cac1d
Redefine the -i option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-15 11:23:20 -08:00
Tom Eastep
6d72cb3138
Correct update inline
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-15 09:32:09 -08:00
Tom Eastep
9abe60bc27
Implement the -i option of upgrade
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-14 17:54:10 -08:00
Tom Eastep
33c5893bdb
Implement INLINE_MATCHES
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-14 13:35:01 -08:00
Tom Eastep
2bc329aa1d
Add INLINE support to the masq file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-13 15:44:16 -08:00
Tom Eastep
95abeaea24
Finish INLINE in the tcrules file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-01 09:25:32 -08:00
Tom Eastep
75258083e3
Cleanup of column splitting change.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-12-01 09:24:49 -08:00
Tom Eastep
bf44e514e3
Keep parentheses balanced when splitting a line.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-11-30 14:13:42 -08:00
Tom Eastep
e5d250750b
Correct handling of ?SECTION
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-11-27 07:53:33 -08:00
Tom Eastep
d63262a0cb
change ZONE2ZONE default to '-'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-11-24 08:16:28 -08:00
Tom Eastep
3870157898
Issue warning on bare SECTION headings.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-11-24 07:58:02 -08:00
Tom Eastep
80d54ec40b
Implement ?SECTION
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-11-18 06:57:54 -08:00
Tom Eastep
855cb6e7f4
Correct handling of HFSC classes with DMAX but no UMAX
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-11-16 08:07:23 -08:00
Tom Eastep
e14d92c5ac
Add DROP support in tcrules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-11-04 10:50:11 -08:00
Tom Eastep
ca3385d1be
Remove superfluous '[' from character set.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-21 09:28:21 -07:00
Tom Eastep
5823411091
Correct typo in a regular expression.
...
- Re-enable |<mark> in the tctrules file.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-21 07:04:23 -07:00
Tom Eastep
66c2fca2b0
Eradicate the use of 'fgrep'
...
- Busybox on Leaf Bering does not have fgrep
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-14 07:15:08 -07:00
Tom Eastep
b27e3d2fff
Merge branch '4.5.21'
2013-10-08 13:17:41 -07:00
Tom Eastep
5e67808abd
Don't add host route in default table.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-08 11:27:41 -07:00
Tom Eastep
fa500b9ea2
Correct H323 and netbios-ns handling.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-08 09:24:52 -07:00
Tom Eastep
b6d7e9ea96
Work around emacs bug
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-08 09:24:40 -07:00
Tom Eastep
0e61c2f210
Correct H323 and netbios-ns handling.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-08 09:20:46 -07:00
Tom Eastep
3c9d984835
Correct typo
...
- list_split s/b split_list
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-08 09:19:07 -07:00
Tom Eastep
4917500f12
Work around emacs bug
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-08 07:13:01 -07:00
Tom Eastep
50b7a81b13
Correct typo
...
- list_split s/b split_list
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-08 06:56:16 -07:00
Tom Eastep
8c4bbf0c85
Implement REAP_OPTION capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-10-07 07:54:52 -07:00
Tom Eastep
5b515f007b
Fix 'monthdays' in the TIME column.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-09-30 15:43:17 -07:00
Tom Eastep
d7cbd1da21
Allow actions to manipulate the current comment from Perl.
...
- Added set_comment()
- moved push/pop_comment() to the :DEFAULT export
2013-09-23 12:21:44 -07:00
Tom Eastep
eb75d0eef4
Add 'nohostroute' option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-09-18 16:49:54 -07:00
Tom Eastep
5dbcdd65e2
Force 'inline' for REJECT_ACTION
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-09-10 07:37:53 -07:00
Tom Eastep
dc5c0dc069
Validate default log levels
...
- Name the .conf option involved in error messages
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-09-06 16:00:15 -07:00
Tom Eastep
87ae801c15
Use the -w ip[6]tables option when available.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-09-04 10:16:36 -07:00
Tom Eastep
67603c5eb3
Implement REJECT_ACTION
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-09-01 09:14:10 -07:00
Tom Eastep
1540e50cce
Remove blank line
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-08-31 10:07:41 -07:00
Tom Eastep
0a2f6c18cc
Correct typo in prog.footer
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-08-13 07:03:20 -07:00
Tom Eastep
32763e998b
Make -v work with the status command
...
- Also document exit status
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-08-13 06:52:46 -07:00
Tom Eastep
a10aea280b
Add some abbreviations for common commands
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-08-06 07:05:47 -07:00
Tom Eastep
ceffc000eb
Correct Typo
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-08-05 08:32:17 -07:00
Tom Eastep
6615c1f736
Clarify usage of Interface Option Chains
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-08-04 09:01:09 -07:00
Tom Eastep
83d1aa6682
Allow OPTIMIZE=All
...
- Remove use of literal 4096 from OPTIMIZATION checks.
- Moved constant declarations to the Config module.
- Documented that level 1 is ignored when level 4 is specified.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-29 10:08:35 -07:00
Tom Eastep
aabb22a50f
Add the TRACK_RULES option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-24 07:22:51 -07:00
Tom Eastep
7aa33c140d
Add an AutoBL action with helper AutoBLL
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-17 10:19:18 -07:00
Tom Eastep
891e3e0e1d
Use the --reap option in sticky recent rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-12 14:46:39 -07:00
Tom Eastep
5c7500e13e
Display the current time as an integer in 'show event[s]' output
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-12 09:46:08 -07:00
Tom Eastep
09240da55a
Change the external name of MARK_ANYWHERE to 'Mark in the filter table'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-12 09:45:20 -07:00
Tom Eastep
89f16bdb37
Include a current time event in /proc/net/xt_recent/
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-12 07:14:22 -07:00
Tom Eastep
8e30831385
Resolve merge conflicts
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-11 14:20:38 -07:00
Tom Eastep
d2725fcd87
Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code
2013-07-11 14:16:19 -07:00
Tom Eastep
9535a7d7df
Rename 'Trigger' to 'Event' and document
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-11 10:39:21 -07:00
Tom Eastep
3c6df56b57
Implement Triggers
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-10 13:27:58 -07:00
Tom Eastep
411ca87ec3
Allow logging rules with more than 15 ports
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-08 15:59:54 -07:00
Tom Eastep
948a7fccc2
Enhance a comment
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-07 12:52:04 -07:00
Tom Eastep
73060a3761
Correct typo in dropBcast()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-06 07:58:21 -07:00
Tom Eastep
cd83d7727c
Restore handle_original_dest().
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-04 14:51:06 -07:00
Tom Eastep
5121634457
Add ihandle_original_dest()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-04 14:37:24 -07:00
Tom Eastep
131c1f432b
Add iverify_source_interface()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-04 14:07:09 -07:00
Tom Eastep
03885f71d3
Create add_expanded_ijump() that breaks long lines
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-03 15:13:48 -07:00
Tom Eastep
b735b93378
Re-factor irule generation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-03 10:59:09 -07:00
Tom Eastep
5ce5d5e607
Delete superfluous blank line
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-02 15:03:50 -07:00
Tom Eastep
00c5985458
Rename clone_rule() to clone_irule()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-02 12:38:16 -07:00
Tom Eastep
1a44b66656
Cleaner handling of trailing spaces from log_irule_limit.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-02 12:32:35 -07:00
Tom Eastep
b215cf379a
Generate a warning when Limit is invoked.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-02 12:31:29 -07:00
Tom Eastep
3ec6745df9
Use log_irule_limit() internally where possible.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-02 11:48:02 -07:00
Tom Eastep
55be5b0119
Add log_irule_limit() and log_irule() functions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-02 11:47:19 -07:00
Tom Eastep
42a649d093
Create $globals{LOGILIMIT}
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-02 09:00:36 -07:00
Tom Eastep
18e7e43b2f
Eliminate globals{STATEMATCH}
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-01 16:01:57 -07:00
Tom Eastep
6803ce5d41
Add constants for %used values.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-07-01 15:36:16 -07:00
Tom Eastep
565fb74795
Correct bridge detection and 'qt' implementation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-24 13:07:38 -07:00
Tom Eastep
fc754040d5
Avoid shell error when detecting owner name match
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-24 09:51:32 -07:00
Tom Eastep
cc5a59231b
Make qt() work correctly when tracing.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-24 07:17:15 -07:00
Tom Eastep
25f96e6a88
Reword unreachable warning (again)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-20 10:50:28 -07:00
Tom Eastep
71bcd11ab6
Make ?...shell/perl directives case insensitive
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-20 10:39:39 -07:00
Tom Eastep
4bd35a0b93
Allow 'routeback=0'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-16 08:37:53 -07:00
Tom Eastep
cb132e2421
Include the chain name in the 'unreachable' warning.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-11 06:29:07 -07:00
Tom Eastep
53f1cd40df
Add 'unmanaged' option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-10 12:36:18 -07:00
Tom Eastep
c653d9ce83
Only issue one 'unreachable' warning per chain.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-08 10:02:19 -07:00
Tom Eastep
254d2037ef
Delete unused variable.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-04 15:34:25 -07:00
Tom Eastep
cb8e76b1d2
Add sub get_opttype to emphasize where rule option types are used.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-04 12:49:20 -07:00
Tom Eastep
2b579d2dff
Small efficiency change in helper processing.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-04 12:48:22 -07:00
Tom Eastep
fc3e3dbf3c
Cosmetic change.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-03 10:53:33 -07:00
Tom Eastep
81acedd1b3
Reword the 'unreachable' warning.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-02 17:13:41 -07:00
Tom Eastep
d8f53cc0a9
Merge branch '4.5.17'
...
Conflicts:
Shorewall/Perl/Shorewall/Chains.pm
2013-06-02 15:31:45 -07:00
Tom Eastep
481811d29f
Merge NFACCT and EXPENSIVE matches during optimization
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-02 13:29:13 -07:00
Tom Eastep
3867902b27
Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-02 07:31:32 -07:00
Tom Eastep
adf51d0059
Revise the unreachable warning stuff.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-01 16:32:46 -07:00
Tom Eastep
7dbd50708b
Clear the current filename after last file is processed.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-01 13:05:35 -07:00
Tom Eastep
4340bcffb1
Don't optimize away a rule that includes nfacct matches.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-01 13:05:25 -07:00
Tom Eastep
4a05e56d6d
Disable warning on unreachable rules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-01 13:05:16 -07:00
Tom Eastep
2d8078033c
Clear the current filename after last file is processed.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-01 13:03:10 -07:00
Tom Eastep
c5f2eeea80
Don't optimize away a rule that includes nfacct matches.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-01 13:02:39 -07:00
Tom Eastep
5343243f6b
Disable warning on unreachable rules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-06-01 13:01:55 -07:00
Tom Eastep
4865899018
Avoid a forward jump for local zones.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-30 06:52:09 -07:00
Tom Eastep
9b68204865
Generate an 'unreachable rule(s)' warning.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-30 06:17:22 -07:00
Tom Eastep
a550dd3eed
Issue a warning when a rule is dropped do to terminated chain.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-29 21:01:07 -07:00
Tom Eastep
f0aa29222f
Correct minor IPv6 TPROXY bug
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-29 07:18:46 -07:00
Tom Eastep
eaf1d0e5c2
Another error check for hosts files and loopback zones.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-28 10:00:07 -07:00
Tom Eastep
446f764d19
Allow config with only local and firewall zones.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-28 08:03:44 -07:00
Tom Eastep
9b0b3d4b70
Correct ICMPV6 type name translation
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-28 08:03:19 -07:00
Tom Eastep
a48a4b7a2e
Don't allow fowarding between local zones.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-28 06:14:44 -07:00
Tom Eastep
8743b64e00
Export 'shorewall' from the Config module.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-27 06:52:45 -07:00
Tom Eastep
2de0fbf7d0
Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-26 14:06:51 -07:00
Tom Eastep
f89c704d01
Disallow 'virtual' physical interfaces.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-26 08:47:44 -07:00
Tom Eastep
0b5a316cfc
Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-26 08:03:54 -07:00
Tom Eastep
31f9ea5b93
Add progess and warning messages to 'update -D'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-25 16:31:55 -07:00
Tom Eastep
dde1f0a779
Only enable helpers during a 'clear' operation.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-25 16:31:27 -07:00
Tom Eastep
60d0a50d9d
Add some warning/progress messages to help understand 'update -D' behavior.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-25 13:20:12 -07:00
Tom Eastep
064f9f974c
Cosmetic change.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-23 09:49:25 -07:00
Tom Eastep
fd11eb7d82
Omit fw->fw jumps when there is a local zone.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-22 09:19:34 -07:00
Tom Eastep
9e77bb5499
Ensure correct match ordering with trivial exclusion
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-22 08:46:22 -07:00
Tom Eastep
8df8fe990a
Allow 'local' zone to work with 'destonly'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-22 07:34:04 -07:00
Tom Eastep
ac02c484f5
Change 'local' interface option to a zone type.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-19 15:35:20 -07:00
Tom Eastep
5ec72dad6c
Add routes for standard tables when there are no providers.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-16 15:32:05 -07:00
Tom Eastep
f6a55bbf05
Allow the '-V' option in the CLI programs.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-16 14:29:36 -07:00
Tom Eastep
739f3779f5
Generate warnings for local->non-firewall and non-firewall->local rules
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-16 07:51:12 -07:00
Tom Eastep
2e293dd356
Make 'local,destonly' work correctly.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-14 14:36:51 -07:00
Tom Eastep
a5412cff38
Issue a warning when a rule will be optimized away due to 'destonly'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-14 09:30:59 -07:00
Tom Eastep
46a6a7b258
Correct earlier optimization.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-14 07:27:57 -07:00
Tom Eastep
105d1db85d
Cosmetic change
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-13 11:24:09 -07:00
Tom Eastep
200d347ac8
Small Efficiency Change
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-13 10:52:04 -07:00
Tom Eastep
c8133145e6
Add support for "all+" in the policy file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-13 09:01:12 -07:00
Tom Eastep
9178ecbab0
Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-12 10:38:44 -07:00
Tom Eastep
d06a7b55b6
Add a 'destonly' option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-12 10:37:40 -07:00
Tom Eastep
2fb01bec8d
Don't assume 'destonly' with 'local'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-12 09:58:37 -07:00
Tom Eastep
6551d67b2e
Call delete_chain_and_references recursively.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-12 09:29:29 -07:00
Tom Eastep
4b76d8c462
Handle optimize level 0 in the IPV6 nat table.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-12 09:28:25 -07:00
Tom Eastep
1bb5b89ee1
Add the 'local' interface option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-12 09:27:12 -07:00
Tom Eastep
c3901f1161
Release mutex on error.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-09 09:57:09 -07:00
Tom Eastep
56318e6cc8
Try to ensure that cp doesn't copy the firewall script to itself.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-06 09:22:16 -07:00
Tom Eastep
13c90e2aef
Correct my update to Mr-4's bup patch.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 18:40:14 -07:00
Tom Eastep
fdfdb49951
Apply Mr-4's priority->perf patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 14:05:03 -07:00
Tom Eastep
61cb105c02
Apply Mr-4's noautosrc patch (modified)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 14:00:25 -07:00
Tom Eastep
4621dccd53
Apply Mr-4's special route handling in COPY (modified).
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-04 13:27:34 -07:00
Tom Eastep
b83ca4812b
Include trailing space in a regular expression.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-03 08:36:38 -07:00
Tom Eastep
80efd095a8
Correct handling of INLINE without '-j' in the tcrules file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-01 14:52:48 -07:00
Tom Eastep
d6961c4c3b
Clean up the temporary chains sooner.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-01 14:48:27 -07:00
Tom Eastep
54f5aaca63
Fix handling of CT_TARGET
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-05-01 11:15:36 -07:00
Tom Eastep
1012251957
Apply Mr-4's 4a patch (modified)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-27 07:04:40 -07:00
Tom Eastep
20d38e8b52
Centralize the validation of nfacct object names.
...
- Also correct a missing ' ' from the output generated by INLINE
freeform input.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-26 09:09:08 -07:00
Tom Eastep
52f5ae15d1
Apply Mr-4's cosmetic patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-25 17:29:41 -07:00
Tom Eastep
7e830e5df4
Allow special characters in nfacct names.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-25 10:07:49 -07:00
Tom Eastep
f543c3bd1e
Finish Mr-4's NFACCT patch
...
- Correct indentation
- Remove '$type' argument to split_nfacct_list
- Update manpages.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-23 06:55:30 -07:00
Dash Four
68c7782e7d
Shorewall 4.5.16 Beta 6
...
Tom Eastep wrote:
> On 4/22/13 5:07 PM, "Dash Four" <mr.dash.four@googlemail.com> wrote:
>
>
>> Anyway, I've just implemented individual "!" in the NFACCT statement by
>> hacking your Accounting.pm - I can attach a small patch for
>> review/inclusion if you are interested, but be aware that it does change
>> the syntax slightly in a sense that "!" needs to be specified for each
>> object within NFACCT() - "NFACCT(...)!" is no longer allowed.
>>
>
> Sure -- send it along.
>
Attached - the above caveat applies though.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 21:17:59 -07:00
Tom Eastep
4faf3728f2
Implement INLINE in the tcrules file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 19:00:29 -07:00
Tom Eastep
ad70240347
Remove a blank line
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 09:36:25 -07:00
Tom Eastep
739013f248
Handle nfacct object lists in parens following an ipset name.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-22 07:56:56 -07:00
Tom Eastep
6d57e7a0ce
Mark a rule as complex if an option value is a reference.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-21 14:44:30 -07:00
Tom Eastep
5ad69aa650
Add CHAIN_SCRIPTS option
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-21 07:30:31 -07:00
Tom Eastep
1b9fd642bb
Add INLINE to the accounting file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-20 08:02:02 -07:00
Tom Eastep
7c8f1ae020
Correct HELPERS handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 16:35:19 -07:00
Tom Eastep
1fd62e1612
Restore order in the NFACCT target.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 11:11:37 -07:00
Tom Eastep
6c2679ce75
Allow incrementing an nfacct object when an ipset matches.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 10:44:57 -07:00
Tom Eastep
610bdf1aac
Correct merge_rules() for LAST matches.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-19 08:40:01 -07:00
Tom Eastep
cbdca08fea
Fix for multiple nfacct patch.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 16:37:54 -07:00
Tom Eastep
b87b4b61d8
Allow multiple nfacct matches in one accounting rule.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 16:14:57 -07:00
Tom Eastep
9c010691a3
Always place 'nfacct' last
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 15:26:34 -07:00
Tom Eastep
8ef11a376b
Document 'HELPERS=none'.
...
- Also make 'check -u' work correctly regarding HELPERS=
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 11:30:47 -07:00
Tom Eastep
4d686e873b
Implement 'HELPERS=none'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-18 10:30:56 -07:00
Tom Eastep
f55e34dd8b
Don't allow options on targets that don't accept them.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 17:18:01 -07:00
Tom Eastep
668bd4a1a4
Accept complex log levels with INLINE
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 16:59:14 -07:00
Tom Eastep
5d5f168f25
Don't clone rule unconditionally in format_rule()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 13:35:32 -07:00
Tom Eastep
938bd72844
Better handling of the matches rule member.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 10:39:32 -07:00
Tom Eastep
8b91575c9e
Maintain order when multiple instances of a match are separated.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-17 06:52:32 -07:00
Tom Eastep
0da38cc38e
Order matches in rules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-12 11:37:29 -07:00
Tom Eastep
6950cd2576
Allow '-' in a match name.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 18:30:02 -07:00
Tom Eastep
ff4fb21044
Require that the '-j' part of a free-form rule be known.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 18:29:45 -07:00
Tom Eastep
614c5e6155
Assume LOG if a level is specified with INLINE.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 14:16:34 -07:00
Tom Eastep
35b0b4a4f9
Support A_ACCEPT!
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 13:37:49 -07:00
Tom Eastep
c34cf333ba
Allow both {...} and ';' with INLINE
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 12:57:59 -07:00
Tom Eastep
b33bdeaa02
Allow a parameter to INLINE
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 11:54:58 -07:00
Tom Eastep
38f3ae0934
Handle 'NONE' policy correctly.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 09:35:27 -07:00
Tom Eastep
beec4a188f
Implement INLINE action (again).
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 09:15:59 -07:00
Tom Eastep
f85d548d40
Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-11 06:23:22 -07:00
Tom Eastep
ee2e85c0fb
Correct generation of the blacklog chain when disposition is audited
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-10 16:43:38 -07:00
Tom Eastep
186f71fa96
Add NEW_TOS_MATCH capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-09 14:04:16 -07:00
Tom Eastep
477e2bc455
Additional corrections to INLINE action.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-09 09:41:43 -07:00
Tom Eastep
273f109daf
Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-09 09:37:12 -07:00
Tom Eastep
50494f667c
Implement INLINE action
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-08 17:30:00 -07:00
Tom Eastep
183a0a75a1
Implement 'builtin' actions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-08 16:14:26 -07:00
Tom Eastep
9e10c38e26
Don't emit 'quantum' calculation unless the qdisc is 'htb'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-03 08:39:18 -07:00
Tom Eastep
ee66a45e2e
Correct comments in the Chains module.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-02 12:52:10 -07:00
Tom Eastep
c200efa6d7
Revert "Disable script generation while processing TC"
...
This reverts commit 5b18ff91ca
.
2013-04-01 15:23:16 -07:00
Tom Eastep
5b18ff91ca
Disable script generation while processing TC
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-04-01 09:05:12 -07:00
Tom Eastep
ef5818ce7e
Merge branch '4.5.15'
2013-03-31 07:08:49 -07:00
Tom Eastep
58ef8e0ec3
Correct bounds check in do_dscp()
...
- "< 0x2f" s/b "< 0x3f"
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-31 07:07:21 -07:00
Tom Eastep
8a84c1c371
Avoid 'echo' failure during 'enable'.
...
- in the case where the kernel doesn't know about
/proc/sys/net/ipv6/conf/x/accept_ra
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-31 07:02:11 -07:00
Tom Eastep
1db5741edd
Merge branch '4.5.15'
...
Conflicts:
Shorewall/Perl/Shorewall/Proc.pm
2013-03-30 18:08:17 -07:00
Tom Eastep
1139e1a09c
Establish /proc/sys/net/ipv6/conf/X/forwarding during 'enable'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-30 17:26:50 -07:00
Tom Eastep
d415de1883
Add the accept_ra Shorewall6 interface option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-30 16:44:18 -07:00
Tom Eastep
448d957e48
Fix use of names for DSCP.
...
- From Thibaut Chèze
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-30 07:20:10 -07:00
Tom Eastep
8fe7963631
Revert another replace->add change.
...
- Also includes a cosmetic change.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-27 06:57:49 -07:00
Tom Eastep
6334b09653
Add a comment about why the 'id' member of builtin tables is initialized in process_providers()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-26 14:30:42 -07:00
Tom Eastep
e572d6ce50
Use the 'id' member in copy_and_edit_table().
...
- Also add prohibit and unreachable to the existing blackhole case.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-26 07:38:13 -07:00
Tom Eastep
792a19bf4b
Initialize the 'id' member of reserved tables after .conf has been read.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-26 07:36:57 -07:00
Tom Eastep
61e21de41b
Revert bad hunk from last change.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-26 07:00:16 -07:00
Tom Eastep
43932f2bbd
Cleanup of table id/number and 'route replace' erradication
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-25 07:35:30 -07:00
Tom Eastep
6e5f00062c
Revert "Use 'replace' rather than 'add' for routes defined in the routes file."
...
This reverts commit 215fd9e234
.
Conflicts:
Shorewall/Perl/Shorewall/Providers.pm
2013-03-24 14:19:31 -07:00
Tom Eastep
b5ea4067e4
Implement USE_RT_NAMES
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-24 10:56:38 -07:00
Tom Eastep
0c30e7c013
Uniform handling of VLSM width.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-23 09:19:26 -07:00
Tom Eastep
536fea27a5
Detect duplicate routes.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-22 14:59:35 -07:00
Tom Eastep
215fd9e234
Use 'replace' rather than 'add' for routes defined in the routes file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-22 14:55:27 -07:00
Tom Eastep
4c0a0e0ff8
Don't emit 'qt ' in the undo_x_routing files.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-22 13:20:27 -07:00
Tom Eastep
9e5cf92a59
Merge branch '4.5.14'
2013-03-21 12:00:20 -07:00
Tom Eastep
3ac6835650
Handle IPv6 /32 networks correctly.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-21 11:30:59 -07:00
Tom Eastep
1e866eac28
Implement the other forms of NULL routing.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-16 08:20:52 -07:00
Tom Eastep
b10218e773
Add a 'UDPLITE Port Redirection' capability.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-10 10:07:52 -07:00
Tom Eastep
8442477224
Add Enhanced Multi-port match capability
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-10 09:04:47 -07:00
Tom Eastep
fd2fcc996f
Don't allow port redirection with UDPLITE
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-10 08:32:45 -07:00
Tom Eastep
8c4c856caa
Issue a warning if the contents of the DUPLICATE column may be invalid.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-09 07:57:13 -08:00
Tom Eastep
a167e3449e
Avoid Perl run-time errors when checking a provider interface.
...
- Handle case where a provider interface matches a wildcard
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-09 07:56:16 -08:00
Tom Eastep
b871fc689c
Merge branch 'FETCH_HEAD' into 4.5.14
2013-03-09 07:11:47 -08:00
Tom Eastep
cfe2bd11b0
Allow 'none' in the COPY column when the DUPLICATE column is empty.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-08 19:18:13 -08:00
Tom Eastep
bd64baa8d9
Require at least one zone for a provider
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-08 13:08:23 -08:00
Tom Eastep
e1f7a9dbf8
Reverse an earlier silly patch.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-08 10:38:13 -08:00
Tom Eastep
4586568649
Merge branch '4.5.14' of ssh://git.code.sf.net/p/shorewall/code
2013-03-08 08:00:43 -08:00
Tom Eastep
b4d4083513
Split large '--ports' lists across multiple rules.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-08 07:38:23 -08:00
Tom Eastep
91f5a9dec0
Make 'main' work correctly when specified in the routes file.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-08 07:26:49 -08:00
Tom Eastep
50030bcc2d
Revert "Don't allow routes to be added to non-Provider tables."
...
This reverts commit 6f9a1ba29d
.
2013-03-08 06:55:12 -08:00
Tom Eastep
8eacbe287b
Correction to MULTIPORT patch
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-07 18:11:59 -08:00
Tom Eastep
6f9a1ba29d
Don't allow routes to be added to non-Provider tables.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-07 17:18:57 -08:00
Tom Eastep
6ba02c4a24
Merge branch 'master' into 4.5.14
...
Conflicts:
Shorewall/Perl/Shorewall/Providers.pm
2013-03-07 08:29:30 -08:00
Tom Eastep
c4f0be96ac
Require that interfaces in the COPY column be known.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-07 07:32:56 -08:00
Tom Eastep
7da10ff923
Additional change to copy blackhole routes.
...
- Add 'blackhole' to the outer case statement
- Add RFC1918 blackhole routes before starting providers.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-07 07:01:58 -08:00
Tom Eastep
ace9a49106
Allow addition of blackhole routes.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-07 07:01:41 -08:00
Tom Eastep
7f2c933cb3
Copy blackhole routes to secondary tables.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-07 07:01:18 -08:00
Tom Eastep
5aa731e963
Additional change to copy blackhole routes.
...
- Add 'blackhole' to the outer case statement
- Add RFC1918 blackhole routes before starting providers.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-07 06:52:16 -08:00
Tom Eastep
06e7f297f7
Allow addition of blackhole routes.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-06 11:48:09 -08:00
Tom Eastep
216029c3a9
Copy blackhole routes to secondary tables.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-06 11:04:23 -08:00
Tom Eastep
e12bc47546
Remove duplicate interface names in generated case statement.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-06 08:28:12 -08:00
Tom Eastep
384c179dd6
Avoid duplicate echo command in generated script.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-06 08:28:03 -08:00
Tom Eastep
32b2030e59
Remove duplicate interface names in generated case statement.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-06 07:03:41 -08:00
Tom Eastep
0bb62ed290
Avoid duplicate echo command in generated script.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-06 06:12:43 -08:00
Tom Eastep
49918b654e
Support '=' in SOURCE PORT(S) columns
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-04 09:56:10 -08:00
Tom Eastep
0857eb27d5
Another case of detecting invalid server IP address.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-02 09:08:13 -08:00
Tom Eastep
69f6149d4c
Detect missing, NIL or ALL server IP address in a DNAT rule.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-02 09:00:08 -08:00
Tom Eastep
5ca3b795fc
Correct IPv6 REDIRECT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-01 16:44:49 -08:00
Tom Eastep
9499a47a0d
Revert "Use '--to-dest' for IPv6 rather than '--to-destination'"
...
This reverts commit c9d8c22b60
.
2013-03-01 10:44:40 -08:00
Tom Eastep
c9d8c22b60
Use '--to-dest' for IPv6 rather than '--to-destination'
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-01 09:03:22 -08:00
Tom Eastep
8960f72532
Handle DNAT with no port correctly.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-03-01 07:58:58 -08:00
Tom Eastep
ee091d09eb
Allow ports with UDPLITE
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-28 06:27:51 -08:00
Tom Eastep
22c614d30b
Don't allow :persistent in a MASQUERADE rule.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-27 12:48:27 -08:00
Tom Eastep
418034579f
Support IPv6 Masquerade
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-27 09:25:26 -08:00
Tom Eastep
78babf0941
Fixes for IPv6 DNAT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-26 10:24:25 -08:00
Tom Eastep
45d53bdb1d
Delete superfluous statement.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 17:50:33 -08:00
Tom Eastep
fb17de0595
Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code
2013-02-25 17:29:49 -08:00
Tom Eastep
6ed1caedd0
Validate IPv4 port range in ADDRESSES column
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 17:29:33 -08:00
Tom Eastep
1d4f189b5f
Don't allow interior brackets in an address range.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 17:26:17 -08:00
Tom Eastep
7006c62892
Correct port pair handling in the snat ADDRESS column.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 15:31:36 -08:00
Tom Eastep
6b825abeb4
Catch ::<port-range> in /etc/shorewall6/snat
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 13:41:43 -08:00
Tom Eastep
f2ee46b83e
Correct IPv6 address range parsing in handle_one_masq1
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 13:37:22 -08:00
Tom Eastep
e873cb28f4
Correctly handle a port number/range with an address variable
...
- ADDRESSES column of the masq/snat files.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 08:00:15 -08:00
Tom Eastep
de1a5a8024
Handle SNAT 'ADDRESS' without enclosing [...]
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-25 06:42:19 -08:00
Tom Eastep
34c6013f1b
Handle missing provider in a masq/snat entry.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-24 08:12:02 -08:00
Tom Eastep
82f9ba8bb7
Correct detection of IPv6 PERSISTENT_SNAT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-23 12:59:38 -08:00
Tom Eastep
6035d49ede
Correct NAT capability required error message.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-23 11:57:32 -08:00
Tom Eastep
67ef1f8b93
Correct detection of IPv6 NAT_ENABLED.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-23 11:57:07 -08:00
Tom Eastep
0349a9a88c
Rename the IPv6 masq file 'snat'.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-19 13:05:24 -08:00
Tom Eastep
2591a17946
Cosmetic change to the output with the '-r' option.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-19 11:59:57 -08:00
Tom Eastep
b562f7f311
Allow specification of destination addresses in Shorewall6 masq.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-19 08:34:03 -08:00
Tom Eastep
ce28c70c60
SNAT and DNAT support for IPv6.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-19 07:08:08 -08:00
Tom Eastep
d0b2d05d5b
Add optional argument to have_capability().
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-18 15:15:26 -08:00
Tom Eastep
088fc1a3a3
Report used/required capabilities
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-18 08:48:18 -08:00
Tom Eastep
6d92d293b8
Use 'here documents' in the usage() function.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-17 07:44:10 -08:00
Tom Eastep
7859267539
Eliminate $globals{CONFDIR}
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-14 17:24:49 -08:00
Tom Eastep
c68513672d
Comments and documentation.
...
- Removes the Actions-4.5 article
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-14 08:48:45 -08:00
Tom Eastep
93b3fd9be5
Correct IPv6 address checking (again)
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-13 13:37:26 -08:00
Tom Eastep
138638cb1a
Effectively use the specified directory as the CONFIG_PATH til .conf is read
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-13 07:45:24 -08:00
Tom Eastep
c5bb16ac26
Another fix for IPv6 address lists.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-13 07:44:19 -08:00
Tom Eastep
f44becdee1
Rename BLACKLIST_LOGLEVEL to BLACKLIST_LOG_LEVEL for consistent naming.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-12 07:47:02 -08:00
Tom Eastep
84c5822c20
Correct IPv6 List Handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-11 16:45:03 -08:00
Tom Eastep
b4977db5b2
Add %section_states that maps sections to their related state(s).
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-11 14:59:48 -08:00
Tom Eastep
8d0a80a7e2
Merge branch '4.5.13'
2013-02-11 06:40:11 -08:00
Tom Eastep
b9d5b92f1b
Correct handling of expressions consisting of a single number.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-10 15:19:30 -08:00
Tom Eastep
b349cc0f22
A better fix for inline default action with parameters.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-10 09:29:30 -08:00
Tom Eastep
a312bfbb42
Add a section => name function map
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-10 09:27:43 -08:00
Tom Eastep
c35e753b1d
A better fix for inline default action with parameters.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-10 09:16:18 -08:00
Tom Eastep
8b4349b356
Merge branch '4.5.13'
2013-02-10 09:05:41 -08:00
Tom Eastep
54c43396f0
Correct default action handling:
...
- isolate basic target before testing for action/inline
- delete the action chain if appropriate.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-10 09:00:13 -08:00
Tom Eastep
f9dc89dc61
Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-10 07:56:04 -08:00
Tom Eastep
60e3f1015e
Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-10 07:51:35 -08:00
Tom Eastep
8e0a90e077
Merge branch '4.5.13'
2013-02-09 17:54:06 -08:00
Tom Eastep
cadf2747fe
Correct reset_optflags()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-09 17:53:40 -08:00
Tom Eastep
810ebe32ce
Merge branch '4.5.13'
2013-02-09 13:15:44 -08:00
Tom Eastep
c04c61b314
Correct typos in check_rules().
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-09 11:42:54 -08:00
Tom Eastep
a8fdfa4e48
Create an ESTABLISHED chain
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-09 09:32:12 -08:00
Tom Eastep
a4297381e9
Don't ACCEPT untracked packets unless UNTRACKED_DISPOSITION=ACCEPT
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-09 09:15:05 -08:00
Tom Eastep
eaa6d72a4f
Allow parameters to be omitted in action invocations.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-09 07:07:01 -08:00
Tom Eastep
62a567b550
Treat each -m conntrack subtype as a separate match
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-08 10:08:23 -08:00
Tom Eastep
e4f1c62e71
Improve handling of nested state actions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-08 09:09:20 -08:00
Tom Eastep
b9e504683e
Prevent a state action from invoking another one.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-07 16:52:06 -08:00
Tom Eastep
aae6e001fe
Convert dropInvalid and allowInvalid to inline actions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-07 11:21:13 -08:00
Tom Eastep
aa528dd075
Revert "Convert allowInvalid and dropInvalid into macros"
...
This reverts commit 272e1d330c
.
2013-02-07 09:09:56 -08:00
Tom Eastep
e4ae242123
Another tweak to check_state()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-06 12:07:51 -08:00
Tom Eastep
272e1d330c
Convert allowInvalid and dropInvalid into macros
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-06 09:54:12 -08:00
Tom Eastep
a66256b25b
Additional refinements of check_state()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-06 08:16:42 -08:00
Tom Eastep
11b976fb36
Correct reference type in check_state()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-05 19:55:22 -08:00
Tom Eastep
a6ccd53fe0
Unconditionally use '-j' to branch to a state chain or DISPOSITION.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-04 15:17:49 -08:00
Tom Eastep
b22b63b1c3
Don't use '-g' when DISPOSITION is CONTINUE.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-04 15:09:17 -08:00
Tom Eastep
615df6ab8f
Handle 'RETURN' in state chain with terminating disposition.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-04 15:08:20 -08:00
Tom Eastep
d8214885f2
Assume that the conntrack state value in a rule is not a reference.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-04 08:29:50 -08:00
Tom Eastep
475942deb9
Normalize rules prior to combine_state tests.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-03 18:14:14 -08:00
Tom Eastep
f1707d2ace
More state rule check fixes.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-03 18:02:02 -08:00
Tom Eastep
30d96afb69
Push/pop $actionresult.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-03 12:43:28 -08:00
Tom Eastep
014b4ddc50
Combine adjacent rules differing only in conntrack state match.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-03 09:03:22 -08:00
Tom Eastep
5b9d1a6159
Handle UNTRACKED_DISPOSITION=ACCEPT correctly.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-03 07:59:47 -08:00
Tom Eastep
752463bfab
Fix TCPFlags
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-02 22:19:13 -08:00
Tom Eastep
ebef29e161
Handle port numbers being passed to one of the tcp-specific actions
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-02 12:48:54 -08:00
Tom Eastep
9b30f48ba0
Correct handling of actions when @chain is altered.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-02 10:57:08 -08:00
Tom Eastep
8249831e6d
Detect some state conflicts
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-02 09:32:57 -08:00
Tom Eastep
cc1054be66
Correct handling of audited dispositions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-02 09:30:25 -08:00
Tom Eastep
c68d4c6e27
Simplify Perl from actions even further.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-01 15:55:39 -08:00
Tom Eastep
752e960f2f
Allow specification of the action type via perl_action_helper().
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-01 12:59:48 -08:00
Tom Eastep
a5d3b1f470
Remove requirement that matches and proto end with a space in perl helper API.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-02-01 12:29:30 -08:00
Tom Eastep
abca3a2024
Improve maintainability of @colums vis a vis @rulecolumns.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-30 10:47:40 -08:00
Tom Eastep
755d605578
Make %statetable global
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-30 08:26:47 -08:00
Tom Eastep
78db4abef5
Remove some redundant local variables from finish_chain_section()
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-30 08:02:23 -08:00
Tom Eastep
fc73c3934b
Replace BLACKLISTNEWONLY with BLACKLIST
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-30 08:00:47 -08:00
Tom Eastep
75fb164234
Don't issue fatal error if a proto other than tcp is passed to a tcp-only inline
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-29 10:31:20 -08:00
Tom Eastep
27c5e67632
Rename process_rule to process_raw_rule and process_rule1 to process_rule
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-29 10:13:48 -08:00
Tom Eastep
61d8f704f9
Correct rule-generation detection in perl_action_helper
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-29 09:43:12 -08:00
Tom Eastep
f33e36b61e
Raise an error if a protocol other than TCP is passed to a TCP-only inline
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-29 07:46:50 -08:00
Tom Eastep
670931c987
Initialize the columns array to '-'s.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-29 07:46:07 -08:00
Tom Eastep
316b67473e
Merge branch 'master' into 4.5.13
...
Conflicts:
Shorewall/Perl/Shorewall/Rules.pm
Shorewall/action.Established
Shorewall/actions.std
2013-01-29 07:30:52 -08:00
Tom Eastep
42f46ea5e7
Accurately determine if an inline action generates a rule.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 20:46:20 -08:00
Tom Eastep
49166efdca
Make the TCP standard actions inline
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 18:01:08 -08:00
Tom Eastep
5a2c1792cb
Inline the conntrack state actions.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 16:55:54 -08:00
Tom Eastep
a70c441458
Add CONTINUE as a possible setting for RELATED_DISPOSITION.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 11:47:45 -08:00
Tom Eastep
519861d7b2
Add CONTINUE as a possible setting for RELATED_DISPOSITION.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 07:58:03 -08:00
Tom Eastep
2e8eeff416
Correct error messages that include the section name.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 07:41:52 -08:00
Tom Eastep
2217f89902
Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 07:41:45 -08:00
Tom Eastep
5c63444c14
Correct error messages that include the section name.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 07:41:09 -08:00
Tom Eastep
cfa5d86f5c
Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT.
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-28 07:40:26 -08:00
Tom Eastep
b3b074fb61
More infrastructure
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-27 15:37:23 -08:00
Tom Eastep
cbbcfe355e
Infrastructure for more powerful action handling
...
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2013-01-27 12:37:10 -08:00