sad/firehol
1
0
Fork 0
mirror of https://github.com/firehol/firehol.git synced 2024-06-30 19:02:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
610 Commits 5 Branches 37 Tags 5.2 MiB
32cfc9a1a6
Commit Graph

21 Commits

Author SHA1 Message Date
Phil Whineray
32cfc9a1a6 Fix behaviour of condrestart to be standard 
See http://fedoraproject.org/wiki/Packaging:SysVInitScript#Required_Actions
 2013-10-28 22:31:14 +00:00
Phil Whineray
d3c1347152 Add an easy way to switch on bash debugging 2013-10-28 22:31:14 +00:00
Phil Whineray
d4cc61074a Fix iptables intrapositioned negation --mac-source 
- All other examples already correct (--tos, --state)
 - Went from deprecated in iptables 1.4.3 (Mar 2009)
   to not working in iptables 1.4.13 (Jul 2011)
 - Thanks to Alexander Prokopyev
 2013-10-28 22:31:14 +00:00
Phil Whineray
84bfb2d437 Allow some configuration to be set by environment 
- Variables that can now be set by environment variables:
     FIREHOL_ESTABLISHED_ACTIVATION_ACCEPT
     FIREHOL_FORWARD_ACTIVATION_POLICY
     FIREHOL_INPUT_ACTIVATION_POLICY
     FIREHOL_OUTPUT_ACTIVATION_POLICY
     FIREHOL_AUTOSAVE
     FIREHOL_LOAD_KERNEL_MODULES
     FIREHOL_NAT
     FIREHOL_ROUTING
 - This can still _only_ be set by an environment variable:
     WAIT_FOR_IFACE
 2013-10-28 22:31:14 +00:00
Phil Whineray
224491aaf3 Do not try to add DROP rules to NAT chains 
- It is no longer possible (and was never really needed).

 - Patch derived from the one attached here by Andrew Schulman:
     http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=536675
 2013-10-28 22:31:14 +00:00
Phil Whineray
ff16e7f7f4 Replace use of netstat with ss 
Originally submitted for firehol by Jiri Popelka:
  http://sourceforge.net/support/tracker.php?aid=3523571

Notes:
  - ip has long been used in firehol, it made good sense to use ss, which
    is from the same package

  - ss will list some IPv4 addresses in the form ::ffff:192.168.122.1
    which the original patch does not allow for, fixed here

Bug reports:
  https://bugzilla.redhat.com/show_bug.cgi?id=784520
 2013-10-28 22:31:14 +00:00
Phil Whineray
2d5c420a27 Added alias tomcat for httpalt 2013-10-28 22:31:14 +00:00
Phil Whineray
98d3a41c94 Clean up service definitions 
Descriptions are maintained separately in doc/services-db.data
 2013-10-28 22:31:14 +00:00
Phil Whineray
0143f3ef9d Remove ecn_shame helper 
- The list that was used (http://urchin.earth.li/cgi-bin/ecn.pl?output=ip)
   is no longer available
 2013-10-28 22:31:14 +00:00
Phil Whineray
6f1ec0f47a Stop warnings when -- is passed after start 
Parameters after -- are passed to the config script, so there is no need
to warn about extra parameters after some commands (e.g. start).
 2013-10-28 22:31:14 +00:00
Phil Whineray
b733cbd955 Apply Gentoo patch firehol-1.273-CVE-2008-4953 
File: firehol-1.273-CVE-2008-4953.patch (CVS rev 1.1)
Purpose: Cleanup temporary directory handling and fix (very slim)
         opportunity for symlink attack
 2013-10-28 22:31:14 +00:00
Phil Whineray
79b96eea63 Apply Gentoo patch firehol-1.273-log-output 
File: firehol-1.273-log-output.patch (CVS rev 1.1)
Purpose: Ensure all error output goes to stderr
 2013-10-28 22:31:14 +00:00
Phil Whineray
e8c1ef9b03 Add further command alternatives for other systems 
With the following additional choices, firehol can be made to run
on an openwrt system:
  awk if gawk is not available
  insmod if modprobe is not available
  nothing if renice is not available
 2013-10-28 22:31:14 +00:00
Phil Whineray
7259383401 Remove 10.0.0.0/8 from RESERVED_IPS 
Leave in PRIVATE_IPS where it belongs.
 2013-10-28 22:31:14 +00:00
Phil Whineray
c78a372dcf Deal with new variants on Kernel versions 
- Such as 3.8-1-amd64
 - Thanks to Cristian Ionescu-Idbohrn
 2013-10-28 22:31:14 +00:00
Phil Whineray
0c9c17b3e1 Updates from Debian/Ubuntu 
Via Tomas Jacik <tomas.jacik@sunfox.cz>
    - added ipv6 regex while searching for RESERVED adresses
    - fixed msn port
    - added OpenVPN port
    - added Nagios NRPE daemon port
    - added default firehol setting probing for debian based systems
    - added wizzard support wlan
    - added wait for interface feature
      Unlike the original patch, this does not source /etc/default/firehol,
      instead we honour the WAIT_FOR_IFACE environment variable if it is set.
      The debian init script needs to export it, as it does for the sanewall
      package.
 2013-10-28 22:31:14 +00:00
Phil Whineray
d0f05d72f7 Implement version numbers 
Using a combination of git attributes, ident and export-subst.
  - Scripts use Format: to emit tag or commit when exported
    or file Id if direct from git
  - configure script uses same mechanisms but cannot do a make dist
  - Brought bolierplate in line for both scripts
 2013-10-28 20:06:21 +00:00
Phil Whineray
224b1ac9d4 Clean up version information boilerplate 
- Use Official GPL stanza in firehol.in
   From: Jari Aalto <jari.aalto@cante.net>
 - Point to the mailing list for announcements
 - Single copy of the version information boilerplate

Conflicts:
	sbin/firehol.in
 2013-10-28 20:06:21 +00:00
Phil Whineray
0d3a7ab858 Merge remote-tracking branch 'origin/development' 
Conflicts:
	doc/commands.html
	sbin/firehol.in

Brought the various additions in line with the autotools layout and
docbook documentation.
 2013-10-23 23:56:00 +01:00
Phil Whineray
adf56f211a Remove checking of MINOR number in service files 2013-10-15 22:25:21 +01:00
Phil Whineray
f4f8500305 Move to autotools 
- Can still be installed just by copying firehol/firehol.in
 - CVS versions will not work any longer, so now following
   http://semver.org/
 - Git commit hooks included to enforce version numbering
   across the various files, NEWS, ChangeLog, configure.ac and
   sbin/firehol.in
 - Replace HTML website copy with DocBook manual
 2013-10-15 22:25:17 +01:00