holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
11,235 Commits 104 Branches 736 Tags 54 MiB
7204220991
Commit Graph

4741 Commits

Author SHA1 Message Date
Tom Eastep
fc5f439b4b Generate prio 999 rule when USE_DEFAULT_RT=Yes, even when there are no balance providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-17 13:00:34 -08:00
Tom Eastep
ed3a623184 Cosmetic and maintainability improvements: 
1. Export optimization masks from Shorewall::Chains for use in
   Shorewall::Compiler.
2. Move capability reporting and checkint from Shorewall::Compiler to
   Shorewall::Config.
3. Eliminate some gratuitous black lines.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-17 07:24:12 -08:00
Tom Eastep
3120bb37d1 Reload load distribution chains during 'refresh' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-16 10:07:18 -08:00
Tom Eastep
25d45dedfc Add STARTOPTIONS and RESTARTOPTIONS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-16 10:03:13 -08:00
Tom Eastep
41e68b59dc Add STARTOPTIONS and RESTARTOPTIONS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-15 20:35:55 -08:00
Tom Eastep
58bf562747 Generate load rules at runtime rather than at compile time. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-15 19:23:44 -08:00
Tom Eastep
364420c4eb Don't derive base in load_chain() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-15 07:54:30 -08:00
Tom Eastep
b0f7c08844 Save load and status of each interface. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-14 17:43:25 -08:00
Tom Eastep
93bd0b59a8 Load lib.base from lib.cli 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-14 14:17:06 -08:00
Tom Eastep
7316a2c51a Implement 'load=<load-factor>' in providers file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-13 16:37:05 -08:00
Tom Eastep
531474592c Correct handling of '-p' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-13 15:42:20 -08:00
Tom Eastep
3920cef17e Update copyright on Shorewall::Providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-12 07:14:04 -08:00
Tom Eastep
ec8491caf8 Issue a warning message when both 'route_rules' and 'rtrules' exist. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-12 07:10:16 -08:00
Tom Eastep
057ea718cd Remove 'stat' provider option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-12 07:09:53 -08:00
Tom Eastep
58a0b9b5c1 Rename route_rules to rtrules -- phase 2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-09 07:19:10 -08:00
Tom Eastep
4c2df6fea7 Rename route_rules to rtrules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-09 06:38:55 -08:00
Tom Eastep
048d380c28 Issue warning if there is a deprecated option setting in the .conf file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-07 19:58:45 -08:00
Tom Eastep
ce73bb3d22 Unify prog.footer and prog.footer6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-07 13:53:41 -08:00
Tom Eastep
6f5ab698b4 Add a PROBABILITY column to the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-06 12:54:37 -08:00
Tom Eastep
c4768d4a4a Allow run-time address variable in the SOURCE column of route_rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-06 11:59:22 -08:00
Tom Eastep
afbc561b91 Shorewall install shouldn't remove /usr/share/shorewall/wait4ifup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-06 11:40:04 -08:00
Tom Eastep
f003c0644b Fix MARK_IN_FORWARD_CHAIN=Yes with fw source 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-06 09:26:43 -08:00
Tom Eastep
5ddb197680 Make '0' equivalent to '-' in the IN_BANDWIDTH column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-06 09:14:07 -08:00
Tom Eastep
cda4c6ed11 Implement 'stat' provider option -- phase 1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-05 16:49:26 -08:00
Tom Eastep
252bba215e Move lib.core from Shorewall-core to Shorewall 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-05 11:30:36 -08:00
Tom Eastep
46d8adcfe9 Add STATISTIC_MATCH capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-04 15:46:01 -08:00
Tom Eastep
9251eca31a Don't delete lib.common and lib.cli when installing Shorewall 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-04 10:32:17 -08:00
Tom Eastep
9353788285 Correct uninstall scripts for Shorewall and Shorewall6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-04 08:07:27 -08:00
Tom Eastep
e545bf4f04 Unify install files between Shorewall and Shorewall6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-03 16:35:41 -08:00
Tom Eastep
84dc26b82c Create lib.core 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-03 13:06:00 -08:00
Tom Eastep
7d756f51ac More unification of prog.header and prog.header6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-03 08:39:18 -08:00
Tom Eastep
4216d80c12 Allow Provider name in 'disable' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-02 15:25:43 -08:00
Tom Eastep
018ba394e3 Move common code from prog.header[6] to lib.common 2012-01-02 14:13:19 -08:00
Tom Eastep
a39f4699dc Update versions and copyrights 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-02 07:43:13 -08:00
Tom Eastep
48a59e032e Add Shorewall-common 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-01 20:30:09 -08:00
Tom Eastep
72699a6af6 4.4.28->4.5.0 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2012-01-01 07:36:46 -08:00
Tom Eastep
288c7b06dc Place sfilter jumps in the option chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-31 14:47:36 -08:00
Tom Eastep
4b8fb130ba Update copyright dates. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-31 14:15:25 -08:00
Tom Eastep
c2293f3d64 Eliminate the $blrules global in Shorewall::Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-31 13:16:04 -08:00
Tom Eastep
d6bac484dc Allow the timeout to be specified in that 'safe' commands. 
Also, allow a suffix (s, m or h) in the <timeout> paramater to the 'try' command.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-31 09:40:36 -08:00
Tom Eastep
64d3ac036b Disable BLACKLIST section 2011-12-30 20:25:54 -08:00
Tom Eastep
28f27c65aa Use SHA1 to shorten digests. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-30 14:58:49 -08:00
Tom Eastep
4d9a43a4dd Delete some 'dont_move' flags 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-30 11:31:08 -08:00
Tom Eastep
1d9a4c58e9 Cosmetic change with comments. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-30 10:59:23 -08:00
Tom Eastep
6f61293b08 Reduce the size of many configs by not copying long chains multiple times. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-30 10:27:58 -08:00
Tom Eastep
b63c7e0016 A bit of optimization in add_interface_options() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-30 08:08:28 -08:00
Tom Eastep
6bed5e5e55 Merge branch '4.4.27' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-30 07:28:14 -08:00
Tom Eastep
5b2f960db3 Disallow :P in CLASSIFY rules and complain if :F is used when the SOURCE or DEST is $FW. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-30 07:22:14 -08:00
Tom Eastep
1da7f52ed5 Copy output interface options rather than jump 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-29 18:49:47 -08:00
Tom Eastep
39f214208a Fix silly bug in the new option chain implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-29 17:57:39 -08:00
Tom Eastep
6926bcdbb9 More refinements of the option chain stuff. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-29 14:52:07 -08:00
Tom Eastep
f9960a0c94 Restore blacklst and blackout chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-29 13:45:35 -08:00
Tom Eastep
2c441b5393 Copy option rules into interface chains if no blacklist 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-29 09:32:16 -08:00
Tom Eastep
bddfb4f41c Add output option chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-29 08:22:00 -08:00
Tom Eastep
03610181fd Disallow :P in CLASSIFY rules and complain if :F is used when the SOURCE or DEST is $FW. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-29 07:49:53 -08:00
Tom Eastep
3ca9577f04 Cruft removal 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-28 16:22:11 -08:00
Tom Eastep
8cdc83638e Don't allow PREROUTING CLASSIFY rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-28 14:07:12 -08:00
Tom Eastep
a98c85cbc4 Make 'audit' work on a converted blacklist file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-28 10:30:24 -08:00
Tom Eastep
eda918215d Option chain phase II implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-28 10:29:15 -08:00
Tom Eastep
0518def9cf Merge branch '4.4.27' 2011-12-28 09:58:19 -08:00
Tom Eastep
09f58512be Make 'audit' work on a converted blacklist file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-28 09:34:34 -08:00
Tom Eastep
eff447ac11 Phase one option chain implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-27 18:12:58 -08:00
Tom Eastep
53451bdaa6 Remove BLACKLIST section from rules files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-27 15:32:49 -08:00
Tom Eastep
ea9c59a297 Add an interface filter chain for each interface. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-27 13:52:44 -08:00
Tom Eastep
49eb84b9e2 Remove more helper/proto silliness 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-27 13:06:37 -08:00
Tom Eastep
8a8214704e Centralize checking for required proto with helper 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-27 13:04:19 -08:00
Tom Eastep
aa743f2886 Merge branch '4.4.27' 2011-12-27 13:02:08 -08:00
Tom Eastep
c5868ef6e4 Revert "Remove redundant check." 
This reverts commit 53dd13cf15.
 2011-12-27 13:01:27 -08:00
Tom Eastep
7721644209 Merge branch '4.4.27' of ssh://shorewall.git.sourceforge.net/gitroot/shorewall/shorewall into 4.4.27 
Conflicts:
	Shorewall/Perl/Shorewall/Chains.pm
	Shorewall/Perl/Shorewall/Raw.pm
 2011-12-27 12:32:13 -08:00
Tom Eastep
1c2ab238a5 Merge branch '4.4.27' of ssh://shorewall.git.sourceforge.net/gitroot/shorewall/shorewall into 4.4.27 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-26 13:22:30 -08:00
Tom Eastep
3541767881 Don't croak when adding gateway route fails for IPv6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-26 11:58:06 -08:00
Tom Eastep
53dd13cf15 Remove redundant check. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-26 11:57:34 -08:00
Tom Eastep
6db8748ee8 Don't show IPv6 cached routes unless asked. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-26 11:57:18 -08:00
Tom Eastep
5520a6d31d Validate helper<->protocol 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-24 09:24:01 -08:00
Tom Eastep
be4cb9d26a Validate helper<->protocol 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-23 17:55:13 -08:00
Tom Eastep
97354c8ce8 Detect CT_TARGET when LOAD_HELPERS_ONLY=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-23 11:59:51 -08:00
Tom Eastep
e8c7ec38dc Allow netstat output to appear in dumps on Fedora 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-23 11:59:19 -08:00
Tom Eastep
b58ad8e758 Be sure to delete fooX chain on errors in determine_capabilities() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-23 10:55:08 -08:00
Tom Eastep
0e3ad6ff91 Omit the chain designator from an error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-23 07:51:12 -08:00
Tom Eastep
1c535ee0f9 Correct handling of a chain designator in CLASSIFY rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-23 07:44:16 -08:00
Tom Eastep
3081ab1da1 Correct RELATED_DISPOSITION error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-22 15:51:50 -08:00
Tom Eastep
ce735e9415 Allow a chain designator in CLASSIFY rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-22 15:41:16 -08:00
Tom Eastep
e93dbdcb99 Stop generation of superfluous routing rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-21 08:01:25 -08:00
Tom Eastep
ea8efd1c44 Correct 'show ipa' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-21 07:25:20 -08:00
Tom Eastep
c03fe0a076 Implement USE_LOGICAL_NAMES. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-20 16:03:56 -08:00
Tom Eastep
3e72442954 Convert sample notrack files to FORMAT 2 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-20 14:38:44 -08:00
Tom Eastep
0d4a6c1c28 Replace SHOREWALL_DIR with g_shorewalldir 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-20 08:19:57 -08:00
Tom Eastep
74cee48bc0 Change /sbin/shorewall6 back into a file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-19 15:52:42 -08:00
Tom Eastep
075d7ca68b Rename $nolock to $g_nolock 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-19 06:29:05 -08:00
Tom Eastep
6b90c09c04 Correct 'show raw' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-18 15:11:56 -08:00
Tom Eastep
1c8f6d3856 Eliminate a variable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-18 15:05:03 -08:00
Tom Eastep
c00068e08d Another correction to the 'CT' target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-18 07:21:32 -08:00
Tom Eastep
a80b46be81 Allow a port number to be appended to a helper name 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-17 17:08:24 -08:00
Tom Eastep
ec848ebc01 Parenthesize qa/.../ in embedded Perl 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-17 10:09:23 -08:00
Tom Eastep
ba5db8753e Fix CT helpers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-17 08:59:27 -08:00
Tom Eastep
9d66f34932 Allow config options to be used as shell variables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-15 12:52:22 -08:00
Tom Eastep
10d10b1c16 Remove a redundant capability test 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-15 12:52:06 -08:00
Tom Eastep
6194eceaa4 Restore text of 'Provider "..." compiled' message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-15 12:51:39 -08:00
Tom Eastep
8ac5f6c086 use specified tool for capabilities detection 2011-12-11 16:28:40 -08:00
Tom Eastep
cc78073ce7 Merge lib.cli-lite into lib.cli 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-11 13:15:30 -08:00
Tom Eastep
4cf564e7c9 Move startup_error() to lib.cli, plus cosmetic changes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-08 22:00:48 -08:00
Tom Eastep
eec8a4edaf Cosmetic cleanup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-07 13:04:20 -08:00
Tom Eastep
eaad3d836c Correct library name in header comments 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-06 19:05:55 -08:00
Tom Eastep
2142baca4f Avoid inappropriate RELATED,ESTABLISHED rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-06 19:04:43 -08:00
Tom Eastep
645e8dfea0 Straighten out LITEDIR 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-06 15:39:18 -08:00
Tom Eastep
004d0bcc38 Allow rules in the RELATED section when there are non-default settions of 
the new RELATED_* options.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-06 13:38:11 -08:00
Tom Eastep
43913915f9 Combine the CLIs into a single 'shorewall' file. 
Add lib.cli-lite and lib.cli-std to contain the functions that are different
between the full products and the lite ones.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-06 12:54:51 -08:00
Tom Eastep
c724e238e6 Move the bulk of command processing to lib.cli 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-06 07:47:34 -08:00
Tom Eastep
e762998f1e Allow spaces in the argument to the iprange command. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-06 06:44:15 -08:00
Tom Eastep
d4957696d1 Update man pages and sample files 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-05 17:45:09 -08:00
Tom Eastep
439af55312 Implement RELATED_DISPOSITION and RELATED_LOG_LEVEL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-05 16:08:17 -08:00
Tom Eastep
febe9e5222 Apply Chris Boot's fix for TC_ENABLED=Shared 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-05 12:22:48 -08:00
Tom Eastep
b27e2517b4 Unify capabilities detection 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-05 12:00:36 -08:00
Tom Eastep
94b8d07645 Correct fix for dynamic blacklisting (chain_exists()) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-05 07:01:16 -08:00
Tom Eastep
7fcdfd6655 Fix chain_exists() from IPv4 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-05 06:54:03 -08:00
Tom Eastep
2cffae738f Initial implementation of CT target support in the 'notrack' file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-04 17:15:58 -08:00
Tom Eastep
a794027f63 Implement CT capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-04 14:35:53 -08:00
Tom Eastep
e7d2b1d4ed Consolidate the lib.common files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-04 09:19:48 -08:00
Tom Eastep
0d80b54ad9 Correct some issue with file consolidation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-03 13:13:25 -08:00
Tom Eastep
f89c78788f Correct a couple of syntax errors in lib.cli 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-03 12:41:05 -08:00
Tom Eastep
252b6580c0 Load the common libs from /sbin/shorewall6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-03 12:04:28 -08:00
Tom Eastep
4161c35108 Implement common lib.base, lib.cli and CLI for Shorewall[6][-lite] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-03 10:59:01 -08:00
Tom Eastep
bc3782c3de Pass $CONFIG_PATH to compiler.pl 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-02 09:31:26 -08:00
Tom Eastep
8c6914d1a2 Don't deprecate 'optional' for shared providers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-01 11:23:22 -08:00
Tom Eastep
a27f5655a7 Merge branch '4.4.26' 2011-12-01 10:41:22 -08:00
Tom Eastep
99bf7fb994 Don't do TC stuff during enable/disable of a shared provider 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-01 10:41:03 -08:00
Tom Eastep
568e3b2e5b Allow a provider name in addition to an interface name in enable/disable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-01 10:32:54 -08:00
Tom Eastep
8f14485d67 Allow a provider name in addition to an interface name in enable/disable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-01 10:30:42 -08:00
Tom Eastep
3110f7c74a Add enable/disable commands to the CLIs 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-12-01 10:25:51 -08:00
Tom Eastep
d8caa6498a Add tracing to Optimize 16. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-30 07:57:19 -08:00
Tom Eastep
3581b2667e Don't install the blacklist file in /etc/shorewall[6] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-27 14:39:59 -08:00
Tom Eastep
9e149ca038 Correct default values during update 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-27 14:12:51 -08:00
Tom Eastep
61d5c6d6da Implement Shorewall::Chains::clone_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-26 09:36:02 -08:00
Tom Eastep
3498076a96 Accurately compare rule key values that are array references. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-26 08:03:02 -08:00
Tom Eastep
15d95b6977 Fix SAME target. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-26 07:48:03 -08:00
Tom Eastep
5cdb74168f Correct port list capture with --multiport. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-25 16:22:23 -08:00
Tom Eastep
613e41c25a Enable OPT 16 in check -r; Suppress duplicate rules 2011-11-25 16:05:07 -08:00
Tom Eastep
90e03e1833 Even more tweaks to optimize 16 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-25 14:46:37 -08:00
Tom Eastep
71bbd7963c Some tweaks to optimize 16 2011-11-25 10:42:10 -08:00
Tom Eastep
f305da9d0d Require extended multi-port match for OPTIMIZE 16. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-24 10:57:09 -08:00
Tom Eastep
8d8a681f40 Implement optimization level 16 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-24 10:22:04 -08:00
Tom Eastep
4559c8b5d0 Tweaks to convert_blacklist() 
- Reword an error message to handle both missing file and zero-sized file.
- Don't rename file that doesn't exist.
 2011-11-21 12:13:39 -08:00
Tom Eastep
dffb79e7bd Handle empty blacklist file in 'update -b' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-20 17:02:01 -08:00
Tom Eastep
bd8ba435cd Avoid uninitialized value in hash element. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-20 16:24:42 -08:00
Tom Eastep
4d30811794 Implement 'show marks' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-20 12:29:17 -08:00
Tom Eastep
e5a6387695 Eliminate use of WIDE_TC_MARKS in the Tc module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-20 08:45:16 -08:00
Tom Eastep
382309bc53 Derive default values for the mark-layout options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-20 07:03:33 -08:00
Tom Eastep
86c51f24d9 Deprecate the old mark layout options. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-19 17:14:05 -08:00
Tom Eastep
0adc82f469 Add the mark layout options to shorewall.conf 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-19 15:29:07 -08:00
Tom Eastep
83d7cfa76a Update documentation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-19 15:18:43 -08:00
Tom Eastep
ae8aa3a45a More fixes for ZONE_BITS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-19 08:19:38 -08:00
Tom Eastep
ab1b65d6a8 Fixes for blacklist conversion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-19 08:18:58 -08:00
Tom Eastep
4f9afc32ec Allow zone names in the MARK column when ZONE_BITS != 0 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-18 07:23:24 -08:00
Tom Eastep
7c0cb69c29 Don't copy limited broadcast routes to provider tables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-18 07:07:51 -08:00
Tom Eastep
364b30fd9b Fix 'update -b' handling of missing files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-18 06:26:37 -08:00
Tom Eastep
72f75c201c Implement zone automark 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-17 16:07:45 -08:00
Tom Eastep
96f5aec71f Add ZONE_BITS configuration option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-17 10:40:47 -08:00
Tom Eastep
fe09646bed Make zone types a power of 2. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-17 09:23:39 -08:00
Tom Eastep
348c6c8cf7 Correct handling of LOGMARK 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-17 07:22:07 -08:00
Tom Eastep
d096b9399a Fix '\!' handling in validate_level() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-15 16:41:32 -08:00
Tom Eastep
afaf0d9de8 Trivial optimiation in validate_level() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-13 06:19:40 -08:00
Tom Eastep
28a1087cd4 Cleanup of rewritten validate_level() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-13 05:58:59 -08:00
Tom Eastep
73ed66b9b9 Add ULOG and NFLOG capabilities plus LOGMARK for IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-12 14:10:48 -08:00
Tom Eastep
bf010dc03e Macro changes from Tuomo Soini 2011-11-11 15:08:57 -08:00
Tom Eastep
ffec7a4d95 More corrections to wildcard interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-11 07:29:44 -08:00
Tom Eastep
04dfe26549 Remove two unused variables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-11 05:23:37 -08:00
Tom Eastep
972721facb Remove some white space 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-10 17:52:25 -08:00
Tom Eastep
6813409c31 Make the previous patch a bit cleaner 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-10 07:19:21 -08:00
Tom Eastep
d85f6970e3 Fix wildcard interfaces 
- Suppress extra jumps to interface chains.
- Insure that the 'lo' ACCEPT rule doesn't get masked by a wildcard interface

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-10 06:53:48 -08:00
Tom Eastep
d053faadde Allow convertion of a legacy blacklist configuration 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-08 12:59:40 -08:00
Tom Eastep
6108a9cad8 Delete BLACKLISTSECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-06 14:46:14 -08:00
Tom Eastep
da7516d401 Update config files and manpages for BLACKLISTSECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-06 12:05:07 -08:00
Tom Eastep
1091c24348 Implement the BLACKLISTSECTION option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-06 08:43:38 -08:00
Tom Eastep
755ed9859b Merge branch '4.4.25' of ssh://shorewall.git.sourceforge.net/gitroot/shorewall/shorewall 2011-11-06 06:16:43 -08:00
Roberto C. Sanchez
cf8c30904d Add support for a "status" command to the Debian init scripts 
(cherry picked from commit d36a2030ea)
 2011-11-06 09:10:59 -05:00
Tom Eastep
d883e45f83 Correct 'start -f' with AUTOMAKE=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-05 07:54:05 -07:00
Tom Eastep
e236be37db Include the rawpost table in dump output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-05 07:52:40 -07:00
Tom Eastep
689e9b0fe1 Make replacement of '+' by '*' global in case statements. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-04 13:49:10 -07:00
Tom Eastep
352dba1aac More cleanup of the IN_BANDWIDTH code 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-02 06:34:35 -07:00
Tom Eastep
b9a7374130 Omit estimator when no avrate. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-01 11:16:51 -07:00
Tom Eastep
cfa33e894f Restore IN_BANDWIDTH functionality on moribund distributions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-01 07:02:32 -07:00
Tom Eastep
8b8140cc9f Add 'Basic Filter' capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-01 06:34:57 -07:00
Tom Eastep
f3b5d5585f Correct detection of FLOW_FILTER 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-11-01 06:21:34 -07:00
Tom Eastep
dc1f815679 Reload blacklistsection chains even when legacy blacklisting is used. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-31 08:04:32 -07:00
Tom Eastep
29f6f6e3f2 Allow 'refresh' to reload chains from the BLACKLIST section. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-30 06:05:24 -07:00
Tom Eastep
16457ce85b Evaluate a variable at compile-time rather than at run-time 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-27 07:07:38 -07:00
Tom Eastep
c319921365 Correct validation of 4in6 addresses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-25 06:19:34 -07:00
Tom Eastep
3258806f6c Insure that 32767 default rule exists on IPv6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-24 21:15:09 -07:00
Tom Eastep
ccdda4c73b Tighten the rule compatibility test in sub compatible(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-24 13:16:17 -07:00
Tom Eastep
3c98094242 Combine all IPV6 filtering in the routing table copy routines 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-24 13:15:36 -07:00
Tom Eastep
14764acd2d Restore a blank line in the generated script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-24 08:50:15 -07:00
Tom Eastep
ee66be8f32 Place all ip-address rules at priority 20000. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-23 17:11:41 -07:00
Tom Eastep
54ba4ed879 Add MARK column to route_rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-23 07:56:53 -07:00
Tom Eastep
4b419f7497 Cleanup if IPv6 provider work 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-22 12:48:07 -07:00
Tom Eastep
d3d9380df5 Don't combine incompatible chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-21 11:55:30 -07:00
Tom Eastep
f31f3dc92a Implement 'fallback' and 'balance' for IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-21 11:55:15 -07:00
Tom Eastep
20cd943a60 Make route-table copying work on IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-20 10:32:09 -07:00
Tom Eastep
a42e2dff7f Allow caps in IPv6 addresses 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-19 07:47:49 -07:00
Tom Eastep
62d43ab6dd Cleanup of new IN-BANDWIDTH handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-18 05:53:50 -07:00
Tom Eastep
dbe936c7c9 Cleanup of new IN-BANDWIDTH handling (avoids a syntax error) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-17 06:29:27 -07:00
Tom Eastep
4d83201843 Allow configuraton of a rate estimated policing filter 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-16 14:38:27 -07:00
Tom Eastep
ebc944f027 Add optional MTU parameter in IN_BANDWIDTH 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-16 10:52:45 -07:00
Tom Eastep
bf6ea13898 Update .service files with patch from Jonathan Underwood 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-12 06:13:15 -07:00
Tom Eastep
a077a9821d Implement rate estimation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-11 15:27:24 -07:00
Tom Eastep
25a6f10025 Fix complex traffic shaping 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-11 10:52:37 -07:00
Tom Eastep
ede17cb771 Restore lost function from merging 4.4.24 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-10 16:51:27 -07:00
Tom Eastep
6d56a8aa45 Merge branch '4.4.24' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-10 06:57:05 -07:00
Tom Eastep
a12a4a5a89 Add '6in4' as a synonym for '6to4' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-10 06:54:31 -07:00
Tom Eastep
99b21fdfc5 Implement HL manipulation for IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-09 14:01:40 -07:00
Tom Eastep
668926c2a6 Add BALANCE_TABLE. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-09 09:00:14 -07:00
Tom Eastep
a5010ec9a6 Correct alternate specification in the tunnels file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-09 08:50:55 -07:00
Tom Eastep
31e0b186bf More fixes for 'fallback' without weight 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-09 07:53:59 -07:00
Tom Eastep
809f27decd More alternate-specification fixes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-09 07:06:01 -07:00
Tom Eastep
8115934adf More alternate-specification fixes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-09 07:05:08 -07:00
Tom Eastep
035db174d8 Fix 'fallback' without weight 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-09 06:58:41 -07:00
Tom Eastep
3afd6a3ad3 Correct proto column of the netmap file 2011-10-08 18:20:47 -07:00
Tom Eastep
2d6f5da6bc Correct proto column of the netmap file 2011-10-08 18:19:08 -07:00
Tom Eastep
c304661217 Fix earlier change 2011-10-08 17:10:23 -07:00
Tom Eastep
661606ef95 Merge branch '4.4.24' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-08 17:07:12 -07:00
Tom Eastep
b5963c6783 Fix alternate nat handling 2011-10-08 17:01:18 -07:00
Tom Eastep
e6b120a805 Implement BALANCE table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-08 13:54:39 -07:00
Tom Eastep
e322e60d73 Fix 'fallback' 2011-10-08 12:32:29 -07:00
Tom Eastep
04c2007d53 Resolve merge conflicts 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-08 07:03:01 -07:00
Tom Eastep
5d4a0172b7 A bit of cleanup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-05 09:32:26 -07:00
Tom Eastep
835a056eb8 Implement BLACKLIST section in the rules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-03 16:02:01 -07:00
Tom Eastep
e09aa8662b Correct title in action.TCPFlags 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-03 09:05:38 -07:00
Tom Eastep
57650e8dd9 Add two new actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-02 18:41:58 -07:00
Tom Eastep
0a5d5821ec Support additional forms of column/value pair specification 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-02 11:45:55 -07:00
Tom Eastep
e728d663f9 Implement IPTABLES_S capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-01 13:54:52 -07:00
Tom Eastep
2f0829596f Fix format-1 Actions 2011-10-01 12:17:29 -07:00
Tom Eastep
f6092ee52d Eliminate the maxcolumns argument to the split_line functions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-01 11:39:12 -07:00
Tom Eastep
072f4752fc Get rid of minimum column requirement 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-10-01 09:56:25 -07:00
Tom Eastep
c76957cc39 Reword an error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-26 08:51:05 -07:00
Tom Eastep
4c7f1a03a0 Catch multiple semicolons on a line. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-26 07:42:44 -07:00
Tom Eastep
9a4dfc4394 Implement an alternate way of specifying column contents. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-25 17:08:53 -07:00
Tom Eastep
da5b6b99d4 Implement TTL support in tcrules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-24 16:17:52 -07:00
Tom Eastep
dbf5f17b41 More tweaks to switch implementation. 
1) Switch names may be 30 characters long.
2) Switch settings are retained over restart.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-24 07:34:58 -07:00
Tom Eastep
40bc6df07a Correct handling of SWITCH column 
- Handle exclusion
- Correctly detect CONDITION_MATCH at compile time
- Include condition match in the filter part of a NAT rule

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-23 15:01:40 -07:00
Tom Eastep
caddd65412 Rename condition->switch and add more documentation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-23 12:33:55 -07:00
Tom Eastep
75b4540d26 Add support for condition match in the rules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-21 15:20:50 -07:00
Tom Eastep
7978993d2b Validate NET2 in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-20 16:24:39 -07:00
Tom Eastep
d005536fcc Merge branch 'master' of ssh://shorewall.git.sourceforge.net/gitroot/shorewall/shorewall 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-20 16:20:34 -07:00
Tom Eastep
a5e05c9e8e Don't allow long port lists or icmp lists in netmap 2011-09-19 13:27:27 -07:00
Tom Eastep
990d6e504d Correct icmp-type and icmpv6-type 2011-09-19 10:05:58 -07:00
Tom Eastep
fd1e996fb1 Correct call to dest_iexclusion() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-19 08:28:29 -07:00
Tom Eastep
e01276225c Correct port order in the netmap file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-19 06:17:02 -07:00
Tom Eastep
c2bcb08483 Add 'i' versions of exclusion functions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-18 14:12:22 -07:00
Tom Eastep
95a83f7fdf Allow exclusion in the netmap file's NET1 column 2011-09-17 09:20:15 -07:00
Tom Eastep
5aac5870a1 Call setup_netmap if IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2011-09-17 07:31:18 -07:00
Tom Eastep
86847957bf Merge branch '4.4.23' 2011-09-16 09:03:43 -07:00