Commit Graph

393 Commits

Author SHA1 Message Date
Tom Eastep
4a01e910ff
Delete unused iptablesbug() function
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2017-01-21 14:42:24 -08:00
Tom Eastep
2a010f827b
Add 'show action' command.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2017-01-19 15:58:18 -08:00
Tom Eastep
b36b07b567
Correct 'show macros'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2017-01-12 08:35:03 -08:00
Tom Eastep
0b3d1b1d36
Revert code that assumed no CLI symlinks
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2017-01-04 17:12:20 -08:00
Tom Eastep
6be89b4e2d
Add command correspondence to shorewall(8)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2017-01-02 13:40:32 -08:00
Tom Eastep
5174fe0161
Avoid echo options
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-28 11:09:08 -08:00
Tom Eastep
638c7c5bca
Implement NETMAP_TARGET capability
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-27 08:26:51 -08:00
Tom Eastep
c4bbb46e3f
Eliminate rawpost table support
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-26 14:20:08 -08:00
Tom Eastep
1b97783c23
Implement 'show ipsec'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-23 10:01:40 -08:00
Tom Eastep
7ce0cc3e2e
Describe 5.0/5.1 differences in shorewall(8)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-22 15:51:15 -08:00
Tom Eastep
1a95db73e9
Revert idiotic change to lib.cli
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-20 08:39:26 -08:00
Tom Eastep
7717de872d
Correct typo in shorewall(8)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-19 12:55:55 -08:00
Tom Eastep
be5a8c440f
Delete duplicated info from shorewall(8)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-19 10:52:29 -08:00
Tom Eastep
8dce87e129
Revert "core: Don't set the 'file' var needlessly"
This reverts commit eaf58d18aa.
2016-12-19 10:26:33 -08:00
Matt Darfeuille
6ff1833ae0
core: Don't set the 'file' var needlessly
Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-19 08:14:48 -08:00
Matt Darfeuille
eaf58d18aa
core: Don't set the 'file' var needlessly
Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-19 08:14:32 -08:00
Tom Eastep
e3951cb5a3
Re-add volume 8 manpages
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-18 16:16:50 -08:00
Matt Darfeuille
56d4d01984
core: Correct the filepath of .shorewallrc
Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-18 12:14:24 -08:00
Tom Eastep
089ff4eb33
Establish default product based on $0
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-18 11:18:07 -08:00
Tom Eastep
7ce5c31c68
Use 'ip -s xfrm' to dump the SPD and SAD
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-17 14:43:16 -08:00
Tom Eastep
eea9882953
Implement CPU Fanout for NFQUEUE.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-09 10:46:39 -08:00
Tom Eastep
6c8dae45c4
Install the core manpage(s)
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-05 10:10:27 -08:00
Tom Eastep
a2e040998b
Move shorewall(8) to shorewall.core
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-04 18:03:18 -08:00
Tom Eastep
4a410c7b4c
Correct 'restore' exit status
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-12-02 09:32:00 -08:00
Tom Eastep
38c9165c39
More shorewall(8) documentation updates
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-21 13:57:06 -08:00
Tom Eastep
bd2df4836d
Break lib.base into two libraries
- Allows separation of default product determination and
  establishment of the product environment

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-21 13:25:57 -08:00
Tom Eastep
875c352473
Unify the CLI
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-21 10:00:55 -08:00
Tom Eastep
de553e7b18
Add the -l option
- Update shorewall(8)

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-20 09:16:16 -08:00
Tom Eastep
36517cdb1e
Rename setup_environment to setup_product_environment
- Default to first detected product
- Verify that specified product is installed

Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-20 08:48:18 -08:00
Tom Eastep
8b99fe20b5
Pave the way for unifying the CLI
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-19 21:17:35 -08:00
Tom Eastep
137b051e52
Centralize setting of product-dependent g_* variables
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-19 17:17:03 -08:00
Tom Eastep
9eb390403b
Implement -p option to disable PAGER
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-17 10:58:10 -08:00
Tom Eastep
ab9f340c55
use $PAGER in the 'show macro' command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-17 10:57:39 -08:00
Tom Eastep
cecfe54ef6
Avoid shell errors when /proc/net/xt_recent/ is empty.
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-11-03 21:29:01 -07:00
Tom Eastep
5b26f1939b
Correct 'sed' command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-22 09:56:59 -07:00
Tom Eastep
49fae96b09
Update the manpages for 'blacklist' verbosity
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-10 19:45:42 -07:00
Tom Eastep
b3e59322b6
Clean up the output of 'blacklist'
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-10 13:26:01 -07:00
Tom Eastep
eb6ae5e186
Correct handling of DYNAMIC_BLACKLIST options
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-05 16:56:29 -07:00
Tom Eastep
ca7ca4bdfe
Add a 'timeout' option to DYNAMIC_BLACKLIST
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-05 12:56:47 -07:00
Tom Eastep
c19e732e42
Correct typo
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-04 10:00:00 -07:00
Tom Eastep
8d731c81e4
Add 'disconnect' option to ipset-based dynamic blacklisting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-04 09:09:45 -07:00
Tom Eastep
1b032f7524
Correct permissions of files created by the 'save' command
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-10-01 13:49:35 -07:00
Tom Eastep
e81a4788c6
Implement DEFAULT_PAGER in shorewallrc
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-09-21 10:20:48 -07:00
Tom Eastep
4a6338d857
Correct/complete Scott Sumate's LOGFILE enhancement
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-07-15 14:25:02 -07:00
Scott Shumate
55ee0113ea Added support for systemd logging by configuring LOGFILE=systemd 2016-07-15 13:40:23 -05:00
Tom Eastep
544be8c937
Change SuSE shorewallrc to use systemd
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-21 13:50:10 -07:00
Tom Eastep
56b6db1a3d
Make the allow command work with both ipset and chain dynamic blacklisting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-14 13:42:20 -07:00
Tom Eastep
f979ccb16d
Merge branch '5.0.9' 2016-06-09 14:47:44 -07:00
Tom Eastep
4869f61a25
'allow' now works with ipset-based dynamic blacklisting
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-09 08:44:25 -07:00
Matt Darfeuille
0925636995
(Fwd) [Shorewall-users] Shorewall-lite on OpenWRT
On 7 Jun 2016 at 8:21, Tom Eastep wrote:

> On 06/07/2016 06:40 AM, Matt Darfeuille wrote:
> > On 5 Jun 2016 at 12:53, Tom Eastep wrote:
> >
> >> On 06/05/2016 12:33 PM, Matt Darfeuille wrote:
> >>> On 5 Jun 2016 at 7:57, Tom Eastep wrote:
> >>>
> >>>> On 05/29/2016 02:00 AM, Matt Darfeuille wrote:
> >>>>
> >>>> Hi Matt,
> >>>>
> >>>>>
> >>>>> -------------- Enclosure number 1 ----------------
> >>>>> >From 6ff651108df33ab8be4562caef03a8582e9eac5e Mon Sep 17 00:00:00 2001
> >>>>> From: Matt Darfeuille <matdarf@gmail.com>
> >>>>> Date: Tue, 24 May 2016 13:10:28 +0200
> >>>>> Subject: [PATCH 1/8] Emulate 'ps -p' using grep to work on openwrt
> >>>>>
> >>>>> Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
> >>>>> ---
> >>>>>  Shorewall-core/lib.common | 2 +-
> >>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>>>>
> >>>>> diff --git a/Shorewall-core/lib.common b/Shorewall-core/lib.common
> >>>>> index 03ecb2a..fcb02ee 100644
> >>>>> --- a/Shorewall-core/lib.common
> >>>>> +++ b/Shorewall-core/lib.common
> >>>>> @@ -776,7 +776,7 @@ mutex_on()
> >>>>>  		error_message "WARNING: Stale lockfile ${lockf} removed"
> >>>>>  	    elif [ $lockpid -eq $$ ]; then
> >>>>>                  return 0
> >>>>> -	    elif ! qt ps p ${lockpid}; then
> >>>>> +	    elif ! qt ps | grep -v grep | grep ${lockpid}; then
> >>>>
> >>>> I don't see how this can work -- 'qt ps' will produce no output yet the
> >>>> code pipes into tandem greps.
> >>>>
> >>>> Do you really want this instead?
> >>>>
> >>>> elif ! ps | grep -v grep | qt grep ${lockpid}; then
> >>>>
> >>>
> >>> Oops sorry Tom, that's what I meant(do you want the corrected
> >>> patch?)!
> >>
> >> Yes, please.
> >>
> >
> > Tom, along with correcting this faulty commit I realize, after some
> > more testing, that I've also sent unnecessary commits.
> >
> > Should I revert these 3 commits(git revert ...):
> > Set proper permissions for the LOCKFILE on openwrt
> > 2ded346cb557212389212fd5adcd4c6800edbb62
> > Create lockfile before using openwrt's lock utility
> > 08e8796ff1abc3b24b8bbd40bf5e0a2b36464d61
> > Emulate 'ps -p' using grep to work on openwrt
> > 6ff651108df33ab8be4562caef03a8582e9eac5e
> >
> > or should I simply create new commits that will correct these faulty
> > commits?
> >
> > In other words what's the best way to correct submited commits.
> >
>
> Matt,
>
> Either way is fine.
>

Hopefully these 3 commits will do it(code-fixes.patch):

Patch 1 will correct the error you have point out!
On OpenWRT the lock utility doesn't allow to append the pid of the
currently running script to the LOCKFILE that's why I've simply
deleted that line(patch 2).
I've also reordered the permissions line to be added after the line
that will lock the file specified by the LOCKFILE variable(patch 3).

and two other patches:
While installing shorewall-init using the DESTDIR variable on debian,
'mkdir' would complain if the directory ${DESTDIR}/${etc}/default
already exist; corrected using 'mkdir -p ...'(patch 4).
The last patch will correct a typo in the blacklisting_support
article.

-Matt

-------------- Enclosure number 1 ----------------
>From 1a2ff15c8dc994030e819d2882570d188b99c501 Mon Sep 17 00:00:00 2001
From: Matt Darfeuille <matdarf@gmail.com>
Date: Wed, 8 Jun 2016 09:09:46 +0200
Subject: [PATCH 1/5] Correct pid detection mutex_on()

Signed-off-by: Matt Darfeuille <matdarf@gmail.com>
Signed-off-by: Tom Eastep <teastep@shorewall.net>
2016-06-08 15:40:48 -07:00