forked from extern/shorewall_code
Compare commits
133 Commits
5.1.5-Beta
...
5.1.8-base
Author | SHA1 | Date | |
---|---|---|---|
|
84cd80eba9 | ||
|
9b02f7a922 | ||
|
f1975ae9b0 | ||
|
7b9f7c095d | ||
|
8ea96098bf | ||
|
02ed36332a | ||
|
15a3b29a32 | ||
|
cb4f9e7261 | ||
|
bfab002dda | ||
|
ddb12fcad9 | ||
|
42ce754961 | ||
|
5cd4d63bc5 | ||
|
5b567f2d8b | ||
|
39a3c72057 | ||
|
b47e633c38 | ||
|
1b55a37a28 | ||
|
a97dcd23d0 | ||
|
108b169d8d | ||
|
a9fbaa57ed | ||
|
317f12041b | ||
|
8469f983d8 | ||
|
f54acb665a | ||
|
3d2e9eb93e | ||
|
c6a939301f | ||
|
1cb98254cc | ||
|
baa791a1e3 | ||
|
8b4b965f63 | ||
|
8ee2d6246c | ||
|
a7be3dfece | ||
|
846e8c4ece | ||
|
e2bf7e6584 | ||
|
ff3994f6a1 | ||
|
494ec9c59c | ||
|
1cde92e8f3 | ||
|
721a1e3b33 | ||
|
84fa774cb7 | ||
|
c39bc7b65f | ||
|
2548e8741d | ||
|
0a31fba6bb | ||
|
9701c9c522 | ||
|
973d352209 | ||
|
91e59c2ed4 | ||
|
be5aabcbfb | ||
|
a8937e6bc8 | ||
|
e91bd9a0e9 | ||
|
5e1cf17ebc | ||
|
85a7ec6fe5 | ||
|
fb831e3128 | ||
|
2ed11c7e15 | ||
|
ef1353790e | ||
|
4f79d2e82b | ||
|
e6a2ba78a4 | ||
|
41ea3bdeda | ||
|
1065c2951b | ||
|
3b373f3f21 | ||
|
0c05ab3bff | ||
|
ef3a33e3f4 | ||
|
8a78fb6e77 | ||
|
b54a691110 | ||
|
90f33dd436 | ||
|
b7aef24d7c | ||
|
6f475cde3f | ||
|
6053a40af0 | ||
|
7e4dba7623 | ||
|
3d322d31b7 | ||
|
34e4fffd7d | ||
|
2e98d4375b | ||
|
419ff8903b | ||
|
390ac30be8 | ||
|
8cb98f16ea | ||
|
5a9f179e25 | ||
|
d8eca457de | ||
|
8641d53bd1 | ||
|
7e3521e221 | ||
|
0603f8e355 | ||
|
ddefde2d10 | ||
|
2beeedd8fe | ||
|
1a2647618e | ||
|
72293883dd | ||
|
c31397532c | ||
|
d0861e813b | ||
|
5d5bef105a | ||
|
da62bd2b32 | ||
|
a83c19cc33 | ||
|
96a33395e8 | ||
|
dabe8abe52 | ||
|
a504820d19 | ||
|
8db4265ccc | ||
|
4c2c1bcdf1 | ||
|
f2ee8013fc | ||
|
56c8f70b52 | ||
|
657215f9b5 | ||
|
5589ab76d9 | ||
|
ec0e6763e4 | ||
|
6425e5ae5d | ||
|
8521c6f750 | ||
|
c57edb0fbf | ||
|
80e6cd8a2f | ||
|
69a0061d0f | ||
|
5a24953e6c | ||
|
eea3cca90c | ||
|
a420ef04d9 | ||
|
e573436b12 | ||
|
7f44473387 | ||
|
cf9773c4de | ||
|
939f0e92a5 | ||
|
320d448684 | ||
|
975a14b94f | ||
|
cf3c304078 | ||
|
d1a21fb678 | ||
|
b9b7baf98d | ||
|
92e725de97 | ||
|
922bd9eeca | ||
|
d2b3fa476a | ||
|
4e978b687d | ||
|
2d0cb5c2d8 | ||
|
d9dc6bcfe2 | ||
|
ff51915b4f | ||
|
1ad796ba5d | ||
|
c8e2b4ae28 | ||
|
9d160d4342 | ||
|
1301848315 | ||
|
f050fc6e05 | ||
|
61b6898782 | ||
|
aee8c14ea6 | ||
|
ff2323b249 | ||
|
b4a06e9656 | ||
|
4122021344 | ||
|
71d50e0217 | ||
|
1b6f15d577 | ||
|
7515520b46 | ||
|
1e2030fd6f | ||
|
708644f7c9 |
2
Shorewall-core/configure
vendored
2
Shorewall-core/configure
vendored
@@ -190,7 +190,7 @@ for p in ${!params[@]}; do
|
||||
done
|
||||
|
||||
echo '#' > shorewallrc
|
||||
echo "# Created by Shorewall Core version $VERSION configure - " `date` >> shorewallrc
|
||||
echo "# Created by Shorewall Core version $VERSION configure - " `date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}"` >> shorewallrc
|
||||
echo "# rc file: $rcfile" >> shorewallrc
|
||||
echo '#' >> shorewallrc
|
||||
|
||||
|
@@ -173,7 +173,12 @@ my $outfile;
|
||||
|
||||
open $outfile, '>', 'shorewallrc' or die "Can't open 'shorewallrc' for output: $!";
|
||||
|
||||
printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
|
||||
if ( $ENV{SOURCE_DATE_EPOCH} ) {
|
||||
printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s\n", VERSION, `date --utc --date=\"\@$ENV{SOURCE_DATE_EPOCH}\"`;
|
||||
} else {
|
||||
printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
|
||||
}
|
||||
|
||||
print $outfile "# rc file: $rcfilename\n#\n";
|
||||
|
||||
print $outfile "# Input: @ARGV\n#\n" if @ARGV;
|
||||
|
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# Shorewall 5.0 -- /usr/share/shorewall/lib.base
|
||||
# Shorewall 5.1 -- /usr/share/shorewall/lib.base
|
||||
#
|
||||
# (c) 1999-2015 - Tom Eastep (teastep@shorewall.net)
|
||||
# (c) 1999-2017 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
|
@@ -25,7 +25,7 @@
|
||||
# loaded after this one and replaces some of the functions declared here.
|
||||
#
|
||||
|
||||
SHOREWALL_CAPVERSION=50100
|
||||
SHOREWALL_CAPVERSION=50106
|
||||
|
||||
if [ -z "$g_basedir" ]; then
|
||||
#
|
||||
@@ -1137,16 +1137,31 @@ show_a_macro() {
|
||||
cat ${directory}/macro.$1
|
||||
}
|
||||
#
|
||||
# Don't dump empty SPD entries
|
||||
# Don't dump empty SPD entries or entries from the other address family
|
||||
#
|
||||
spd_filter()
|
||||
{
|
||||
awk \
|
||||
'BEGIN { skip=0; }; \
|
||||
/^src/ { skip=0; }; \
|
||||
/^src 0.0.0.0\/0/ { skip=1; }; \
|
||||
/^src ::\/0/ { skip=1; }; \
|
||||
{ if ( skip == 0 ) print; };'
|
||||
spd_filter() {
|
||||
#
|
||||
# af = Address Family (4 or 6)
|
||||
# afok = Address Family of entry matches af
|
||||
# p = print the contents of A (entry is not empty)
|
||||
# i = Number of lines stored in A
|
||||
#
|
||||
awk -v af=$g_family \
|
||||
'function prnt(A,i, j) { while ( j < i ) print A[j++]; };\
|
||||
\
|
||||
/^src / { if (p) prnt( A, i );\
|
||||
afok = 1;\
|
||||
p = 0;\
|
||||
i = 0;\
|
||||
if ( af == 4 )\
|
||||
{ if ( /:/ ) afok = 0; }\
|
||||
else\
|
||||
{ if ( /\./ ) afok = 0; }\
|
||||
};\
|
||||
{ if ( afok ) A[i++] = $0; };\
|
||||
/tmpl/ { p = afok; };\
|
||||
\
|
||||
END { if (p) prnt( A, i ); }'
|
||||
}
|
||||
#
|
||||
# Print a heading with leading and trailing black lines
|
||||
@@ -1159,7 +1174,8 @@ heading() {
|
||||
|
||||
show_ipsec() {
|
||||
heading "PFKEY SPD"
|
||||
$IP -s xfrm policy | spd_filter
|
||||
$IP -s -$g_family xfrm policy | spd_filter
|
||||
|
||||
heading "PFKEY SAD"
|
||||
$IP -s -$g_family xfrm state | egrep -v '[[:space:]]+(auth-trunc|enc )' # Don't divulge the keys
|
||||
}
|
||||
@@ -2770,7 +2786,7 @@ determine_capabilities() {
|
||||
GOTO_TARGET=
|
||||
LOGMARK_TARGET=
|
||||
IPMARK_TARGET=
|
||||
LOG_TARGET=Yes
|
||||
LOG_TARGET=
|
||||
ULOG_TARGET=
|
||||
NFLOG_TARGET=
|
||||
PERSISTENT_SNAT=
|
||||
@@ -2803,6 +2819,8 @@ determine_capabilities() {
|
||||
WAIT_OPTION=
|
||||
CPU_FANOUT=
|
||||
NETMAP_TARGET=
|
||||
NFLOG_SIZE=
|
||||
RESTORE_WAIT_OPTION=
|
||||
|
||||
AMANDA_HELPER=
|
||||
FTP_HELPER=
|
||||
@@ -2826,9 +2844,11 @@ determine_capabilities() {
|
||||
qt $arptables -L OUT && ARPTABLESJF=Yes
|
||||
fi
|
||||
|
||||
[ -z "$(${g_tool}-restore --wait < /dev/null 2>&1)" ] && RESTORE_WAIT_OPTION=Yes
|
||||
|
||||
if qt $g_tool --wait -t filter -L INPUT -n -v; then
|
||||
WAIT_OPTION=Yes
|
||||
tool="$tool --wait"
|
||||
g_tool="$g_tool --wait"
|
||||
fi
|
||||
|
||||
chain=fooX$$
|
||||
@@ -3134,12 +3154,15 @@ determine_capabilities() {
|
||||
qt $g_tool -A $chain -m time --timestart 23:00 -j DROP && TIME_MATCH=Yes
|
||||
qt $g_tool -A $chain -g $chain1 && GOTO_TARGET=Yes
|
||||
qt $g_tool -A $chain -j LOGMARK && LOGMARK_TARGET=Yes
|
||||
qt $g_tool -A $chain -j LOG || LOG_TARGET=
|
||||
qt $g_tool -A $chain -j LOG && LOG_TARGET=Yes
|
||||
qt $g_tool -A $chain -j ULOG && ULOG_TARGET=Yes
|
||||
qt $g_tool -A $chain -j NFLOG && NFLOG_TARGET=Yes
|
||||
qt $g_tool -A $chain -j MARK --set-mark 5 && MARK_ANYWHERE=Yes
|
||||
qt $g_tool -A $chain -m statistic --mode nth --every 2 --packet 1 && STATISTIC_MATCH=Yes
|
||||
qt $g_tool -A $chain -m geoip --src-cc US && GEOIP_MATCH=Yes
|
||||
if qt $g_tool -A $chain -j NFLOG; then
|
||||
NFLOG_TARGET=Yes
|
||||
qt $g_tool -A $chain -j NFLOG --nflog-size 64 && NFLOG_SIZE=Yes
|
||||
fi
|
||||
|
||||
if [ $g_family -eq 4 ]; then
|
||||
qt $g_tool -A $chain -j ACCOUNT --addr 192.168.1.0/29 --tname $chain && ACCOUNT_TARGET=Yes
|
||||
@@ -3295,9 +3318,11 @@ report_capabilities_unsorted() {
|
||||
if [ $g_family -eq 4 ]; then
|
||||
report_capability "iptables -S (IPTABLES_S)" $IPTABLES_S
|
||||
report_capability "iptables --wait option (WAIT_OPTION)" $WAIT_OPTION
|
||||
report_capability "iptables-restore --wait option (RESTORE_WAIT_OPTION)" $RESTORE_WAIT_OPTION
|
||||
else
|
||||
report_capability "ip6tables -S (IPTABLES_S)" $IPTABLES_S
|
||||
report_capability "ip6tables --wait option (WAIT_OPTION)" $WAIT_OPTION
|
||||
report_capability "ip6tables-restore --wait option (RESTORE_WAIT_OPTION)" $RESTORE_WAIT_OPTION
|
||||
fi
|
||||
|
||||
report_capability "Basic Filter (BASIC_FILTER)" $BASIC_FILTER
|
||||
@@ -3305,6 +3330,7 @@ report_capabilities_unsorted() {
|
||||
report_capability "CT Target (CT_TARGET)" $CT_TARGET
|
||||
report_capability "NFQUEUE CPU Fanout (CPU_FANOUT)" $CPU_FANOUT
|
||||
report_capability "NETMAP Target (NETMAP_TARGET)" $NETMAP_TARGET
|
||||
report_capability "--nflog-size support (NFLOG_SIZE)" $NFLOG_SIZE
|
||||
|
||||
echo " Kernel Version (KERNELVERSION): $KERNELVERSION"
|
||||
echo " Capabilities Version (CAPVERSION): $CAPVERSION"
|
||||
@@ -3411,6 +3437,8 @@ report_capabilities_unsorted1() {
|
||||
report_capability1 WAIT_OPTION
|
||||
report_capability1 CPU_FANOUT
|
||||
report_capability1 NETMAP_TARGET
|
||||
report_capability1 NFLOG_SIZE
|
||||
report_capability1 RESTORE_WAIT_OPTION
|
||||
|
||||
report_capability1 AMANDA_HELPER
|
||||
report_capability1 FTP_HELPER
|
||||
@@ -3715,7 +3743,7 @@ ipcalc_command() {
|
||||
|
||||
valid_address $address || fatal_error "Invalid IP address: $address"
|
||||
[ -z "$vlsm" ] && fatal_error "Missing VLSM"
|
||||
[ "x$address" = "x$vlsm" ] && "Invalid VLSM"
|
||||
[ "x$address" = "x$vlsm" ] && fatal_error "Invalid VLSM"
|
||||
[ $vlsm -gt 32 ] && fatal_error "Invalid VLSM: /$vlsm"
|
||||
|
||||
address=$address/$vlsm
|
||||
|
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# Shorewall 5.0 -- /usr/share/shorewall/lib.common.
|
||||
# Shorewall 5.1 -- /usr/share/shorewall/lib.common.
|
||||
#
|
||||
# (c) 2010-2015 - Tom Eastep (teastep@shorewall.net)
|
||||
# (c) 2010-2017 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
@@ -269,53 +269,48 @@ loadmodule() # $1 = module name, $2 - * arguments
|
||||
{
|
||||
local modulename
|
||||
modulename=$1
|
||||
shift
|
||||
local moduleoptions
|
||||
moduleoptions=$*
|
||||
local modulefile
|
||||
local suffix
|
||||
|
||||
if [ -d /sys/module/ ]; then
|
||||
if ! list_search $modulename $DONT_LOAD; then
|
||||
if [ ! -d /sys/module/$modulename ]; then
|
||||
shift
|
||||
|
||||
for suffix in $MODULE_SUFFIX ; do
|
||||
for directory in $moduledirectories; do
|
||||
modulefile=$directory/${modulename}.${suffix}
|
||||
|
||||
if [ -f $modulefile ]; then
|
||||
case $moduleloader in
|
||||
insmod)
|
||||
insmod $modulefile $*
|
||||
;;
|
||||
*)
|
||||
modprobe $modulename $*
|
||||
;;
|
||||
esac
|
||||
break 2
|
||||
for directory in $moduledirectories; do
|
||||
for modulefile in $directory/${modulename}.*; do
|
||||
if [ -f $modulefile ]; then
|
||||
insmod $modulefile $moduleoptions
|
||||
return
|
||||
fi
|
||||
done
|
||||
done
|
||||
;;
|
||||
*)
|
||||
modprobe -q $modulename $moduleoptions
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
fi
|
||||
elif ! list_search $modulename $DONT_LOAD $MODULES; then
|
||||
shift
|
||||
|
||||
for suffix in $MODULE_SUFFIX ; do
|
||||
for directory in $moduledirectories; do
|
||||
modulefile=$directory/${modulename}.${suffix}
|
||||
|
||||
if [ -f $modulefile ]; then
|
||||
case $moduleloader in
|
||||
insmod)
|
||||
insmod $modulefile $*
|
||||
;;
|
||||
*)
|
||||
modprobe $modulename $*
|
||||
;;
|
||||
esac
|
||||
break 2
|
||||
for directory in $moduledirectories; do
|
||||
for modulefile in $directory/${modulename}.*; do
|
||||
if [ -f $modulefile ]; then
|
||||
insmod $modulefile $moduleoptions
|
||||
return
|
||||
fi
|
||||
done
|
||||
done
|
||||
;;
|
||||
*)
|
||||
modprobe -q $modulename $moduleoptions
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -338,8 +333,6 @@ reload_kernel_modules() {
|
||||
moduleloader=insmod
|
||||
fi
|
||||
|
||||
[ -n "${MODULE_SUFFIX:=ko ko.gz ko.xz o o.gz o.xz gz xz}" ]
|
||||
|
||||
if [ -n "$MODULESDIR" ]; then
|
||||
case "$MODULESDIR" in
|
||||
+*)
|
||||
@@ -394,8 +387,6 @@ load_kernel_modules() # $1 = Yes, if we are to save moduleinfo in $VARDIR
|
||||
moduleloader=insmod
|
||||
fi
|
||||
|
||||
[ -n "${MODULE_SUFFIX:=o gz xz ko o.gz o.xz ko.gz ko.xz}" ]
|
||||
|
||||
if [ -n "$MODULESDIR" ]; then
|
||||
case "$MODULESDIR" in
|
||||
+*)
|
||||
|
@@ -1,7 +1,7 @@
|
||||
#
|
||||
# Shorewall 5.0 -- /usr/share/shorewall/lib.core
|
||||
# Shorewall 5.1 -- /usr/share/shorewall/lib.core
|
||||
#
|
||||
# (c) 1999-2015 - Tom Eastep (teastep@shorewall.net)
|
||||
# (c) 1999-2017 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
@@ -24,7 +24,7 @@
|
||||
# generated scripts.
|
||||
#
|
||||
|
||||
SHOREWALL_LIBVERSION=50100
|
||||
SHOREWALL_LIBVERSION=50108
|
||||
|
||||
#
|
||||
# Fatal Error
|
||||
|
@@ -1,6 +1,6 @@
|
||||
#
|
||||
#
|
||||
# Shorewall 5.0 -- /usr/share/shorewall/lib.installer.
|
||||
# Shorewall 5.1 -- /usr/share/shorewall/lib.installer.
|
||||
#
|
||||
# (c) 2017 - Tom Eastep (teastep@shorewall.net)
|
||||
# (c) 2017 - Matt Darfeuille (matdarf@gmail.com)
|
||||
|
@@ -1,6 +1,6 @@
|
||||
#
|
||||
#
|
||||
# Shorewall 5.0 -- /usr/share/shorewall/lib.installer.
|
||||
# Shorewall 5.1 -- /usr/share/shorewall/lib.installer.
|
||||
#
|
||||
# (c) 2017 - Tom Eastep (teastep@shorewall.net)
|
||||
# (c) 2017 - Matt Darfeuille (matdarf@gmail.com)
|
||||
|
@@ -1,8 +1,8 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Shorewall Packet Filtering Firewall Control Program - V5.0
|
||||
# Shorewall Packet Filtering Firewall Control Program - V5.1
|
||||
#
|
||||
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2014,2015 -
|
||||
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2014,2015-2017
|
||||
# Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Shorewall documentation is available at http://www.shorewall.net
|
||||
@@ -25,6 +25,10 @@
|
||||
# For a list of supported commands, type 'shorewall help' or 'shorewall6 help'
|
||||
#
|
||||
################################################################################################
|
||||
#
|
||||
# Default product is Shorewall. PRODUCT will be set based on $0 and on passed -[46] and -l
|
||||
# options
|
||||
#
|
||||
PRODUCT=shorewall
|
||||
|
||||
#
|
||||
|
@@ -159,8 +159,9 @@ shorewall_stop () {
|
||||
|
||||
mkdir -p $(dirname "$SAVE_IPSETS")
|
||||
if ipset -S > "${SAVE_IPSETS}.tmp"; then
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
|
||||
else
|
||||
rm -f "${SAVE_IPSETS}.tmp"
|
||||
echo_notdone
|
||||
fi
|
||||
|
||||
|
@@ -66,6 +66,10 @@ start () {
|
||||
|
||||
printf "Initializing \"Shorewall-based firewalls\": "
|
||||
|
||||
if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then
|
||||
ipset -R < "$SAVE_IPSETS"
|
||||
fi
|
||||
|
||||
for PRODUCT in $PRODUCTS; do
|
||||
setstatedir
|
||||
retval=$?
|
||||
@@ -120,6 +124,15 @@ stop () {
|
||||
done
|
||||
|
||||
if [ $retval -eq 0 ]; then
|
||||
if [ -n "$SAVE_IPSETS" ]; then
|
||||
mkdir -p $(dirname "$SAVE_IPSETS")
|
||||
if ipset -S > "${SAVE_IPSETS}.tmp"; then
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
|
||||
else
|
||||
rm -f "${SAVE_IPSETS}.tmp"
|
||||
fi
|
||||
fi
|
||||
|
||||
rm -f $lockfile
|
||||
success
|
||||
else
|
||||
|
@@ -126,7 +126,9 @@ stop () {
|
||||
if [ -n "$SAVE_IPSETS" ]; then
|
||||
mkdir -p $(dirname "$SAVE_IPSETS")
|
||||
if ipset -S > "${SAVE_IPSETS}.tmp"; then
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
|
||||
else
|
||||
rm -f "${SAVE_IPSETS}.tmp"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
@@ -116,7 +116,9 @@ shorewall_stop () {
|
||||
if [ -n "$SAVE_IPSETS" ]; then
|
||||
mkdir -p $(dirname "$SAVE_IPSETS")
|
||||
if ipset -S > "${SAVE_IPSETS}.tmp"; then
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
|
||||
else
|
||||
rm -f "${SAVE_IPSETS}.tmp"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
@@ -126,7 +126,9 @@ shorewall_stop () {
|
||||
if [ -n "$SAVE_IPSETS" ]; then
|
||||
mkdir -p $(dirname "$SAVE_IPSETS")
|
||||
if ipset -S > "${SAVE_IPSETS}.tmp"; then
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
|
||||
else
|
||||
rm -f "${SAVE_IPSETS}.tmp"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
@@ -104,7 +104,9 @@ shorewall_stop () {
|
||||
if [ -n "$SAVE_IPSETS" ]; then
|
||||
mkdir -p $(dirname "$SAVE_IPSETS")
|
||||
if ipset -S > "${SAVE_IPSETS}.tmp"; then
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS"
|
||||
grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" || rm -f "${SAVE_IPSETS}.tmp"
|
||||
else
|
||||
rm -f "${SAVE_IPSETS}.tmp"
|
||||
fi
|
||||
fi
|
||||
|
||||
|
@@ -28,7 +28,7 @@
|
||||
#
|
||||
# On the target system (the system where the firewall program is to run):
|
||||
#
|
||||
# [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] [ MODULE_SUFFIX="<module suffix list>" ] shorecap > capabilities
|
||||
# [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] shorecap > capabilities
|
||||
#
|
||||
# Now move the capabilities file to the compilation system. The file must
|
||||
# be placed in a directory on the CONFIG_PATH to be used when compiling firewalls
|
||||
@@ -38,7 +38,6 @@
|
||||
#
|
||||
# IPTABLES - iptables
|
||||
# MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
|
||||
# MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
|
||||
#
|
||||
# Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
|
||||
# used during firewall compilation, then the generated firewall program will likewise not
|
||||
|
@@ -107,6 +107,11 @@ if ( $command & $REAP_OPT ) {
|
||||
|
||||
$duration .= '--rttl ' if $command & $TTL_OPT;
|
||||
|
||||
if ( ( $targets{$action} || 0 ) & NATRULE ) {
|
||||
perl_action_helper( "${action}-", "-m recent --rcheck ${duration}--hitcount $hitcount" );
|
||||
$action = 'ACCEPT';
|
||||
}
|
||||
|
||||
if ( $command & $RESET_CMD ) {
|
||||
require_capability 'MARK_ANYWHERE', '"reset"', 's';
|
||||
|
||||
|
@@ -41,6 +41,11 @@ fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
if ( ( $targets{$action} || 0 ) & NATRULE ) {
|
||||
perl_action_helper( "${action}-", "" );
|
||||
$action = 'ACCEPT';
|
||||
}
|
||||
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( $action, '', '', "-m recent --name $event --remove --rdest" );
|
||||
} else {
|
||||
|
@@ -37,6 +37,11 @@ fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
if ( ( $targets{$action} || 0 ) & NATRULE ) {
|
||||
perl_action_helper( "${action}-", "" );
|
||||
$action = 'ACCEPT';
|
||||
}
|
||||
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( $action, '', '', "-m recent --name $event --set --rdest" );
|
||||
} else {
|
||||
|
39
Shorewall/Actions/action.dropBcasts
Normal file
39
Shorewall/Actions/action.dropBcasts
Normal file
@@ -0,0 +1,39 @@
|
||||
#
|
||||
# Shorewall -- /usr/share/shorewall/action.dropBcasts
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
|
||||
#
|
||||
# (c) 2017 Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
# dropBcasts[([audit])]
|
||||
#
|
||||
###############################################################################
|
||||
|
||||
DEFAULTS -
|
||||
|
||||
?if passed(@1)
|
||||
?if @1 eq 'audit'
|
||||
?require AUDIT_TARGET
|
||||
Broadcast(A_DROP)
|
||||
?else
|
||||
?error "Invalid argument (@1) to dropBcasts"
|
||||
?endif
|
||||
?else
|
||||
Broadcast(DROP)
|
||||
?endif
|
||||
|
@@ -6,4 +6,5 @@
|
||||
###############################################################################
|
||||
#ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST RATE USER
|
||||
|
||||
PARAM - - udp 3389
|
||||
PARAM - - tcp 3389
|
||||
|
@@ -1,82 +0,0 @@
|
||||
# Shorewall Packet Filtering Firewall Export Directory Makefile - V4.2
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
|
||||
#
|
||||
# (c) 2006 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Shorewall documentation is available at http://www.shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
################################################################################
|
||||
# Place this file in each export directory. Modify each copy to set HOST
|
||||
# to the name of the remote firewall corresponding to the directory.
|
||||
#
|
||||
# To make the 'firewall' script, type "make".
|
||||
#
|
||||
# Once the script is compiling correctly, you can install it by
|
||||
# typing "make install".
|
||||
#
|
||||
################################################################################
|
||||
# V A R I A B L E S
|
||||
#
|
||||
# Files in the export directory on which the firewall script does not depend
|
||||
#
|
||||
IGNOREFILES = firewall% Makefile% trace% %~
|
||||
#
|
||||
# Remote Firewall system
|
||||
#
|
||||
HOST = gateway
|
||||
#
|
||||
# Save some typing
|
||||
#
|
||||
LITEDIR = /var/lib/shorewall-lite
|
||||
#
|
||||
# Set this if the remote system has a non-standard modules directory
|
||||
#
|
||||
MODULESDIR=
|
||||
#
|
||||
# Default target is the firewall script
|
||||
#
|
||||
################################################################################
|
||||
# T A R G E T S
|
||||
#
|
||||
all: firewall
|
||||
#
|
||||
# Only generate the capabilities file if it doesn't already exist
|
||||
#
|
||||
capabilities:
|
||||
ssh root@$(HOST) "MODULESDIR=$(MODULESDIR) /usr/share/shorewall-lite/shorecap > $(LITEDIR)/capabilities"
|
||||
scp root@$(HOST):$(LITEDIR)/capabilities .
|
||||
#
|
||||
# Compile the firewall script. Using the 'wildcard' function causes "*" to be expanded so that
|
||||
# 'filter-out' will be presented with the list of files in this directory rather than "*"
|
||||
#
|
||||
firewall: $(filter-out $(IGNOREFILES) capabilities , $(wildcard *) ) capabilities
|
||||
shorewall compile -e . firewall
|
||||
#
|
||||
# Only reload on demand.
|
||||
#
|
||||
install: firewall
|
||||
scp firewall firewall.conf root@$(HOST):$(LITEDIR)
|
||||
ssh root@$(HOST) "/sbin/shorewall-lite restart"
|
||||
#
|
||||
# Save running configuration
|
||||
#
|
||||
save:
|
||||
ssh root@$(HOST) "/sbin/shorewall-lite save"
|
||||
#
|
||||
# Remove generated files
|
||||
#
|
||||
clean:
|
||||
rm -f capabilities firewall firewall.conf reload
|
@@ -195,7 +195,7 @@ sub process_accounting_rule1( $$$$$$$$$$$ ) {
|
||||
$ports = '' if $ports eq 'any' || $ports eq 'all';
|
||||
$sports = '' if $sports eq 'any' || $sports eq 'all';
|
||||
|
||||
fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT;
|
||||
fatal_error "USER/GROUP may only be specified in the OUTPUT section" unless $user eq '-' || $asection == OUTPUT_SECTION;
|
||||
|
||||
my $rule = do_proto( $proto, $ports, $sports ) . do_user ( $user ) . do_test ( $mark, $globals{TC_MASK} ) . do_headers( $headers );
|
||||
my $prerule = '';
|
||||
@@ -266,7 +266,7 @@ sub process_accounting_rule1( $$$$$$$$$$$ ) {
|
||||
if ( $source eq 'any' || $source eq 'all' ) {
|
||||
$source = ALLIP;
|
||||
} else {
|
||||
fatal_error "MAC addresses only allowed in the INPUT and FORWARD sections" if $source =~ /~/ && ( $asection == OUTPUT || ! $asection );
|
||||
fatal_error "MAC addresses only allowed in the INPUT and FORWARD sections" if $source =~ /~/ && ( $asection == OUTPUT_SECTION || ! $asection );
|
||||
}
|
||||
|
||||
if ( have_bridges && ! $asection ) {
|
||||
|
@@ -851,8 +851,15 @@ sub validate_port( $$ ) {
|
||||
my $value;
|
||||
|
||||
if ( $port =~ /^(\d+)$/ || $port =~ /^0x/ ) {
|
||||
$port = numeric_value $port;
|
||||
return $port if defined $port && $port && $port <= 65535;
|
||||
$value = numeric_value $port;
|
||||
|
||||
if ( defined $value ) {
|
||||
if ( $value && $value <= 65535 ) {
|
||||
return $value;
|
||||
} else {
|
||||
$value = undef;
|
||||
}
|
||||
}
|
||||
} elsif ( $port =~ /^%(.*)/ ) {
|
||||
$value = record_runtime_port( $1 );
|
||||
} else {
|
||||
@@ -891,13 +898,13 @@ sub validate_portpair( $$ ) {
|
||||
$what = 'port range';
|
||||
|
||||
unless ($ports[0] =~ /^\$/ || $ports[1] =~ /^\$/ ) {
|
||||
fatal_error "Invalid port range ($portpair)" unless $ports[0] < $ports[1];
|
||||
fatal_error "Invalid port range ($_[1])" unless $ports[0] < $ports[1];
|
||||
}
|
||||
} else {
|
||||
$what = 'port';
|
||||
}
|
||||
|
||||
fatal_error "Using a $what ( $portpair ) requires PROTO TCP, UDP, UDPLITE, SCTP or DCCP" unless
|
||||
fatal_error "Using a $what ( $_[1] ) requires PROTO TCP, UDP, UDPLITE, SCTP or DCCP" unless
|
||||
defined $protonum && ( $protonum == TCP ||
|
||||
$protonum == UDP ||
|
||||
$protonum == UDPLITE ||
|
||||
@@ -1338,8 +1345,6 @@ sub format_rule( $$;$ ) {
|
||||
} else {
|
||||
$rule .= join( '' , ' --', $_, ' ', $value );
|
||||
}
|
||||
|
||||
next;
|
||||
} elsif ( $type == EXPENSIVE ) {
|
||||
#
|
||||
# Only emit expensive matches now if there are '-m nfacct' or '-m recent' matches in the rule
|
||||
@@ -1398,13 +1403,15 @@ sub compatible( $$ ) {
|
||||
}
|
||||
#
|
||||
# Don't combine chains where each specifies
|
||||
# -m policy
|
||||
# -m policy and the policies are different
|
||||
# or when one specifies
|
||||
# -m multiport
|
||||
# and the other specifies
|
||||
# --dport or --sport or -m multiport
|
||||
#
|
||||
return ! ( $ref1->{policy} && $ref2->{policy} ||
|
||||
my ( $p1, $p2 );
|
||||
|
||||
return ! ( ( ( $p1 = $ref1->{policy} ) && ( $p2 = $ref2->{policy} ) && $p1 ne $p2 ) ||
|
||||
( ( $ref1->{multiport} && ( $ref2->{dport} || $ref2->{sport} || $ref2->{multiport} ) ) ||
|
||||
( $ref2->{multiport} && ( $ref1->{dport} || $ref1->{sport} ) ) ) );
|
||||
}
|
||||
@@ -1922,7 +1929,7 @@ sub delete_reference( $$ ) {
|
||||
|
||||
assert( $toref );
|
||||
|
||||
delete $toref->{references}{$fromref->{name}} unless --$toref->{references}{$fromref->{name}} > 0;
|
||||
delete $toref->{references}{$fromref->{name}} if --$toref->{references}{$fromref->{name}} <= 0;
|
||||
}
|
||||
|
||||
#
|
||||
@@ -2060,7 +2067,7 @@ sub adjust_reference_counts( $$$ ) {
|
||||
my ($toref, $name1, $name2) = @_;
|
||||
|
||||
if ( $toref ) {
|
||||
delete $toref->{references}{$name1} unless --$toref->{references}{$name1} > 0;
|
||||
delete $toref->{references}{$name1} if --$toref->{references}{$name1} <= 0;
|
||||
$toref->{references}{$name2}++;
|
||||
}
|
||||
}
|
||||
@@ -3268,8 +3275,10 @@ sub initialize_chain_table($) {
|
||||
$chainref = new_nat_chain( 'DOCKER' );
|
||||
set_optflags( $chainref, DONT_OPTIMIZE | DONT_DELETE | DONT_MOVE );
|
||||
add_commands( $chainref, '[ -f ${VARDIR}/.nat_DOCKER ] && cat ${VARDIR}/.nat_DOCKER >&3' );
|
||||
$chainref = new_standard_chain( 'DOCKER-INGRESS' );
|
||||
$chainref = new_standard_chain( 'DOCKER-ISOLATION' );
|
||||
set_optflags( $chainref, DONT_OPTIMIZE | DONT_DELETE | DONT_MOVE );
|
||||
add_commands( $chainref, '[ -f ${VARDIR}/.filter_DOCKER-INGRESS ] && cat ${VARDIR}/.filter_DOCKER-INGRESS >&3' );
|
||||
add_commands( $chainref, '[ -f ${VARDIR}/.filter_DOCKER-ISOLATION ] && cat ${VARDIR}/.filter_DOCKER-ISOLATION >&3' );
|
||||
}
|
||||
|
||||
@@ -3666,7 +3675,7 @@ sub optimize_level4( $$ ) {
|
||||
#
|
||||
delete_chain_and_references( $chainref );
|
||||
$progress = 1;
|
||||
} elsif ( $chainref->{builtin} || ! $globals{KLUDGEFREE} || $firstrule->{policy} ) {
|
||||
} elsif ( $chainref->{builtin} || ! $globals{KLUDGEFREE} ) {
|
||||
#
|
||||
# This case requires a new rule merging algorithm. Ignore this chain from
|
||||
# now on.
|
||||
@@ -3893,6 +3902,15 @@ sub optimize_level8( $$$ ) {
|
||||
}
|
||||
|
||||
$combined{ $chainref1->{name} } = $chainref->{name};
|
||||
#
|
||||
# While rare, it is possible for a policy chain to be combined with a non-policy chain. So we need to preserve
|
||||
# the policy attributes in the combined chain
|
||||
#
|
||||
if ( $chainref->{policychain} ) {
|
||||
@{$chainref1}{qw(policychain policy)} = @{$chainref}{qw(policychain policy)} unless $chainref1->{policychain};
|
||||
} elsif ( $chainref1->{policychain} ) {
|
||||
@{$chainref}{qw(policychain policy)} = @{$chainref1}{qw(policychain policy)} unless $chainref->{policychain};
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -4819,7 +4837,7 @@ sub do_proto( $$$;$ )
|
||||
$multiport = 1;
|
||||
} else {
|
||||
fatal_error "Missing DEST PORT" unless supplied $ports;
|
||||
$ports = validate_portpair $pname , $ports;
|
||||
$ports = validate_portpair $pname , $ports unless $ports =~ /^\$/;
|
||||
$output .= ( $srcndst ? "-m multiport ${invert}--ports ${ports} " : "${invert}--dport ${ports} " );
|
||||
}
|
||||
}
|
||||
@@ -5026,7 +5044,7 @@ sub do_iproto( $$$ )
|
||||
$multiport = 1;
|
||||
} else {
|
||||
fatal_error "Missing DEST PORT" unless supplied $ports;
|
||||
$ports = validate_portpair $pname , $ports;
|
||||
$ports = validate_portpair $pname , $ports unless $ports =~ /^\$/;
|
||||
|
||||
if ( $srcndst ) {
|
||||
push @output, multiport => "${invert}--ports ${ports}";
|
||||
@@ -6311,7 +6329,7 @@ sub match_dest_net( $;$ ) {
|
||||
return '-d ' . record_runtime_address $1, $2;
|
||||
}
|
||||
|
||||
$net = validate_net $net, 1;
|
||||
$net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
|
||||
$net eq ALLIP ? '' : "-d $net ";
|
||||
}
|
||||
|
||||
@@ -6392,7 +6410,7 @@ sub imatch_dest_net( $;$ ) {
|
||||
return ( d => record_runtime_address( $1, $2, 1 ) );
|
||||
}
|
||||
|
||||
$net = validate_net $net, 1;
|
||||
$net = validate_net $net, 1 unless $net =~ /^\$/; # Don't validate if runtime address variable
|
||||
$net eq ALLIP ? () : ( d => $net );
|
||||
}
|
||||
|
||||
@@ -7051,6 +7069,8 @@ sub interface_gateway( $ ) {
|
||||
sub get_interface_gateway ( $;$$ ) {
|
||||
my ( $logical, $protect, $provider ) = @_;
|
||||
|
||||
$provider = '' unless defined $provider;
|
||||
|
||||
my $interface = get_physical $logical;
|
||||
my $variable = interface_gateway( $interface );
|
||||
my $gateway = get_interface_option( $interface, 'gateway' );
|
||||
@@ -7064,9 +7084,9 @@ sub get_interface_gateway ( $;$$ ) {
|
||||
}
|
||||
|
||||
if ( interface_is_optional $logical ) {
|
||||
$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface));
|
||||
$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface $provider));
|
||||
} else {
|
||||
$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface)
|
||||
$interfacegateways{$interface} = qq([ -n "\$$variable" ] || $variable=\$(detect_gateway $interface $provider)
|
||||
[ -n "\$$variable" ] || startup_error "Unable to detect the gateway through interface $interface");
|
||||
}
|
||||
|
||||
@@ -7515,6 +7535,11 @@ sub isolate_dest_interface( $$$$ ) {
|
||||
|
||||
$rule .= "-d $variable ";
|
||||
}
|
||||
} elsif ( $dest =~ /^\$/ ) {
|
||||
#
|
||||
# Runtime address variable
|
||||
#
|
||||
$dnets = $dest;
|
||||
} elsif ( $family == F_IPV4 ) {
|
||||
if ( $dest =~ /^(.+?):(.+)$/ ) {
|
||||
$diface = $1;
|
||||
@@ -8438,6 +8463,7 @@ sub save_docker_rules($) {
|
||||
qq( $tool -t nat -S OUTPUT | tail -n +2 | fgrep DOCKER > \${VARDIR}/.nat_OUTPUT),
|
||||
qq( $tool -t nat -S POSTROUTING | tail -n +2 | fgrep -v SHOREWALL > \${VARDIR}/.nat_POSTROUTING),
|
||||
qq( $tool -t filter -S DOCKER | tail -n +2 > \${VARDIR}/.filter_DOCKER),
|
||||
qq( [ -n "\$g_dockeringress" ] && $tool -t filter -S DOCKER-INGRESS | tail -n +2 > \${VARDIR}/.filter_DOCKER-INGRESS),
|
||||
qq( [ -n "\$g_dockernetwork" ] && $tool -t filter -S DOCKER-ISOLATION | tail -n +2 > \${VARDIR}/.filter_DOCKER-ISOLATION)
|
||||
);
|
||||
|
||||
@@ -8453,6 +8479,7 @@ sub save_docker_rules($) {
|
||||
q( rm -f ${VARDIR}/.nat_OUTPUT),
|
||||
q( rm -f ${VARDIR}/.nat_POSTROUTING),
|
||||
q( rm -f ${VARDIR}/.filter_DOCKER),
|
||||
q( rm -f ${VARDIR}/.filter_DOCKER-INGRESS),
|
||||
q( rm -f ${VARDIR}/.filter_DOCKER-ISOLATION),
|
||||
q( rm -f ${VARDIR}/.filter_FORWARD),
|
||||
q(fi)
|
||||
@@ -8895,9 +8922,15 @@ sub create_netfilter_load( $ ) {
|
||||
my $UTILITY = $family == F_IPV4 ? 'IPTABLES_RESTORE' : 'IP6TABLES_RESTORE';
|
||||
|
||||
emit( '',
|
||||
'if [ "$COMMAND" = reload -a -n "$g_counters" ] && chain_exists $g_sha1sum1 && chain_exists $g_sha1sum2 ; then',
|
||||
' option="--counters"',
|
||||
'',
|
||||
'if [ "$COMMAND" = reload -a -n "$g_counters" ] && chain_exists $g_sha1sum1 && chain_exists $g_sha1sum2 ; then' );
|
||||
|
||||
if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
|
||||
emit( ' option="--counters --wait "' . $config{MUTEX_TIMEOUT} );
|
||||
} else {
|
||||
emit( ' option="--counters"' );
|
||||
}
|
||||
|
||||
emit( '',
|
||||
' progress_message "Reusing existing ruleset..."',
|
||||
'',
|
||||
'else'
|
||||
@@ -8905,7 +8938,11 @@ sub create_netfilter_load( $ ) {
|
||||
|
||||
push_indent;
|
||||
|
||||
if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
|
||||
emit 'option="--wait "' . $config{MUTEX_TIMEOUT};
|
||||
} else {
|
||||
emit 'option=';
|
||||
}
|
||||
|
||||
save_progress_message "Preparing $utility input...";
|
||||
|
||||
@@ -8954,6 +8991,10 @@ sub create_netfilter_load( $ ) {
|
||||
enter_cmd_mode;
|
||||
emit( '[ -n "$g_dockernetwork" ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
|
||||
enter_cat_mode;
|
||||
} elsif ( $name eq 'DOCKER-INGRESS' ) {
|
||||
enter_cmd_mode;
|
||||
emit( '[ -n "$g_dockeringress" ] && echo ":DOCKER-INGRESS - [0:0]" >&3' );
|
||||
enter_cat_mode;
|
||||
} else {
|
||||
emit_unindented ":$name - [0:0]";
|
||||
}
|
||||
@@ -9058,6 +9099,11 @@ sub preview_netfilter_load() {
|
||||
print( '[ -n "$g_dockernetwork" ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
|
||||
print "\n";
|
||||
enter_cat_mode1;
|
||||
} elsif ( $name eq 'DOCKER-INGRESS' ) {
|
||||
enter_cmd_mode1 unless $mode == CMD_MODE;
|
||||
print( '[ -n "$g_dockeringress" ] && echo ":DOCKER-INGRESS - [0:0]" >&3' );
|
||||
print "\n";
|
||||
enter_cat_mode1;
|
||||
} else {
|
||||
enter_cmd_mode1 unless $mode == CMD_MODE;
|
||||
print( ":$name - [0:0]\n" );
|
||||
@@ -9295,6 +9341,10 @@ sub create_stop_load( $ ) {
|
||||
enter_cmd_mode;
|
||||
emit( '[ -n "$g_dockernetwork" ] && echo ":DOCKER-ISOLATION - [0:0]" >&3' );
|
||||
enter_cat_mode;
|
||||
} elsif ( $name eq 'DOCKER-INGRESS' ) {
|
||||
enter_cmd_mode;
|
||||
emit( '[ -n "$g_dockeringress" ] && echo ":DOCKER-INGRESS - [0:0]" >&3' );
|
||||
enter_cat_mode;
|
||||
} else {
|
||||
emit_unindented ":$name - [0:0]";
|
||||
}
|
||||
@@ -9320,7 +9370,11 @@ sub create_stop_load( $ ) {
|
||||
|
||||
enter_cmd_mode;
|
||||
|
||||
if ( have_capability( 'RESTORE_WAIT_OPTION' ) ) {
|
||||
emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command="$' . $UTILITY . ' --wait ' . $config{MUTEX_TIMEOUT} . '"' );
|
||||
} else {
|
||||
emit( '[ -n "$g_debug_iptables" ] && command=debug_restore_input || command=$' . $UTILITY );
|
||||
}
|
||||
|
||||
emit( '',
|
||||
'progress_message2 "Running $command..."',
|
||||
|
@@ -109,7 +109,7 @@ sub generate_script_1( $ ) {
|
||||
################################################################################
|
||||
EOF
|
||||
|
||||
for my $exit ( qw/init start tcclear started stop stopped clear refresh refreshed restored/ ) {
|
||||
for my $exit ( qw/init start tcclear started stop stopped clear refresh refreshed restored enabled disabled/ ) {
|
||||
emit "\nrun_${exit}_exit() {";
|
||||
push_indent;
|
||||
append_file $exit or emit 'true';
|
||||
@@ -209,6 +209,8 @@ sub generate_script_2() {
|
||||
emit ( '[ -f ${g_confdir}/vardir ] && . ${g_confdir}/vardir' );
|
||||
emit ( qq([ -n "\${VARDIR:=$shorewallrc1{VARDIR}}" ]) );
|
||||
emit ( qq([ -n "\${VARLIB:=$shorewallrc1{VARLIB}}" ]) );
|
||||
emit ( qq([ -n "\${CONFDIR:=$shorewallrc1{CONFDIR}}" ]) );
|
||||
emit ( qq([ -n "\${SHAREDIR:=$shorewallrc1{SHAREDIR}}" ]) );
|
||||
|
||||
emit 'TEMPFILE=';
|
||||
|
||||
@@ -266,7 +268,8 @@ sub generate_script_2() {
|
||||
emit( '',
|
||||
'chain_exists DOCKER nat && chain_exists DOCKER && g_docker=Yes',
|
||||
);
|
||||
emit( 'chain_exists DOCKER-ISOLATION && g_dockernetwork=Yes]' );
|
||||
emit( 'chain_exists DOCKER-INGRESS && g_dockeringress=Yes' );
|
||||
emit( 'chain_exists DOCKER-ISOLATION && g_dockernetwork=Yes' );
|
||||
emit( '' );
|
||||
}
|
||||
|
||||
@@ -689,6 +692,7 @@ sub compiler {
|
||||
set_timestamp( $timestamp );
|
||||
set_debug( $debug , $confess );
|
||||
#
|
||||
# S H O R E W A L L R C ,
|
||||
# S H O R E W A L L . C O N F A N D C A P A B I L I T I E S
|
||||
#
|
||||
get_configuration( $export , $update , $annotate , $inline );
|
||||
@@ -793,13 +797,10 @@ sub compiler {
|
||||
emit '}'; # End of setup_common_rules()
|
||||
}
|
||||
|
||||
disable_script;
|
||||
#
|
||||
# R O U T I N G _ A N D _ T R A F F I C _ S H A P I N G
|
||||
# (Writes the setup_routing_and_traffic_shaping() function to the compiled script)
|
||||
#
|
||||
enable_script;
|
||||
#
|
||||
# Validate the TC files so that the providers will know what interfaces have TC
|
||||
#
|
||||
my $tcinterfaces = process_tc;
|
||||
|
@@ -36,11 +36,13 @@ use strict;
|
||||
use warnings;
|
||||
use File::Basename;
|
||||
use File::Temp qw/ tempfile tempdir /;
|
||||
use File::Glob ':globally';
|
||||
use Cwd qw(abs_path getcwd);
|
||||
use autouse 'Carp' => qw(longmess confess);
|
||||
use Scalar::Util 'reftype';
|
||||
use FindBin;
|
||||
use Digest::SHA qw(sha1_hex);
|
||||
use Errno qw(:POSIX);
|
||||
|
||||
our @ISA = qw(Exporter);
|
||||
#
|
||||
@@ -315,7 +317,7 @@ our %renamed = ( AUTO_COMMENT => 'AUTOCOMMENT', BLACKLIST_LOGLEVEL => 'BLACKLIST
|
||||
#
|
||||
# Config options and global settings that are to be copied to output script
|
||||
#
|
||||
our @propagateconfig = qw/ DISABLE_IPV6 MODULESDIR MODULE_SUFFIX LOAD_HELPERS_ONLY LOCKFILE SUBSYSLOCK LOG_VERBOSITY RESTART/;
|
||||
our @propagateconfig = qw/ DISABLE_IPV6 MODULESDIR LOAD_HELPERS_ONLY LOCKFILE SUBSYSLOCK LOG_VERBOSITY RESTART/;
|
||||
#
|
||||
# From parsing the capabilities file or detecting capabilities
|
||||
#
|
||||
@@ -413,7 +415,9 @@ our %capdesc = ( NAT_ENABLED => 'NAT',
|
||||
WAIT_OPTION => 'iptables --wait option',
|
||||
CPU_FANOUT => 'NFQUEUE CPU Fanout',
|
||||
NETMAP_TARGET => 'NETMAP Target',
|
||||
|
||||
NFLOG_SIZE => '--nflog-size support',
|
||||
RESTORE_WAIT_OPTION
|
||||
=> 'iptables-restore --wait option',
|
||||
AMANDA_HELPER => 'Amanda Helper',
|
||||
FTP_HELPER => 'FTP Helper',
|
||||
FTP0_HELPER => 'FTP-0 Helper',
|
||||
@@ -646,6 +650,7 @@ our %eliminated = ( LOGRATE => 1,
|
||||
HIGH_ROUTE_MARKS => 1,
|
||||
BLACKLISTNEWONLY => 1,
|
||||
CHAIN_SCRIPTS => 1,
|
||||
MODULE_SUFFIX => 1,
|
||||
);
|
||||
#
|
||||
# Variables involved in ?IF, ?ELSE ?ENDIF processing
|
||||
@@ -750,8 +755,8 @@ sub initialize( $;$$) {
|
||||
TC_SCRIPT => '',
|
||||
EXPORT => 0,
|
||||
KLUDGEFREE => '',
|
||||
VERSION => "5.1.4-Beta1",
|
||||
CAPVERSION => 50100 ,
|
||||
VERSION => "5.1.8-Beta1",
|
||||
CAPVERSION => 50106 ,
|
||||
BLACKLIST_LOG_TAG => '',
|
||||
RELATED_LOG_TAG => '',
|
||||
MACLIST_LOG_TAG => '',
|
||||
@@ -846,7 +851,6 @@ sub initialize( $;$$) {
|
||||
BLACKLIST => undef,
|
||||
BLACKLISTNEWONLY => undef,
|
||||
DELAYBLACKLISTLOAD => undef,
|
||||
MODULE_SUFFIX => undef,
|
||||
DISABLE_IPV6 => undef,
|
||||
DYNAMIC_ZONES => undef,
|
||||
PKTTYPE=> undef,
|
||||
@@ -910,6 +914,7 @@ sub initialize( $;$$) {
|
||||
FIREWALL => undef ,
|
||||
BALANCE_PROVIDERS => undef ,
|
||||
PERL_HASH_SEED => undef ,
|
||||
USE_NFLOG_SIZE => undef ,
|
||||
#
|
||||
# Packet Disposition
|
||||
#
|
||||
@@ -1005,7 +1010,7 @@ sub initialize( $;$$) {
|
||||
CONNLIMIT_MATCH => undef,
|
||||
TIME_MATCH => undef,
|
||||
GOTO_TARGET => undef,
|
||||
LOG_TARGET => 1, # Assume that we have it.
|
||||
LOG_TARGET => undef,
|
||||
ULOG_TARGET => undef,
|
||||
NFLOG_TARGET => undef,
|
||||
LOGMARK_TARGET => undef,
|
||||
@@ -1043,6 +1048,8 @@ sub initialize( $;$$) {
|
||||
WAIT_OPTION => undef,
|
||||
CPU_FANOUT => undef,
|
||||
NETMAP_TARGET => undef,
|
||||
NFLOG_SIZE => undef,
|
||||
RESTORE_WAIT_OPTION => undef,
|
||||
|
||||
AMANDA_HELPER => undef,
|
||||
FTP_HELPER => undef,
|
||||
@@ -1987,6 +1994,7 @@ sub find_file($)
|
||||
for my $directory ( @config_path ) {
|
||||
my $file = "$directory$filename";
|
||||
return $file if -f $file;
|
||||
$!{ENOENT} || fatal_error "Unable to access $file: " . $!;
|
||||
}
|
||||
|
||||
"$config_path[0]$filename";
|
||||
@@ -2341,7 +2349,7 @@ sub split_line2( $$;$$$ ) {
|
||||
|
||||
$inline_matches = $pairs;
|
||||
|
||||
if ( $columns =~ /^(\s*|.*[^&@%]){(.*)}\s*$/ ) {
|
||||
if ( $columns =~ /^(\s*|.*[^&@%])\{(.*)\}\s*$/ ) {
|
||||
#
|
||||
# Pairs are enclosed in curly brackets.
|
||||
#
|
||||
@@ -2357,7 +2365,7 @@ sub split_line2( $$;$$$ ) {
|
||||
if ( $currline =~ /^\s*INLINE(?:\(.*\)(:.*)?|:.*)?\s/ || $currline =~ /^\s*IP6?TABLES(?:\(.*\)|:.*)?\s/ ) {
|
||||
$inline_matches = $pairs;
|
||||
|
||||
if ( $columns =~ /^(\s*|.*[^&@%]){(.*)}\s*$/ ) {
|
||||
if ( $columns =~ /^(\s*|.*[^&@%])\{(.*)\}\s*$/ ) {
|
||||
#
|
||||
# Pairs are enclosed in curly brackets.
|
||||
#
|
||||
@@ -2371,7 +2379,7 @@ sub split_line2( $$;$$$ ) {
|
||||
} elsif ( $checkinline ) {
|
||||
warning_message "This entry needs to be changed before INLINE_MATCHES can be set to Yes";
|
||||
}
|
||||
} elsif ( $currline =~ /^(\s*|.*[^&@%]){(.*)}$/ ) {
|
||||
} elsif ( $currline =~ /^(\s*|.*[^&@%])\{(.*)\}$/ ) {
|
||||
#
|
||||
# Pairs are enclosed in curly brackets.
|
||||
#
|
||||
@@ -2569,7 +2577,7 @@ sub open_file( $;$$$$ ) {
|
||||
$max_format = supplied $mf ? $mf : 1;
|
||||
$comments_allowed = supplied $ca ? $ca : 0;
|
||||
$nocomment = $nc;
|
||||
do_open_file $fname;;
|
||||
do_open_file $fname;
|
||||
} else {
|
||||
$ifstack = @ifstack;
|
||||
'';
|
||||
@@ -4046,7 +4054,7 @@ sub make_mask( $ ) {
|
||||
0xffffffff >> ( 32 - $_[0] );
|
||||
}
|
||||
|
||||
my @suffixes = qw(group range threshold nlgroup cprange qthreshold);
|
||||
my @suffixes;
|
||||
|
||||
#
|
||||
# Validate a log level -- Drop the trailing '!' and translate to numeric value if appropriate"
|
||||
@@ -4282,7 +4290,7 @@ sub which( $ ) {
|
||||
# Load the kernel modules defined in the 'modules' file.
|
||||
#
|
||||
sub load_kernel_modules( ) {
|
||||
my $moduleloader = which( 'modprobe' ) || ( which 'insmod' );
|
||||
my $moduleloader = which( 'modprobe' ) || which( 'insmod' );
|
||||
|
||||
my $modulesdir = $config{MODULESDIR};
|
||||
|
||||
@@ -4315,25 +4323,20 @@ sub load_kernel_modules( ) {
|
||||
|
||||
close LSMOD;
|
||||
|
||||
$config{MODULE_SUFFIX} = 'o gz xz ko o.gz o.xz ko.gz ko.xz' unless $config{MODULE_SUFFIX};
|
||||
|
||||
my @suffixes = split /\s+/ , $config{MODULE_SUFFIX};
|
||||
|
||||
MODULE:
|
||||
while ( read_a_line( NORMAL_READ ) ) {
|
||||
fatal_error "Invalid modules file entry" unless ( $currentline =~ /^loadmodule\s+([a-zA-Z]\w*)\s*(.*)$/ );
|
||||
my ( $module, $arguments ) = ( $1, $2 );
|
||||
unless ( $loadedmodules{ $module } ) {
|
||||
for my $directory ( @moduledirectories ) {
|
||||
for my $suffix ( @suffixes ) {
|
||||
my $modulefile = "$directory/$module.$suffix";
|
||||
if ( -f $modulefile ) {
|
||||
if ( $moduleloader eq 'insmod' ) {
|
||||
system ("insmod $modulefile $arguments" );
|
||||
} else {
|
||||
system( "modprobe $module $arguments" );
|
||||
}
|
||||
|
||||
if ( $moduleloader =~ /modprobe$/ ) {
|
||||
system( "modprobe -q $module $arguments" );
|
||||
$loadedmodules{ $module } = 1;
|
||||
} else {
|
||||
for my $directory ( @moduledirectories ) {
|
||||
for my $modulefile ( <$directory/$module.*> ) {
|
||||
system ("insmod $modulefile $arguments" );
|
||||
$loadedmodules{ $module } = 1;
|
||||
next MODULE;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -4818,6 +4821,10 @@ sub NFLog_Target() {
|
||||
qt1( "$iptables $iptablesw -A $sillyname -j NFLOG" );
|
||||
}
|
||||
|
||||
sub NFLog_Size() {
|
||||
have_capability( 'NFLOG_TARGET' ) && qt1( "$iptables $iptablesw -A $sillyname -j NFLOG --nflog-size 64" );
|
||||
}
|
||||
|
||||
sub Logmark_Target() {
|
||||
qt1( "$iptables $iptablesw -A $sillyname -j LOGMARK" );
|
||||
}
|
||||
@@ -4941,6 +4948,10 @@ sub Cpu_Fanout() {
|
||||
have_capability( 'NFQUEUE_TARGET' ) && qt1( "$iptables -A $sillyname -j NFQUEUE --queue-balance 0:3 --queue-cpu-fanout" );
|
||||
}
|
||||
|
||||
sub Restore_Wait_Option() {
|
||||
length( `${iptables}-restore --wait < /dev/null 2>&1` ) == 0;
|
||||
}
|
||||
|
||||
our %detect_capability =
|
||||
( ACCOUNT_TARGET =>\&Account_Target,
|
||||
AMANDA_HELPER => \&Amanda_Helper,
|
||||
@@ -4993,6 +5004,7 @@ our %detect_capability =
|
||||
LOG_TARGET => \&Log_Target,
|
||||
ULOG_TARGET => \&Ulog_Target,
|
||||
NFLOG_TARGET => \&NFLog_Target,
|
||||
NFLOG_SIZE => \&NFLog_Size,
|
||||
MANGLE_ENABLED => \&Mangle_Enabled,
|
||||
MANGLE_FORWARD => \&Mangle_Forward,
|
||||
MARK => \&Mark,
|
||||
@@ -5020,6 +5032,7 @@ our %detect_capability =
|
||||
REALM_MATCH => \&Realm_Match,
|
||||
REAP_OPTION => \&Reap_Option,
|
||||
RECENT_MATCH => \&Recent_Match,
|
||||
RESTORE_WAIT_OPTION => \&Restore_Wait_Option,
|
||||
RPFILTER_MATCH => \&RPFilter_Match,
|
||||
SANE_HELPER => \&SANE_Helper,
|
||||
SANE0_HELPER => \&SANE0_Helper,
|
||||
@@ -5186,6 +5199,9 @@ sub determine_capabilities() {
|
||||
$capabilities{TCPMSS_TARGET} = detect_capability( 'TCPMSS_TARGET' );
|
||||
$capabilities{CPU_FANOUT} = detect_capability( 'CPU_FANOUT' );
|
||||
$capabilities{NETMAP_TARGET} = detect_capability( 'NETMAP_TARGET' );
|
||||
$capabilities{NFLOG_SIZE} = detect_capability( 'NFLOG_SIZE' );
|
||||
$capabilities{RESTORE_WAIT_OPTION}
|
||||
= detect_capability( 'RESTORE_WAIT_OPTION' );
|
||||
|
||||
unless ( have_capability 'CT_TARGET' ) {
|
||||
$capabilities{HELPER_MATCH} = detect_capability 'HELPER_MATCH';
|
||||
@@ -6052,7 +6068,6 @@ sub get_configuration( $$$$ ) {
|
||||
#
|
||||
# get_capabilities requires that the true settings of these options be established
|
||||
#
|
||||
default 'MODULE_PREFIX', 'ko ko.gz o o.gz gz';
|
||||
default_yes_no 'LOAD_HELPERS_ONLY' , 'Yes';
|
||||
|
||||
if ( ! $export && $> == 0 ) {
|
||||
@@ -6238,7 +6253,7 @@ sub get_configuration( $$$$ ) {
|
||||
$config{LOG_VERBOSITY} = -1;
|
||||
}
|
||||
|
||||
default_yes_no 'ADD_IP_ALIASES' , 'Yes';
|
||||
default_yes_no 'ADD_IP_ALIASES' , $family == F_IPV4 ? 'Yes' : '';
|
||||
default_yes_no 'ADD_SNAT_ALIASES' , '';
|
||||
default_yes_no 'DETECT_DNAT_IPADDRS' , '';
|
||||
default_yes_no 'DETECT_DNAT_IPADDRS' , '';
|
||||
@@ -6393,6 +6408,17 @@ sub get_configuration( $$$$ ) {
|
||||
default_yes_no 'AUTOMAKE' , '';
|
||||
default_yes_no 'TRACK_PROVIDERS' , '';
|
||||
default_yes_no 'BALANCE_PROVIDERS' , $config{USE_DEFAULT_RT} ? 'Yes' : '';
|
||||
default_yes_no 'USE_NFLOG_SIZE' , '';
|
||||
|
||||
if ( $config{USE_NFLOG_SIZE} ) {
|
||||
if ( have_capability( 'NFLOG_SIZE' ) ) {
|
||||
@suffixes = qw(group size threshold nlgroup cprange qthreshold);
|
||||
} else {
|
||||
fatal_error "USE_NFLOG_SIZE=Yes, but the --nflog-size capabiity is not present";
|
||||
}
|
||||
} else {
|
||||
@suffixes = qw(group range threshold nlgroup cprange qthreshold);
|
||||
}
|
||||
|
||||
unless ( ( $config{NULL_ROUTE_RFC1918} || '' ) =~ /^(?:blackhole|unreachable|prohibit)$/ ) {
|
||||
default_yes_no( 'NULL_ROUTE_RFC1918', '' );
|
||||
@@ -6813,6 +6839,12 @@ sub get_configuration( $$$$ ) {
|
||||
}
|
||||
}
|
||||
|
||||
if ( supplied( $val = $config{MUTEX_TIMEOUT} ) ) {
|
||||
fatal_error "Invalid value ($val) for MUTEX_TIMEOUT" unless $val && $val =~ /^\d+$/;
|
||||
} else {
|
||||
$config{MUTEX_TIMEOUT} = 60;
|
||||
}
|
||||
|
||||
add_variables %config;
|
||||
|
||||
while ( my ($var, $val ) = each %renamed ) {
|
||||
|
@@ -667,6 +667,7 @@ sub create_docker_rules() {
|
||||
|
||||
my $chainref = $filter_table->{FORWARD};
|
||||
|
||||
add_commands( $chainref, '[ -n "$g_dockeringress" ] && echo "-A FORWARD -j DOCKER-INGRESS" >&3', );
|
||||
add_commands( $chainref, '[ -n "$g_dockernetwork" ] && echo "-A FORWARD -j DOCKER-ISOLATION" >&3', );
|
||||
|
||||
if ( my $dockerref = known_interface('docker0') ) {
|
||||
|
@@ -941,7 +941,17 @@ sub handle_nat_rule( $$$$$$$$$$$$$ ) {
|
||||
} else {
|
||||
$server = $1 if $family == F_IPV6 && $server =~ /^\[(.+)\]$/;
|
||||
fatal_error "Invalid server IP address ($server)" if $server eq ALLIP || $server eq NILIP;
|
||||
my @servers = validate_address $server, 1;
|
||||
|
||||
my @servers;
|
||||
|
||||
if ( ( $server =~ /^([&%])(.+)/ ) ) {
|
||||
$server = record_runtime_address( $1, $2 );
|
||||
$server =~ s/ $//;
|
||||
@servers = ( $server );
|
||||
} else {
|
||||
@servers = validate_address $server, 1;
|
||||
}
|
||||
|
||||
$server = join ',', @servers;
|
||||
}
|
||||
|
||||
|
@@ -357,7 +357,7 @@ sub balance_fallback_route( $$$$ ) {
|
||||
emit '';
|
||||
|
||||
if ( $first_fallback_route ) {
|
||||
if ( $balanced_providers == 1 ) {
|
||||
if ( $fallback_providers == 1 ) {
|
||||
if ( $gateway ) {
|
||||
emit "FALLBACK_ROUTE=\"via $gateway dev $interface $realm\"";
|
||||
} else {
|
||||
@@ -502,7 +502,7 @@ sub process_a_provider( $ ) {
|
||||
|
||||
if ( ( $gw = lc $gateway ) eq 'detect' ) {
|
||||
fatal_error "Configuring multiple providers through one interface requires an explicit gateway" if $shared;
|
||||
$gateway = get_interface_gateway( $interface, undef, 1 );
|
||||
$gateway = get_interface_gateway( $interface, undef, $number );
|
||||
$gatewaycase = 'detect';
|
||||
set_interface_option( $interface, 'gateway', 'detect' );
|
||||
} elsif ( $gw eq 'none' ) {
|
||||
@@ -602,6 +602,7 @@ sub process_a_provider( $ ) {
|
||||
} elsif ( $option eq 'nohostroute' ) {
|
||||
$hostroute = 0;
|
||||
} elsif ( $option eq 'persistent' ) {
|
||||
warning_message "When RESTORE_DEFAULT_ROUTE=Yes, the 'persistent' option may not work as expected" if $config{RESTORE_DEFAULT_ROUTE};
|
||||
$persistent = 1;
|
||||
} else {
|
||||
fatal_error "Invalid option ($option)";
|
||||
@@ -847,7 +848,7 @@ sub add_a_provider( $$ ) {
|
||||
if ( $tproxy ) {
|
||||
emit 'run_ip route add local ' . ALLIP . " dev $physical table $id";
|
||||
} else {
|
||||
emit "run_ip route add default dev $physical table $id";
|
||||
emit "run_ip route replace default dev $physical table $id";
|
||||
}
|
||||
}
|
||||
|
||||
@@ -863,7 +864,7 @@ sub add_a_provider( $$ ) {
|
||||
emit qq(echo "\$IP route del $gateway src $address dev $physical ${mtu}table $id $realm > /dev/null 2>&1" >> \${VARDIR}/undo_${table}_routing);
|
||||
}
|
||||
|
||||
emit( "run_ip route add default via $gateway src $address dev $physical ${mtu}table $id $realm" );
|
||||
emit( "run_ip route replace default via $gateway src $address dev $physical ${mtu}table $id $realm" );
|
||||
emit( qq( echo "\$IP route del default via $gateway src $address dev $physical ${mtu}table $id $realm > /dev/null 2>&1" >> \${VARDIR}/undo_${table}_routing) );
|
||||
}
|
||||
|
||||
@@ -873,9 +874,9 @@ sub add_a_provider( $$ ) {
|
||||
emit( "run_ip rule add from $address pref 20000 table $id" ,
|
||||
"echo \"\$IP -$family rule del from $address pref 20000> /dev/null 2>&1\" >> \${VARDIR}/undo_${table}_routing" );
|
||||
} else {
|
||||
emit ( "find_interface_addresses $physical | while read address; do" );
|
||||
emit ( " qt \$IP -$family rule del from \$address" );
|
||||
emit ( " run_ip rule add from \$address pref 20000 table $id",
|
||||
emit ( "find_interface_addresses $physical | while read address; do",
|
||||
" qt \$IP -$family rule del from \$address",
|
||||
" run_ip rule add from \$address pref 20000 table $id",
|
||||
" echo \"\$IP -$family rule del from \$address pref 20000 > /dev/null 2>&1\" >> \${VARDIR}/undo_${table}_routing",
|
||||
' rulenum=$(($rulenum + 1))',
|
||||
'done'
|
||||
@@ -898,7 +899,6 @@ sub add_a_provider( $$ ) {
|
||||
emit( qq(fi\n),
|
||||
qq(echo 1 > \${VARDIR}/${physical}_disabled) );
|
||||
|
||||
|
||||
pop_indent;
|
||||
|
||||
emit( "}\n" );
|
||||
@@ -924,7 +924,7 @@ sub add_a_provider( $$ ) {
|
||||
if ( $tproxy ) {
|
||||
emit 'run_ip route add local ' . ALLIP . " dev $physical table $id";
|
||||
} else {
|
||||
emit "run_ip route add default dev $physical table $id";
|
||||
emit "run_ip route replace default dev $physical table $id";
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -956,7 +956,7 @@ CEOF
|
||||
my $hexmark = in_hex( $mark );
|
||||
my $mask = have_capability( 'FWMARK_RT_MASK' ) ? '/' . in_hex( $globals{ $tproxy && ! $local ? 'TPROXY_MARK' : 'PROVIDER_MASK' } ) : '';
|
||||
|
||||
emit ( "qt \$IP -$family rule del fwmark ${hexmark}${mask}" ) if $config{DELETE_THEN_ADD};
|
||||
emit ( "qt \$IP -$family rule del fwmark ${hexmark}${mask}" ) if $persistent || $config{DELETE_THEN_ADD};
|
||||
|
||||
emit ( "run_ip rule add fwmark ${hexmark}${mask} pref $pref table $id",
|
||||
"echo \"\$IP -$family rule del fwmark ${hexmark}${mask} > /dev/null 2>&1\" >> \${VARDIR}/undo_${table}_routing"
|
||||
@@ -985,7 +985,7 @@ CEOF
|
||||
emit qq(run_ip route replace $gateway src $address dev $physical ${mtu}table $id $realm);
|
||||
}
|
||||
|
||||
emit "run_ip route add default via $gateway src $address dev $physical ${mtu}table $id $realm";
|
||||
emit "run_ip route replace default via $gateway src $address dev $physical ${mtu}table $id $realm";
|
||||
}
|
||||
|
||||
if ( $balance ) {
|
||||
@@ -997,14 +997,16 @@ CEOF
|
||||
emit '';
|
||||
if ( $gateway ) {
|
||||
emit qq(run_ip route replace $gateway/32 dev $physical table $id) if $hostroute;
|
||||
emit qq(run_ip route add default via $gateway src $address dev $physical table $id metric $number);
|
||||
emit qq(run_ip route replace default via $gateway src $address dev $physical table $id metric $number);
|
||||
emit qq(echo "\$IP -$family route del default via $gateway table $id > /dev/null 2>&1" >> \${VARDIR}/undo_${table}_routing);
|
||||
emit qq(echo "\$IP -4 route del $gateway/32 dev $physical table $id > /dev/null 2>&1" >> \${VARDIR}/undo_${table}_routing) if $family == F_IPV4;
|
||||
} else {
|
||||
emit qq(run_ip route add default table $id dev $physical metric $number);
|
||||
emit qq(run_ip route replace default table $id dev $physical metric $number);
|
||||
emit qq(echo "\$IP -$family route del default dev $physical table $id > /dev/null 2>&1" >> \${VARDIR}/undo_${table}_routing);
|
||||
}
|
||||
|
||||
emit( 'g_fallback=Yes' ) if $persistent;
|
||||
|
||||
$metrics = 1;
|
||||
}
|
||||
|
||||
@@ -1026,12 +1028,13 @@ CEOF
|
||||
} elsif ( ! $noautosrc ) {
|
||||
if ( $shared ) {
|
||||
if ( $persistent ) {
|
||||
emit( qq(if ! egrep -q "^2000:[[:space:]]+from $address lookup $id"; then),
|
||||
emit( qq(if ! egrep -q "^20000:[[:space:]]+from $address lookup $id"; then),
|
||||
qq( qt \$IP -$family rule del from $address pref 20000),
|
||||
qq( run_ip rule add from $address pref 20000 table $id),
|
||||
qq( echo "\$IP -$family rule del from $address pref 20000> /dev/null 2>&1" >> \${VARDIR}/undo_${table}_routing ),
|
||||
qq(fi) );
|
||||
} else {
|
||||
emit "qt \$IP -$family rule del from $address" if $config{DELETE_THEN_ADD};
|
||||
emit "qt \$IP -$family rule del from $address" if $persistent || $config{DELETE_THEN_ADD};
|
||||
emit( "run_ip rule add from $address pref 20000 table $id" ,
|
||||
"echo \"\$IP -$family rule del from $address pref 20000> /dev/null 2>&1\" >> \${VARDIR}/undo_${table}_routing" );
|
||||
}
|
||||
@@ -1088,7 +1091,21 @@ CEOF
|
||||
emit( "setup_${dev}_tc" ) if $tcdevices->{$interface};
|
||||
}
|
||||
|
||||
emit( qq(rm -f \${VARDIR}/${physical}_disabled) );
|
||||
emit( qq(rm -f \${VARDIR}/${physical}_disabled),
|
||||
$pseudo ? "run_enabled_exit ${physical} ${interface}" : "run_enabled_exit ${physical} ${interface} ${table}"
|
||||
);
|
||||
|
||||
if ( ! $pseudo && $config{USE_DEFAULT_RT} && $config{RESTORE_DEFAULT_ROUTE} ) {
|
||||
emit ( '#',
|
||||
'# We now have a viable default route in the \'default\' table so delete any default routes in the main table',
|
||||
'#',
|
||||
'while qt \$IP -$family route del default table ' . MAIN_TABLE . '; do',
|
||||
' true',
|
||||
'done',
|
||||
''
|
||||
);
|
||||
}
|
||||
|
||||
emit_started_message( '', 2, $pseudo, $table, $number );
|
||||
|
||||
if ( get_interface_option( $interface, 'used_address_variable' ) || get_interface_option( $interface, 'used_gateway_variable' ) ) {
|
||||
@@ -1233,12 +1250,14 @@ CEOF
|
||||
"qt \$TC qdisc del dev $physical ingress\n" ) if $tcdevices->{$interface};
|
||||
}
|
||||
|
||||
emit( "echo 1 > \${VARDIR}/${physical}.status" );
|
||||
emit( "echo 1 > \${VARDIR}/${physical}.status",
|
||||
$pseudo ? "run_disabled_exit ${physical} ${interface}" : "run_disabled_exit ${physical} ${interface} ${table}"
|
||||
);
|
||||
|
||||
if ( $pseudo ) {
|
||||
emit( "progress_message2 \" Optional Interface $table stopped\"" );
|
||||
emit( "progress_message2 \"Optional Interface $table stopped\"" );
|
||||
} else {
|
||||
emit( "progress_message2 \" Provider $table ($number) stopped\"" );
|
||||
emit( "progress_message2 \"Provider $table ($number) stopped\"" );
|
||||
}
|
||||
|
||||
pop_indent;
|
||||
@@ -1339,7 +1358,7 @@ sub add_an_rtrule1( $$$$$ ) {
|
||||
|
||||
$priority = "pref $priority";
|
||||
|
||||
push @{$providerref->{rules}}, "qt \$IP -$family rule del $source ${dest}${mark} $priority" if $config{DELETE_THEN_ADD};
|
||||
push @{$providerref->{rules}}, "qt \$IP -$family rule del $source ${dest}${mark} $priority" if $persistent || $config{DELETE_THEN_ADD};
|
||||
push @{$providerref->{rules}}, "run_ip rule add $source ${dest}${mark} $priority table $id";
|
||||
|
||||
if ( $persistent ) {
|
||||
@@ -1437,22 +1456,22 @@ sub add_a_route( ) {
|
||||
|
||||
if ( $gateway ne '-' ) {
|
||||
if ( $device ne '-' ) {
|
||||
push @$routes, qq(run_ip route add $dest via $gateway dev $physical table $id);
|
||||
push @$persistent_routes, qq(run_ip route add $dest via $gateway dev $physical table $id) if $persistent;
|
||||
push @$routes, qq(run_ip route replace $dest via $gateway dev $physical table $id);
|
||||
push @$persistent_routes, qq(run_ip route replace $dest via $gateway dev $physical table $id) if $persistent;
|
||||
push @$routes, q(echo "$IP ) . qq(-$family route del $dest via $gateway dev $physical table $id > /dev/null 2>&1" >> \${VARDIR}/undo_${provider}_routing) if $number >= DEFAULT_TABLE;
|
||||
} elsif ( $null ) {
|
||||
push @$routes, qq(run_ip route add $null $dest table $id);
|
||||
push @$persistent_routes, qq(run_ip route add $null $dest table $id) if $persistent;
|
||||
push @$routes, qq(run_ip route replace $null $dest table $id);
|
||||
push @$persistent_routes, qq(run_ip route replace $null $dest table $id) if $persistent;
|
||||
push @$routes, q(echo "$IP ) . qq(-$family route del $null $dest table $id > /dev/null 2>&1" >> \${VARDIR}/undo_${provider}_routing) if $number >= DEFAULT_TABLE;
|
||||
} else {
|
||||
push @$routes, qq(run_ip route add $dest via $gateway table $id);
|
||||
push @$persistent_routes, qq(run_ip route add $dest via $gateway table $id) if $persistent;
|
||||
push @$routes, qq(run_ip route replace $dest via $gateway table $id);
|
||||
push @$persistent_routes, qq(run_ip route replace $dest via $gateway table $id) if $persistent;
|
||||
push @$routes, q(echo "$IP ) . qq(-$family route del $dest via $gateway table $id > /dev/null 2>&1" >> \${VARDIR}/undo_${provider}_routing) if $number >= DEFAULT_TABLE;
|
||||
}
|
||||
} else {
|
||||
fatal_error "You must specify a device for this route" unless $physical;
|
||||
push @$routes, qq(run_ip route add $dest dev $physical table $id);
|
||||
push @$persistent_routes, qq(run_ip route add $dest dev $physical table $id) if $persistent;
|
||||
push @$routes, qq(run_ip route replace $dest dev $physical table $id);
|
||||
push @$persistent_routes, qq(run_ip route replace $dest dev $physical table $id) if $persistent;
|
||||
push @$routes, q(echo "$IP ) . qq(-$family route del $dest dev $physical table $id > /dev/null 2>&1" >> \${VARDIR}/undo_${provider}_routing) if $number >= DEFAULT_TABLE;
|
||||
}
|
||||
|
||||
@@ -1575,7 +1594,7 @@ sub finish_providers() {
|
||||
' error_message "WARNING: No Default route added (all \'balance\' providers are down)"' );
|
||||
|
||||
if ( $config{RESTORE_DEFAULT_ROUTE} ) {
|
||||
emit qq( restore_default_route $config{USE_DEFAULT_RT} && error_message "NOTICE: Default route restored")
|
||||
emit qq( [ -z "\${FALLBACK_ROUTE}\${g_fallback}" ] && restore_default_route $config{USE_DEFAULT_RT} && error_message "NOTICE: Default route restored")
|
||||
} else {
|
||||
emit qq( qt \$IP -$family route del default table $table && error_message "WARNING: Default route deleted from table $table");
|
||||
}
|
||||
@@ -1602,7 +1621,7 @@ sub finish_providers() {
|
||||
}
|
||||
|
||||
emit ( '#',
|
||||
'# Delete any routes in the \'balance\' table',
|
||||
'# Delete any default routes with metric 0 in the \'balance\' table',
|
||||
'#',
|
||||
"while qt \$IP -$family route del default table $balance; do",
|
||||
' true',
|
||||
@@ -1630,7 +1649,10 @@ sub finish_providers() {
|
||||
'fi',
|
||||
'' );
|
||||
} elsif ( $config{USE_DEFAULT_RT} ) {
|
||||
emit( "delete_default_routes $default",
|
||||
emit( '#',
|
||||
'# No balanced fallback routes - delete any routes with metric 0 from the \'default\' table',
|
||||
'#',
|
||||
"delete_default_routes $default",
|
||||
''
|
||||
);
|
||||
}
|
||||
|
@@ -216,6 +216,10 @@ our %statetable;
|
||||
# Tracks which of the state match actions (action.Invalid, etc.) that is currently being expanded
|
||||
#
|
||||
our $statematch;
|
||||
#
|
||||
# Remembers NAT-oriented columns from top-level action invocations
|
||||
#
|
||||
our %nat_columns;
|
||||
|
||||
#
|
||||
# Action/Inline options
|
||||
@@ -384,6 +388,8 @@ sub initialize( $ ) {
|
||||
);
|
||||
}
|
||||
|
||||
%nat_columns = ( dest => '-', proto => '-', ports => '-' );
|
||||
|
||||
############################################################################
|
||||
# Initialize variables moved from the Tc module in Shorewall 5.0.7 #
|
||||
############################################################################
|
||||
@@ -1652,6 +1658,19 @@ sub merge_inline_source_dest( $$ ) {
|
||||
$body || '';
|
||||
}
|
||||
|
||||
#
|
||||
# This one is used by perl_action_helper()
|
||||
#
|
||||
sub merge_action_column( $$ ) {
|
||||
my ( $body, $invocation ) = @_;
|
||||
|
||||
if ( supplied( $body ) && $body ne '-' ) {
|
||||
$body;
|
||||
} else {
|
||||
$invocation;
|
||||
}
|
||||
}
|
||||
|
||||
sub merge_macro_column( $$ ) {
|
||||
my ( $body, $invocation ) = @_;
|
||||
|
||||
@@ -2510,6 +2529,8 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
my $exceptionrule = '';
|
||||
my $usergenerated;
|
||||
my $prerule = '';
|
||||
my %save_nat_columns = %nat_columns;
|
||||
my $generated = 0;
|
||||
#
|
||||
# Subroutine for handling MARK and CONNMARK.
|
||||
#
|
||||
@@ -2591,7 +2612,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
|
||||
$current_param = $param unless $param eq '' || $param eq 'PARAM';
|
||||
|
||||
my $generated = process_macro( $basictarget,
|
||||
$generated = process_macro( $basictarget,
|
||||
$chainref,
|
||||
$rule . $raw_matches,
|
||||
$matches1,
|
||||
@@ -2614,9 +2635,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
$wildcard );
|
||||
|
||||
$macro_nest_level--;
|
||||
|
||||
return $generated;
|
||||
|
||||
goto EXIT;
|
||||
} elsif ( $actiontype & NFQ ) {
|
||||
$action = handle_nfqueue( $param,
|
||||
1 # Allow 'bypass'
|
||||
@@ -2688,6 +2707,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
|
||||
REDIRECT => sub () {
|
||||
my $z = $actiontype & NATONLY ? '' : firewall_zone;
|
||||
|
||||
if ( $dest eq '-' ) {
|
||||
if ( $family == F_IPV4 ) {
|
||||
$dest = ( $inchain ) ? '' : join( '', $z, '::' , $ports =~ /[:,]/ ? '' : $ports );
|
||||
@@ -2816,6 +2836,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#
|
||||
# Isolate and validate source and destination zones
|
||||
#
|
||||
@@ -2909,7 +2930,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
#
|
||||
if ( $destref->{type} & BPORT ) {
|
||||
unless ( $sourceref->{bridge} eq $destref->{bridge} || single_interface( $sourcezone ) eq $destref->{bridge} ) {
|
||||
return 0 if $wildcard;
|
||||
goto EXIT if $wildcard;
|
||||
fatal_error "Rules with a DESTINATION Bridge Port zone must have a SOURCE zone on the same bridge";
|
||||
}
|
||||
}
|
||||
@@ -2924,7 +2945,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
my $policy = $chainref->{policy};
|
||||
|
||||
if ( $policy eq 'NONE' ) {
|
||||
return 0 if $wildcard;
|
||||
goto EXIT if $wildcard;
|
||||
fatal_error "Rules may not override a NONE policy";
|
||||
}
|
||||
#
|
||||
@@ -2933,9 +2954,9 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
if ( $optimize == 1 && $section == NEW_SECTION ) {
|
||||
my $loglevel = $filter_table->{$chainref->{policychain}}{loglevel};
|
||||
if ( $loglevel ne '' ) {
|
||||
return 0 if $target eq "${policy}:${loglevel}";
|
||||
goto EXIT if $target eq "${policy}:${loglevel}";
|
||||
} else {
|
||||
return 0 if $basictarget eq $policy;
|
||||
goto EXIT if $basictarget eq $policy;
|
||||
}
|
||||
}
|
||||
#
|
||||
@@ -2980,6 +3001,21 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
my $actionchain; # Name of the action chain
|
||||
|
||||
if ( $actiontype & ACTION ) {
|
||||
#
|
||||
# Save NAT-oriented column contents
|
||||
#
|
||||
@nat_columns{'dest', 'proto', 'ports' } = ( $dest,
|
||||
$proto eq '-' ? $nat_columns{proto} : $proto,
|
||||
$ports eq '-' ? $nat_columns{ports} : $ports );
|
||||
#
|
||||
# Push the current column array onto the column stack
|
||||
#
|
||||
my @savecolumns = @columns;
|
||||
#
|
||||
# And store the (modified) columns into the columns array for use by perl_action[_tcp]_helper. We
|
||||
# only need the NAT-oriented columns
|
||||
#
|
||||
@columns = ( undef , undef, $dest, $proto, $ports);
|
||||
#
|
||||
# Handle 'section' option
|
||||
#
|
||||
@@ -3023,6 +3059,8 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
}
|
||||
|
||||
$action = $basictarget; # Remove params, if any, from $action.
|
||||
|
||||
@columns = @savecolumns;
|
||||
} elsif ( $actiontype & INLINE ) {
|
||||
#
|
||||
# process_inline() will call process_rule() recursively for each rule in the action body
|
||||
@@ -3039,7 +3077,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
|
||||
$actionresult = 0;
|
||||
|
||||
my $generated = process_inline( $basictarget,
|
||||
$generated = process_inline( $basictarget,
|
||||
$chainref,
|
||||
$prerule . $rule,
|
||||
$matches1 . $raw_matches,
|
||||
@@ -3066,7 +3104,7 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
|
||||
$macro_nest_level--;
|
||||
|
||||
return $generated;
|
||||
goto EXIT;
|
||||
}
|
||||
#
|
||||
# Generate Fixed part of the rule
|
||||
@@ -3252,7 +3290,14 @@ sub process_rule ( $$$$$$$$$$$$$$$$$$$$ ) {
|
||||
unless unreachable_warning( $wildcard || $section == DEFAULTACTION_SECTION, $chainref );
|
||||
}
|
||||
|
||||
return 1;
|
||||
$generated = 1;
|
||||
|
||||
EXIT:
|
||||
{
|
||||
%nat_columns = %save_nat_columns;
|
||||
}
|
||||
|
||||
return $generated;
|
||||
}
|
||||
|
||||
|
||||
@@ -3405,6 +3450,37 @@ sub perl_action_helper($$;$$) {
|
||||
merge_target( $ref, $target ),
|
||||
'', # CurrentParam
|
||||
@columns );
|
||||
} else {
|
||||
if ( ( $targets{$target} || 0 ) & NATRULE ) {
|
||||
$result = process_rule( $chainref,
|
||||
$matches,
|
||||
$matches1,
|
||||
merge_target( $actions{$action}, $target ),
|
||||
'', # Current Param
|
||||
'-', # Source
|
||||
merge_action_column( # Dest
|
||||
$columns[2],
|
||||
$nat_columns{dest}
|
||||
),
|
||||
merge_action_column( #Proto
|
||||
$columns[3],
|
||||
$nat_columns{proto}
|
||||
),
|
||||
merge_action_column( #Ports
|
||||
$columns[4],
|
||||
$nat_columns{ports}),
|
||||
'-', # Source Port(s)
|
||||
'-', # Original Dest
|
||||
'-', # Rate Limit
|
||||
'-', # User
|
||||
'-', # Mark
|
||||
'-', # Connlimit
|
||||
'-', # Time
|
||||
'-', # Headers,
|
||||
'-', # condition,
|
||||
'-', # helper,
|
||||
0, # Wildcard
|
||||
);
|
||||
} else {
|
||||
$result = process_rule( $chainref,
|
||||
$matches,
|
||||
@@ -3427,6 +3503,8 @@ sub perl_action_helper($$;$$) {
|
||||
'-', # helper,
|
||||
0, # Wildcard
|
||||
);
|
||||
}
|
||||
|
||||
allow_optimize( $chainref );
|
||||
}
|
||||
#
|
||||
@@ -3493,6 +3571,7 @@ sub perl_action_tcp_helper($$) {
|
||||
'-', # helper,
|
||||
0, # Wildcard
|
||||
);
|
||||
|
||||
allow_optimize( $chainref );
|
||||
}
|
||||
#
|
||||
@@ -4063,10 +4142,10 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$$ ) {
|
||||
expand_rule( $chainref,
|
||||
$restriction,
|
||||
$prerule ,
|
||||
do_proto( $proto, $ports, $sports ) .
|
||||
$match .
|
||||
do_user( $user ) .
|
||||
do_test( $testval, $globals{TC_MASK} ) .
|
||||
do_test( $testval, $globals{TC_MASK} ) .
|
||||
do_test( $testval, $mask ) .
|
||||
do_length( $length ) .
|
||||
do_tos( $tos ) .
|
||||
do_connbytes( $connbytes ) .
|
||||
@@ -4074,6 +4153,7 @@ sub process_mangle_rule1( $$$$$$$$$$$$$$$$$$$ ) {
|
||||
do_headers( $headers ) .
|
||||
do_probability( $probability ) .
|
||||
do_dscp( $dscp ) .
|
||||
do_time( $time ) .
|
||||
do_condition( $condition, $chainref->{name} ) .
|
||||
state_match( $state ) .
|
||||
$raw_matches ,
|
||||
@@ -5286,7 +5366,7 @@ sub process_snat1( $$$$$$$$$$$$ ) {
|
||||
$interfaces = $1;
|
||||
} elsif ( $dest =~ /^([^:]+):([^:]*)$/ ) {
|
||||
my ( $one, $two ) = ( $1, $2 );
|
||||
if ( $2 =~ /\./ || $2 =~ /^%/ ) {
|
||||
if ( $2 =~ /\./ || $2 =~ /^[+%!]/ ) {
|
||||
$interfaces = $one;
|
||||
$destnets = $two;
|
||||
} else {
|
||||
@@ -5642,16 +5722,24 @@ sub process_snat( )
|
||||
sub setup_snat( $ ) # Convert masq->snat if true
|
||||
{
|
||||
my $fn;
|
||||
my $have_masq;
|
||||
|
||||
convert_masq() if $_[0];
|
||||
|
||||
if ( $fn = open_file( 'masq', 1, 1 ) ) {
|
||||
if ( $_[0] ) {
|
||||
convert_masq();
|
||||
} elsif ( $fn = open_file( 'masq', 1, 1 ) ) {
|
||||
first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty masq file" , 's'; } );
|
||||
process_one_masq(0) while read_a_line( NORMAL_READ );
|
||||
} elsif ( $fn = open_file( 'snat', 1, 1 ) ) {
|
||||
process_one_masq(0), $have_masq = 1 while read_a_line( NORMAL_READ );
|
||||
}
|
||||
|
||||
unless ( $have_masq ) {
|
||||
#
|
||||
# Masq file empty or didn't exist
|
||||
#
|
||||
if ( $fn = open_file( 'snat', 1, 1 ) ) {
|
||||
first_entry( sub { progress_message2 "$doing $fn..."; require_capability 'NAT_ENABLED' , "a non-empty snat file" , 's'; } );
|
||||
process_snat while read_a_line( NORMAL_READ );
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
1;
|
||||
|
@@ -1434,7 +1434,7 @@ sub process_tc_filter2( $$$$$$$$$ ) {
|
||||
|
||||
while ( @sportlist ) {
|
||||
my ( $sport, $smask ) = ( shift @sportlist, shift @sportlist );
|
||||
$rule .= "\\\n cmp\\( u16 at 0 layer 2 mask $smask eq 0x$sport \\)";
|
||||
$rule .= "\\\n cmp\\( u16 at 0 layer 2 mask 0x$smask eq 0x$sport \\)";
|
||||
$rule .= ' or' if @sportlist;
|
||||
}
|
||||
|
||||
|
@@ -701,6 +701,40 @@ sub haveipseczones() {
|
||||
0;
|
||||
}
|
||||
|
||||
#
|
||||
# Returns 1 if the two interfaces passed are related
|
||||
#
|
||||
sub interface_match( $$ ) {
|
||||
my ( $piface, $ciface ) = @_;
|
||||
|
||||
return 1 if $piface eq $ciface;
|
||||
|
||||
my ( $pifaceref, $cifaceref ) = @interfaces{$piface, $ciface};
|
||||
|
||||
return 1 if $piface eq $cifaceref->{bridge};
|
||||
return 1 if $ciface eq $pifaceref->{bridge};
|
||||
|
||||
if ( $minroot ) {
|
||||
if ( $piface =~ /\+$/ ) {
|
||||
my $root = $pifaceref->{root};
|
||||
my $rlength = length( $root );
|
||||
while ( length( $ciface ) >= $rlength ) {
|
||||
return 1 if $ciface eq $root;
|
||||
chop $ciface;
|
||||
}
|
||||
} elsif ( $ciface =~ /\+$/ ) {
|
||||
my $root = $cifaceref->{root};
|
||||
my $rlength = length( $root );
|
||||
while ( length( $piface ) >= $rlength ) {
|
||||
return 1 if $piface eq $root;
|
||||
chop $piface;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
0;
|
||||
}
|
||||
|
||||
#
|
||||
# Report about zones.
|
||||
#
|
||||
@@ -738,7 +772,7 @@ sub zone_report()
|
||||
if ( $family == F_IPV4 ) {
|
||||
progress_message_nocompress " $iref->{physical}:$grouplist";
|
||||
} else {
|
||||
progress_message_nocompress " $iref->{physical}:<$grouplist>";
|
||||
progress_message_nocompress " $iref->{physical}:[$grouplist]";
|
||||
}
|
||||
$printed = 1;
|
||||
}
|
||||
@@ -747,6 +781,17 @@ sub zone_report()
|
||||
}
|
||||
}
|
||||
|
||||
PARENT:
|
||||
for my $p ( @{$zoneref->{parents}} ) {
|
||||
for my $pi ( keys ( %{$zones{$p}{interfaces}} ) ) {
|
||||
for my $ci ( keys( %{$zoneref->{interfaces}} ) ) {
|
||||
next PARENT if interface_match( $pi, $ci );
|
||||
}
|
||||
}
|
||||
|
||||
warning_message "Zone $zone is defined as a sub-zone of $p, yet the two zones have no interface in common";
|
||||
}
|
||||
|
||||
unless ( $printed ) {
|
||||
fatal_error "No bridge has been associated with zone $zone" if $type & BPORT && ! $zoneref->{bridge};
|
||||
warning_message "*** $zone is an EMPTY ZONE ***" unless $type == FIREWALL;
|
||||
@@ -1575,9 +1620,7 @@ sub known_interface($)
|
||||
#
|
||||
# We have wildcard interfaces -- see if this interface matches one of their roots
|
||||
#
|
||||
while ( length $iface > $minroot ) {
|
||||
chop $iface;
|
||||
|
||||
while ( length $iface >= $minroot ) {
|
||||
if ( my $i = $roots{$iface} ) {
|
||||
#
|
||||
# Found one
|
||||
@@ -1599,6 +1642,8 @@ sub known_interface($)
|
||||
};
|
||||
return $interfaceref;
|
||||
}
|
||||
|
||||
chop $iface;
|
||||
}
|
||||
}
|
||||
|
||||
|
@@ -1,4 +1,4 @@
|
||||
# (c) 1999-2016 - Tom Eastep (teastep@shorewall.net)
|
||||
# (c) 1999-2017 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# This program is part of Shorewall.
|
||||
#
|
||||
@@ -369,7 +369,7 @@ replace_default_route() # $1 = USE_DEFAULT_RT
|
||||
delete_default_routes() # $1 = table number
|
||||
{
|
||||
$IP -$g_family route ls table $1 | grep -F default | grep -vF metric | while read route; do
|
||||
qt $IP -$g_family route del $route
|
||||
qt $IP -$g_family route del $route table $1
|
||||
done
|
||||
}
|
||||
|
||||
@@ -421,7 +421,7 @@ restore_default_route() # $1 = USE_DEFAULT_RT
|
||||
conditionally_flush_conntrack() {
|
||||
|
||||
if [ -n "$g_purge" ]; then
|
||||
if [ -n $(mywhich conntrack) ]; then
|
||||
if [ -n "$(mywhich conntrack)" ]; then
|
||||
conntrack -F
|
||||
else
|
||||
error_message "WARNING: The '-p' option requires the conntrack utility which does not appear to be installed on this system"
|
||||
@@ -899,7 +899,7 @@ detect_dynamic_gateway() { # $1 = interface
|
||||
#
|
||||
# Detect the gateway through an interface
|
||||
#
|
||||
detect_gateway() # $1 = interface
|
||||
detect_gateway() # $1 = interface $2 = table number
|
||||
{
|
||||
local interface
|
||||
interface=$1
|
||||
@@ -912,6 +912,8 @@ detect_gateway() # $1 = interface
|
||||
# Maybe there's a default route through this gateway already
|
||||
#
|
||||
[ -n "$gateway" ] || gateway=$(find_gateway $($IP -4 route list dev $interface | grep ^default))
|
||||
|
||||
[ -z "$gateway" -a -n "$2" ] && gateway=$(find_gateway $($IP -4 route list dev $interface table $2 | grep ^default))
|
||||
#
|
||||
# Last hope -- is there a load-balancing route through the interface?
|
||||
#
|
||||
|
@@ -78,11 +78,13 @@ reload_command() {
|
||||
detect_configuration
|
||||
define_firewall
|
||||
status=$?
|
||||
if [ -n "$SUBSYSLOCK" ]; then
|
||||
[ $status -eq 0 ] && touch $SUBSYSLOCK || rm -f $SUBSYSLOCK
|
||||
fi
|
||||
|
||||
[ $status -eq 0 ] && progress_message3 "done."
|
||||
if [ $status -eq 0 ]; then
|
||||
[ -n "$SUBSYSLOCK" ] && touch $SUBSYSLOCK
|
||||
progress_message3 "done."
|
||||
else
|
||||
[ -n "$SUBSYSLOCK" ] && rm -f $SUBSYSLOCK
|
||||
fi
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -127,8 +129,10 @@ g_counters=
|
||||
g_compiled=
|
||||
g_file=
|
||||
g_docker=
|
||||
g_dockeringress=
|
||||
g_dockernetwork=
|
||||
g_forcereload=
|
||||
g_fallback=
|
||||
|
||||
[ -n "$SERVICEDIR" ] && SUBSYSLOCK=
|
||||
|
||||
@@ -418,9 +422,12 @@ case "$COMMAND" in
|
||||
[ $# -ne 1 ] && usage 2
|
||||
mutex_on
|
||||
if product_is_started; then
|
||||
COMMAND=disable
|
||||
detect_configuration $1
|
||||
COMMAND=enable disable_provider $1 Yes
|
||||
COMMAND=disable enable_provider $1 Yes
|
||||
disable_provider $1 Yes
|
||||
COMMAND=enable
|
||||
detect_configuration $1
|
||||
enable_provider $1 Yes
|
||||
fi
|
||||
mutex_off
|
||||
status=0
|
||||
|
@@ -205,8 +205,6 @@ MINIUPNPD=No
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MULTICAST=No
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
@@ -249,6 +247,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -216,8 +216,6 @@ MINIUPNPD=No
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MULTICAST=No
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
@@ -260,6 +258,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -213,8 +213,6 @@ MINIUPNPD=No
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MULTICAST=No
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
@@ -257,6 +255,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -216,8 +216,6 @@ MINIUPNPD=No
|
||||
|
||||
MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MULTICAST=No
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
@@ -260,6 +258,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -25,6 +25,7 @@ Broadcast noinline,audit # Handles Broadcast/Anycast
|
||||
DNSAmp # Matches one-question recursive DNS queries
|
||||
Drop # Default Action for DROP policy (deprecated)
|
||||
dropBcast inline # Silently Drop Broadcast
|
||||
dropBcasts inline # Silently Drop Broadcast
|
||||
dropInvalid inline # Drops packets in the INVALID conntrack state
|
||||
dropMcast inline # Silently Drop Multicast
|
||||
dropNotSyn noinline # Silently Drop Non-syn TCP packets
|
||||
|
12
Shorewall/configfiles/disabled
Normal file
12
Shorewall/configfiles/disabled
Normal file
@@ -0,0 +1,12 @@
|
||||
#
|
||||
# Shorewall -- /etc/shorewall/disabled
|
||||
#
|
||||
# Add commands below that you want executed when an optional
|
||||
# interface is successfully disabled using the 'disable' command
|
||||
#
|
||||
# When the commands are invoked:
|
||||
#
|
||||
# $1 contains the physical name of the interface
|
||||
# $2 contains the logical name of the interface
|
||||
# $3 contains the name of the provider associated with the interface,
|
||||
if any
|
12
Shorewall/configfiles/enabled
Normal file
12
Shorewall/configfiles/enabled
Normal file
@@ -0,0 +1,12 @@
|
||||
#
|
||||
# Shorewall -- /etc/shorewall/enabled
|
||||
#
|
||||
# Add commands below that you want executed when an optional
|
||||
# interface is successfully enabled using the 'enable' command
|
||||
#
|
||||
# When the commands are invoked:
|
||||
#
|
||||
# $1 contains the physical name of the interface
|
||||
# $2 contains the logical name of the interface
|
||||
# $3 contains the name of the provider associated with the interface,
|
||||
if any
|
@@ -205,8 +205,6 @@ MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MINIUPNPD=No
|
||||
|
||||
MODULE_SUFFIX=ko
|
||||
|
||||
MULTICAST=No
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
@@ -249,6 +247,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -616,8 +616,14 @@ run_install $OWNERSHIP -m 0644 params.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/c
|
||||
if [ -f ${DESTDIR}${CONFDIR}/$PRODUCT/params ]; then
|
||||
chmod 0644 ${DESTDIR}${CONFDIR}/$PRODUCT/params
|
||||
else
|
||||
case "$SPARSE" in
|
||||
[Vv]ery)
|
||||
;;
|
||||
*)
|
||||
run_install $OWNERSHIP -m 0600 params${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/params
|
||||
echo "Parameter file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/params"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
|
||||
if [ $PRODUCT = shorewall ]; then
|
||||
@@ -693,10 +699,16 @@ fi
|
||||
run_install $OWNERSHIP -m 0644 conntrack ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
|
||||
run_install $OWNERSHIP -m 0644 conntrack.annotated ${DESTDIR}${SHAREDIR}/$PRODUCT/configfiles
|
||||
|
||||
if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack ]; then
|
||||
case "$SPARSE" in
|
||||
[Vv]ery)
|
||||
;;
|
||||
*)
|
||||
if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack ]; then
|
||||
run_install $OWNERSHIP -m 0600 conntrack${suffix} ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack
|
||||
echo "Conntrack file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/conntrack"
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
#
|
||||
# Install the Mangle file
|
||||
@@ -1163,31 +1175,25 @@ fi
|
||||
if [ $PRODUCT = shorewall6 ]; then
|
||||
make_parent_directory ${DESTDIR}${MANDIR}/man5 0755
|
||||
|
||||
for f in \
|
||||
shorewall-accounting.5.gz shorewall-ipsets.5.gz shorewall-providers.5.gz shorewall-tcclasses.5.gz \
|
||||
shorewall-actions.5.gz shorewall-maclist.5.gz shorewall-tcdevices.5.gz \
|
||||
shorewall-mangle.5.gz shorewall-proxyndp.5.gz shorewall-tcfilters.5.gz \
|
||||
shorewall-blacklist.5.gz shorewall-masq.5.gz shorewall-routes.5.gz shorewall-tcinterfaces.5.gz \
|
||||
shorewall-blrules.5.gz shorewall-modules.5.gz shorewall-routestopped.5.gz shorewall-tcpri.5.gz \
|
||||
shorewall-conntrack.5.gz shorewall-nat.5.gz shorewall-rtrules.5.gz shorewall-tcrules.5.gz \
|
||||
shorewall-nesting.5.gz shorewall-rules.5.gz shorewall-tos.5.gz \
|
||||
shorewall-exclusion.5.gz shorewall-netmap.5.gz shorewall-secmarks.5.gz shorewall-tunnels.5.gz \
|
||||
shorewall-hosts.5.gz shorewall-params.5.gz shorewall-snat.5.gz shorewall-vardir.5.gz \
|
||||
shorewall-interfaces.5.gz shorewall-policy.5.gz shorewall-stoppedrules.5.gz shorewall-zones.5.gz
|
||||
do
|
||||
base=$(basename $f);
|
||||
rm -f ${DESTDIR}${MANDIR}/man5/shorewall6*
|
||||
|
||||
case $base in
|
||||
shorewall-arprules.*|shorewall-ecn.*|shorewall-proxyarp.*)
|
||||
;;
|
||||
*)
|
||||
base6=shorewall6-${base#*-}
|
||||
ln -sf ${MANDIR}/man5/$(basename $f) ${DESTDIR}${MANDIR}/man5/$base6
|
||||
;;
|
||||
esac
|
||||
for f in \
|
||||
shorewall-accounting.5 shorewall-ipsets.5 shorewall-providers.5 shorewall-tcclasses.5 \
|
||||
shorewall-actions.5 shorewall-maclist.5 shorewall-tcdevices.5 \
|
||||
shorewall-mangle.5 shorewall-proxyndp.5 shorewall-tcfilters.5 \
|
||||
shorewall-blacklist.5 shorewall-masq.5 shorewall-routes.5 shorewall-tcinterfaces.5 \
|
||||
shorewall-blrules.5 shorewall-modules.5 shorewall-routestopped.5 shorewall-tcpri.5 \
|
||||
shorewall-conntrack.5 shorewall-nat.5 shorewall-rtrules.5 shorewall-tcrules.5 \
|
||||
shorewall-nesting.5 shorewall-rules.5 shorewall-tos.5 \
|
||||
shorewall-exclusion.5 shorewall-netmap.5 shorewall-secmarks.5 shorewall-tunnels.5 \
|
||||
shorewall-hosts.5 shorewall-params.5 shorewall-snat.5 shorewall-vardir.5 \
|
||||
shorewall-interfaces.5 shorewall-policy.5 shorewall-stoppedrules.5 shorewall-zones.5
|
||||
do
|
||||
f6=shorewall6-${f#*-}
|
||||
echo ".so man5/$f" > ${DESTDIR}${MANDIR}/man5/$f6
|
||||
done
|
||||
|
||||
ln -sf ${MANDIR}/man5/shorewall.conf.5.gz ${DESTDIR}${MANDIR}/man5/shorewall6.conf.5.gz
|
||||
echo ".so man5/shorewall.conf.5" > ${DESTDIR}${MANDIR}/man5/shorewall6.conf.5
|
||||
fi
|
||||
|
||||
[ -n "$INSTALLD" ] || make_parent_directory ${DESTDIR}${MANDIR}/man8 0755
|
||||
|
@@ -1556,10 +1556,10 @@ remote_reload_command() # $* = original arguments less the command.
|
||||
|
||||
progress_message "Getting Capabilities on system $system..."
|
||||
if [ $g_family -eq 4 ]; then
|
||||
if ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $g_shorewalldir/capabilities; then
|
||||
if ! rsh_command "MODULESDIR=$MODULESDIR IPTABLES=$IPTABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall-lite/shorecap" > $g_shorewalldir/capabilities; then
|
||||
fatal_error "Capturing capabilities on system $system failed"
|
||||
fi
|
||||
elif ! rsh_command "MODULESDIR=$MODULESDIR MODULE_SUFFIX=\"$MODULE_SUFFIX\" IP6TABLES=$IP6TABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall6-lite/shorecap" > $g_shorewalldir/capabilities; then
|
||||
elif ! rsh_command "MODULESDIR=$MODULESDIR IP6TABLES=$IP6TABLES DONT_LOAD=\"$DONT_LOAD\" $libexec/shorewall6-lite/shorecap" > $g_shorewalldir/capabilities; then
|
||||
fatal_error "Capturing capabilities on system $system failed"
|
||||
fi
|
||||
fi
|
||||
|
@@ -104,9 +104,7 @@ loc eth2 -</programlisting>
|
||||
<para>You may use wildcards here by specifying a prefix followed by
|
||||
the plus sign ("+"). For example, if you want to make an entry that
|
||||
applies to all PPP interfaces, use 'ppp+'; that would match ppp0,
|
||||
ppp1, ppp2, … Please note that the '+' means '<emphasis
|
||||
role="bold">one</emphasis> or more additional characters' so 'ppp'
|
||||
does not match 'ppp+'.</para>
|
||||
ppp1, ppp2, …</para>
|
||||
|
||||
<para>When using Shorewall versions before 4.1.4, care must be
|
||||
exercised when using wildcards where there is another zone that uses
|
||||
|
@@ -51,7 +51,7 @@
|
||||
|
||||
<para>The <replaceable>modulename</replaceable> names a kernel module
|
||||
(without suffix). Shorewall will search for modules based on your
|
||||
MODULESDIR and MODULE_SUFFIX settings in <ulink
|
||||
MODULESDIR setting in <ulink
|
||||
url="/manpages/shorewall.conf.html">shorewall.conf</ulink>(8). The
|
||||
<replaceable>moduleoption</replaceable>s are passed to modprobe (if
|
||||
installed) or to insmod.</para>
|
||||
|
@@ -214,7 +214,14 @@
|
||||
BALANCE_PROVIDERS=Yes, <option>balance=1</option> is assumed
|
||||
unless the <option>fallback</option>, <option>loose</option>,
|
||||
<option>load</option> or <option>tproxy</option> option is
|
||||
specified.</para>
|
||||
specified.I</para>
|
||||
|
||||
<caution>
|
||||
<para>In IPV6, the <option>balance</option> option does not
|
||||
cause balanced default routes to be created; it rather
|
||||
causes a sequence of default routes with different metrics
|
||||
to be created.</para>
|
||||
</caution>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
@@ -337,6 +344,14 @@
|
||||
<para>Prior to Shorewall 4.4.24, the option is ignored with a
|
||||
warning message if USE_DEFAULT_RT=Yes in
|
||||
<filename>shorewall.conf</filename>.</para>
|
||||
|
||||
<caution>
|
||||
<para>In IPV6, specifying the <option>fallback</option>
|
||||
option on multiple providers does not cause balanced
|
||||
fallback routes to be created; it rather causes a sequence
|
||||
of fallback routes with different metrics to be
|
||||
created.</para>
|
||||
</caution>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
@@ -423,6 +438,14 @@
|
||||
<command>enable</command> and <command>reenable</command>
|
||||
commands can reenable the provider.</para>
|
||||
</note>
|
||||
|
||||
<important>
|
||||
<para>RESTORE_DEFAULT_OPTION=Yes in shorewall[6].conf is not
|
||||
recommended when the <option>persistent</option> option is
|
||||
used, as restoring default routes to the main routing table
|
||||
can prevent link status monitors such as foolsm from
|
||||
correctly detecting non-working providers.</para>
|
||||
</important>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
@@ -673,7 +673,7 @@
|
||||
address changed to 206.124.146.177.</para>
|
||||
|
||||
<programlisting> #ACTION SOURCE DEST
|
||||
SNAT(206.124.146.177) - eth0+myset[dst]</programlisting>
|
||||
SNAT(206.124.146.177) - eth0:+myset[dst]</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
|
@@ -406,8 +406,9 @@
|
||||
<listitem>
|
||||
<para>Formerly named AUTO_COMMENT. If set, if there is not a current
|
||||
comment when a macro is invoked, the behavior is as if the first
|
||||
line of the macro file was "COMMENT <macro name>". The
|
||||
AUTO_COMMENT option has a default value of 'Yes'.</para>
|
||||
line of the macro file was "COMMENT <macro name>". If not
|
||||
specified, the AUTO_COMMENT option has a default value of
|
||||
'Yes'.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
@@ -473,7 +474,7 @@
|
||||
command, then the compilation step is skipped and the compiled
|
||||
script that executed the last <command>start</command>, <emphasis
|
||||
role="bold">reload</emphasis> or <command>restart</command> command
|
||||
is used. The default is AUTOMAKE=No.</para>
|
||||
is used. If not specified, the default is AUTOMAKE=No.</para>
|
||||
|
||||
<para>The setting of the AUTOMAKE option is ignored if the
|
||||
<command>start</command>, <emphasis role="bold">reload</emphasis> or
|
||||
@@ -1891,18 +1892,6 @@ LOG:info:,bar net fw</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">MODULE_SUFFIX=</emphasis>[<emphasis
|
||||
role="bold">"</emphasis><emphasis>extension</emphasis> ...<emphasis
|
||||
role="bold">"</emphasis>]</term>
|
||||
|
||||
<listitem>
|
||||
<para>The value of this option determines the possible file
|
||||
extensions of kernel modules. The default value is "ko ko.gz ko.xz o
|
||||
o.gz o.xz gz xz".</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis
|
||||
role="bold">MODULESDIR=</emphasis>[[+]<emphasis>pathname</emphasis>[<emphasis
|
||||
@@ -2212,8 +2201,9 @@ LOG:info:,bar net fw</programlisting>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>The default value is zero which disables all
|
||||
optimizations.</para>
|
||||
<para>In versions prior to 5.1.0, the default value is zero which
|
||||
disables all optimizations. Beginning with Shorewall 5.1.0, the
|
||||
default value is All which enables all optimizations.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
@@ -3083,6 +3073,40 @@ INLINE - - - ;; -j REJECT
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">USE_NFLOG_SIZE=</emphasis>[<emphasis
|
||||
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
|
||||
|
||||
<listitem>
|
||||
<para>Added in Shorewall 5.1.5. The second parameter to the NFLOG
|
||||
target specifies how many bytes of the packet to copy to the log; if
|
||||
omitted or if supplied as zero, the entire packet is copied. This
|
||||
feature has traditionally been implemented using the --nflog-range
|
||||
option to the NFLOG iptables target. Unfortuntely, the --nflog-range
|
||||
option never worked (the entire packet was always copied). To deal
|
||||
with this issue, the Netfilter team:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Added a warning message when --nflog-range is used</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Added --nflog-size which works like --nflog-range was
|
||||
intended to work.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>When USE_NFLOG_SIZE=Yes, Shorewall will attempt to use the new
|
||||
--nflog-size feature. If that feature is not available in the
|
||||
running kernel and ip[6]tables, an error is raised.</para>
|
||||
|
||||
<para>When USE_NFLOG_SIZE is not supplied, USE_NFLOG_SIZE=No is
|
||||
assumed. When USE_NFLOG_SIZE is added by shorewall update, it is
|
||||
added with setting No.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><emphasis role="bold">USE_PHYSICAL_NAMES=</emphasis>[<emphasis
|
||||
role="bold">Yes</emphasis>|<emphasis role="bold">No</emphasis>]</term>
|
||||
|
@@ -28,7 +28,7 @@
|
||||
#
|
||||
# On the target system (the system where the firewall program is to run):
|
||||
#
|
||||
# [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] [ MODULE_SUFFIX="<module suffix list>" ] shorecap > capabilities
|
||||
# [ IPTABLES=<iptables binary> ] [ MODULESDIR=<kernel modules directory> ] shorecap > capabilities
|
||||
#
|
||||
# Now move the capabilities file to the compilation system. The file must
|
||||
# be placed in a directory on the CONFIG_PATH to be used when compiling firewalls
|
||||
@@ -38,7 +38,6 @@
|
||||
#
|
||||
# IPTABLES - iptables
|
||||
# MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
|
||||
# MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
|
||||
#
|
||||
# Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
|
||||
# used during firewall compilation, then the generated firewall program will likewise not
|
||||
|
@@ -8,6 +8,7 @@
|
||||
Description=Shorewall IPv6 firewall (lite)
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
After=shorewall-lite.service
|
||||
Conflicts=ip6tables.service firewalld.service
|
||||
|
||||
[Service]
|
||||
|
@@ -7,6 +7,7 @@
|
||||
Description=Shorewall IPv6 firewall (lite)
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
After=shorewall-lite.service
|
||||
Conflicts=ip6tables.service firewalld.service
|
||||
|
||||
[Service]
|
||||
|
@@ -1,82 +0,0 @@
|
||||
# Shorewall6 Packet Filtering Firewall Export Directory Makefile - V4.2
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
|
||||
#
|
||||
# (c) 2006 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Shorewall documentation is available at http://www.shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
################################################################################
|
||||
# Place this file in each export directory. Modify each copy to set HOST
|
||||
# to the name of the remote firewall corresponding to the directory.
|
||||
#
|
||||
# To make the 'firewall' script, type "make".
|
||||
#
|
||||
# Once the script is compiling correctly, you can install it by
|
||||
# typing "make install".
|
||||
#
|
||||
################################################################################
|
||||
# V A R I A B L E S
|
||||
#
|
||||
# Files in the export directory on which the firewall script does not depend
|
||||
#
|
||||
IGNOREFILES = firewall% Makefile% trace% %~
|
||||
#
|
||||
# Remote Firewall system
|
||||
#
|
||||
HOST = gateway
|
||||
#
|
||||
# Save some typing
|
||||
#
|
||||
LITEDIR = /var/lib/shorewall6-lite
|
||||
#
|
||||
# Set this if the remote system has a non-standard modules directory
|
||||
#
|
||||
MODULESDIR=
|
||||
#
|
||||
# Default target is the firewall script
|
||||
#
|
||||
################################################################################
|
||||
# T A R G E T S
|
||||
#
|
||||
all: firewall
|
||||
#
|
||||
# Only generate the capabilities file if it doesn't already exist
|
||||
#
|
||||
capabilities:
|
||||
ssh root@$(HOST) "MODULESDIR=$(MODULESDIR) /usr/share/shorewall6-lite/shorecap > $(LITEDIR)/capabilities"
|
||||
scp root@$(HOST):$(LITEDIR)/capabilities .
|
||||
#
|
||||
# Compile the firewall script. Using the 'wildcard' function causes "*" to be expanded so that
|
||||
# 'filter-out' will be presented with the list of files in this directory rather than "*"
|
||||
#
|
||||
firewall: $(filter-out $(IGNOREFILES) capabilities , $(wildcard *) ) capabilities
|
||||
shorewall6 compile -e . firewall
|
||||
#
|
||||
# Only reload on demand.
|
||||
#
|
||||
install: firewall
|
||||
scp firewall firewall.conf root@$(HOST):$(LITEDIR)
|
||||
ssh root@$(HOST) "/sbin/shorewall6-lite restart"
|
||||
#
|
||||
# Save running configuration
|
||||
#
|
||||
save:
|
||||
ssh root@$(HOST) "/sbin/shorewall6-lite save"
|
||||
#
|
||||
# Remove generated files
|
||||
#
|
||||
clean:
|
||||
rm -f capabilities firewall firewall.conf reload
|
@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MINIUPNPD=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
OPTIMIZE=All
|
||||
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=Yes
|
||||
|
||||
RESTART=restart
|
||||
|
||||
RESTORE_DEFAULT_ROUTE=Yes
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
SAVE_IPSETS=No
|
||||
@@ -222,6 +222,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -191,8 +191,6 @@ MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MINIUPNPD=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
OPTIMIZE=All
|
||||
@@ -207,6 +205,8 @@ REQUIRE_INTERFACE=No
|
||||
|
||||
RESTART=restart
|
||||
|
||||
RESTORE_DEFAULT_ROUTE=Yes
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
SAVE_IPSETS=No
|
||||
@@ -223,6 +223,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MINIUPNPD=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
OPTIMIZE=All
|
||||
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=No
|
||||
|
||||
RESTART=restart
|
||||
|
||||
RESTORE_DEFAULT_ROUTE=Yes
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
SAVE_IPSETS=No
|
||||
@@ -222,6 +222,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MINIUPNPD=No
|
||||
|
||||
MODULE_SUFFIX="ko ko.xz"
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
OPTIMIZE=All
|
||||
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=No
|
||||
|
||||
RESTART=restart
|
||||
|
||||
RESTORE_DEFAULT_ROUTE=Yes
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
SAVE_IPSETS=No
|
||||
@@ -222,6 +222,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -21,6 +21,7 @@ BLACKLIST logjump,section # Add sender to the dynamic blacklist
|
||||
Broadcast noinline # Handles Broadcast/Anycast
|
||||
Drop # Default Action for DROP policy (deprecated)
|
||||
dropBcast inline # Silently Drop Broadcast
|
||||
dropBcasts inline # Silently Drop Broadcast
|
||||
dropInvalid inline # Drops packets in the INVALID conntrack state
|
||||
dropMcast inline # Silently Drop Multicast
|
||||
dropNotSyn noinline # Silently Drop Non-syn TCP packets
|
||||
|
12
Shorewall6/configfiles/disabled
Normal file
12
Shorewall6/configfiles/disabled
Normal file
@@ -0,0 +1,12 @@
|
||||
#
|
||||
# Shorewall6 -- /etc/shorewall6/disabled
|
||||
#
|
||||
# Add commands below that you want executed when an optional
|
||||
# interface is successfully disabled using the 'disable' command
|
||||
#
|
||||
# When the commands are invoked:
|
||||
#
|
||||
# $1 contains the physical name of the interface
|
||||
# $2 contains the logical name of the interface
|
||||
# $3 contains the name of the provider associated with the interface,
|
||||
if any
|
12
Shorewall6/configfiles/enabled
Normal file
12
Shorewall6/configfiles/enabled
Normal file
@@ -0,0 +1,12 @@
|
||||
#
|
||||
# Shorewall6 -- /etc/shorewall6/enabled
|
||||
#
|
||||
# Add commands below that you want executed when an optional
|
||||
# interface is successfully enabled using the 'enable' command
|
||||
#
|
||||
# When the commands are invoked:
|
||||
#
|
||||
# $1 contains the physical name of the interface
|
||||
# $2 contains the logical name of the interface
|
||||
# $3 contains the name of the provider associated with the interface,
|
||||
if any
|
@@ -190,8 +190,6 @@ MARK_IN_FORWARD_CHAIN=No
|
||||
|
||||
MINIUPNPD=No
|
||||
|
||||
MODULE_SUFFIX=ko
|
||||
|
||||
MUTEX_TIMEOUT=60
|
||||
|
||||
OPTIMIZE=All
|
||||
@@ -206,6 +204,8 @@ REQUIRE_INTERFACE=No
|
||||
|
||||
RESTART=restart
|
||||
|
||||
RESTORE_DEFAULT_ROUTE=Yes
|
||||
|
||||
RESTORE_ROUTEMARKS=Yes
|
||||
|
||||
SAVE_IPSETS=No
|
||||
@@ -222,6 +222,8 @@ TRACK_RULES=No
|
||||
|
||||
USE_DEFAULT_RT=Yes
|
||||
|
||||
USE_NFLOG_SIZE=No
|
||||
|
||||
USE_PHYSICAL_NAMES=No
|
||||
|
||||
USE_RT_NAMES=No
|
||||
|
@@ -7,6 +7,7 @@
|
||||
Description=Shorewall IPv6 firewall
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
After=shorewall.service
|
||||
Conflicts=ip6tables.service firewalld.service
|
||||
|
||||
[Service]
|
||||
|
@@ -8,6 +8,7 @@
|
||||
Description=Shorewall IPv6 firewall
|
||||
Wants=network-online.target
|
||||
After=network-online.target
|
||||
After=shorewall.service
|
||||
Conflicts=ip6tables.service firewalld.service
|
||||
|
||||
[Service]
|
||||
|
@@ -417,7 +417,8 @@
|
||||
<row>
|
||||
<entry><ulink url="IPv6Support.html">IPv6 Support</ulink></entry>
|
||||
|
||||
<entry><ulink url="Events.html">Shorewall Events</ulink></entry>
|
||||
<entry><ulink url="SharedConfig.html">Shared Shorewall/Shorewall6
|
||||
Configuration</ulink></entry>
|
||||
|
||||
<entry/>
|
||||
</row>
|
||||
@@ -426,8 +427,7 @@
|
||||
<entry><ulink url="ISO-3661.html">ISO 3661 Country
|
||||
Codes</ulink></entry>
|
||||
|
||||
<entry><ulink url="Shorewall-init.html">Shorewall
|
||||
Init</ulink></entry>
|
||||
<entry><ulink url="Events.html">Shorewall Events</ulink></entry>
|
||||
|
||||
<entry/>
|
||||
</row>
|
||||
@@ -436,8 +436,8 @@
|
||||
<entry><ulink url="Shorewall_and_Kazaa.html">Kazaa
|
||||
Filtering</ulink></entry>
|
||||
|
||||
<entry><ulink url="Shorewall-Lite.html">Shorewall
|
||||
Lite</ulink></entry>
|
||||
<entry><ulink url="Shorewall-init.html">Shorewall
|
||||
Init</ulink></entry>
|
||||
|
||||
<entry/>
|
||||
</row>
|
||||
@@ -446,7 +446,8 @@
|
||||
<entry><ulink url="kernel.htm">Kernel
|
||||
Configuration</ulink></entry>
|
||||
|
||||
<entry/>
|
||||
<entry><ulink url="Shorewall-Lite.html">Shorewall
|
||||
Lite</ulink></entry>
|
||||
|
||||
<entry/>
|
||||
</row>
|
||||
|
@@ -475,10 +475,8 @@ root@gateway:~# </programlisting>
|
||||
<section>
|
||||
<title>Automatic Blacklisting</title>
|
||||
|
||||
<para>This example is taken from <ulink
|
||||
url="http://www.briandowney.net/blog/2009/08/20/firewalling-brute-force-attempts-with-iptables/">this
|
||||
article</ulink> which explains the nice benefits of this approach. This
|
||||
example is for ssh, but it can be adapted for any application.</para>
|
||||
<para>This example is for ssh, but it can be adapted for any
|
||||
application.</para>
|
||||
|
||||
<para>The name SSH has been changed to SSHLIMIT so as not to override
|
||||
the Shorewall macro of the same name.</para>
|
||||
|
63
docs/FAQ.xml
63
docs/FAQ.xml
@@ -175,8 +175,8 @@
|
||||
</section>
|
||||
|
||||
<section id="faq76">
|
||||
<title>(FAQ 76) I just upgraded my Debian (Ubuntu, Kubuntu, ...) system
|
||||
and now masquerading doesn't work? What happened?</title>
|
||||
<title>(FAQ 76) I just upgraded my system and now masquerading doesn't
|
||||
work? What happened?</title>
|
||||
|
||||
<para><emphasis role="bold">Answer:</emphasis> This happens to people
|
||||
who ignore <ulink url="Install.htm#Upgrade_Deb">our advice</ulink> and
|
||||
@@ -185,7 +185,7 @@
|
||||
default settings. Failure to forward traffic (such as during masqueraded
|
||||
net access from a local network) usually means that <filename><ulink
|
||||
url="manpages/shorewall.conf.html">/etc/shorewall/shorewall.conf</ulink></filename>
|
||||
contains the Debian default setting IP_FORWARDING=Keep; it should be
|
||||
contains the default setting IP_FORWARDING=Keep; it should be
|
||||
IP_FORWARDING=On.</para>
|
||||
|
||||
<para><emphasis role="bold">Update</emphasis>: Beginning with Shorewall
|
||||
@@ -776,12 +776,7 @@ SNAT(<emphasis role="bold">130.151.100.69</emphasis>) 192.168.1.0/24 eth1:19
|
||||
|
||||
<para>That rule (and the second one in the previous bullet) only
|
||||
works of course if you have a static external IP address. If you
|
||||
have a dynamic IP address then include this in
|
||||
<filename>/etc/shorewall/params</filename>.</para>
|
||||
|
||||
<programlisting><command>ETH0_IP=$(find_first_interface_address eth0)</command> </programlisting>
|
||||
|
||||
<para>and make your DNAT rule:</para>
|
||||
have a dynamic IP address then make your DNAT rule:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
|
||||
|
||||
@@ -793,34 +788,17 @@ SNAT(<emphasis role="bold">130.151.100.69</emphasis>) 192.168.1.0/24 eth1:19
|
||||
?SECTION NEW
|
||||
|
||||
DNAT loc loc:192.168.1.5 tcp www - <emphasis
|
||||
role="bold">$ETH0_IP</emphasis></programlisting>
|
||||
role="bold">&eth0</emphasis></programlisting>
|
||||
|
||||
<para>Using this technique, you will want to configure your
|
||||
DHCP/PPPoE/PPTP/… client to automatically restart Shorewall each
|
||||
time that you get a new IP address.</para>
|
||||
DHCP/PPPoE/PPTP/… client to automatically reload Shorewall each time
|
||||
that you get a new IP address.</para>
|
||||
|
||||
<note>
|
||||
<para>If your local interface is a bridge, see <link
|
||||
linkend="faq2e">FAQ 2e</link> for additional configuration
|
||||
steps.</para>
|
||||
</note>
|
||||
|
||||
<note>
|
||||
<para>For optional interfaces, use the function <emphasis
|
||||
role="bold">find_first_interface_address_if_any()</emphasis>
|
||||
rather than <emphasis
|
||||
role="bold">find_first_interface_address()</emphasis>. The former
|
||||
will return 0.0.0.0 if the interface has no configured IP address;
|
||||
the latter terminates the calling program.</para>
|
||||
</note>
|
||||
|
||||
<note id="Call">
|
||||
<para>If you run Shorewall-lite on your firewall, you must use the
|
||||
following in the firewall's configuration directory
|
||||
<filename>params</filename> file:</para>
|
||||
|
||||
<programlisting><command>ETH0_IP=$(ssh root@firewall "/sbin/shorewall-lite call find_first_interface_address eth0")</command></programlisting>
|
||||
</note>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
@@ -928,14 +906,8 @@ MASQUERADE 192.168.1.0/24 eth2:192.168.1.2 tcp www</programlisting>
|
||||
|
||||
<emphasis role="bold">DNAT loc dmz:192.168.2.4 tcp 80 - 206.124.146.176</emphasis></programlisting>
|
||||
|
||||
<para>If your external IP address is dynamic, then you must do the
|
||||
following:</para>
|
||||
|
||||
<para>In <filename>/etc/shorewall/params</filename>:</para>
|
||||
|
||||
<programlisting><command>ETH0_IP=`find_first_interface_address eth0`</command> </programlisting>
|
||||
|
||||
<para>and make your DNAT rule:</para>
|
||||
<para>If your external IP address is dynamic, then you must make your
|
||||
DNAT rule:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DPORT SPORT ORIGDEST
|
||||
|
||||
@@ -947,7 +919,7 @@ MASQUERADE 192.168.1.0/24 eth2:192.168.1.2 tcp www</programlisting>
|
||||
?SECTION NEW
|
||||
|
||||
DNAT loc dmz:192.168.2.4 tcp 80 - <emphasis
|
||||
role="bold">$ETH0_IP</emphasis></programlisting>
|
||||
role="bold">&eth0</emphasis></programlisting>
|
||||
|
||||
<warning>
|
||||
<para>With dynamic IP addresses, you probably don't want to use
|
||||
@@ -956,21 +928,6 @@ DNAT loc dmz:192.168.2.4 tcp 80 - <emphasi
|
||||
save</command> and <command>shorewall[-lite]
|
||||
restore</command></ulink>.</para>
|
||||
</warning>
|
||||
|
||||
<note>
|
||||
<para>For optional interfaces, use the function <emphasis
|
||||
role="bold">find_first_interface_address_if_any()</emphasis> rather
|
||||
than <emphasis
|
||||
role="bold">find_first_interface_address()</emphasis>. The former
|
||||
will return 0.0.0.0 if the interface has no configured IP address;
|
||||
the latter terminates the calling program.</para>
|
||||
</note>
|
||||
|
||||
<note>
|
||||
<para>If you use Shorewall-lite, then you need to configure the
|
||||
params file in the firewall's configuration directory as described
|
||||
<link linkend="Call">above</link>.</para>
|
||||
</note>
|
||||
</section>
|
||||
|
||||
<section id="faq2c">
|
||||
|
@@ -24,6 +24,8 @@
|
||||
|
||||
<year>2016</year>
|
||||
|
||||
<year>2017</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
@@ -537,6 +539,15 @@ ACCEPT net:wlan0:<2002:ce7c:92b4::3> $FW tcp 22
|
||||
remote firewalls to allow for central IPv6 firewall administration.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Shared Shorewall/Shorewall6 Configuration Files</title>
|
||||
|
||||
<para>Normally, the configuration files for Shorewall are kept in
|
||||
/etc/shorewall/ and those for Shorewall6 are kept in /etc/shorewall6/. It
|
||||
is possible, however, to share almost all of those files as shown in
|
||||
<ulink url="/SharedConfig.html">this article</ulink>.</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>More information about IPv6</title>
|
||||
|
||||
|
@@ -387,7 +387,7 @@
|
||||
|
||||
<listitem>
|
||||
<para>Directory where the Shorewall Perl modules are installed.
|
||||
Then will be installed in this directory under the sub-directory
|
||||
They will be installed in this directory under the sub-directory
|
||||
Shorewall. Default is distribution-specific.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
@@ -597,7 +597,7 @@
|
||||
...</member>
|
||||
</simplelist>
|
||||
|
||||
<para>The possible values for option are the same as those shone above
|
||||
<para>The possible values for option are the same as those shown above
|
||||
in the shorewallrc file. They may be specified in either upper or
|
||||
lower case and may optionally be prefixed by '--'. To facilitate use
|
||||
with the rpm %configure script, the following options are
|
||||
@@ -634,7 +634,7 @@
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
<para>Note that %configure may dsgenerate option/value pairs that are
|
||||
<para>Note that %configure may generate option/value pairs that are
|
||||
incompatible with the <command>configure</command> script. The current
|
||||
%configure macro is:</para>
|
||||
|
||||
|
@@ -2246,14 +2246,6 @@ net eth1 detect <emphasis role="bold">optional</emphasis><
|
||||
contains the link configurations. That file is included by
|
||||
<filename>/etc/foolsm/foolsm.conf</filename>.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>The script run by FOOLSM during state change
|
||||
(<filename>/etc/foolsm/script) </filename>writes a<filename>
|
||||
${VARDIR}/xxx.status</filename> file when the status of an
|
||||
interface changes. Those files are read by the
|
||||
<filename>isusable</filename> extension script (see below).</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>Below are my relevant configuration files.</para>
|
||||
@@ -2278,6 +2270,11 @@ COM_IF=eth1</programlisting>
|
||||
|
||||
return $status</programlisting>
|
||||
|
||||
<para>Note that the above script overrides the normal behavior of
|
||||
<emphasis>persistent</emphasis> providers, in that it prevents the
|
||||
attempt to enable the provider during <command>start</command>,
|
||||
<command>restart</command> and <command>reload</command>.</para>
|
||||
|
||||
<para><filename>/etc/shorewall/lib.private</filename>:</para>
|
||||
|
||||
<programlisting>###############################################################################
|
||||
|
1051
docs/SharedConfig.xml
Normal file
1051
docs/SharedConfig.xml
Normal file
File diff suppressed because it is too large
Load Diff
@@ -147,7 +147,7 @@
|
||||
|
||||
<para>To integrate with NetworkManager and ifup/ifdown, additional steps
|
||||
are required. You probably don't want to enable this feature if you run a
|
||||
link status monitor like swping or LSM.</para>
|
||||
link status monitor like FOOLSM.</para>
|
||||
|
||||
<orderedlist numeration="loweralpha">
|
||||
<listitem>
|
||||
|
@@ -20,6 +20,8 @@
|
||||
<copyright>
|
||||
<year>2003-2008</year>
|
||||
|
||||
<year>2017</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
@@ -45,6 +47,13 @@
|
||||
release.</emphasis></para>
|
||||
</caution>
|
||||
|
||||
<caution>
|
||||
<para>If your firewall is dual-stack, there are risks to using either
|
||||
Transparent Proxy or TPROXY. Both break PMTU discovery for local clients
|
||||
and can cause slow page loading and/or inability to connect to some
|
||||
sites.</para>
|
||||
</caution>
|
||||
|
||||
<section id="Transparent">
|
||||
<title>Squid as a Transparent (Interception) Proxy</title>
|
||||
|
||||
@@ -417,7 +426,8 @@ Tproxy 1 - - lo - tproxy</programli
|
||||
DIVERT eth0 0.0.0.0/0 tcp - 80
|
||||
TPROXY(3129) eth1 0.0.0.0/0 tcp 80</programlisting>
|
||||
|
||||
<para>Corresponding <filename>/etc/shorewall/mangle</filename> are:</para>
|
||||
<para>Corresponding <filename>/etc/shorewall/tcrules</filename>
|
||||
are:</para>
|
||||
|
||||
<programlisting>#MARK SOURCE DEST PROTO DPORT SPORT
|
||||
DIVERT eth0 0.0.0.0/0 tcp - 80
|
||||
|
@@ -253,7 +253,7 @@ eth0:0 192.168.1.0/24 206.124.146.178-206.124.146.180</program
|
||||
<filename>/etc/shorewall/snat</filename> is:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO PORT
|
||||
SNAT(206.124.146.178-206.24.146.80) 192.168.1.0/24 eth0</programlisting>
|
||||
SNAT(206.124.146.178-206.24.146.180) 192.168.1.0/24 eth0</programlisting>
|
||||
|
||||
<para>The above would create three IP addresses:</para>
|
||||
|
||||
|
@@ -18,7 +18,7 @@
|
||||
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2001-2016</year>
|
||||
<year>2001-2017</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
@@ -583,9 +583,9 @@ ACCEPT net:\
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>conntrack (formerly notrack)</entry>
|
||||
<entry>conntrack</entry>
|
||||
|
||||
<entry>source,dest,proto,dport,sport,user,switch</entry>
|
||||
<entry>action,source,dest,proto,dport,sport,user,switch</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
@@ -859,6 +859,15 @@ INLINE net $FW ; -m recent --rcheck 10 --hitcount 5 -
|
||||
|
||||
<programlisting>COMB_IF !70.90.191.120/29 70.90.191.121 ;; -m statistic --mode random --probability 0.50
|
||||
COMB_IF !70.90.191.120/29 70.90.191.123</programlisting>
|
||||
|
||||
<para>If the first character of the inline matches is a plus sign
|
||||
("+"), then the matches are processed before the column-oriented
|
||||
input in the rule. That is required when specifying additional TCP
|
||||
protocol parameters.</para>
|
||||
|
||||
<para>Example from action.TCPFlags:</para>
|
||||
|
||||
<programlisting>DROP - - ;;+ -p 6 --tcp-flags ALL FIN,URG,PSH</programlisting>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
@@ -234,6 +234,18 @@ cat -</programlisting>
|
||||
can be used to augment or replace functions in the standard CLI
|
||||
libraries.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><filename>enabled</filename> -- Added in Shorewall 5.1.6.
|
||||
Invoked when an optional interface or provider is successfully enabled
|
||||
using the <command>enable</command> command.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para><filename>disabled</filename> -- Added in Shorewall 5.1.6.
|
||||
Invoked when an optional interface or provider is successfully
|
||||
disabled using the <command>disable</command> command.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para><emphasis role="bold">If your version of Shorewall doesn't have the
|
||||
@@ -274,6 +286,18 @@ cat -</programlisting>
|
||||
<entry/>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>disable</entry>
|
||||
|
||||
<entry>disable</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>enable</entry>
|
||||
|
||||
<entry>enable</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>init</entry>
|
||||
|
||||
@@ -446,20 +470,14 @@ cat -</programlisting>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>CONFDIR - The configuration directory. Will be <filename
|
||||
class="directory">/etc/shorewall</filename>, <filename
|
||||
class="directory">/etc/shorewall6/</filename>, <filename
|
||||
class="directory">/etc/shorewall-lite</filename>, or <filename
|
||||
class="directory">/etc/shorewall6-lite</filename> depending on
|
||||
which product is running.</para>
|
||||
class="directory">/etc/</filename>.
|
||||
The running product is defined in the g_product variable.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>SHAREDIR - The product shared directory. Will be <filename
|
||||
class="directory">/usr/share/shorewall</filename>, <filename
|
||||
class="directory">/usr/share/shorewall6/</filename>, <filename
|
||||
class="directory">/usr/share/shorewall-lite</filename>, or
|
||||
<filename class="directory">/usr/share/shorewall6-lite</filename>
|
||||
depending on which product is running.</para>
|
||||
class="directory">/usr/share</filename>.
|
||||
The running product is defined in the g_product variable.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@@ -508,25 +526,37 @@ cat -</programlisting>
|
||||
<row>
|
||||
<entry>initdone</entry>
|
||||
|
||||
<entry>init</entry>
|
||||
<entry>disable</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>maclog</entry>
|
||||
|
||||
<entry>isusable</entry>
|
||||
<entry>enable</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>Per-chain (including those associated with
|
||||
actions)</entry>
|
||||
|
||||
<entry>start</entry>
|
||||
<entry>init</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry>postcompile</entry>
|
||||
|
||||
<entry>isusable</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry/>
|
||||
|
||||
<entry>start</entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry/>
|
||||
|
||||
<entry>started</entry>
|
||||
</row>
|
||||
|
||||
@@ -575,6 +605,44 @@ cat -</programlisting>
|
||||
</tgroup>
|
||||
</informaltable></para>
|
||||
|
||||
<para>The contents of each run-time script is placed in a shell
|
||||
function, so you can declare local variables and can use the
|
||||
<command>return</command> command. The functions generated from the
|
||||
<filename>enable</filename> and <filename>disable</filename> scripts are
|
||||
passed three arguments:</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>$1</term>
|
||||
|
||||
<listitem>
|
||||
<para>Physical name of the interface that was enabled or
|
||||
disabled.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>$2</term>
|
||||
|
||||
<listitem>
|
||||
<para>Logical name of the interface.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>$3</term>
|
||||
|
||||
<listitem>
|
||||
<para>Name of the Provider, if any, associated with the
|
||||
interface.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
<para>As described above, the function generated from the
|
||||
<filename>isusable</filename> script is passed a single argument that
|
||||
names a network interface.</para>
|
||||
|
||||
<para>With the exception of postcompile, compile-time extension scripts
|
||||
are executed using the Perl 'eval `cat
|
||||
<<emphasis>file</emphasis>>`' mechanism. Be sure that each script
|
||||
|
@@ -18,7 +18,7 @@
|
||||
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2012</year>
|
||||
<year>2017</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
Reference in New Issue
Block a user