-
Notifications
You must be signed in to change notification settings - Fork 9
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Make iptables-restore backend flushing
Before this change, the `iptables-restore` binary was called with the `--noflush` option. The idea was that DFW would not take over the entire tables, but rather only concern itself with its own rules. As it turns out, this had some disadvantages. It was extremely hard to control: * the rules in the default chains that jump to the DFW chains, * the contents of DFW's own chains. Both of these issues were solved by simply ommitting the `--noflush` flag and thus controlling the touched tables -- `nat` and `filter` -- in their entirety. This means that this is a breaking change: where before external rules would have stayed unchanged -- as long as the user didn't supply any such initialization rules -- any external rules are now simply overwritten without regard. If the user requires custom rules apart from the ones generated by DFW, they can still use the "initialization" section of the configuration. (Additionally, this refactors the internal fields of `IPTablesRestore`, which unveiled that rules passed through `IPTablesRestore::execute` were not applied before. This has been fixed.)
- Loading branch information
Showing
13 changed files
with
155 additions
and
99 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,17 @@ | ||
| - *filter | ||
| - :DFWRS_FORWARD - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - :DFWRS_INPUT - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - -F DFWRS_INPUT | ||
| - -P INPUT ACCEPT | ||
| - -A DFWRS_INPUT -m state --state INVALID -j DROP | ||
| - -A DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - -A DFWRS_FORWARD -m state --state INVALID -j DROP | ||
| - -A DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - COMMIT | ||
| - *nat | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - :DFWRS_PREROUTING - [0:0] | ||
| - -F DFWRS_PREROUTING | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - -F DFWRS_POSTROUTING | ||
| - COMMIT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,16 @@ | ||
| - *filter | ||
| - :DFWRS_FORWARD - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - :DFWRS_INPUT - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - -F DFWRS_INPUT | ||
| - -A DFWRS_INPUT -m state --state INVALID -j DROP | ||
| - -A DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - -A DFWRS_FORWARD -m state --state INVALID -j DROP | ||
| - -A DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - COMMIT | ||
| - *nat | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - :DFWRS_PREROUTING - [0:0] | ||
| - -F DFWRS_PREROUTING | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - -F DFWRS_POSTROUTING | ||
| - COMMIT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,16 @@ | ||
| - *filter | ||
| - :DFWRS_FORWARD - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - :DFWRS_INPUT - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - -F DFWRS_INPUT | ||
| - -A DFWRS_INPUT -m state --state INVALID -j DROP | ||
| - -A DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - -A DFWRS_FORWARD -m state --state INVALID -j DROP | ||
| - -A DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - COMMIT | ||
| - *nat | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - :DFWRS_PREROUTING - [0:0] | ||
| - -F DFWRS_PREROUTING | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - -F DFWRS_POSTROUTING | ||
| - COMMIT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,16 @@ | ||
| - *filter | ||
| - :DFWRS_FORWARD - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - :DFWRS_INPUT - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - -F DFWRS_INPUT | ||
| - -A DFWRS_INPUT -m state --state INVALID -j DROP | ||
| - -A DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - -A DFWRS_FORWARD -m state --state INVALID -j DROP | ||
| - -A DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - COMMIT | ||
| - *nat | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - :DFWRS_PREROUTING - [0:0] | ||
| - -F DFWRS_PREROUTING | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - -F DFWRS_POSTROUTING | ||
| - COMMIT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,16 @@ | ||
| - *filter | ||
| - :DFWRS_FORWARD - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - :DFWRS_INPUT - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - -F DFWRS_INPUT | ||
| - -A DFWRS_INPUT -m state --state INVALID -j DROP | ||
| - -A DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - -A DFWRS_FORWARD -m state --state INVALID -j DROP | ||
| - -A DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - COMMIT | ||
| - *nat | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - :DFWRS_PREROUTING - [0:0] | ||
| - -F DFWRS_PREROUTING | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - -F DFWRS_POSTROUTING | ||
| - COMMIT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,16 @@ | ||
| - *filter | ||
| - :DFWRS_FORWARD - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - :DFWRS_INPUT - [0:0] | ||
| - -F DFWRS_FORWARD | ||
| - -F DFWRS_INPUT | ||
| - -A DFWRS_INPUT -m state --state INVALID -j DROP | ||
| - -A DFWRS_INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - -A DFWRS_FORWARD -m state --state INVALID -j DROP | ||
| - -A DFWRS_FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT | ||
| - COMMIT | ||
| - *nat | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - :DFWRS_PREROUTING - [0:0] | ||
| - -F DFWRS_PREROUTING | ||
| - :DFWRS_POSTROUTING - [0:0] | ||
| - -F DFWRS_POSTROUTING | ||
| - COMMIT |
Oops, something went wrong.