sad/firehol
1
0
Fork 0
mirror of https://github.com/firehol/firehol.git synced 2024-06-30 19:02:21 +00:00
Code Issues Packages Projects Releases Wiki Activity
633 Commits 5 Branches 37 Tags 5.2 MiB
62a969547a
Commit Graph

38 Commits

Author SHA1 Message Date
Phil Whineray
62a969547a Allow independent setting of ipv4 and ipv6 src/dst 2013-11-10 12:40:28 +00:00
Phil Whineray
ed8e75ece3 Prevent arbitrary namespace switches 
For instance, creating an ipv4 rule in an ipv6 interface must be prevented
Also, cache the current namespace to improve performance
 2013-11-10 12:38:37 +00:00
Phil Whineray
8e63720554 Make rule_action_param() ip(6)tables use explicit 2013-11-10 11:35:00 +00:00
Phil Whineray
fc717a28d9 Split processing for IPv4 and IPv6 addresses 2013-11-10 11:28:23 +00:00
Phil Whineray
9d3c3c9e6d Move all single-value options outside rules loop 2013-11-10 10:58:00 +00:00
Phil Whineray
6612b20897 Fix both dynamic counters 2013-11-05 07:36:55 +00:00
Phil Whineray
419569a294 Another small fix 2013-11-05 07:36:55 +00:00
Phil Whineray
96287be98b Use ip6tables or iptables according to namespace 2013-11-05 07:36:55 +00:00
Phil Whineray
df50d6cb29 Fixes to saving files 2013-11-05 07:36:16 +00:00
Phil Whineray
c2b57c7701 Initial IPv6 work 
Save and restore ip6tables as well as iptables state
Stop, status and panic apply to IPv6 as well as IPv4
Start will create an empty IPv6 firewall with policy applied
 2013-11-05 07:36:16 +00:00
Phil Whineray
0204a8ecde Make FIREHOL_FAST_ACTIVATION environment-settable 
Especially useful when running comparison tests
 2013-11-02 10:18:31 +00:00
Phil Whineray
5a82954aae Use flock(1) instead of lockfile(1) 
- Introduces a dependency on util-linux (rather than procmail)
- Exit immediately if we cannot create lockfile when using flock
 2013-11-02 09:59:53 +00:00
Phil Whineray
6a544f8c0e Improve worst-case error handling 
- When the generated script fails but we don't know why
   we now leave the temporary files behind
 - Ensure execution happens in current shell context so we don't
   lose variables defined as part of the configuration

Conflicts:
	sbin/firehol.in
 2013-11-01 13:26:13 +00:00
Phil Whineray
8ee20457ee Use FIREHOL_ESTABLISHED_ACTIVATION_ACCEPT 
In non fast-activation mode and if set to 1 (the default), will emit
temporary rules to allow established traffic to continue even when
the activation policy is DENY. The temporary rules are deleted when
the firewall is complete.
 2013-10-29 22:14:23 +00:00
Phil Whineray
401be40a00 Fix non-detection of iptables error status 
Problem was introduced in commit d3c134715275d07bc76131a6187903aca4ad3535
(Add an easy way to switch on bash debugging) where the status was saved
after showing the output, not before.
 2013-10-29 21:16:06 +00:00
Phil Whineray
d53a78d885 Make activation policy part of initial chain setup 2013-10-28 22:31:14 +00:00
Phil Whineray
b1dd501162 Slight improvements to wizard output 
- Do not output a blank line at the top
 - Do not emit a #! line - configurations cannot be used in this way
 2013-10-28 22:31:14 +00:00
Phil Whineray
32cfc9a1a6 Fix behaviour of condrestart to be standard 
See http://fedoraproject.org/wiki/Packaging:SysVInitScript#Required_Actions
 2013-10-28 22:31:14 +00:00
Phil Whineray
d3c1347152 Add an easy way to switch on bash debugging 2013-10-28 22:31:14 +00:00
Phil Whineray
d4cc61074a Fix iptables intrapositioned negation --mac-source 
- All other examples already correct (--tos, --state)
 - Went from deprecated in iptables 1.4.3 (Mar 2009)
   to not working in iptables 1.4.13 (Jul 2011)
 - Thanks to Alexander Prokopyev
 2013-10-28 22:31:14 +00:00
Phil Whineray
84bfb2d437 Allow some configuration to be set by environment 
- Variables that can now be set by environment variables:
     FIREHOL_ESTABLISHED_ACTIVATION_ACCEPT
     FIREHOL_FORWARD_ACTIVATION_POLICY
     FIREHOL_INPUT_ACTIVATION_POLICY
     FIREHOL_OUTPUT_ACTIVATION_POLICY
     FIREHOL_AUTOSAVE
     FIREHOL_LOAD_KERNEL_MODULES
     FIREHOL_NAT
     FIREHOL_ROUTING
 - This can still _only_ be set by an environment variable:
     WAIT_FOR_IFACE
 2013-10-28 22:31:14 +00:00
Phil Whineray
224491aaf3 Do not try to add DROP rules to NAT chains 
- It is no longer possible (and was never really needed).

 - Patch derived from the one attached here by Andrew Schulman:
     http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=536675
 2013-10-28 22:31:14 +00:00
Phil Whineray
ff16e7f7f4 Replace use of netstat with ss 
Originally submitted for firehol by Jiri Popelka:
  http://sourceforge.net/support/tracker.php?aid=3523571

Notes:
  - ip has long been used in firehol, it made good sense to use ss, which
    is from the same package

  - ss will list some IPv4 addresses in the form ::ffff:192.168.122.1
    which the original patch does not allow for, fixed here

Bug reports:
  https://bugzilla.redhat.com/show_bug.cgi?id=784520
 2013-10-28 22:31:14 +00:00
Phil Whineray
2d5c420a27 Added alias tomcat for httpalt 2013-10-28 22:31:14 +00:00
Phil Whineray
98d3a41c94 Clean up service definitions 
Descriptions are maintained separately in doc/services-db.data
 2013-10-28 22:31:14 +00:00
Phil Whineray
0143f3ef9d Remove ecn_shame helper 
- The list that was used (http://urchin.earth.li/cgi-bin/ecn.pl?output=ip)
   is no longer available
 2013-10-28 22:31:14 +00:00
Phil Whineray
6f1ec0f47a Stop warnings when -- is passed after start 
Parameters after -- are passed to the config script, so there is no need
to warn about extra parameters after some commands (e.g. start).
 2013-10-28 22:31:14 +00:00
Phil Whineray
b733cbd955 Apply Gentoo patch firehol-1.273-CVE-2008-4953 
File: firehol-1.273-CVE-2008-4953.patch (CVS rev 1.1)
Purpose: Cleanup temporary directory handling and fix (very slim)
         opportunity for symlink attack
 2013-10-28 22:31:14 +00:00
Phil Whineray
79b96eea63 Apply Gentoo patch firehol-1.273-log-output 
File: firehol-1.273-log-output.patch (CVS rev 1.1)
Purpose: Ensure all error output goes to stderr
 2013-10-28 22:31:14 +00:00
Phil Whineray
e8c1ef9b03 Add further command alternatives for other systems 
With the following additional choices, firehol can be made to run
on an openwrt system:
  awk if gawk is not available
  insmod if modprobe is not available
  nothing if renice is not available
 2013-10-28 22:31:14 +00:00
Phil Whineray
7259383401 Remove 10.0.0.0/8 from RESERVED_IPS 
Leave in PRIVATE_IPS where it belongs.
 2013-10-28 22:31:14 +00:00
Phil Whineray
c78a372dcf Deal with new variants on Kernel versions 
- Such as 3.8-1-amd64
 - Thanks to Cristian Ionescu-Idbohrn
 2013-10-28 22:31:14 +00:00
Phil Whineray
0c9c17b3e1 Updates from Debian/Ubuntu 
Via Tomas Jacik <tomas.jacik@sunfox.cz>
    - added ipv6 regex while searching for RESERVED adresses
    - fixed msn port
    - added OpenVPN port
    - added Nagios NRPE daemon port
    - added default firehol setting probing for debian based systems
    - added wizzard support wlan
    - added wait for interface feature
      Unlike the original patch, this does not source /etc/default/firehol,
      instead we honour the WAIT_FOR_IFACE environment variable if it is set.
      The debian init script needs to export it, as it does for the sanewall
      package.
 2013-10-28 22:31:14 +00:00
Phil Whineray
d0f05d72f7 Implement version numbers 
Using a combination of git attributes, ident and export-subst.
  - Scripts use Format: to emit tag or commit when exported
    or file Id if direct from git
  - configure script uses same mechanisms but cannot do a make dist
  - Brought bolierplate in line for both scripts
 2013-10-28 20:06:21 +00:00
Phil Whineray
224b1ac9d4 Clean up version information boilerplate 
- Use Official GPL stanza in firehol.in
   From: Jari Aalto <jari.aalto@cante.net>
 - Point to the mailing list for announcements
 - Single copy of the version information boilerplate

Conflicts:
	sbin/firehol.in
 2013-10-28 20:06:21 +00:00
Phil Whineray
0d3a7ab858 Merge remote-tracking branch 'origin/development' 
Conflicts:
	doc/commands.html
	sbin/firehol.in

Brought the various additions in line with the autotools layout and
docbook documentation.
 2013-10-23 23:56:00 +01:00
Phil Whineray
adf56f211a Remove checking of MINOR number in service files 2013-10-15 22:25:21 +01:00
Phil Whineray
f4f8500305 Move to autotools 
- Can still be installed just by copying firehol/firehol.in
 - CVS versions will not work any longer, so now following
   http://semver.org/
 - Git commit hooks included to enforce version numbering
   across the various files, NEWS, ChangeLog, configure.ac and
   sbin/firehol.in
 - Replace HTML website copy with DocBook manual
 2013-10-15 22:25:17 +01:00