Attachment 291950 Details for Bug 428905 – Patch file to support custom rules within RH-Firewall-1-INPUT chain

[patch] Patch file to support custom rules within RH-Firewall-1-INPUT chain

system-config-securitylevel-1.7.0-customrules.patch (text/plain), 1.93 KB, created by Larry O'Leary on 2008-01-17 03:59:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Larry O'Leary

Created: 2008-01-17 03:59:01 UTC

Size: 1.93 KB

patch

obsolete

>diff -up system-config-securitylevel-1.7.0/src/lokkit.c.customrules system-config-securitylevel-1.7.0/src/lokkit.c
>--- system-config-securitylevel-1.7.0/src/lokkit.c.customrules	2007-01-12 09:22:30.000000000 -0600
>+++ system-config-securitylevel-1.7.0/src/lokkit.c	2008-01-16 20:29:45.000000000 -0600
>@@ -44,6 +44,7 @@ struct devcb {
> };
> 
> #define CHAIN_NAME "RH-Firewall-1-INPUT"
>+#define CUST_CHAIN_NAME "RH-Firewall-Custom1-INPUT"
> #define MARK_OF_THE_MASQ 0x9
> 
> char *fwscript    = "/etc/sysconfig/iptables";
>@@ -898,6 +899,12 @@ int write_firewall(char **devs, char **m
> 	fprintf(fw, ":FORWARD ACCEPT [0:0]\n");
> 	fprintf(fw, ":OUTPUT ACCEPT [0:0]\n");
> 	fprintf(fw, ":%s - [0:0]\n", CHAIN_NAME);
>+
>+	/* If we expect a custom rules file, we need to add a custom user-defined chain named CUST_CHAIN_NAME to hold them. */
>+	if (custom_rules_file != NULL) {
>+		fprintf(fw, ":%s - [0:0]\n", CUST_CHAIN_NAME);
>+	}
>+
> 	fprintf(fw, "-A INPUT -j %s\n", CHAIN_NAME);
> 
> 	fprintf(fw, "-A %s -i lo -j ACCEPT\n", CHAIN_NAME);
>@@ -931,6 +938,11 @@ int write_firewall(char **devs, char **m
> 			        CHAIN_NAME, ports[i].proto, ports[i].proto, ports[i].start_port,
>                                 ports[i].end_port);
>         }
>+	
>+	/* If we expect a custom rules file, we need to add a jump target to the CUST_CHAIN_NAME chain. */
>+	if (custom_rules_file != NULL) {
>+		fprintf(fw, "-A %s -j %s\n", CHAIN_NAME, CUST_CHAIN_NAME);
>+	}
> 
> 	fprintf(fw, "-A %s -j REJECT --reject-with icmp-host-prohibited\n", CHAIN_NAME);
> 	fprintf(fw, "-A FORWARD -j REJECT --reject-with icmp-host-prohibited\n");
>@@ -957,6 +969,7 @@ int write_firewall(char **devs, char **m
> 	}
> 
> 	/* Allow the user to include their own rules after all the default stuff. */
>+	/* If the user adds rules to the CUST_CHAIN_NAME chain, they will be evaluated prior to the REJECT target in the CHAIN_NAME chain. */ 
> 	if (custom_rules_file != NULL) {
> 		FILE *f = fopen(custom_rules_file, "r");
> 		int numread = 0;

Actions: View | Diff

Attachments on bug 428905: 291950