holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity
14,446 Commits 104 Branches 736 Tags 54 MiB
d52a4b1c9d
Commit Graph

3657 Commits

Author SHA1 Message Date
Tom Eastep
2d7025dcc3 Correct mark range handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-12-13 08:31:31 -08:00
Tom Eastep
a833815b31 Correct IPv6 handling of LOG_BACKEND=LOG 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-15 08:56:42 -08:00
Tom Eastep
9241552c52 Make emacs sh-mode work better with lib.core 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-14 16:28:44 -08:00
Tom Eastep
16c1809ef2 Apply Alan Barrett's dhclient patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-14 13:39:23 -08:00
Tom Eastep
9a6047b3c4 Correct reversed naming of SHA chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-06 08:18:52 -08:00
Tom Eastep
5b4e3bc07c Accomodate new module names for LOG_BACKEND 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-05 12:51:24 -08:00
Tom Eastep
dc3f163e71 Change the names of the sha1 chains for uniqueness 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-04 17:54:38 -08:00
Tom Eastep
8c0c1bd1e0 Omit the 'shorewall' chain from .ip[6]tables-restore-input 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-02 08:16:47 -08:00
Tom Eastep
8b825c4c4c Avoid failure of ip[6]tables-restore. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-02 07:56:05 -08:00
Tom Eastep
9598ac6fad Correct a couple of problems with -C 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-01 10:09:04 -07:00
Tom Eastep
8fb73026c8 Replace SAVE_COUNTERS with the -C command option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-11-01 09:37:57 -07:00
Tom Eastep
4546cbaff7 Use chains with names derived from a digest to identify ruleset 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-31 11:36:53 -07:00
Tom Eastep
a83c146636 Cleanup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 20:27:06 -07:00
Tom Eastep
2ffc97867c Correct syntax error in the generated script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 19:59:20 -07:00
Tom Eastep
f08803e293 Preserve counts on 'restart' without compilation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 18:38:45 -07:00
Tom Eastep
3454e10525 Add SAVE_COUNTERS option. 
- Also implement recover command

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-30 08:57:56 -07:00
Tom Eastep
edc30fcc8d Process the params file with SHOREWALL_SHELL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-29 12:22:00 -07:00
Tom Eastep
85e5669fc7 Rename function interface_up() to interface_enabled() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-27 18:38:22 -07:00
Tom Eastep
f5bdc9e7f4 Allow two limits in the RATE LIMIT columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-22 11:21:43 -07:00
Tom Eastep
3bae6e61cf Eliminate syntax errors in the generated script 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-07 07:53:26 -07:00
Tom Eastep
5204cbc95f Suppress 'No ipsets were saved' warning when SAVE_IPSETS=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-07 07:50:12 -07:00
Tom Eastep
ea1b8ac63a Correct handling of empty LOG_BACKEND 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-10-07 07:34:55 -07:00
Tom Eastep
820c769499 Correct silly bug in last change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-29 07:08:39 -07:00
Tom Eastep
e6b0666ac9 Save ipsets during normal stop (duh) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 18:43:11 -07:00
Tom Eastep
3174454300 Correct SAVE_IPSETS logic in Config.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 14:38:01 -07:00
Tom Eastep
ce1c367d1d Re-commit the fix that saves only the appropriate family 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 14:09:20 -07:00
Tom Eastep
3e2c903a41 Revert "Only save ipsets of the proper family" 
This reverts commit b053cab630.
 2014-09-28 13:32:32 -07:00
Tom Eastep
b053cab630 Only save ipsets of the proper family 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 12:58:52 -07:00
Tom Eastep
6f7d063921 Remove the target file before saving ipsets in the savesets command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 11:53:52 -07:00
Tom Eastep
3858683e94 Allow saving a specified list of ipsets 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-28 11:19:41 -07:00
Tom Eastep
38a18ac9ac Allow indefinite alternative to 'yes' and 'no' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-27 15:06:18 -07:00
Tom Eastep
a09484356c Support 'yes', 'no, <other> values for simple config options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-27 07:57:46 -07:00
Tom Eastep
bc8588a68e Fix rule numbers in trace output 
- Don't increment $number needlessly when not tracing

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-27 07:57:09 -07:00
Tom Eastep
4989f694cd Correct trace output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-25 14:47:00 -07:00
Tom Eastep
053df2a5fb Go back to original insert_irule() fix. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-25 09:21:20 -07:00
Tom Eastep
976a1f3deb Merge branch '4.6.3' 
Conflicts:
	Shorewall/Perl/Shorewall/Misc.pm
 2014-09-25 08:06:16 -07:00
Tom Eastep
ea40068c10 Fix ADMINISABSENTMINDED=No used with stoppedrules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-25 08:03:35 -07:00
Tom Eastep
56649e2183 Don't compile routestopped during check if there is stoppedrules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 19:24:13 -07:00
Tom Eastep
520d21c056 Another tweak to LOG_BACKEND 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 17:12:05 -07:00
Tom Eastep
540eff24aa Correctons to LOG_BACKEND implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 16:35:41 -07:00
Tom Eastep
580e00dabd Implement LOG_BACKEND option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 15:26:13 -07:00
Tom Eastep
4815f7eba3 Correct warning message in stoppedrules processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-24 11:05:15 -07:00
Tom Eastep
7481514a97 Implement the 'terminating' action option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-23 09:29:13 -07:00
Tom Eastep
1f5439257a Revert "Implement the 'terminating' action option" 
This reverts commit 6851744cb7.
 2014-09-23 07:39:25 -07:00
Tom Eastep
d97d45f4ad Merge branch '4.6.3' 2014-09-23 07:10:17 -07:00
Tom Eastep
f9d98b74a2 Merge branch '4.6.2' into 4.6.3 
Conflicts:
	Shorewall/Perl/Shorewall/Providers.pm

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-16 08:09:20 -07:00
Tom Eastep
0d23b9c542 Don't verify required interfaces during 'stop' or 'clear'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-14 09:29:04 -07:00
Tom Eastep
a7bdfcc47b Refine the rule reduction fix 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-11 20:58:01 -07:00
Tom Eastep
988ee64621 Eliminate Redundant Rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-11 10:17:01 -07:00
Tom Eastep
9947f4d968 Re-enable SECTION PREROUTING in the accounting file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-10 12:53:08 -07:00
Tom Eastep
9e039e30e5 Issue warning message when /etc/iproute2/rt_tables is not writeable 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-02 08:11:33 -07:00
Tom Eastep
6851744cb7 Implement the 'terminating' action option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-09-01 08:16:42 -07:00
Tom Eastep
f963adccf5 Correct silly typo in Chains.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-31 16:57:24 -07:00
Tom Eastep
fa8c3b3b6c Correct typo in error messages 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-24 08:34:33 -07:00
Tom Eastep
602ecad712 Cleaner code in expand_variables() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-20 11:25:49 -07:00
Tom Eastep
6f777098d7 Add 'wildcard' member to the interface table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-12 06:51:17 -07:00
Tom Eastep
e545329eb9 Modify the preceding fix to work with wildcard interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-12 06:50:59 -07:00
Tom Eastep
aedd9b5a76 Add 'wildcard' member to the interface table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-11 08:30:44 -07:00
Tom Eastep
427f38109e Some cosmetic cleanup 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-10 07:20:23 -07:00
Tom Eastep
0e1a1a3f44 Modify the preceding fix to work with wildcard interfaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-08 10:34:29 -07:00
Tom Eastep
b6161b8be7 Merge branch '4.6.2' 2014-08-08 08:30:04 -07:00
Tom Eastep
d3209ca624 Correct handling of a physical name in the provider INTERFACE column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-08 08:15:26 -07:00
Tom Eastep
5ef5aa8cdb Allow inline matches in an action file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-05 07:34:24 -07:00
Tom Eastep
0ca12bd86f Correct syntax error caused by replacing '%%' with '??' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-03 15:29:58 -07:00
Tom Eastep
a2f1c57246 Add DNSAmp action 
- Allow escaping '@' allowing u32 in action body
- Allow inline matches in actions

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-03 15:11:25 -07:00
Tom Eastep
fd42fa9f74 Make 'detect_configuration' work in the 'run' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-08-01 07:34:40 -07:00
Tom Eastep
e49832f4b5 Run the 'init' script in the 'run' command. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-30 10:25:00 -07:00
Tom Eastep
0bf80c15d8 Detect missing <commmand> in the generated scrip 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-29 11:35:32 -07:00
Tom Eastep
31e5aeeaea Refine the 'run' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-29 10:30:07 -07:00
Tom Eastep
a7b18ca875 Implement 'run' command 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-28 07:04:56 -07:00
Tom Eastep
ad6c91bcbd Allow optimize level 8 to work with Perl 5.20.0. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-25 21:03:48 -07:00
Tom Eastep
461f7b10ba Detect Arptables JF capability when LOAD_HELPERS_ONLY = No. 
- Move detection of Header Match to its proper ordinal.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-20 07:19:02 -07:00
Tom Eastep
2c9eda9cee Add some white space for readability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 18:33:02 -07:00
Tom Eastep
64fc3d2e43 Correct a typo that caused iset couter match to be mis-detected 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 10:27:29 -07:00
Tom Eastep
d0aed87546 Correct IPV6 ipset capabilities checking on 3.14 kernels 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 10:25:46 -07:00
Tom Eastep
56fa6bd78a Revert "Correct ipset detection on later kernels." 
This reverts commit b207f64a85.
 2014-07-19 10:22:12 -07:00
Tom Eastep
b207f64a85 Correct ipset detection on later kernels. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 08:55:02 -07:00
Tom Eastep
9f381209d5 Detect HEADER_MATCH when LOAD_MODULES_ONLY=No 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-19 07:20:28 -07:00
Tom Eastep
6771dc54ad Streamline some code from the last commit 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-18 12:58:49 -07:00
Tom Eastep
417bd0138e Correct two problems with tcrules processing: 
- SAVE and RESTORE didn't work
- '|' and '&' were ignored


Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-18 08:32:22 -07:00
Tom Eastep
2ed523101c Allow specification of the MAC address of a gateway 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-06 09:54:53 -07:00
Tom Eastep
c663a14c4d Correct TIME column handling in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-04 08:17:19 -07:00
Tom Eastep
8bfff55ed2 Add a TIME column to the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-04 08:01:14 -07:00
Tom Eastep
b1a6ec7f03 Merge branch '4.6.1' 2014-07-02 21:41:27 -07:00
Tom Eastep
cad8443e01 Allow SAVE/RESTORE rules in the OUTPUT chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-02 12:38:02 -07:00
Tom Eastep
2ad81f1a81 Apply Thibaut Chèze's patch for DSCP names 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-02 12:37:50 -07:00
Tom Eastep
166e1a3df9 Allow SAVE/RESTORE rules in the OUTPUT chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-01 06:54:54 -07:00
Tom Eastep
84437ea689 Apply Thibaut Chèze's patch for DSCP names 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-07-01 06:52:58 -07:00
Tom Eastep
7fdc398a5e Revert "Revert "Revert "Add a TIME column to the mangle file""" 
This reverts commit 1165b2689c.
 2014-06-27 08:23:04 -07:00
Tom Eastep
1165b2689c Revert "Revert "Add a TIME column to the mangle file"" 
This reverts commit 9c7fcd09fd.
 2014-06-27 08:14:28 -07:00
Tom Eastep
2701b0a756 Correct number of columns in split_line2() calls. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-25 08:22:09 -07:00
Tom Eastep
9c7fcd09fd Revert "Add a TIME column to the mangle file" 
This reverts commit 824b14b714.
 2014-06-25 07:33:42 -07:00
Tom Eastep
824b14b714 Add a TIME column to the mangle file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-25 07:05:12 -07:00
Tom Eastep
122d58b122 Clear inline matches in perl_action_tcp_helper 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-21 07:58:27 -07:00
Tom Eastep
61bb73fd8c Correct handling of matches in action_tcp_helper() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-20 14:28:17 -07:00
Tom Eastep
36e31ed839 Correct typo in error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-08 09:40:50 -07:00
Tom Eastep
b55b6a913c Insert the server address list into the error message in DNAT/REDIRECT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-08 09:36:18 -07:00
Tom Eastep
9c9ae04c86 Raise an error when a server list is specified in a DNAT or REDIRECT rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-08 08:52:41 -07:00
Tom Eastep
c898129ad6 Correct pi-rho's patch to not deal with the loopback interface 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-06 13:12:02 -07:00
Tom Eastep
2cd5c41ec0 Clean up white space in pi-rho's patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-06 10:44:33 -07:00
Tom Eastep
bea5434de6 Merge branch '4.5.21' 2014-06-06 10:05:02 -07:00
Tom Eastep
8657dd97f7 Apply pi-rho's patch for rpfilter. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-06-06 10:04:42 -07:00
Tom Eastep
954cddc37a Enable 1:1 NAT in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-25 12:50:00 -07:00
Tom Eastep
5a22b14947 Enable 1:1 NAT in IPv6 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-25 08:57:01 -07:00
Tom Eastep
6d3b1d80d4 Make 'update -A' convert the tcrules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-16 14:46:15 -07:00
Tom Eastep
c6565f051e Clean up checking for chain designators with SOURCE $FW. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-16 07:18:35 -07:00
Tom Eastep
c9b6d4a670 Correct CHECKSUM handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-16 07:18:06 -07:00
Tom Eastep
d15956feea Deprecate FORMAT-1 actions and macros 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-08 14:30:33 -07:00
Tom Eastep
f717d097d7 Apply Tuomo Soini's Macro format patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-05-07 12:19:24 -07:00
Tom Eastep
ba3a7d0621 Do not deprecate USE_DEFAULT_RT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-19 07:53:18 -07:00
Tom Eastep
4d4e8b3df4 Do nothing when a rules file section is empty. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-18 14:13:34 -07:00
Tom Eastep
240d3d8cab Improve interface option inheritence 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-18 13:36:06 -07:00
Tom Eastep
acda5482c4 If USE_DEFAULT_RT isn't specified, make it 'No' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-18 13:22:58 -07:00
Tom Eastep
e731ea1ca8 Revert "Always inherit interface options" 
This reverts commit 65cde3475f.
 2014-04-15 11:54:58 -07:00
Tom Eastep
65cde3475f Always inherit interface options 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-15 11:37:51 -07:00
Tom Eastep
b3cd9ab15a Default to LOAD_HELPERS_ONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-04-12 11:05:28 -07:00
Tom Eastep
58700b2301 Correct the behavior of rpfilter when FASTACCEPT=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-31 07:29:29 -07:00
Tom Eastep
a9ac9c274e Correct the behavior of rpfilter when FASTACCEPT=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-31 07:28:30 -07:00
Tom Eastep
72869adcd6 Correct missing comment in trace entry. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:55 -07:00
Tom Eastep
0c8365001d Avoid spurious comments on jumps to section chains. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:48 -07:00
Tom Eastep
6274f8444f Correct missing comment in trace entry. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:23 -07:00
Tom Eastep
05816e94ee Avoid spurious comments on jumps to section chains. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-28 08:55:00 -07:00
Tom Eastep
0561b10adb Merge branch 'master' of ssh://server.shorewall.net/home/teastep/shorewall/code 2014-03-22 08:58:20 -07:00
Tom Eastep
db1b25b4d7 Restore small mark verification. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-22 08:38:57 -07:00
Tom Eastep
4de651ff55 Add a comment line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-19 10:38:41 -07:00
Tom Eastep
5981ce59e3 Include -t <table> in debug_restore_input() error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-19 10:25:37 -07:00
Tom Eastep
54a5e4af52 A couple of minor tweaks to the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-19 10:24:30 -07:00
Tom Eastep
4bd8d9791c Include -t <table> in debug_restore_input() error message 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-18 07:28:14 -07:00
Tom Eastep
39b7527cb6 Include rule priority in delete of generated address route rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-10 08:25:59 -07:00
Tom Eastep
08d29edf1a Include rule priority in delete of generated address route rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-10 08:24:38 -07:00
Tom Eastep
093ff580b5 Deprecate USE_DEFAULT_RT=No. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-09 07:48:05 -07:00
Tom Eastep
cea237620a Change USE_DEFAULT_RT default to 'Yes'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-09 07:42:22 -07:00
Tom Eastep
c9d7370fb4 Merge branch '4.5.21' 
Conflicts:
	Shorewall/manpages/shorewall.conf.xml
	Shorewall6/manpages/shorewall6.conf.xml

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-05 09:00:34 -08:00
Tom Eastep
8b4d8bfa16 Finish ADMINISABSENDMINDED change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-03-05 08:57:03 -08:00
Tom Eastep
4eadec234a Revert "Correct the behavior of ADMINISABSENTMINDED" 
This reverts commit ded747a51a.
 2014-03-02 08:25:05 -08:00
Tom Eastep
2b489993ca Revert "Correct the behavior of ADMINISABSENTMINDED" 
This reverts commit df09e0ccc5.
 2014-03-02 08:23:23 -08:00
Tom Eastep
ded747a51a Correct the behavior of ADMINISABSENTMINDED 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-28 10:14:33 -08:00
Tom Eastep
df09e0ccc5 Correct the behavior of ADMINISABSENTMINDED 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-28 10:14:08 -08:00
Tom Eastep
454e53bcfa Reformat preceding patch and correct syntax errors. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-25 13:21:23 -08:00
Tom Eastep
66fdc9f6a7 Call directive_callback for directives without '?' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-25 12:48:25 -08:00
Tom Eastep
c74235a200 Correct typos 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-17 14:17:49 -08:00
Tom Eastep
1759fc75b0 Correctly handle alternate specification with ';' in 'update -t' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-17 14:10:17 -08:00
Tom Eastep
3e87efc82b Document -t option 
- Also copy compiler directives to the mangle file.
 2014-02-17 12:50:59 -08:00
Tom Eastep
a011ad8efe Add raw matches to the converted mangle file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-16 09:59:13 -08:00
Tom Eastep
0e40a42729 Allow SAVE and RESTORE in the postrouting chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-16 09:50:43 -08:00
Tom Eastep
669d15e2cf Implement the -t update option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-15 09:36:13 -08:00
Tom Eastep
2dbcd36a9c Implement BASIC_FILTERS 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 16:34:03 -08:00
Tom Eastep
0383ca7de6 Correct semantics of ipset lists in tcfilters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 12:27:46 -08:00
Tom Eastep
7ddc65133e Support ipset lists in the tcfilters file. 
- Also document the fact that ipset match options are not available in
  the tcfilters file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 12:16:35 -08:00
Tom Eastep
1d4a87a0d0 Excape an opening parehthesis. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 12:15:35 -08:00
Tom Eastep
3b3608ad65 Correct ICMP handling in basic filters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-04 07:16:41 -08:00
Tom Eastep
081a387f1d Fix some bugs in basic filter generation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-02-03 14:59:27 -08:00
Tom Eastep
50fb8e3f2f Use HEX representation for matching IPv6 addresses in basic filters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-31 12:49:47 -08:00
Tom Eastep
f029f5b483 Correct handling of logging of a non-terminating target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-29 08:22:31 -08:00
Tom Eastep
86f667afd4 Correct handling of logging of a non-terminating target 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-29 08:19:53 -08:00
Tom Eastep
8a63053c13 Correct defects found in unit testing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-21 20:19:56 -08:00
Tom Eastep
62557cb98e Correct defects found during testing of ematch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-21 12:53:33 -08:00
Tom Eastep
9c4089fc99 Initial basic filter implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-20 18:40:40 -08:00
Tom Eastep
fd28a12653 Allow DROP in the stoppedrules file 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-07 13:19:49 -08:00
Tom Eastep
7e6fc3229d Correct handling of default chain when a mark range is specified. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-07 13:15:51 -08:00
Tom Eastep
42dd8dfee9 Change license to GPLv2+ and update copyrights 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-04 09:48:27 -08:00
Tom Eastep
5a7e458104 Backout ematch stuff for now 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-03 12:01:56 -08:00
Tom Eastep
7e1a310929 Implement ipset matches in tcfilters 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-03 09:35:34 -08:00
Tom Eastep
78ecf9bdc8 Finish up ipset extensions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-03 09:23:14 -08:00
Tom Eastep
1771bb75cf Finish ipset match option implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-02 14:43:55 -08:00
Tom Eastep
b4847d6a01 New IPSET MATCH extensions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-02 09:36:35 -08:00
Tom Eastep
48ceed9ecb Make tcpflags the default. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 15:10:38 -08:00
Tom Eastep
1083dd8c26 Allow ?COMMENT in the mangle file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 08:02:17 -08:00
Tom Eastep
5e7cd855c2 Correct typo in Tc.pm 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:53:38 -08:00
Tom Eastep
2c2aaf262c Add IP[6]TABLES support for the conntrack file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:18:36 -08:00
Tom Eastep
6c990a7253 Logically OR builtin definitions from the actions file if the builtin exists 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:18:00 -08:00
Tom Eastep
f7bbac6ea8 Make tcrules/mangle similar to notrack/conntrack. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2014-01-01 07:15:56 -08:00
Tom Eastep
4c1b83beef Tweaks to the Tc.pm module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-31 11:42:38 -08:00
Tom Eastep
ac6a506e35 Allow logging from the RAW table 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-31 11:04:43 -08:00
Tom Eastep
11e61ec6e5 Add chain information to the builtin_target table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-31 08:22:58 -08:00
Tom Eastep
5985a6e9b3 Implement IP[6]TABLES in the rules files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 13:46:58 -08:00
Tom Eastep
66a04e4819 Allow inline matches with IP[6]TABLES 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 10:13:00 -08:00
Tom Eastep
1634267faa Rename JUMP to IP[6]TABLES. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 10:12:33 -08:00
Tom Eastep
c8866ef8bf Correct handling of columns with embedded spaces 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-29 08:56:14 -08:00
Tom Eastep
6fe06c82c8 More switch from tcrules to mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-28 15:24:05 -08:00
Tom Eastep
543446f8d7 Integrate tcrules and mangle processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-28 14:24:36 -08:00
Tom Eastep
a1222d10cb change 'marks' file to 'mangle' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-28 10:03:23 -08:00
Tom Eastep
3dba1f5bee Tested version of the marks file handler 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-27 12:38:22 -08:00
Tom Eastep
3960aaee4c Consolidate declarations in process_mark_rule(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-24 09:49:10 -08:00
Tom Eastep
5419109880 Correct syntax errors in new mars handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-24 09:04:54 -08:00
Tom Eastep
584b0ac50e Some small tweaks to the marks file processing 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-24 07:25:40 -08:00
Tom Eastep
4c2cedb670 Add get_target_param1() that doesn't accept the <action>/<param> syntax 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-19 09:17:11 -08:00
Tom Eastep
f32a777099 Fix INLINE in tcrles 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-18 09:19:35 -08:00
Tom Eastep
cd5be38cfb Eliminate silly extra loop in accounting processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-18 09:19:16 -08:00
Tom Eastep
2894bb9656 Move INLINE processing into the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-16 12:31:35 -08:00
Tom Eastep
fad3b42bd3 Correct line split in the Accounting module 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-16 07:40:41 -08:00
Tom Eastep
4e4e7cac1d Redefine the -i option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-15 11:23:20 -08:00
Tom Eastep
6d72cb3138 Correct update inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-15 09:32:09 -08:00
Tom Eastep
9abe60bc27 Implement the -i option of upgrade 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-14 17:54:10 -08:00
Tom Eastep
33c5893bdb Implement INLINE_MATCHES 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-14 13:35:01 -08:00
Tom Eastep
2bc329aa1d Add INLINE support to the masq file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-13 15:44:16 -08:00
Tom Eastep
95abeaea24 Finish INLINE in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-01 09:25:32 -08:00
Tom Eastep
75258083e3 Cleanup of column splitting change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-12-01 09:24:49 -08:00
Tom Eastep
bf44e514e3 Keep parentheses balanced when splitting a line. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-30 14:13:42 -08:00
Tom Eastep
e5d250750b Correct handling of ?SECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-27 07:53:33 -08:00
Tom Eastep
d63262a0cb change ZONE2ZONE default to '-'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-24 08:16:28 -08:00
Tom Eastep
3870157898 Issue warning on bare SECTION headings. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-24 07:58:02 -08:00
Tom Eastep
80d54ec40b Implement ?SECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-18 06:57:54 -08:00
Tom Eastep
855cb6e7f4 Correct handling of HFSC classes with DMAX but no UMAX 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-16 08:07:23 -08:00
Tom Eastep
e14d92c5ac Add DROP support in tcrules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-11-04 10:50:11 -08:00
Tom Eastep
ca3385d1be Remove superfluous '[' from character set. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-21 09:28:21 -07:00
Tom Eastep
5823411091 Correct typo in a regular expression. 
- Re-enable |<mark> in the tctrules file.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-21 07:04:23 -07:00
Tom Eastep
66c2fca2b0 Eradicate the use of 'fgrep' 
- Busybox on Leaf Bering does not have fgrep

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-14 07:15:08 -07:00
Tom Eastep
b27e3d2fff Merge branch '4.5.21' 2013-10-08 13:17:41 -07:00
Tom Eastep
5e67808abd Don't add host route in default table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 11:27:41 -07:00
Tom Eastep
fa500b9ea2 Correct H323 and netbios-ns handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:24:52 -07:00
Tom Eastep
b6d7e9ea96 Work around emacs bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:24:40 -07:00
Tom Eastep
0e61c2f210 Correct H323 and netbios-ns handling. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:20:46 -07:00
Tom Eastep
3c9d984835 Correct typo 
- list_split s/b split_list

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 09:19:07 -07:00
Tom Eastep
4917500f12 Work around emacs bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 07:13:01 -07:00
Tom Eastep
50b7a81b13 Correct typo 
- list_split s/b split_list

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-08 06:56:16 -07:00
Tom Eastep
8c4bbf0c85 Implement REAP_OPTION capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-10-07 07:54:52 -07:00
Tom Eastep
5b515f007b Fix 'monthdays' in the TIME column. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-30 15:43:17 -07:00
Tom Eastep
d7cbd1da21 Allow actions to manipulate the current comment from Perl. 
- Added set_comment()
- moved push/pop_comment() to the :DEFAULT export
 2013-09-23 12:21:44 -07:00
Tom Eastep
eb75d0eef4 Add 'nohostroute' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-18 16:49:54 -07:00
Tom Eastep
5dbcdd65e2 Force 'inline' for REJECT_ACTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-10 07:37:53 -07:00
Tom Eastep
dc5c0dc069 Validate default log levels 
- Name the .conf option involved in error messages

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-06 16:00:15 -07:00
Tom Eastep
87ae801c15 Use the -w ip[6]tables option when available. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-04 10:16:36 -07:00
Tom Eastep
67603c5eb3 Implement REJECT_ACTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-09-01 09:14:10 -07:00
Tom Eastep
1540e50cce Remove blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-31 10:07:41 -07:00
Tom Eastep
0a2f6c18cc Correct typo in prog.footer 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-13 07:03:20 -07:00
Tom Eastep
32763e998b Make -v work with the status command 
- Also document exit status

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-13 06:52:46 -07:00
Tom Eastep
a10aea280b Add some abbreviations for common commands 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-06 07:05:47 -07:00
Tom Eastep
ceffc000eb Correct Typo 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-05 08:32:17 -07:00
Tom Eastep
6615c1f736 Clarify usage of Interface Option Chains 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-08-04 09:01:09 -07:00
Tom Eastep
83d1aa6682 Allow OPTIMIZE=All 
- Remove use of literal 4096 from OPTIMIZATION checks.
- Moved constant declarations to the Config module.
- Documented that level 1 is ignored when level 4 is specified.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-29 10:08:35 -07:00
Tom Eastep
aabb22a50f Add the TRACK_RULES option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-24 07:22:51 -07:00
Tom Eastep
7aa33c140d Add an AutoBL action with helper AutoBLL 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-17 10:19:18 -07:00
Tom Eastep
891e3e0e1d Use the --reap option in sticky recent rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 14:46:39 -07:00
Tom Eastep
5c7500e13e Display the current time as an integer in 'show event[s]' output 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 09:46:08 -07:00
Tom Eastep
09240da55a Change the external name of MARK_ANYWHERE to 'Mark in the filter table' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 09:45:20 -07:00
Tom Eastep
89f16bdb37 Include a current time event in /proc/net/xt_recent/ 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-12 07:14:22 -07:00
Tom Eastep
8e30831385 Resolve merge conflicts 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-11 14:20:38 -07:00
Tom Eastep
d2725fcd87 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2013-07-11 14:16:19 -07:00
Tom Eastep
9535a7d7df Rename 'Trigger' to 'Event' and document 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-11 10:39:21 -07:00
Tom Eastep
3c6df56b57 Implement Triggers 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-10 13:27:58 -07:00
Tom Eastep
411ca87ec3 Allow logging rules with more than 15 ports 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-08 15:59:54 -07:00
Tom Eastep
948a7fccc2 Enhance a comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-07 12:52:04 -07:00
Tom Eastep
73060a3761 Correct typo in dropBcast() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-06 07:58:21 -07:00
Tom Eastep
cd83d7727c Restore handle_original_dest(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:51:06 -07:00
Tom Eastep
5121634457 Add ihandle_original_dest() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:37:24 -07:00
Tom Eastep
131c1f432b Add iverify_source_interface() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-04 14:07:09 -07:00
Tom Eastep
03885f71d3 Create add_expanded_ijump() that breaks long lines 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-03 15:13:48 -07:00
Tom Eastep
b735b93378 Re-factor irule generation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-03 10:59:09 -07:00
Tom Eastep
5ce5d5e607 Delete superfluous blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 15:03:50 -07:00
Tom Eastep
00c5985458 Rename clone_rule() to clone_irule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:38:16 -07:00
Tom Eastep
1a44b66656 Cleaner handling of trailing spaces from log_irule_limit. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:32:35 -07:00
Tom Eastep
b215cf379a Generate a warning when Limit is invoked. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 12:31:29 -07:00
Tom Eastep
3ec6745df9 Use log_irule_limit() internally where possible. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 11:48:02 -07:00
Tom Eastep
55be5b0119 Add log_irule_limit() and log_irule() functions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 11:47:19 -07:00
Tom Eastep
42a649d093 Create $globals{LOGILIMIT} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-02 09:00:36 -07:00
Tom Eastep
18e7e43b2f Eliminate globals{STATEMATCH} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-01 16:01:57 -07:00
Tom Eastep
6803ce5d41 Add constants for %used values. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-07-01 15:36:16 -07:00
Tom Eastep
565fb74795 Correct bridge detection and 'qt' implementation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 13:07:38 -07:00
Tom Eastep
fc754040d5 Avoid shell error when detecting owner name match 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 09:51:32 -07:00
Tom Eastep
cc5a59231b Make qt() work correctly when tracing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-24 07:17:15 -07:00
Tom Eastep
25f96e6a88 Reword unreachable warning (again) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-20 10:50:28 -07:00
Tom Eastep
71bcd11ab6 Make ?...shell/perl directives case insensitive 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-20 10:39:39 -07:00
Tom Eastep
4bd35a0b93 Allow 'routeback=0' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-16 08:37:53 -07:00
Tom Eastep
cb132e2421 Include the chain name in the 'unreachable' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-11 06:29:07 -07:00
Tom Eastep
53f1cd40df Add 'unmanaged' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-10 12:36:18 -07:00
Tom Eastep
c653d9ce83 Only issue one 'unreachable' warning per chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-08 10:02:19 -07:00
Tom Eastep
254d2037ef Delete unused variable. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 15:34:25 -07:00
Tom Eastep
cb8e76b1d2 Add sub get_opttype to emphasize where rule option types are used. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 12:49:20 -07:00
Tom Eastep
2b579d2dff Small efficiency change in helper processing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-04 12:48:22 -07:00
Tom Eastep
fc3e3dbf3c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-03 10:53:33 -07:00
Tom Eastep
81acedd1b3 Reword the 'unreachable' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 17:13:41 -07:00
Tom Eastep
d8f53cc0a9 Merge branch '4.5.17' 
Conflicts:
	Shorewall/Perl/Shorewall/Chains.pm
 2013-06-02 15:31:45 -07:00
Tom Eastep
481811d29f Merge NFACCT and EXPENSIVE matches during optimization 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 13:29:13 -07:00
Tom Eastep
3867902b27 Use 'NONE' policies for LOOPBACK and LOCAL zones to non-firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-02 07:31:32 -07:00
Tom Eastep
adf51d0059 Revise the unreachable warning stuff. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 16:32:46 -07:00
Tom Eastep
7dbd50708b Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:35 -07:00
Tom Eastep
4340bcffb1 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:25 -07:00
Tom Eastep
4a05e56d6d Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:05:16 -07:00
Tom Eastep
2d8078033c Clear the current filename after last file is processed. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:03:10 -07:00
Tom Eastep
c5f2eeea80 Don't optimize away a rule that includes nfacct matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:02:39 -07:00
Tom Eastep
5343243f6b Disable warning on unreachable rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-06-01 13:01:55 -07:00
Tom Eastep
4865899018 Avoid a forward jump for local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:52:09 -07:00
Tom Eastep
9b68204865 Generate an 'unreachable rule(s)' warning. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-30 06:17:22 -07:00
Tom Eastep
a550dd3eed Issue a warning when a rule is dropped do to terminated chain. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 21:01:07 -07:00
Tom Eastep
f0aa29222f Correct minor IPv6 TPROXY bug 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-29 07:18:46 -07:00
Tom Eastep
eaf1d0e5c2 Another error check for hosts files and loopback zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 10:00:07 -07:00
Tom Eastep
446f764d19 Allow config with only local and firewall zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:44 -07:00
Tom Eastep
9b0b3d4b70 Correct ICMPV6 type name translation 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 08:03:19 -07:00
Tom Eastep
a48a4b7a2e Don't allow fowarding between local zones. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-28 06:14:44 -07:00
Tom Eastep
8743b64e00 Export 'shorewall' from the Config module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-27 06:52:45 -07:00
Tom Eastep
2de0fbf7d0 Change 'local' to 'loopback' and add 'local' zones that match non-loopback interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 14:06:51 -07:00
Tom Eastep
f89c704d01 Disallow 'virtual' physical interfaces. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:47:44 -07:00
Tom Eastep
0b5a316cfc Emit 'expensive' matches last unless there are '-m nfacct' matches in the rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-26 08:03:54 -07:00
Tom Eastep
31f9ea5b93 Add progess and warning messages to 'update -D' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:55 -07:00
Tom Eastep
dde1f0a779 Only enable helpers during a 'clear' operation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 16:31:27 -07:00
Tom Eastep
60d0a50d9d Add some warning/progress messages to help understand 'update -D' behavior. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-25 13:20:12 -07:00
Tom Eastep
064f9f974c Cosmetic change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-23 09:49:25 -07:00
Tom Eastep
fd11eb7d82 Omit fw->fw jumps when there is a local zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 09:19:34 -07:00
Tom Eastep
9e77bb5499 Ensure correct match ordering with trivial exclusion 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 08:46:22 -07:00
Tom Eastep
8df8fe990a Allow 'local' zone to work with 'destonly' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-22 07:34:04 -07:00
Tom Eastep
ac02c484f5 Change 'local' interface option to a zone type. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-19 15:35:20 -07:00
Tom Eastep
5ec72dad6c Add routes for standard tables when there are no providers. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 15:32:05 -07:00
Tom Eastep
f6a55bbf05 Allow the '-V' option in the CLI programs. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 14:29:36 -07:00
Tom Eastep
739f3779f5 Generate warnings for local->non-firewall and non-firewall->local rules 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-16 07:51:12 -07:00
Tom Eastep
2e293dd356 Make 'local,destonly' work correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 14:36:51 -07:00
Tom Eastep
a5412cff38 Issue a warning when a rule will be optimized away due to 'destonly'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 09:30:59 -07:00
Tom Eastep
46a6a7b258 Correct earlier optimization. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-14 07:27:57 -07:00
Tom Eastep
105d1db85d Cosmetic change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 11:24:09 -07:00
Tom Eastep
200d347ac8 Small Efficiency Change 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 10:52:04 -07:00
Tom Eastep
c8133145e6 Add support for "all+" in the policy file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-13 09:01:12 -07:00
Tom Eastep
9178ecbab0 Suppress superfluous ACCEPT rule when 'lo' is attached to a 'local' zone. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:38:44 -07:00
Tom Eastep
d06a7b55b6 Add a 'destonly' option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 10:37:40 -07:00
Tom Eastep
2fb01bec8d Don't assume 'destonly' with 'local'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:58:37 -07:00
Tom Eastep
6551d67b2e Call delete_chain_and_references recursively. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:29:29 -07:00
Tom Eastep
4b76d8c462 Handle optimize level 0 in the IPV6 nat table. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:28:25 -07:00
Tom Eastep
1bb5b89ee1 Add the 'local' interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-12 09:27:12 -07:00
Tom Eastep
c3901f1161 Release mutex on error. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-09 09:57:09 -07:00
Tom Eastep
56318e6cc8 Try to ensure that cp doesn't copy the firewall script to itself. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-06 09:22:16 -07:00
Tom Eastep
13c90e2aef Correct my update to Mr-4's bup patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 18:40:14 -07:00
Tom Eastep
fdfdb49951 Apply Mr-4's priority->perf patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 14:05:03 -07:00
Tom Eastep
61cb105c02 Apply Mr-4's noautosrc patch (modified) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 14:00:25 -07:00
Tom Eastep
4621dccd53 Apply Mr-4's special route handling in COPY (modified). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-04 13:27:34 -07:00
Tom Eastep
b83ca4812b Include trailing space in a regular expression. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-03 08:36:38 -07:00
Tom Eastep
80efd095a8 Correct handling of INLINE without '-j' in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-01 14:52:48 -07:00
Tom Eastep
d6961c4c3b Clean up the temporary chains sooner. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-01 14:48:27 -07:00
Tom Eastep
54f5aaca63 Fix handling of CT_TARGET 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-05-01 11:15:36 -07:00
Tom Eastep
1012251957 Apply Mr-4's 4a patch (modified) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-27 07:04:40 -07:00
Tom Eastep
20d38e8b52 Centralize the validation of nfacct object names. 
- Also correct a missing ' ' from the output generated by INLINE
  freeform input.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-26 09:09:08 -07:00
Tom Eastep
52f5ae15d1 Apply Mr-4's cosmetic patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-25 17:29:41 -07:00
Tom Eastep
7e830e5df4 Allow special characters in nfacct names. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-25 10:07:49 -07:00
Tom Eastep
f543c3bd1e Finish Mr-4's NFACCT patch 
- Correct indentation
- Remove '$type' argument to split_nfacct_list
- Update manpages.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-23 06:55:30 -07:00
Dash Four
68c7782e7d Shorewall 4.5.16 Beta 6 
Tom Eastep wrote:
> On 4/22/13 5:07 PM, "Dash Four" <mr.dash.four@googlemail.com> wrote:
>
>
>> Anyway, I've just implemented individual "!" in the NFACCT statement by
>> hacking your Accounting.pm - I can attach a small patch for
>> review/inclusion if you are interested, but be aware that it does change
>> the syntax slightly in a sense that "!" needs to be specified for each
>> object within NFACCT() - "NFACCT(...)!" is no longer allowed.
>>
>
> Sure -- send it along.
>
Attached - the above caveat applies though.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 21:17:59 -07:00
Tom Eastep
4faf3728f2 Implement INLINE in the tcrules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 19:00:29 -07:00
Tom Eastep
ad70240347 Remove a blank line 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 09:36:25 -07:00
Tom Eastep
739013f248 Handle nfacct object lists in parens following an ipset name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-22 07:56:56 -07:00
Tom Eastep
6d57e7a0ce Mark a rule as complex if an option value is a reference. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-21 14:44:30 -07:00
Tom Eastep
5ad69aa650 Add CHAIN_SCRIPTS option 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-21 07:30:31 -07:00
Tom Eastep
1b9fd642bb Add INLINE to the accounting file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-20 08:02:02 -07:00
Tom Eastep
7c8f1ae020 Correct HELPERS handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 16:35:19 -07:00
Tom Eastep
1fd62e1612 Restore order in the NFACCT target. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 11:11:37 -07:00
Tom Eastep
6c2679ce75 Allow incrementing an nfacct object when an ipset matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 10:44:57 -07:00
Tom Eastep
610bdf1aac Correct merge_rules() for LAST matches. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-19 08:40:01 -07:00
Tom Eastep
cbdca08fea Fix for multiple nfacct patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 16:37:54 -07:00
Tom Eastep
b87b4b61d8 Allow multiple nfacct matches in one accounting rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 16:14:57 -07:00
Tom Eastep
9c010691a3 Always place 'nfacct' last 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 15:26:34 -07:00
Tom Eastep
8ef11a376b Document 'HELPERS=none'. 
- Also make 'check -u' work correctly regarding HELPERS=

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 11:30:47 -07:00
Tom Eastep
4d686e873b Implement 'HELPERS=none' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-18 10:30:56 -07:00
Tom Eastep
f55e34dd8b Don't allow options on targets that don't accept them. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 17:18:01 -07:00
Tom Eastep
668bd4a1a4 Accept complex log levels with INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 16:59:14 -07:00
Tom Eastep
5d5f168f25 Don't clone rule unconditionally in format_rule() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 13:35:32 -07:00
Tom Eastep
938bd72844 Better handling of the matches rule member. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 10:39:32 -07:00
Tom Eastep
8b91575c9e Maintain order when multiple instances of a match are separated. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-17 06:52:32 -07:00
Tom Eastep
0da38cc38e Order matches in rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-12 11:37:29 -07:00
Tom Eastep
6950cd2576 Allow '-' in a match name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 18:30:02 -07:00
Tom Eastep
ff4fb21044 Require that the '-j' part of a free-form rule be known. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 18:29:45 -07:00
Tom Eastep
614c5e6155 Assume LOG if a level is specified with INLINE. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 14:16:34 -07:00
Tom Eastep
35b0b4a4f9 Support A_ACCEPT! 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 13:37:49 -07:00
Tom Eastep
c34cf333ba Allow both {...} and ';' with INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 12:57:59 -07:00
Tom Eastep
b33bdeaa02 Allow a parameter to INLINE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 11:54:58 -07:00
Tom Eastep
38f3ae0934 Handle 'NONE' policy correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 09:35:27 -07:00
Tom Eastep
beec4a188f Implement INLINE action (again). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 09:15:59 -07:00
Tom Eastep
f85d548d40 Correct handling of MACLIST_DISPOSITION with MACLIST_TABLE=mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-11 06:23:22 -07:00
Tom Eastep
ee2e85c0fb Correct generation of the blacklog chain when disposition is audited 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-10 16:43:38 -07:00
Tom Eastep
186f71fa96 Add NEW_TOS_MATCH capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 14:04:16 -07:00
Tom Eastep
477e2bc455 Additional corrections to INLINE action. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 09:41:43 -07:00
Tom Eastep
273f109daf Correct handling of MACLIST_DISPOSITION=A_xxx when MACLIST_TABLE=mangle 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-09 09:37:12 -07:00
Tom Eastep
50494f667c Implement INLINE action 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-08 17:30:00 -07:00
Tom Eastep
183a0a75a1 Implement 'builtin' actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-08 16:14:26 -07:00
Tom Eastep
9e10c38e26 Don't emit 'quantum' calculation unless the qdisc is 'htb' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-03 08:39:18 -07:00
Tom Eastep
ee66a45e2e Correct comments in the Chains module. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-02 12:52:10 -07:00
Tom Eastep
c200efa6d7 Revert "Disable script generation while processing TC" 
This reverts commit 5b18ff91ca.
 2013-04-01 15:23:16 -07:00
Tom Eastep
5b18ff91ca Disable script generation while processing TC 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-04-01 09:05:12 -07:00
Tom Eastep
ef5818ce7e Merge branch '4.5.15' 2013-03-31 07:08:49 -07:00
Tom Eastep
58ef8e0ec3 Correct bounds check in do_dscp() 
- "< 0x2f" s/b "< 0x3f"

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-31 07:07:21 -07:00
Tom Eastep
8a84c1c371 Avoid 'echo' failure during 'enable'. 
- in the case where the kernel doesn't know about
  /proc/sys/net/ipv6/conf/x/accept_ra

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-31 07:02:11 -07:00
Tom Eastep
1db5741edd Merge branch '4.5.15' 
Conflicts:
	Shorewall/Perl/Shorewall/Proc.pm
 2013-03-30 18:08:17 -07:00
Tom Eastep
1139e1a09c Establish /proc/sys/net/ipv6/conf/X/forwarding during 'enable' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-30 17:26:50 -07:00
Tom Eastep
d415de1883 Add the accept_ra Shorewall6 interface option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-30 16:44:18 -07:00
Tom Eastep
448d957e48 Fix use of names for DSCP. 
- From Thibaut Chèze

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-30 07:20:10 -07:00
Tom Eastep
8fe7963631 Revert another replace->add change. 
- Also includes a cosmetic change.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-27 06:57:49 -07:00
Tom Eastep
6334b09653 Add a comment about why the 'id' member of builtin tables is initialized in process_providers() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 14:30:42 -07:00
Tom Eastep
e572d6ce50 Use the 'id' member in copy_and_edit_table(). 
- Also add prohibit and unreachable to the existing blackhole case.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 07:38:13 -07:00
Tom Eastep
792a19bf4b Initialize the 'id' member of reserved tables after .conf has been read. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 07:36:57 -07:00
Tom Eastep
61e21de41b Revert bad hunk from last change. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-26 07:00:16 -07:00
Tom Eastep
43932f2bbd Cleanup of table id/number and 'route replace' erradication 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-25 07:35:30 -07:00
Tom Eastep
6e5f00062c Revert "Use 'replace' rather than 'add' for routes defined in the routes file." 
This reverts commit 215fd9e234.

Conflicts:

	Shorewall/Perl/Shorewall/Providers.pm
 2013-03-24 14:19:31 -07:00
Tom Eastep
b5ea4067e4 Implement USE_RT_NAMES 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-24 10:56:38 -07:00
Tom Eastep
0c30e7c013 Uniform handling of VLSM width. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-23 09:19:26 -07:00
Tom Eastep
536fea27a5 Detect duplicate routes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-22 14:59:35 -07:00
Tom Eastep
215fd9e234 Use 'replace' rather than 'add' for routes defined in the routes file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-22 14:55:27 -07:00
Tom Eastep
4c0a0e0ff8 Don't emit 'qt ' in the undo_x_routing files. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-22 13:20:27 -07:00
Tom Eastep
9e5cf92a59 Merge branch '4.5.14' 2013-03-21 12:00:20 -07:00
Tom Eastep
3ac6835650 Handle IPv6 /32 networks correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-21 11:30:59 -07:00
Tom Eastep
1e866eac28 Implement the other forms of NULL routing. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-16 08:20:52 -07:00
Tom Eastep
b10218e773 Add a 'UDPLITE Port Redirection' capability. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-10 10:07:52 -07:00
Tom Eastep
8442477224 Add Enhanced Multi-port match capability 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-10 09:04:47 -07:00
Tom Eastep
fd2fcc996f Don't allow port redirection with UDPLITE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-10 08:32:45 -07:00
Tom Eastep
8c4c856caa Issue a warning if the contents of the DUPLICATE column may be invalid. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-09 07:57:13 -08:00
Tom Eastep
a167e3449e Avoid Perl run-time errors when checking a provider interface. 
- Handle case where a provider interface matches a wildcard

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-09 07:56:16 -08:00
Tom Eastep
b871fc689c Merge branch 'FETCH_HEAD' into 4.5.14 2013-03-09 07:11:47 -08:00
Tom Eastep
cfe2bd11b0 Allow 'none' in the COPY column when the DUPLICATE column is empty. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 19:18:13 -08:00
Tom Eastep
bd64baa8d9 Require at least one zone for a provider 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 13:08:23 -08:00
Tom Eastep
e1f7a9dbf8 Reverse an earlier silly patch. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 10:38:13 -08:00
Tom Eastep
4586568649 Merge branch '4.5.14' of ssh://git.code.sf.net/p/shorewall/code 2013-03-08 08:00:43 -08:00
Tom Eastep
b4d4083513 Split large '--ports' lists across multiple rules. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 07:38:23 -08:00
Tom Eastep
91f5a9dec0 Make 'main' work correctly when specified in the routes file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-08 07:26:49 -08:00
Tom Eastep
50030bcc2d Revert "Don't allow routes to be added to non-Provider tables." 
This reverts commit 6f9a1ba29d.
 2013-03-08 06:55:12 -08:00
Tom Eastep
8eacbe287b Correction to MULTIPORT patch 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 18:11:59 -08:00
Tom Eastep
6f9a1ba29d Don't allow routes to be added to non-Provider tables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 17:18:57 -08:00
Tom Eastep
6ba02c4a24 Merge branch 'master' into 4.5.14 
Conflicts:
	Shorewall/Perl/Shorewall/Providers.pm
 2013-03-07 08:29:30 -08:00
Tom Eastep
c4f0be96ac Require that interfaces in the COPY column be known. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:32:56 -08:00
Tom Eastep
7da10ff923 Additional change to copy blackhole routes. 
- Add 'blackhole' to the outer case statement
- Add RFC1918 blackhole routes before starting providers.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:01:58 -08:00
Tom Eastep
ace9a49106 Allow addition of blackhole routes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:01:41 -08:00
Tom Eastep
7f2c933cb3 Copy blackhole routes to secondary tables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 07:01:18 -08:00
Tom Eastep
5aa731e963 Additional change to copy blackhole routes. 
- Add 'blackhole' to the outer case statement
- Add RFC1918 blackhole routes before starting providers.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-07 06:52:16 -08:00
Tom Eastep
06e7f297f7 Allow addition of blackhole routes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 11:48:09 -08:00
Tom Eastep
216029c3a9 Copy blackhole routes to secondary tables. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 11:04:23 -08:00
Tom Eastep
e12bc47546 Remove duplicate interface names in generated case statement. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 08:28:12 -08:00
Tom Eastep
384c179dd6 Avoid duplicate echo command in generated script. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 08:28:03 -08:00
Tom Eastep
32b2030e59 Remove duplicate interface names in generated case statement. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 07:03:41 -08:00
Tom Eastep
0bb62ed290 Avoid duplicate echo command in generated script. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-06 06:12:43 -08:00
Tom Eastep
49918b654e Support '=' in SOURCE PORT(S) columns 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-04 09:56:10 -08:00
Tom Eastep
0857eb27d5 Another case of detecting invalid server IP address. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-02 09:08:13 -08:00
Tom Eastep
69f6149d4c Detect missing, NIL or ALL server IP address in a DNAT rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-02 09:00:08 -08:00
Tom Eastep
5ca3b795fc Correct IPv6 REDIRECT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-01 16:44:49 -08:00
Tom Eastep
9499a47a0d Revert "Use '--to-dest' for IPv6 rather than '--to-destination'" 
This reverts commit c9d8c22b60.
 2013-03-01 10:44:40 -08:00
Tom Eastep
c9d8c22b60 Use '--to-dest' for IPv6 rather than '--to-destination' 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-01 09:03:22 -08:00
Tom Eastep
8960f72532 Handle DNAT with no port correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-03-01 07:58:58 -08:00
Tom Eastep
ee091d09eb Allow ports with UDPLITE 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-28 06:27:51 -08:00
Tom Eastep
22c614d30b Don't allow :persistent in a MASQUERADE rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-27 12:48:27 -08:00
Tom Eastep
418034579f Support IPv6 Masquerade 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-27 09:25:26 -08:00
Tom Eastep
78babf0941 Fixes for IPv6 DNAT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-26 10:24:25 -08:00
Tom Eastep
45d53bdb1d Delete superfluous statement. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 17:50:33 -08:00
Tom Eastep
fb17de0595 Merge branch 'master' of ssh://git.code.sf.net/p/shorewall/code 2013-02-25 17:29:49 -08:00
Tom Eastep
6ed1caedd0 Validate IPv4 port range in ADDRESSES column 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 17:29:33 -08:00
Tom Eastep
1d4f189b5f Don't allow interior brackets in an address range. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 17:26:17 -08:00
Tom Eastep
7006c62892 Correct port pair handling in the snat ADDRESS column. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 15:31:36 -08:00
Tom Eastep
6b825abeb4 Catch ::<port-range> in /etc/shorewall6/snat 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 13:41:43 -08:00
Tom Eastep
f2ee46b83e Correct IPv6 address range parsing in handle_one_masq1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 13:37:22 -08:00
Tom Eastep
e873cb28f4 Correctly handle a port number/range with an address variable 
- ADDRESSES column of the masq/snat files.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 08:00:15 -08:00
Tom Eastep
de1a5a8024 Handle SNAT 'ADDRESS' without enclosing [...] 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-25 06:42:19 -08:00
Tom Eastep
34c6013f1b Handle missing provider in a masq/snat entry. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-24 08:12:02 -08:00
Tom Eastep
82f9ba8bb7 Correct detection of IPv6 PERSISTENT_SNAT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-23 12:59:38 -08:00
Tom Eastep
6035d49ede Correct NAT capability required error message. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-23 11:57:32 -08:00
Tom Eastep
67ef1f8b93 Correct detection of IPv6 NAT_ENABLED. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-23 11:57:07 -08:00
Tom Eastep
0349a9a88c Rename the IPv6 masq file 'snat'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-19 13:05:24 -08:00
Tom Eastep
2591a17946 Cosmetic change to the output with the '-r' option. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-19 11:59:57 -08:00
Tom Eastep
b562f7f311 Allow specification of destination addresses in Shorewall6 masq. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-19 08:34:03 -08:00
Tom Eastep
ce28c70c60 SNAT and DNAT support for IPv6. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-19 07:08:08 -08:00
Tom Eastep
d0b2d05d5b Add optional argument to have_capability(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-18 15:15:26 -08:00
Tom Eastep
088fc1a3a3 Report used/required capabilities 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-18 08:48:18 -08:00
Tom Eastep
6d92d293b8 Use 'here documents' in the usage() function. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-17 07:44:10 -08:00
Tom Eastep
7859267539 Eliminate $globals{CONFDIR} 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-14 17:24:49 -08:00
Tom Eastep
c68513672d Comments and documentation. 
- Removes the Actions-4.5 article

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-14 08:48:45 -08:00
Tom Eastep
93b3fd9be5 Correct IPv6 address checking (again) 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-13 13:37:26 -08:00
Tom Eastep
138638cb1a Effectively use the specified directory as the CONFIG_PATH til .conf is read 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-13 07:45:24 -08:00
Tom Eastep
c5bb16ac26 Another fix for IPv6 address lists. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-13 07:44:19 -08:00
Tom Eastep
f44becdee1 Rename BLACKLIST_LOGLEVEL to BLACKLIST_LOG_LEVEL for consistent naming. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-12 07:47:02 -08:00
Tom Eastep
84c5822c20 Correct IPv6 List Handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-11 16:45:03 -08:00
Tom Eastep
b4977db5b2 Add %section_states that maps sections to their related state(s). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-11 14:59:48 -08:00
Tom Eastep
8d0a80a7e2 Merge branch '4.5.13' 2013-02-11 06:40:11 -08:00
Tom Eastep
b9d5b92f1b Correct handling of expressions consisting of a single number. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-10 15:19:30 -08:00
Tom Eastep
b349cc0f22 A better fix for inline default action with parameters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-10 09:29:30 -08:00
Tom Eastep
a312bfbb42 Add a section => name function map 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-10 09:27:43 -08:00
Tom Eastep
c35e753b1d A better fix for inline default action with parameters. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-10 09:16:18 -08:00
Tom Eastep
8b4349b356 Merge branch '4.5.13' 2013-02-10 09:05:41 -08:00
Tom Eastep
54c43396f0 Correct default action handling: 
- isolate basic target before testing for action/inline
- delete the action chain if appropriate.

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-10 09:00:13 -08:00
Tom Eastep
f9dc89dc61 Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-10 07:56:04 -08:00
Tom Eastep
60e3f1015e Allow arbitrary $n variables when IGNOREUNKNOWNVARIABLES=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-10 07:51:35 -08:00
Tom Eastep
8e0a90e077 Merge branch '4.5.13' 2013-02-09 17:54:06 -08:00
Tom Eastep
cadf2747fe Correct reset_optflags() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-09 17:53:40 -08:00
Tom Eastep
810ebe32ce Merge branch '4.5.13' 2013-02-09 13:15:44 -08:00
Tom Eastep
c04c61b314 Correct typos in check_rules(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-09 11:42:54 -08:00
Tom Eastep
a8fdfa4e48 Create an ESTABLISHED chain 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-09 09:32:12 -08:00
Tom Eastep
a4297381e9 Don't ACCEPT untracked packets unless UNTRACKED_DISPOSITION=ACCEPT 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-09 09:15:05 -08:00
Tom Eastep
eaa6d72a4f Allow parameters to be omitted in action invocations. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-09 07:07:01 -08:00
Tom Eastep
62a567b550 Treat each -m conntrack subtype as a separate match 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-08 10:08:23 -08:00
Tom Eastep
e4f1c62e71 Improve handling of nested state actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-08 09:09:20 -08:00
Tom Eastep
b9e504683e Prevent a state action from invoking another one. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-07 16:52:06 -08:00
Tom Eastep
aae6e001fe Convert dropInvalid and allowInvalid to inline actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-07 11:21:13 -08:00
Tom Eastep
aa528dd075 Revert "Convert allowInvalid and dropInvalid into macros" 
This reverts commit 272e1d330c.
 2013-02-07 09:09:56 -08:00
Tom Eastep
e4ae242123 Another tweak to check_state() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-06 12:07:51 -08:00
Tom Eastep
272e1d330c Convert allowInvalid and dropInvalid into macros 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-06 09:54:12 -08:00
Tom Eastep
a66256b25b Additional refinements of check_state() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-06 08:16:42 -08:00
Tom Eastep
11b976fb36 Correct reference type in check_state() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-05 19:55:22 -08:00
Tom Eastep
a6ccd53fe0 Unconditionally use '-j' to branch to a state chain or DISPOSITION. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-04 15:17:49 -08:00
Tom Eastep
b22b63b1c3 Don't use '-g' when DISPOSITION is CONTINUE. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-04 15:09:17 -08:00
Tom Eastep
615df6ab8f Handle 'RETURN' in state chain with terminating disposition. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-04 15:08:20 -08:00
Tom Eastep
d8214885f2 Assume that the conntrack state value in a rule is not a reference. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-04 08:29:50 -08:00
Tom Eastep
475942deb9 Normalize rules prior to combine_state tests. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-03 18:14:14 -08:00
Tom Eastep
f1707d2ace More state rule check fixes. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-03 18:02:02 -08:00
Tom Eastep
30d96afb69 Push/pop $actionresult. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-03 12:43:28 -08:00
Tom Eastep
014b4ddc50 Combine adjacent rules differing only in conntrack state match. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-03 09:03:22 -08:00
Tom Eastep
5b9d1a6159 Handle UNTRACKED_DISPOSITION=ACCEPT correctly. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-03 07:59:47 -08:00
Tom Eastep
752463bfab Fix TCPFlags 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-02 22:19:13 -08:00
Tom Eastep
ebef29e161 Handle port numbers being passed to one of the tcp-specific actions 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-02 12:48:54 -08:00
Tom Eastep
9b30f48ba0 Correct handling of actions when @chain is altered. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-02 10:57:08 -08:00
Tom Eastep
8249831e6d Detect some state conflicts 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-02 09:32:57 -08:00
Tom Eastep
cc1054be66 Correct handling of audited dispositions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-02 09:30:25 -08:00
Tom Eastep
c68d4c6e27 Simplify Perl from actions even further. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-01 15:55:39 -08:00
Tom Eastep
752e960f2f Allow specification of the action type via perl_action_helper(). 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-01 12:59:48 -08:00
Tom Eastep
a5d3b1f470 Remove requirement that matches and proto end with a space in perl helper API. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-02-01 12:29:30 -08:00
Tom Eastep
abca3a2024 Improve maintainability of @colums vis a vis @rulecolumns. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-30 10:47:40 -08:00
Tom Eastep
755d605578 Make %statetable global 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-30 08:26:47 -08:00
Tom Eastep
78db4abef5 Remove some redundant local variables from finish_chain_section() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-30 08:02:23 -08:00
Tom Eastep
fc73c3934b Replace BLACKLISTNEWONLY with BLACKLIST 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-30 08:00:47 -08:00
Tom Eastep
75fb164234 Don't issue fatal error if a proto other than tcp is passed to a tcp-only inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 10:31:20 -08:00
Tom Eastep
27c5e67632 Rename process_rule to process_raw_rule and process_rule1 to process_rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 10:13:48 -08:00
Tom Eastep
61d8f704f9 Correct rule-generation detection in perl_action_helper 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 09:43:12 -08:00
Tom Eastep
f33e36b61e Raise an error if a protocol other than TCP is passed to a TCP-only inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 07:46:50 -08:00
Tom Eastep
670931c987 Initialize the columns array to '-'s. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-29 07:46:07 -08:00
Tom Eastep
316b67473e Merge branch 'master' into 4.5.13 
Conflicts:
	Shorewall/Perl/Shorewall/Rules.pm
	Shorewall/action.Established
	Shorewall/actions.std
 2013-01-29 07:30:52 -08:00
Tom Eastep
42f46ea5e7 Accurately determine if an inline action generates a rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 20:46:20 -08:00
Tom Eastep
49166efdca Make the TCP standard actions inline 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 18:01:08 -08:00
Tom Eastep
5a2c1792cb Inline the conntrack state actions. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 16:55:54 -08:00
Tom Eastep
a70c441458 Add CONTINUE as a possible setting for RELATED_DISPOSITION. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 11:47:45 -08:00
Tom Eastep
519861d7b2 Add CONTINUE as a possible setting for RELATED_DISPOSITION. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:58:03 -08:00
Tom Eastep
2e8eeff416 Correct error messages that include the section name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:41:52 -08:00
Tom Eastep
2217f89902 Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:41:45 -08:00
Tom Eastep
5c63444c14 Correct error messages that include the section name. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:41:09 -08:00
Tom Eastep
cfa5d86f5c Correctly initialize $chainref->{sections} vis-a-vis FASTACCEPT. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-28 07:40:26 -08:00
Tom Eastep
b3b074fb61 More infrastructure 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 15:37:23 -08:00
Tom Eastep
cbbcfe355e Infrastructure for more powerful action handling 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 12:37:10 -08:00
Tom Eastep
2a2e23cb17 Merge branch '4.5.13' 2013-01-27 11:26:59 -08:00
Tom Eastep
1b94c3651d Always handle ESTABLISHED before the other connection states. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:56:41 -08:00
Tom Eastep
b1b2aa910e Correct section handling: 
- Correct typo (' INVALID' -> 'INVALID' )
- Don't jump to non-existent target in finish_chain_section()

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:14:27 -08:00
Tom Eastep
aa609b87a9 Allow arbitrary actions for the various states. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:10:24 -08:00
Tom Eastep
a3a90d8d2e Correct section handling: 
- Correct typo (' INVALID' -> 'INVALID' )
- Don't jump to non-existent target in finish_chain_section()

Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 10:08:02 -08:00
Tom Eastep
6c8761c7dd Add a "matches" argument to process_rule1 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:21:30 -08:00
Tom Eastep
9194165e89 Handle explicit CONTINUE value for UNTRACKED_DISPOSITION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:17:09 -08:00
Tom Eastep
6306103991 Clean up fix for optimize 8 performance issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:13:27 -08:00
Tom Eastep
749773f89a Handle explicit CONTINUE value for UNTRACKED_DISPOSITION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 08:12:49 -08:00
Tom Eastep
5db317b6f7 Clean up fix for optimize 8 performance issue 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-27 07:55:55 -08:00
Tom Eastep
380d427a5d Dramatically reduce the CPU cost of optimize 8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 17:46:31 -08:00
Tom Eastep
6ce392b08e Correct handling of handle_first_entry() to avoid runaway recursion. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 12:18:17 -08:00
Tom Eastep
5fa01728ad Pass UNTRACKED packets through the blacklist chain when BLACKLISTNEWONLY=Yes 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 09:18:20 -08:00
Tom Eastep
7bc66da663 Call handle_first_entry in the warning/error-message generators. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-26 07:30:50 -08:00
Tom Eastep
b8cc9c5a6a Drop chain-ending rules whose target is 'RETURN'. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-25 14:03:04 -08:00
Tom Eastep
b7273d6999 Favor low-numbered less complex synonym chains in optimization 8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-25 13:55:04 -08:00
Tom Eastep
e12b919dc1 Prefer shorter action chain names in optimize level 8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 17:25:11 -08:00
Tom Eastep
18c0956374 Fix two bugs in the UNTRACKED section implementation. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 16:41:18 -08:00
Tom Eastep
6403f4959d Implement UNTRACKED SECTION 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 15:42:01 -08:00
Tom Eastep
0ca93c1ac9 Unify handling of the RELATED and INVALID sections within finish_chain_section() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 14:38:02 -08:00
Tom Eastep
a40c74ddec Eliminate forward declaration of finish_chain_section() 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 09:04:50 -08:00
Tom Eastep
c2bc74cdfe Add INVALID section to the rules file. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-24 08:33:59 -08:00
Tom Eastep
7fe2027229 Eliminate superfluous ESTABLISHED,RELATED rule 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-22 16:17:19 -08:00
Tom Eastep
8fe36422b5 Delete stale comment 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-22 10:44:12 -08:00
Tom Eastep
f61f5a8183 Don't copy a chain that has a single RETURN rule. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-22 09:07:07 -08:00
Tom Eastep
4ed5c5fdfe Sort the chain list in optimize_level8. 
Signed-off-by: Tom Eastep <teastep@shorewall.net>
 2013-01-21 16:00:32 -08:00