forked from extern/shorewall_code
Compare commits
17 Commits
5.0.14-RC3
...
5.0.14.1
| Author | SHA1 | Date | |
|---|---|---|---|
|
6a89fd1367 | ||
|
|
ffe1e1d335 | ||
|
|
cecfe54ef6 | ||
|
|
8441ac5c5f | ||
|
|
01a6881f4f | ||
|
|
f917670fbd | ||
|
|
c376740329 | ||
|
|
4169520d63 | ||
|
|
53d97bbcc8 | ||
|
|
9ae36e1989 | ||
|
|
60619fb3cb | ||
|
|
41ecee356b | ||
|
|
e188bde6c4 | ||
|
|
6e08717089 | ||
|
|
d37967f32f | ||
|
|
10c1ad245a | ||
|
|
032a16eb43 |
@@ -949,7 +949,7 @@ show_events() {
|
||||
for file in /proc/net/xt_recent/*; do
|
||||
base=$(basename $file)
|
||||
|
||||
if [ $base != %CURRENTTIME ]; then
|
||||
if [ "$base" != %CURRENTTIME -a "$base" != "*" ]; then
|
||||
echo $base
|
||||
show_event $base
|
||||
echo
|
||||
|
||||
@@ -472,7 +472,7 @@ sub validate_portpair1( $$ ) {
|
||||
|
||||
fatal_error "Invalid port range ($portpair)" if $portpair =~ tr/-/-/ > 1;
|
||||
|
||||
$portpair = "0$portpair" if substr( $portpair, 0, 1 ) eq ':';
|
||||
$portpair = "1$portpair" if substr( $portpair, 0, 1 ) eq ':';
|
||||
$portpair = "${portpair}65535" if substr( $portpair, -1, 1 ) eq ':';
|
||||
|
||||
my @ports = split /-/, $portpair, 2;
|
||||
@@ -483,9 +483,10 @@ sub validate_portpair1( $$ ) {
|
||||
|
||||
if ( @ports == 2 ) {
|
||||
$what = 'port range';
|
||||
fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1];
|
||||
fatal_error "Invalid port range ($portpair)" unless $ports[0] && $ports[0] < $ports[1];
|
||||
} else {
|
||||
$what = 'port';
|
||||
fatal_error 'Invalid port number (0)' unless $portpair;
|
||||
}
|
||||
|
||||
fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, SCTP or DCCP" unless
|
||||
|
||||
@@ -280,14 +280,20 @@ sub process_one_masq1( $$$$$$$$$$$$ )
|
||||
} elsif ( $family == F_IPV4 ) {
|
||||
if ( $addr =~ /^.*\..*\..*\./ ) {
|
||||
$target = 'SNAT ';
|
||||
my ($ipaddr, $rest) = split ':', $addr;
|
||||
my ($ipaddr, $rest) = split ':', $addr, 2;
|
||||
if ( $ipaddr =~ /^(.+)-(.+)$/ ) {
|
||||
validate_range( $1, $2 );
|
||||
} else {
|
||||
validate_address $ipaddr, 0;
|
||||
}
|
||||
validate_portpair1( $proto, $rest ) if supplied $rest;
|
||||
$addrlist .= "--to-source $addr ";
|
||||
|
||||
if ( supplied $rest ) {
|
||||
validate_portpair1( $proto, $rest );
|
||||
$addrlist .= "--to-source $addr ";
|
||||
} else {
|
||||
$addrlist .= "--to-source $ipaddr";
|
||||
}
|
||||
|
||||
$exceptionrule = do_proto( $proto, '', '' ) if $addr =~ /:/;
|
||||
} else {
|
||||
my $ports = $addr;
|
||||
@@ -399,7 +405,11 @@ sub process_one_masq1( $$$$$$$$$$$$ )
|
||||
if ( $snat ) {
|
||||
$target =~ s/ .*//;
|
||||
$target .= '+' if $pre_nat;
|
||||
$target .= '(' . $addresses . ')' if $addresses ne '-' && $addresses ne 'NONAT';
|
||||
|
||||
if ( $addresses ne '-' && $addresses ne 'NONAT' ) {
|
||||
$addresses =~ s/^://;
|
||||
$target .= '(' . $addresses . ')';
|
||||
}
|
||||
|
||||
my $line = "$target\t$networks\t$savelist\t$proto\t$ports\t$ipsec\t$mark\t$user\t$condition\t$origdest\t$probability";
|
||||
#
|
||||
|
||||
@@ -5363,6 +5363,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
|
||||
$pre_nat = $1;
|
||||
$addresses = ( $2 || '' );
|
||||
$options = 'random' if $addresses =~ s/:?random$//;
|
||||
$add_snat_aliases = '';
|
||||
} elsif ( $action =~ /^SNAT(\+)?\((.+)\)$/ ) {
|
||||
$pre_nat = $1;
|
||||
$addresses = $2;
|
||||
@@ -5377,6 +5378,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
|
||||
$pre_nat = $1;
|
||||
} elsif ( $action eq 'MASQUERADE' ) {
|
||||
$actiontype = $builtin_target{$target = 'MASQUERADE'};
|
||||
$add_snat_aliases = '';
|
||||
} else {
|
||||
( $target , $params ) = get_target_param1( $action );
|
||||
|
||||
@@ -5507,10 +5509,12 @@ sub process_snat1( $$$$$$$$$$$$ ) {
|
||||
$detectaddress = 1;
|
||||
}
|
||||
} else {
|
||||
fatal_error "SNAT rules must spacify a new source address and/or new source ports" unless supplied $addresses;
|
||||
|
||||
my $addrlist = '';
|
||||
my @addrs = split_list $addresses, 'address';
|
||||
|
||||
fatal_error "Only one ADDRESS may be specified" if @addrs > 1;
|
||||
fatal_error "Only one SNAT address may be specified" if @addrs > 1;
|
||||
|
||||
for my $addr ( @addrs ) {
|
||||
if ( $addr =~ /^([&%])(.+)$/ ) {
|
||||
@@ -5553,20 +5557,27 @@ sub process_snat1( $$$$$$$$$$$$ ) {
|
||||
}
|
||||
} elsif ( $family == F_IPV4 ) {
|
||||
if ( $addr =~ /^.*\..*\..*\./ ) {
|
||||
my ($ipaddr, $rest) = split ':', $addr;
|
||||
my ($ipaddr, $rest) = split ':', $addr, 2;
|
||||
if ( $ipaddr =~ /^(.+)-(.+)$/ ) {
|
||||
validate_range( $1, $2 );
|
||||
} else {
|
||||
validate_address $ipaddr, 0;
|
||||
}
|
||||
validate_portpair1( $proto, $rest ) if supplied $rest;
|
||||
$addrlist .= " --to-source $addr";
|
||||
|
||||
if ( supplied $rest ) {
|
||||
validate_portpair1( $proto, $rest );
|
||||
$addrlist .= " --to-source $addr";
|
||||
} else {
|
||||
$addrlist .= " --to-source $ipaddr";
|
||||
}
|
||||
|
||||
$exceptionrule = do_proto( $proto, '', '' ) if $addr =~ /:/;
|
||||
} else {
|
||||
my $ports = $addr;
|
||||
$ports =~ s/^://;
|
||||
fatal_error "Missing Address or Port[-range] ($addr)" unless supplied $ports && $ports ne '-';
|
||||
validate_portpair1( $proto, $ports );
|
||||
$addrlist .= " --to-ports $ports";
|
||||
$addrlist .= " --to-source :$ports";
|
||||
$exceptionrule = do_proto( $proto, '', '' );
|
||||
}
|
||||
} else {
|
||||
@@ -5616,6 +5627,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
|
||||
if ( supplied $addresses ) {
|
||||
validate_portpair1($proto, $addresses );
|
||||
$target .= " --to-ports $addresses";
|
||||
$exceptionrule = do_proto( $proto, '', '' );
|
||||
}
|
||||
}
|
||||
#
|
||||
@@ -5701,7 +5713,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
|
||||
|
||||
conditional_rule_end( $chainref ) if $detectaddress || $conditional;
|
||||
|
||||
if ( $add_snat_aliases ) {
|
||||
if ( $add_snat_aliases && $addresses ) {
|
||||
my ( $interface, $alias , $remainder ) = split( /:/, $fullinterface, 3 );
|
||||
fatal_error "Invalid alias ($alias:$remainder)" if defined $remainder;
|
||||
for my $address ( split_list $addresses, 'address' ) {
|
||||
|
||||
@@ -10,12 +10,14 @@
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-snat"
|
||||
###################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
#
|
||||
# See http://shorewall.net/manpages/shorewall-snat.html for more information
|
||||
###########################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
#
|
||||
# Rules generated from masq file /home/teastep/shorewall/trunk/Shorewall/Samples/three-interfaces/masq by Shorewall 5.0.13-RC1 - Sat Oct 15 11:43:47 PDT 2016
|
||||
#
|
||||
MASQUERADE 10.0.0.0/8,\
|
||||
169.254.0.0/16,\
|
||||
172.16.0.0/12,\
|
||||
192.168.0.0/16 eth0
|
||||
MASQUERADE 10.0.0.0/8,\
|
||||
169.254.0.0/16,\
|
||||
172.16.0.0/12,\
|
||||
192.168.0.0/16 eth0
|
||||
|
||||
@@ -10,12 +10,14 @@
|
||||
# See the file README.txt for further details.
|
||||
#------------------------------------------------------------------------------
|
||||
# For information about entries in this file, type "man shorewall-snat"
|
||||
###################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
#
|
||||
# See http://shorewall.net/manpages/shorewall-snat.html for more information
|
||||
###########################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
#
|
||||
# Rules generated from masq file /home/teastep/shorewall/trunk/Shorewall/Samples/two-interfaces/masq by Shorewall 5.0.13-RC1 - Sat Oct 15 11:41:40 PDT 2016
|
||||
#
|
||||
MASQUERADE 10.0.0.0/8,\
|
||||
169.254.0.0/16,\
|
||||
172.16.0.0/12,\
|
||||
192.168.0.0/16 eth0
|
||||
MASQUERADE 10.0.0.0/8,\
|
||||
169.254.0.0/16,\
|
||||
172.16.0.0/12,\
|
||||
92.168.0.0/16 eth0
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
#
|
||||
# Shorewall SNAT/Masquerade File
|
||||
# Shorewall -- /etc/shorewall/snat
|
||||
#
|
||||
# For information about entries in this file, type "man shorewall-snat"
|
||||
#
|
||||
# See http://shorewall.net/manpages/shorewall-snat.html for additional information
|
||||
###################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
# See http://shorewall.net/manpages/shorewall-snat.html for more information
|
||||
#
|
||||
###########################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
#
|
||||
# Shorewall6 SNAT/Masquerade File
|
||||
# Shorewall6 -- /etc/shorewall6/snat
|
||||
#
|
||||
# For information about entries in this file, type "man shorewall6-snat"
|
||||
#
|
||||
# See http://shorewall.net/manpages6/shorewall6-snat.html for additional information
|
||||
###################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
# See http://shorewall.net/manpages6/shorewall6-snat.html for more information
|
||||
#
|
||||
###########################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
|
||||
|
||||
Reference in New Issue
Block a user