On 06/04/2011 07:58 AM, Steven Jan Springl wrote: > On Saturday 04 June 2011 15:42:55 Tom Eastep wrote:
> Confirmed, that's fixed it. Thanks, Steven Here's another patch that corrects the handling of the 'audit' option in the blacklist file. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
diff --git a/Shorewall/Perl/Shorewall/Misc.pm b/Shorewall/Perl/Shorewall/Misc.pm
index 8a48a7b..8394c0e 100644
--- a/Shorewall/Perl/Shorewall/Misc.pm
+++ b/Shorewall/Perl/Shorewall/Misc.pm
@@ -203,7 +203,7 @@ sub setup_blacklist() {
my $chainref;
my $chainref1;
my ( $level, $disposition ) = @config{'BLACKLIST_LOGLEVEL', 'BLACKLIST_DISPOSITION' };
- my $audit = $disposition =~ s/^A_//;
+ my $audit = $disposition =~ /^A_/;
my $target = $disposition eq 'REJECT' ? 'reject' : $disposition;
my $orig_target = $target;
@@ -218,6 +218,9 @@ sub setup_blacklist() {
if ( defined $level && $level ne '' ) {
my $logchainref = new_standard_chain 'blacklog';
+ $target =~ s/A_//;
+ $target = 'reject' if $target eq 'REJECT';
+
log_rule_limit( $level , $logchainref , 'blacklst' , $disposition , "$globals{LOGLIMIT}" , '', 'add', '' );
if ( $audit ) {
@@ -233,7 +236,7 @@ sub setup_blacklist() {
$target = 'blacklog';
} elsif ( $audit ) {
require_capability 'AUDIT_TARGET', "BLACKLIST_DISPOSITION=$disposition", 's';
- $target = verify_audit( $config{BLACKLIST_DISPOSITION} );
+ $target = verify_audit( $disposition );
}
}
@@ -259,7 +262,11 @@ sub setup_blacklist() {
my ( $networks, $protocol, $ports, $options ) = split_line 1, 4, 'blacklist file';
- $options = 'src' if $options eq '-';
+ if ( $options eq '-' ) {
+ $options = 'src';
+ } elsif ( $options eq 'audit' ) {
+ $options = 'audit,src';
+ }
my ( $to, $from, $whitelist, $auditone ) = ( 0, 0, 0, 0 );
@@ -284,7 +291,7 @@ sub setup_blacklist() {
- $tgt = verify_audit( 'A_' . $target, $orig_target );
+ $tgt = verify_audit( 'A_' . $target, $orig_target, $target );
}
}
diff --git a/Shorewall/Perl/Shorewall/Rules.pm b/Shorewall/Perl/Shorewall/Rules.pm
index 5e2b0b0..0b8d805 100644
--- a/Shorewall/Perl/Shorewall/Rules.pm
+++ b/Shorewall/Perl/Shorewall/Rules.pm
@@ -648,7 +648,7 @@ sub complete_standard_chain ( $$$$ ) {
policy_rules $stdchainref , $policy , $loglevel, $defaultaction, 0;
}
-sub require_audit($$);
+sub require_audit($$;$);
#
# Create and populate the synflood chains corresponding to entries in /etc/shorewall/policy
@@ -1136,8 +1136,8 @@ sub map_old_actions( $ ) {
#
# Create and populate the passed AUDIT chain if it doesn't exist. Return chain name
-sub ensure_audit_chain( $;$ ) {
- my ( $target, $action ) = @_;
+sub ensure_audit_chain( $;$$ ) {
+ my ( $target, $action, $tgt ) = @_;
push_comment( '' );
@@ -1149,7 +1149,9 @@ sub ensure_audit_chain( $;$ ) {
unless ( $action ) {
$action = $target;
$action =~ s/^A_//;
- }
+ }
+
+ $tgt ||= $action;
if ( $config{FAKE_AUDIT} ) {
add_rule( $ref, '-j AUDIT -m comment --comment "--type ' . lc $action . '"' );
@@ -1157,10 +1159,11 @@ sub ensure_audit_chain( $;$ ) {
add_rule $ref, '-j AUDIT --type ' . lc $action;
}
- if ( $action eq 'REJECT' ) {
+
+ if ( $tgt eq 'REJECT' ) {
add_jump $ref , 'reject', 1;
} else {
- add_jump $ref , $action, 0;
+ add_jump $ref , $tgt, 0;
}
}
@@ -1173,8 +1176,8 @@ sub ensure_audit_chain( $;$ ) {
# Return the appropriate target based on whether the second argument is 'audit'
#
-sub require_audit($$) {
- my ($action, $audit ) = @_;
+sub require_audit($$;$) {
+ my ($action, $audit, $tgt ) = @_;
return $action unless defined $audit and $audit ne '';
@@ -1184,7 +1187,7 @@ sub require_audit($$) {
require_capability 'AUDIT_TARGET', 'audit', 's';
- return ensure_audit_chain $target, $action;
+ return ensure_audit_chain $target, $action, $tgt;
}
#
@@ -1632,12 +1635,12 @@ sub process_macro ( $$$$$$$$$$$$$$$$$ ) {
#
# Confirm that we have AUDIT_TARGET capability and ensure the appropriate AUDIT chain.
#
-sub verify_audit($;$) {
- my ($target, $audit ) = @_;
+sub verify_audit($;$$) {
+ my ($target, $audit, $tgt ) = @_;
require_capability 'AUDIT_TARGET', "$target rules", '';
- return ensure_audit_chain $target, $audit;
+ return ensure_audit_chain $target, $audit, $tgt;
}
#
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Simplify data backup and recovery for your virtual environment with vRanger. Installation's a snap, and flexible recovery options mean your data is safe, secure and there when you need it. Discover what all the cheering's about. Get your free trial download today. http://p.sf.net/sfu/quest-dev2dev2
_______________________________________________ Shorewall-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-devel
