holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
12,319 Commits 104 Branches 736 Tags 54 MiB
93b3fd9be5
Commit Graph

2702 Commits

Author SHA1 Message Date
Tom Eastep
78db4abef5 Remove some redundant local variables from finish_chain_section() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-30 08:02:23 -08:00
Tom Eastep
fc73c3934b Replace BLACKLISTNEWONLY with BLACKLIST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-30 08:00:47 -08:00
Tom Eastep
75fb164234 Don't issue fatal error if a proto other than tcp is passed to a tcp-only inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 10:31:20 -08:00
Tom Eastep
27c5e67632 Rename process_rule to process_raw_rule and process_rule1 to process_rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 10:13:48 -08:00
Tom Eastep
61d8f704f9 Correct rule-generation detection in perl_action_helper 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 09:43:12 -08:00
Tom Eastep
f33e36b61e Raise an error if a protocol other than TCP is passed to a TCP-only inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 07:46:50 -08:00
Tom Eastep
670931c987 Initialize the columns array to '-'s. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 07:46:07 -08:00
Tom Eastep
316b67473e Merge branch 'master' into 4.5.13 
Conflicts:
	Shorewall/Perl/Shorewall/Rules.pm
	Shorewall/action.Established
	Shorewall/actions.std
 2013-01-29 07:30:52 -08:00
Tom Eastep
42f46ea5e7 Accurately determine if an inline action generates a rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 20:46:20 -08:00
Tom Eastep
49166efdca Make the TCP standard actions inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 18:01:08 -08:00
Tom Eastep
5a2c1792cb Inline the conntrack state actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 16:55:54 -08:00
Tom Eastep
a70c441458 Add CONTINUE as a possible setting for RELATED_DISPOSITION. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 11:47:45 -08:00
Tom Eastep
519861d7b2 Add CONTINUE as a possible setting for RELATED_DISPOSITION. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:58:03 -08:00
Tom Eastep
2e8eeff416 Correct error messages that include the section name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:41:52 -08:00
Tom Eastep
2217f89902 Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:41:45 -08:00
Tom Eastep
5c63444c14 Correct error messages that include the section name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:41:09 -08:00
Tom Eastep
cfa5d86f5c Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:40:26 -08:00
Tom Eastep
b3b074fb61 More infrastructure 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 15:37:23 -08:00
Tom Eastep
cbbcfe355e Infrastructure for more powerful action handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 12:37:10 -08:00
Tom Eastep
2a2e23cb17 Merge branch '4.5.13' 2013-01-27 11:26:59 -08:00
Tom Eastep
1b94c3651d Always handle ESTABLISHED before the other connection states. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:56:41 -08:00
Tom Eastep
b1b2aa910e Correct section handling: 
- Correct typo (' INVALID' -> 'INVALID' )
- Don't jump to non-existent target in finish_chain_section()

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:14:27 -08:00
Tom Eastep
aa609b87a9 Allow arbitrary actions for the various states. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:10:24 -08:00
Tom Eastep
a3a90d8d2e Correct section handling: 
- Correct typo (' INVALID' -> 'INVALID' )
- Don't jump to non-existent target in finish_chain_section()

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:08:02 -08:00
Tom Eastep
6c8761c7dd Add a "matches" argument to process_rule1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:21:30 -08:00
Tom Eastep
9194165e89 Handle explicit CONTINUE value for UNTRACKED_DISPOSITION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:17:09 -08:00
Tom Eastep
6306103991 Clean up fix for optimize 8 performance issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:13:27 -08:00
Tom Eastep
749773f89a Handle explicit CONTINUE value for UNTRACKED_DISPOSITION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:12:49 -08:00
Tom Eastep
5db317b6f7 Clean up fix for optimize 8 performance issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 07:55:55 -08:00
Tom Eastep
380d427a5d Dramatically reduce the CPU cost of optimize 8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 17:46:31 -08:00
Tom Eastep
6ce392b08e Correct handling of handle_first_entry() to avoid runaway recursion. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 12:18:17 -08:00
Tom Eastep
5fa01728ad Pass UNTRACKED packets through the blacklist chain when BLACKLISTNEWONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 09:18:20 -08:00
Tom Eastep
7bc66da663 Call handle_first_entry in the warning/error-message generators. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 07:30:50 -08:00
Tom Eastep
b8cc9c5a6a Drop chain-ending rules whose target is 'RETURN'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-25 14:03:04 -08:00
Tom Eastep
b7273d6999 Favor low-numbered less complex synonym chains in optimization 8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-25 13:55:04 -08:00
Tom Eastep
e12b919dc1 Prefer shorter action chain names in optimize level 8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 17:25:11 -08:00
Tom Eastep
18c0956374 Fix two bugs in the UNTRACKED section implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 16:41:18 -08:00
Tom Eastep
6403f4959d Implement UNTRACKED SECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 15:42:01 -08:00
Tom Eastep
0ca93c1ac9 Unify handling of the RELATED and INVALID sections within finish_chain_section() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 14:38:02 -08:00
Tom Eastep
a40c74ddec Eliminate forward declaration of finish_chain_section() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 09:04:50 -08:00
Tom Eastep
c2bc74cdfe Add INVALID section to the rules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 08:33:59 -08:00
Tom Eastep
7fe2027229 Eliminate superfluous ESTABLISHED,RELATED rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-22 16:17:19 -08:00
Tom Eastep
8fe36422b5 Delete stale comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-22 10:44:12 -08:00
Tom Eastep
f61f5a8183 Don't copy a chain that has a single RETURN rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-22 09:07:07 -08:00
Tom Eastep
4ed5c5fdfe Sort the chain list in optimize_level8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 16:00:32 -08:00
Tom Eastep
25d6164f21 Try to avoid ~combN chains when dealing with action chains. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 11:51:33 -08:00
Tom Eastep
32c475193f Another fix for RELATED_DISPOSITION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 11:50:46 -08:00
Tom Eastep
982fabc96f Delete $caller argument from process_default_action() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 09:45:54 -08:00
Tom Eastep
5beae475f5 Make optimize 8 a multi-pass operation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 09:12:42 -08:00
Tom Eastep
c820c54f41 Correctly handle audited RELATED_DISPOSITION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 09:03:27 -08:00
Tom Eastep
4a354ba5a2 Avoid internal error during standard chain completion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 08:02:50 -08:00
Tom Eastep
e23876b582 Rename '$inline' to '$action' in policy_rules() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 07:36:50 -08:00
Tom Eastep
64e76599e0 Correct handling of default actions that set Shorewall variables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-20 16:15:04 -08:00
Tom Eastep
c4a2f3d386 Set caller when possible in policy chains. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-20 14:51:16 -08:00
Tom Eastep
bc882af6c5 Allow RESET of Shorewall variables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-20 07:32:34 -08:00
Tom Eastep
d31221b03c Fix variable assignment. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-20 07:26:10 -08:00
Tom Eastep
f403420926 Allow setting chain variables 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-19 10:52:11 -08:00
Tom Eastep
b31c76cc50 Proper job of fixing DEFER_DNS_RESOLUTION=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-18 17:18:29 -08:00
Tom Eastep
1307770178 Allow setting action parameters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-18 15:05:14 -08:00
Tom Eastep
95aab78c0d Add infrastructure to delete the %usedactions entry for an action chain if 
the chain parameters are modified.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-18 14:54:57 -08:00
Tom Eastep
4587430e4a Move get_action_logging() to the Config Module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-18 13:06:55 -08:00
Tom Eastep
8ccd1ab52b Handle exclusion correctly when DEFER_DNS_RESOLUTION=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-18 12:09:54 -08:00
Tom Eastep
89a09f0256 Implement DEFER_DNS_RESOLUTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-13 17:00:14 -08:00
Tom Eastep
54dbbaaa2d Don't resolve DNS names at compile time. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-13 10:34:31 -08:00
Tom Eastep
90bd19feb9 Convert DNS names into ip addresses in validate_net(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-13 07:39:27 -08:00
Tom Eastep
853b9ce916 Enable DNS names without an interface name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-12 14:38:26 -08:00
Tom Eastep
c61d51363d Correct generation of rules in the ESTABLISHED section of the rules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-12 06:49:32 -08:00
Tom Eastep
af83989465 Update copyright dates. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-11 16:01:10 -08:00
Tom Eastep
b53fd39b49 Avoid a fatal Perl error in Config::cleanup when an fatal error occurs 
while compiling a default action.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-11 15:50:23 -08:00
Tom Eastep
38097bef5d Correct an optimizer bug. 
- delete_chain_and_references() was only deleting the downward references
  and not the upward ones.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-11 14:55:43 -08:00
Tom Eastep
76a63fb7e8 Don't flush 'noarp' ARP entries 
= doing so kills the loopback interface

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-10 17:14:40 -08:00
Tom Eastep
15ca9edf8a Allow delete_tc1() to work on devices which an @ suffix in their reported names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-09 14:09:07 -08:00
Tom Eastep
199bce925f Don't add chains with RETURNs to %terminating. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-09 12:54:29 -08:00
Tom Eastep
1fd3a6a522 Detect terminating chains 
- no RETURN Rules
- last rule is terminating

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-08 16:32:24 -08:00
Tom Eastep
011dd2c901 Add a RETURNS flag to optflags indicating that there is RETURN in the chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-08 15:25:53 -08:00
Tom Eastep
e54563d9c1 Don't append rules that can't be matched. 
Also, delete chains whose only rule is a -j RETURN

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-08 13:53:03 -08:00
Tom Eastep
f8c1b02dba Correct test for optimization in 'check -r' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-08 09:51:32 -08:00
Tom Eastep
dece73f7b6 Another fix for *C actions in arprules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-07 18:59:24 -08:00
Tom Eastep
eb3b47ae24 Correctly handle *C actions in arprules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-07 18:29:41 -08:00
Tom Eastep
c157228f7d Correct handling of unknown ACTION in arprules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-07 18:21:58 -08:00
Tom Eastep
a7af052d91 Correct issue with generating ESTABLISHED rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-07 16:07:24 -08:00
Tom Eastep
414a74d23c Support protocol lists in most files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-07 16:06:54 -08:00
Tom Eastep
0526863e66 Make $section numeric 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-07 13:39:49 -08:00
Tom Eastep
5dbe2aa9ec Optimize a test in finish_chain_section(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-07 07:00:15 -08:00
Tom Eastep
ca202ca10b Flush the arp cache after applying the arprules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-06 17:46:40 -08:00
Tom Eastep
de4e0898b5 Catch protocol lists in contexts that don't allow them. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-06 17:23:14 -08:00
Tom Eastep
edc0a84e5d Optimize RELATED rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-06 16:48:37 -08:00
Tom Eastep
d4c9885c09 Change interpretation of the log tag when LOGTAGONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-06 13:10:18 -08:00
Tom Eastep
c41b9e596d Don't add --cstate to dropInvalid rule. 
Signed-off-by: Tom Eastep <teastep@mint14.(none)>
 2013-01-06 09:42:55 -08:00
Tom Eastep
9fd7933b5d Make inline actions work in sections other than NEW. 
Signed-off-by: Tom Eastep <teastep@mint14.(none)>
 2013-01-06 09:32:50 -08:00
Tom Eastep
f223e3584c Make '+' optional in the ADD and DEL statements. 
Signed-off-by: Tom Eastep <teastep@mint14.(none)>
 2013-01-06 07:37:11 -08:00
Tom Eastep
3f24416f37 Add a warning for opcode inversion when not arptables_jf. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-05 13:14:32 -08:00
Tom Eastep
38aa7f3857 Correct opcode inversion when not ARPTABLES_JF 
Signed-off-by: Tom Eastep <teastep@mint14.(none)>
 2013-01-05 08:26:46 -08:00
Tom Eastep
7f6430a383 Correct address inversion in match_arp_net() 
Signed-off-by: Tom Eastep <teastep@mint14.(none)>
 2013-01-05 08:20:51 -08:00
Tom Eastep
4fc0dba26d Correct two-interface check in process_arprule. 
Signed-off-by: Tom Eastep <teastep@mint14.(none)>
 2013-01-05 08:17:53 -08:00
Tom Eastep
0c7e10dbfa Add a comment to the Zones file 
- define the {bridge} member.
 2013-01-05 08:15:56 -08:00
Tom Eastep
97009bad79 Correct arptables_jf MAC handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-04 17:27:16 -08:00
Tom Eastep
af7b7195d2 Fix MAC handling in the ARP module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-04 15:55:52 -08:00
Tom Eastep
a732f6e538 Add some comments to the ARP module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-04 15:07:51 -08:00
Tom Eastep
38657d9f98 Support for arptables. 
Signed-off-by: Tom Eastep <teastep@mint14.(none)>
 2013-01-04 09:17:57 -08:00