Attachment 156736 Details for Bug 243741 – Patch for state module usage.

Patch for state module usage.

system-config-securitylevel-1.6.29.1-v6state.patch (text/x-patch), 1.71 KB, created by Thomas Woerner on 2007-06-11 16:45:36 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Woerner

Created: 2007-06-11 16:45:36 UTC

Size: 1.71 KB

patch

obsolete

>--- system-config-securitylevel-1.6.29.1/src/lokkit.c.v6state	2006-12-14 17:40:11.000000000 +0100
>+++ system-config-securitylevel-1.6.29.1/src/lokkit.c	2007-06-06 17:04:30.000000000 +0200
>@@ -1029,33 +1029,17 @@
> 	fprintf(fw, "-A %s -p udp -m udp --dport 631 -j ACCEPT\n", CHAIN_NAME);
> 	fprintf(fw, "-A %s -p tcp -m tcp --dport 631 -j ACCEPT\n", CHAIN_NAME);
> 
>-	/* Allow outgoing connections */
>-	fprintf(fw, "-A %s -p udp -m udp --dport 32768:61000 -j ACCEPT\n", CHAIN_NAME);
>-	fprintf(fw, "-A %s -p tcp -m tcp --dport 32768:61000 -j ACCEPT\n", CHAIN_NAME);
>-
> 	/* Note: The RELATED is extremely important as it matches ICMP error messages. */
>-	/* fprintf(fw, "-A %s -m state --state ESTABLISHED,RELATED -j ACCEPT\n", CHAIN_NAME); */
>+	fprintf(fw, "-A %s -m state --state ESTABLISHED,RELATED -j ACCEPT\n", CHAIN_NAME);
> 
> 	for (i=0; ports && ports[i].start_port; i++) {
>-                if (ports[i].end_port == 0) {
>-			fprintf(fw, "-A %s -m %s -p %s --dport %d -j ACCEPT\n",
>-			        CHAIN_NAME, ports[i].proto, ports[i].proto,
>-				ports[i].start_port);
>-		}
>-/*
>+                if (ports[i].end_port == 0)
> 		        fprintf(fw, "-A %s -m state --state NEW -m %s -p %s --dport %d -j ACCEPT\n",
> 			        CHAIN_NAME, ports[i].proto, ports[i].proto, ports[i].start_port);
>-*/
>-                else {
>-			fprintf(fw, "-A %s -m %s -p %s --dport %d:%d -j ACCEPT\n",
>-			        CHAIN_NAME, ports[i].proto, ports[i].proto,
>-				ports[i].start_port, ports[i].end_port);
>-		}
>-/*
>+                else
> 		        fprintf(fw, "-A %s -m state --state NEW -m %s -p %s --dport %d:%d -j ACCEPT\n",
> 			        CHAIN_NAME, ports[i].proto, ports[i].proto, ports[i].start_port,
>                                 ports[i].end_port);
>-*/
>         }
> 
>

Actions: View

Attachments on bug 243741: 156736