Correct handling of dbl=src_dst in interface OPTIONS

Signed-off-by: Tom Eastep <teastep@shorewall.net>
Check for linkdown in interface_is_usable() rather than ..._is_up().
2018-05-18 10:18:09 -07:00 · 2018-05-18 07:56:06 -07:00 · 2018-05-12 08:09:46 -07:00 · 2018-05-10 11:12:23 -07:00 · 2018-05-10 09:30:02 -07:00 · 2018-05-06 13:31:54 -07:00
3 changed files with 9 additions and 5 deletions
--- a/Shorewall/Perl/Shorewall/Config.pm
+++ b/Shorewall/Perl/Shorewall/Config.pm
@@ -2529,6 +2529,10 @@ sub split_rawline2( $$;$$$ ) {
    # Delete trailing comment
    #
    $currentline =~ s/\s*#.*//;
+    #
+    # Convert ${...} to $...
+    #
+    $currentline =~ s/\$\{(.*?)\}/\$$1/g;

    my @result = &split_line2( @_ );

@@ -5459,7 +5463,7 @@ sub update_config_file( $ ) {
 	update_default( 'BLACKLIST_DEFAULT', 'AllowICMPs,dropBcasts,dropNotSyn,dropInvalid' );
    }

-    for ( qw/DROP_DEFAULT REJECT_DEFAULT/ ) {
+    for ( qw/DROP_DEFAULT REJECT_DEFAULT BLACKLIST_DEFAULT/ ) {
 	my $policy = $config{ $_ };

 	if ( $policy =~ /\bA_(?:Drop|Reject)\b/ ) {
@@ -6599,7 +6603,7 @@ sub get_configuration( $$$ ) {
    default_yes_no 'BALANCE_PROVIDERS'          , $config{USE_DEFAULT_RT} ? 'Yes' : '';
    default_yes_no 'USE_NFLOG_SIZE'             , '';

-    if ( ( $val = $config{AUTOMAKE} ) !~ /^[Rr]ecursive$/ ) {
+    if ( ( $val = ( $config{AUTOMAKE} || '' ) ) !~ /^[Rr]ecursive$/ ) {
 	default_yes_no( 'AUTOMAKE' , '' ) unless $val && $val =~ /^\d{1,2}$/;
    }

--- a/Shorewall/Perl/Shorewall/Misc.pm
+++ b/Shorewall/Perl/Shorewall/Misc.pm
@@ -810,7 +810,7 @@ sub add_common_rules ( $ ) {
 		    $dbl_dst_target = $dbl_src_target;
 		}		    
 	    } elsif ( $dbl_level ) {
-		my $chainref = set_optflags( new_standard_chain( $dbl_src_target = 'dbl_log' ) , DONT_OPTIMIZE | DONT_DELETE );
+		my $chainref = set_optflags( new_standard_chain( $dbl_src_target = $dbl_dst_target = 'dbl_log' ) , DONT_OPTIMIZE | DONT_DELETE );

 		log_rule_limit( $dbl_level,
 				$chainref,
--- a/Shorewall/Perl/lib.runtime
+++ b/Shorewall/Perl/lib.runtime
@@ -675,7 +675,7 @@ interface_is_usable() # $1 = interface
    status=0

    if ! loopback_interface $1; then
-	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != 0.0.0.0 ]; then
+	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != 0.0.0.0 ] && [ -z "$($IP -$g_family link list dev $1 2> /dev/null | fgrep 'state DOWN')" ]; then
 	    if [ "$COMMAND" != enable ]; then
 		[ ! -f ${VARDIR}/${1}_disabled ] && run_isusable_exit $1
 		status=$?
@@ -1101,7 +1101,7 @@ interface_is_usable() # $1 = interface
    status=0

    if [ "$1" != lo ]; then
-	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != :: ]; then
+	if interface_is_up $1 && [ "$(find_first_interface_address_if_any $1)" != :: ] && [ -z "$($IP -$g_family link list dev $1 2> /dev/null | fgrep 'state DOWN')" ]; then
 	    if [ "$COMMAND" != enable ]; then
 		[ ! -f ${VARDIR}/${1}_disabled ] && run_isusable_exit $1
 		status=$?
Author	SHA1	Message	Date
Tom Eastep	ec21b03c5b	Correct handling of dbl=src_dst in interface OPTIONS Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-18 10:18:09 -07:00
Tom Eastep	25dcf8c5d6	Check for linkdown in interface_is_usable() rather than ..._is_up(). Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-18 07:56:06 -07:00
Tom Eastep	c02b71b530	Correct interface_is_up() to look for the 'state' as well as 'UP' Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-12 08:09:46 -07:00
Tom Eastep	78269d57bc	Handle missing AUTOMAKE Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-10 11:12:23 -07:00
Tom Eastep	fc91648315	Avoid split_line2 confusion when processing a raw line Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-10 09:30:02 -07:00
Tom Eastep	067f435ac5	Update BLACKLIST_DEFAULT if Drop or Reject Signed-off-by: Tom Eastep <teastep@shorewall.net>	2018-05-06 13:31:54 -07:00