holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
14,525 Commits 104 Branches 736 Tags 54 MiB
481afef2c3
Commit Graph

7229 Commits

Author SHA1 Message Date
Tom Eastep
cd0837beb5
Avoid run-time Perl diagnostic when validating a null log level 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-09 09:00:12 -07:00
Tom Eastep
4869f61a25
'allow' now works with ipset-based dynamic blacklisting 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-09 08:44:25 -07:00
Matt Darfeuille
cd4e9654d8
(Fwd) [Shorewall-users] Shorewall-lite on OpenWRT 
------- Forwarded message follows -------
From:	istvan@istvan.org
To:	shorewall-users@lists.sourceforge.net
Date sent:	Thu, 19 May 2016 09:10:21 +0200
Subject:	[Shorewall-users] Shorewall-lite on OpenWRT
Send reply to:	Shorewall Users <shorewall-users@lists.sourceforge.net>
	<mailto:shorewall-users-request@lists.sourceforge.net?subject=unsubscribe>
	<mailto:shorewall-users-request@lists.sourceforge.net?subject=subscribe>

Hi there,

I use Shorewall on an OpenWRT distribution and I experience 2
problems.
I have solved them myself and report them here to help others with
it.

Shorewall version: shorewall[6]-lite 5.0.4
OpenWRT version: Chaos Calmer 15.05, r46767

Problem 1:
Shorewall uses the lock utility from openwrt. I believe it is used in

the wrong way. File lib.common line 775
First it passes arguments which the utility doesn't use/know. The
util
accepts them dumbly and continues to create a lockfile. It has no
time-out functionality. I do not know the meaning of the r1 argument.
Second the mutex_off simply deletes the lockfile by using the utility

rm. This way a stale lock process keeps running. After a while the
router is running a high number of stale processes which has impact
on
the load of the router. The correct way is to use "lock -u
/lib/shorewall-lite/lock". This way the lockfile will be removed and
the
process will be terminated accordingly. To make it work for me, I no
more let shorewall use the lock utility by using an ugly hack.

Problem 2:
An fgrep on the output of the type utility is wrongly coded. The
output
of the type command probably has been changed. File lib.cli line 4343
It is coded: "if type $1 2> /dev/null | fgrep -q 'is a function';
then"
To make it work for me, it should be coded: "if type $1 2> /dev/null
|
fgrep -q 'is a shell function'; then"

With regards,

Stefan
------- End of forwarded message -------

Tom, attached as code.patch, are the patches that I  believe will
correct those issues

In addition to those patches I've also added 3 patches:
- Patch 1 will emulate the -p flag of the ps utility which is not
available on openwrt.
- The last two patches will add "file" to the progress message of
SYSCONFFILE to make it more consistent among the installers.

In shorewall-init/install.sh the else clause between  the line 586
and 597 will only work for a sysvinit script.
Should I make it also work for a systemd service script or can't we
simply remove that else clause?

In the compiled firewall script the comments before and after the
functions imported from lib.common have two slashes in the path:
$ grep -H lib.common firewall
firewall:#   Functions imported from /usr/share/shorewall//lib.common
firewall:#   End of imports from /usr/share/shorewall//lib.common

-Matt

-------------- Enclosure number 1 ----------------
>From 6ff651108df33ab8be4562caef03a8582e9eac5e Mon Sep 17 00:00:00 2001
From: Matt Darfeuille <matdarf@gmail.com>
Date: Tue, 24 May 2016 13:10:28 +0200
Subject: [PATCH 1/8] Emulate 'ps -p' using grep to work on openwrt

Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-08 15:40:36 -07:00
Tom Eastep
cd01df4200
Allow more than 9 interfaces with Simple TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-06-07 14:43:37 -07:00
Tom Eastep
7798c52a19
Fix DOCKER=Yes when docker0 is defined and Docker isn't started. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-22 17:50:51 -07:00
Tom Eastep
82169a0bfd
Use 'date' format for compiletime rather than localtime format 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-07 13:48:16 -07:00
Tom Eastep
d4df67966d Turn on AUTOMAKE in the sample configurations 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-06 08:46:11 -07:00
Tom Eastep
f16bb887f3 Report versions as Shorewall's rather than Shorewall6's 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-05 15:41:46 -07:00
Tom Eastep
64fb662bb1 Verify Shorewall6 version when compiling for IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-05 15:22:47 -07:00
Tom Eastep
ce20e5592b Cross-check core and standard versions during compilation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-05 13:53:26 -07:00
Tom Eastep
590243a787 Add NFLOG as a supported mangle action 
- Also document nflog-parameters
- Correct range of nflog groups

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-03 11:27:34 -07:00
Tom Eastep
9dd0346987 Apply Paul Gear's patch for Ubuntu 16.04 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-05-02 07:25:37 -07:00
Tom Eastep
ccfa181a6d Tweak compile_info_command() 
- Fix comment
- use $globals{VERSION} for the version number

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-30 14:12:34 -07:00
Tom Eastep
b7de785396 Correct typo in manpages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-30 08:34:43 -07:00
Tom Eastep
24d40f4cc2 Add VERBOSE_MESSAGES option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-30 08:00:56 -07:00
Tom Eastep
244f2cefe5 Update comment describing info_command() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-29 15:42:48 -07:00
Tom Eastep
41923cb80e Improve compile time/date implementation 
- Rename the command from 'date' to 'info'
- Return the complete date/time/version string in the command

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-29 12:31:17 -07:00
Tom Eastep
2a40012fc4 Include compile time and date in the output of 'shorewall status' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-27 16:25:21 -07:00
Matt Darfeuille
05a15c6f8b patches and request 
Tom,

Some patches for the trunk repo(fixes.patch):

Patch1: Fix a typo in the path being printed for the standard actions
file.
Patch2: Will only install the shorewall's manpages if the variable
MANDIR is none-empty(I did it only for the sake of completeness)!
Patch3: Will only install the shorewall-lite's manpages if the
variable MANDIR is none-empty.
Patch4: Correct multiple product name's typos in
shorewall-init/install.sh.
Patch5: Remove ~/.shorewallrc when shorewall-core is uninstalled.

And two other  patches for the release repo(changelog-1.patch):

Patch1: Changed restart to reload for the line: 'Update DHCP
article(refresh -> restart).
Patch2: Rephrased the line for the newly added ?WARNING and ?INFO
directives.

Request:
Could the date of the compiled firewall script also be displayed when
'shorewall status' is executed?

-Matt

-------------- Enclosure number 2 ----------------
>From a5ae24bbe9b25aefdbcc4d7c8e5d013a36b03078 Mon Sep 17 00:00:00 2001
From: Matt Darfeuille <matdarf@gmail.com>
Date: Sat, 23 Apr 2016 14:44:19 +0200
Subject: [PATCH 1/5] Fix typo in printed path for standard actions file

Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-27 15:07:44 -07:00
Tom Eastep
a92d10f19c Merge branch '5.0.8' 2016-04-27 10:23:51 -07:00
Tom Eastep
47edfaf093 Create standard error messages in the CLI 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-27 10:13:24 -07:00
Tom Eastep
f6b7eb4ea0 Correct handling of persistent provider with no IP address 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-25 12:27:00 -07:00
Tom Eastep
800c06e8c9 Rename lib.core to lib.runtime 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-21 08:12:41 -07:00
Tom Eastep
f16e3f1fbe Issue warning when enable/disable won't work correctly 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-19 10:42:50 -07:00
Tom Eastep
71bd7a4647 Update the STARTUP_LOG description in shorewall[6].conf 
- Update list of commands

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-19 07:49:37 -07:00
Tom Eastep
f9bbca8b05 Expand the list of commands that write to STARTUP_LOG 
- add the safe-* commands

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 14:16:13 -07:00
Tom Eastep
0faf3b6db1 Send INFO messages to STDERR rather than STDOUT 2016-04-18 13:59:29 -07:00
Tom Eastep
3253c882e9 Merge branch '5.0.8' 2016-04-18 12:36:28 -07:00
Tom Eastep
5212dba7cb Add an ESTABLISHED,RELATED rule for docker0 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 10:13:05 -07:00
Tom Eastep
35a22eedac Reword error message when tcclass MARK is too large 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 10:06:04 -07:00
Tom Eastep
2b7ef0fe32 Update the tcclasses manpage to discuss fw mark filter priority 
- Also correct default priorities for tos= and tcp-ack

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 09:18:48 -07:00
Tom Eastep
b53de922d1 Catch 0 in the MARK column of the tcclasses file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-18 08:50:10 -07:00
Matt Darfeuille
365ffaf645 questions 
On 17 Apr 2016 at 7:45, Tom Eastep wrote:

> On 04/17/2016 06:23 AM, Matt Darfeuille wrote:
>
> >> Tom, I neglected the git part of that request!(sorry):
> >>
> >> Could changes be also made in the git code repo that take for account
> >> case insensitive system?:
> >>
> >> What I suggest doing is using the deprecated extension when the case
> >> of a file is changed in the code so git wouldn't show 'Modified: ...'
> >> and simply modifying shorewall/install.sh to strip the file from the
> >> deprecated extension and then copying it to the deprecated directory.
> >>
> >> In other words: when changing the case of a file tracked by git could
> >> case-insensitivity platform be taken in to account?
> >>
> >> -Matt
> >>
> >> P.S. I'll test SW_LOGGERTAG tomorrow!!!:)
> >
> > Or do you have a better solution, if no, I could do the changes to
> > shorewall/install.sh!?
>
> Sure -- go ahead. We'll do it in the master branch, though, since I've
> now created a 5.0.8 branch for the upcoming release.
>
> >
> > You might want to apply the attached patch to changelog.txt in the
> > release repo!
> >
>
> Applied -- thanks!
>
> -Tom
> --
> Tom Eastep        \ When I die, I want to go like my Grandfather who
> Shoreline,         \ died peacefully in his sleep. Not screaming like
> Washington, USA     \ all of the passengers in his car
> http://shorewall.net \________________________________________________
>
>

Attached as case.patch are 3 patches:

1 and 2 simply rename the deprecated files(adding .deprecated)

Patch 3 will modify Shorewall/install.sh to reflect the new naming
scheme!

I didn't have the time to test SW_LOGGERTAG but will do so in the
coming days!!!:)

-Matt

-------------- Enclosure number 1 ----------------
From 2ecd761b414af61c5854d6427fb9ec8ab1365c7b Mon Sep 17 00:00:00 2001
From: Matt Darfeuille <matdarf@gmail.com>
Date: Sun, 17 Apr 2016 18:34:40 +0200
Subject: [PATCH 1/3] Rename macro.SNMPTrap to macro.SNMPTrap.deprecated

Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-17 13:50:17 -07:00
Tom Eastep
ae852b513d Correct indentation issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-17 10:23:18 -07:00
Tom Eastep
9611b588e3 Use a uniform format for log timestamps 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:52:35 -07:00
Tom Eastep
eb95532248 Enable compiler logging on reload and restart 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:52:17 -07:00
Tom Eastep
fb8dbcf44b Use a uniform format for log timestamps 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:49:38 -07:00
Tom Eastep
62a14aab28 Enable compiler logging on reload and restart 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:37:42 -07:00
Tom Eastep
335f2968f8 Implement ?INFO and ?WARNING 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-16 09:20:09 -07:00
Tom Eastep
32f888a7d4 Add an ENVIRONMENT section to the CLI manpages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-15 15:41:55 -07:00
Tom Eastep
c725372639 Correct logging of 'reloaded' message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-15 14:46:21 -07:00
Tom Eastep
524838ae47 Implement $SW_LOGGERTAG 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-15 14:29:51 -07:00
Tom Eastep
6aa0ecae4f Re-factor the code for saving/loading ipsets 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 15:15:47 -07:00
Tom Eastep
434e042494 Add the deprecated/ directories to the CONFIG_PATH 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 14:17:06 -07:00
Tom Eastep
9fa0df2fd1 Move the code that generates zap_ipsets() to after save_ipsets() generation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 09:56:48 -07:00
Tom Eastep
074655d1bd Fix AUTOMAKE and the start command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 09:43:21 -07:00
Tom Eastep
216bc715e8 Clean up V4/V5 ipset enforcement 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-14 09:00:38 -07:00
Tom Eastep
dbd42e1d5d More ipset fixes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-12 16:29:13 -07:00
Tuomo Soini
772f88b1fd action.A_Reject: improve comment text 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-12 13:17:56 +03:00
Tuomo Soini
3e0b8c60a2 Reverse the order of ICMP and Broadcast checking in the default actions 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-12 10:12:29 +03:00
Tom Eastep
16afd880b2 Reverse the order of ICMP and Broadcast checking in the default actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 11:16:46 -07:00
Tom Eastep
76a5841fcd Reverse the order of Broadcast and ICMP checking in the default actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 10:47:11 -07:00
Tom Eastep
9758e8cdc5 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2016-04-11 10:41:44 -07:00
Tom Eastep
2cf3706864 Correct handling of a zone with two interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 10:32:26 -07:00
Tom Eastep
3028dafbac Correct DBL 'src-dst' handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 09:13:17 -07:00
Tom Eastep
16a31c3d29 Make MINIUPNPD work with DOCKER 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 09:02:44 -07:00
Tom Eastep
d3f377e915 Don't double-save the dynamic blacklisting ipset 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-11 08:37:39 -07:00
Tuomo Soini
54a5748395 macros: RedisCluster and RedisSentinel 
http://redis.io/topics/sentinel

Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-11 14:39:21 +03:00
Tom Eastep
6c00f72f44 Create ipsets with the 'counters' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-10 18:09:41 -07:00
Tom Eastep
deaaecdf1c Add 'nodbl' interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-10 16:09:39 -07:00
Tom Eastep
05e4049174 Ipset-based blacklisting 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-10 16:07:56 -07:00
Tom Eastep
ef10515a42 Correct FASTACCEPT description 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-10 07:20:45 -07:00
Tom Eastep
5db6cb1b7d Correct load_ipsets() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-09 16:07:10 -07:00
Tom Eastep
76c8917aa7 Add a sixth parameter to Drop and Reject 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-08 09:10:45 -07:00
Tom Eastep
be58d530c4 Document 'logjump' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-08 09:09:59 -07:00
Tom Eastep
321476fd51 Tweak terminating() implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-08 08:24:57 -07:00
Tom Eastep
bd6b32eb25 Add a progress message for REJECT_ACTION processing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 10:30:54 -07:00
Tom Eastep
4fdf54eca1 Tweak process_reject_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 10:02:48 -07:00
Tom Eastep
70bbd21b35 Ensure that the REJECT_ACTION is terminating 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 09:34:38 -07:00
Tom Eastep
87a9b95f73 Catch case where a transformed rule jumps to its own chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 08:58:50 -07:00
Tom Eastep
ecd7261365 Use -g when target is a terminating chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-07 08:48:36 -07:00
Tom Eastep
293cd1d66a Always go to the reject chain rather than jump to it 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-06 09:14:06 -07:00
Tom Eastep
436b5d89ce Correct comment 
- The chain will only exist if logging wasn't specified for the same
  disposition.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-06 08:50:29 -07:00
Tom Eastep
26795cf082 Correct setup of $usedactions{A_REJECT} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-06 08:18:36 -07:00
Tom Eastep
95e4071f34 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2016-04-06 07:42:46 -07:00
Tuomo Soini
20179a5c9d remove completely false README.txt 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-06 10:23:58 +03:00
Tom Eastep
b7e6893f7d Restore DropUPnP behavior in Reject 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-05 20:00:15 -07:00
Tom Eastep
3ac3ae279f Add A_REJECT action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-05 16:38:39 -07:00
Tom Eastep
54843c617d Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2016-04-05 11:46:42 -07:00
Tom Eastep
e9467326f3 Allow allow REJECT to take a parameter 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-05 11:20:44 -07:00
Tuomo Soini
80bf77e8a8 modules.xtables: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:31:36 +03:00
Tuomo Soini
1e5ebee799 modules.tc: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:31:36 +03:00
Tuomo Soini
74fe7b302e modules.ipset: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:31:36 +03:00
Tuomo Soini
d70e18535b modules.extensions: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:31:36 +03:00
Tuomo Soini
64a6b36918 modules.essential: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:31:36 +03:00
Tuomo Soini
2962809243 action.Untracked: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
23a91d7c26 action.template: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
30b2b2dcb4 action.TCPFlags: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
46a86cfa58 action.SetEvent: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
ad2dfd9eaf action.RST: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
001aabf72c action.ResetEvent: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
7052819a9c action.Related: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
2b1244c110 action.Reject: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
94803b63b1 action.NotSyn: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
5f33cb5d0a action.New: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
deda26c790 action.mangletemplate: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
f9f349a148 action.Invalid: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
2842e897c9 action.IfEvent: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
de44a16094 action.GlusterFS: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
6560e74c2c action.Established: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
f7ddf3008d action.DropSmurfs: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
cb608172d3 action.dropInvalid: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
f806010521 action.Drop: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
205254e043 action.DNSAmp: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
a7efa12fff action.Broadcast: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
95c4f2d7f6 action.AutoBLL: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
89189f7836 action.AutoBL: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
c2e3156e5c action.A_Reject: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
ffe9f88c07 action.allowInvalid: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tuomo Soini
e4c9c83e2b action.A_Drop: reformat to new header style 
Signed-off-by: Tuomo Soini <tis@foobar.fi>
 2016-04-05 20:13:55 +03:00
Tom Eastep
77a93d10a4 Don't pass an argument to DropUPnP out of Drop and Reject 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-04 15:55:48 -07:00
Tom Eastep
75df718865 Reword comment in push_action_params() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-04 09:41:28 -07:00
Tom Eastep
ae8e2f70ea Efficiency change to known_interface() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 17:34:02 -07:00
Tom Eastep
39f5b77e5f Fix known_interface() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 16:31:45 -07:00
Tom Eastep
cb5a2519f3 Keep hyphens in @chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 16:30:31 -07:00
Tom Eastep
4151f7c504 Revert change to log_[i]rule_limit 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 16:29:52 -07:00
Tom Eastep
054837aeea Use the real chain name in log messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-03 13:04:25 -07:00
Tom Eastep
b637d303b9 Correct use of a physical interface name in the hosts file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-02 17:27:20 -07:00
Tom Eastep
0dbf42424d Make physical name a synonym for the correcponding logical name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-02 10:04:05 -07:00
Tom Eastep
f22e8d6d55 Allow physical interface to work in the ecn file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-01 15:10:49 -07:00
Tom Eastep
d98305c6f4 Correct default for MINIUPNOD 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-01 12:20:42 -07:00
Tom Eastep
3cbfdadb32 Merge branch '5.0.7' 2016-04-01 09:46:53 -07:00
Tom Eastep
81d76e3817 Document + in the MODULESDIR setting. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-01 09:43:06 -07:00
Tom Eastep
df1b1f6768 Add MINIUPNPD option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-04-01 08:57:08 -07:00
Tom Eastep
3881b38e02 Fix similar INTERFACE column issue in the nat and netmap files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-31 14:16:43 -07:00
Tom Eastep
8a8f3b6f59 Merge branch '5.0.7' 2016-03-31 12:55:16 -07:00
Tom Eastep
b9bed00123 Correct handling of a physical name in a masq rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-31 12:52:30 -07:00
Tom Eastep
38aa7797c4 Allow protocol and user lists in actions and macros 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-30 08:34:42 -07:00
Tom Eastep
404540ffe1 Merge branch '5.0.7' 2016-03-30 08:17:19 -07:00
Tom Eastep
dd3c0daa08 Handle inline matches correctly in the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 13:33:47 -07:00
Tom Eastep
4fddfcfba0 More complete fix for inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 13:15:01 -07:00
Tom Eastep
421d5f6043 Move Raw matches to last. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-29 09:31:27 -07:00
Tom Eastep
382ab380a2 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2016-03-29 07:36:49 -07:00
Tuomo Soini
2342c7cd9c Perl/Shorewall/Chains.pm: Fix warning with older perl 2016-03-29 09:58:33 +03:00
Tom Eastep
66ae4975b2 Allow :R with DIVERT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-28 15:52:49 -07:00
Tom Eastep
5b7a9db170 Correct clearing of inline matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-28 15:48:59 -07:00
Roberto C. Sánchez
899a317c95 Fix typos 2016-03-26 22:25:30 -04:00
Tom Eastep
ad87d94e33 Small efficiency change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-26 13:12:33 -07:00
Tom Eastep
f86abf9552 Eliminate @columnstack -- simple save the columns array on the call stack. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-22 10:49:40 -07:00
Tom Eastep
9fe1a34412 Tighten up editing of configuration options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-21 12:03:45 -07:00
Tom Eastep
abe533b6e3 Correct the action on ingress filters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 13:45:33 -07:00
Tom Eastep
1c3140789c Add stab to ingress qdiscs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 13:25:39 -07:00
Tom Eastep
0399a346d0 Replace a silly line of code. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-19 12:05:45 -07:00
Tom Eastep
6ed3861d76 Correct Mangle Action Handling for second visit to the same action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 15:25:52 -07:00
Tom Eastep
7a18847c14 Correct handling of log level in a _DEFAULT setting. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 15:25:14 -07:00
Tom Eastep
273c89a753 Implement MARK and CONNMARK in the rules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:42:58 -07:00
Tom Eastep
2bebf1c95a Make '&' and '|' work with CONNMARK 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:30:52 -07:00
Tom Eastep
18573037f9 More 'check -r' fixes around Docker 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 11:09:39 -07:00
Tom Eastep
818628138b Add MARK and CONNMARK to the %targets table 
- Also, sort the table entries

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 10:21:35 -07:00
Tom Eastep
2adec0eb65 Implement a filename cache for find_file() 
- Don't need to search the CONFIG_PATH for re-open of same file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 09:45:41 -07:00
Tom Eastep
6ae94767b7 Correct a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-18 08:31:52 -07:00
Tom Eastep
9f26c010ac Remove embedded Perl from allowInvalid and dropInvalid 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-17 08:59:29 -07:00
Tom Eastep
9ab2310dc8 Correct an incorrect comment in process_rules() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-17 08:47:33 -07:00
Tom Eastep
c9c5f0174c Remove trailing blank lines from action.TCPFlags 2016-03-16 14:54:05 -07:00
Tom Eastep
da0653cb2f Declare passed() in Shorewall::User rather than importing it from Config 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 14:16:15 -07:00
Tom Eastep
65ce6ed226 Update modules to use passed() for parameter testing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 12:06:32 -07:00
Tom Eastep
eb9dd3e485 Implement passed() in Config.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 12:00:56 -07:00
Tom Eastep
796f191d48 Don't re-stat action files in process_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-15 09:03:36 -07:00
Tom Eastep
71c26beab4 Remove dead code (caused by bad test) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 17:56:34 -07:00
Tom Eastep
6f04902963 Make use of 'state=' in actions a fatal error 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 17:55:54 -07:00
Tom Eastep
bd2295c4c3 Avoid embedded Perl in the Broadcast action when ADDRTYPE is available 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:57:32 -07:00
Tom Eastep
901c6d34f6 Correct typo in Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:56:57 -07:00
Tom Eastep
741da14789 Ignore 'state' in the actions file with a warning 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:46:29 -07:00
Tom Eastep
34c3828b7c Fix action.Related 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:44:16 -07:00
Tom Eastep
eed7692952 Document the state action option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 15:15:32 -07:00
Tom Eastep
3c544b20e6 Convert the state actions to use the 'state' action option 
- Also avoid the CLI having to know about builtin actions

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 14:54:09 -07:00
Tom Eastep
dd547c90a8 Implement the 'state' action option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 14:30:36 -07:00
Tom Eastep
35fac8c2ea Avoid repeated %actions lookup in process_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 12:37:45 -07:00
Tom Eastep
513b828788 Pass '$prerule' to process_inline() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:56:07 -07:00
Tom Eastep
28e0cb5335 Use filename stored in the actions table 
- Avoid a find_file call on each action invocation

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:55:39 -07:00
Tom Eastep
c631173310 Eliminate the %inlines table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-14 10:47:18 -07:00
Tom Eastep
95da427ea8 Update manpages for 'audit' actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 15:53:31 -07:00
Tom Eastep
2c14b7c9e3 Rename %actparms to %actparams 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 15:36:38 -07:00
Tom Eastep
8e7af2e95e Additional editing of audit action parameters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 15:28:49 -07:00
Tom Eastep
6be4fd377f Make RST and NotSyn 'audit' actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 14:40:12 -07:00
Tom Eastep
44c0bffcd3 Add 'audit' option to actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 14:39:46 -07:00
Tom Eastep
2c3644a510 Make Action/Inline binary options into a bitmap 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 14:15:43 -07:00
Tom Eastep
407bc8f8db More prerule fixes in expand_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 12:57:23 -07:00
Tom Eastep
2743a411ae Add a jump to DOCKER from OUTPUT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 12:51:36 -07:00
Tom Eastep
1a23e840d7 Restore NotSyn rule in action.Reject 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 12:21:24 -07:00
Tom Eastep
bed747c20b Restore NotSyn and RST logic using perl_action_tcp_helper() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 10:49:23 -07:00
Tom Eastep
c2fd48c4c6 Include pre-rule matches when the target is a chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 10:08:17 -07:00
Tom Eastep
054637880b Cleanup of Standard Actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-13 10:06:02 -07:00
Tom Eastep
5f01bc75bd Better fix for $current_param in the INLINE block of process_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 18:28:27 -08:00
Tom Eastep
0e59b82503 Handle '+' in inline matches the mangle and masq files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 17:14:15 -08:00
Tom Eastep
33343aaf17 Modify TCP-specific actions to use + in inline_matches 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 17:01:52 -08:00
Tom Eastep
90ace544eb Implement '+' to specify inline matches as "early" 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 16:39:46 -08:00
Tom Eastep
c36cee28fb Save/Restore $current_param in process_inline() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 16:39:08 -08:00
Tom Eastep
df5f34951c Correct actions 
- Restore the TCP-related actions
- Correct typo in action.Drop

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 15:09:31 -08:00
Tom Eastep
ec2ebee0e6 Clear inline matches between calls to process_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 15:08:47 -08:00
Tom Eastep
a50c52675b Correct a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 15:08:04 -08:00
Tom Eastep
bb7b3123df Eliminate ?begin perl ... ?end Perl in many actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 12:15:07 -08:00
Tom Eastep
3960fa6e0e Performance tweak to read_a_line() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-12 09:05:30 -08:00
Tom Eastep
a7fda02d88 Print lines copied into the generated script when tracing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-11 15:59:49 -08:00
Tom Eastep
68a324c62c Small tweaks to read_a_line() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-11 13:56:03 -08:00
Tom Eastep
d179615fca 'trace' and 'check -r' uses $PAGER 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-11 13:26:23 -08:00
Tom Eastep
6779c8307f Optimize chain resolution in process_mangle_rule1() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 15:26:52 -08:00
Tom Eastep
147c7e284f Fix a couple of Mangle Action blunders 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 13:59:29 -08:00
Tom Eastep
8d657775af Fix 'check -r' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 13:41:59 -08:00
Tom Eastep
b14bf0e779 Remove unused globals from the Rules module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2016-03-10 11:14:51 -08:00