diff options
17 files changed, 65 insertions, 0 deletions
diff --git a/lib/Vyatta/IpTables/Rule.pm b/lib/Vyatta/IpTables/Rule.pm index fa7a0e5..9cbd303 100644 --- a/lib/Vyatta/IpTables/Rule.pm +++ b/lib/Vyatta/IpTables/Rule.pm @@ -28,6 +28,15 @@ my %fields = ( _non_frag => undef, _recent_time => undef, _recent_cnt => undef, + _p2p => { + _all => undef, + _apple => undef, + _bit => undef, + _dc => undef, + _edk => undef, + _gnu => undef, + _kazaa => undef, + }, ); my %dummy_rule = ( @@ -51,6 +60,15 @@ my %dummy_rule = ( _non_frag => undef, _recent_time => undef, _recent_cnt => undef, + _p2p => { + _all => undef, + _apple => undef, + _bit => undef, + _dc => undef, + _edk => undef, + _gnu => undef, + _kazaa => undef, + }, ); sub new { @@ -99,6 +117,14 @@ sub setup { $self->{_non_frag} = $config->exists("fragment match-non-frag"); $self->{_recent_time} = $config->returnValue('recent time'); $self->{_recent_cnt} = $config->returnValue('recent count'); + + $self->{_p2p}->{_all} = $config->exists("p2p all"); + $self->{_p2p}->{_apple} = $config->exists("p2p applejuice"); + $self->{_p2p}->{_bit} = $config->exists("p2p bittorrent"); + $self->{_p2p}->{_dc} = $config->exists("p2p directconnect"); + $self->{_p2p}->{_edk} = $config->exists("p2p edonkey"); + $self->{_p2p}->{_gnu} = $config->exists("p2p gnutella"); + $self->{_p2p}->{_kazaa} = $config->exists("p2p kazaa"); # TODO: need $config->exists("$level source") in Vyatta::Config.pm $src->setup("$level source"); @@ -137,6 +163,14 @@ sub setupOrig { $self->{_recent_time} = $config->returnOrigValue('recent time'); $self->{_recent_cnt} = $config->returnOrigValue('recent count'); + $self->{_p2p}->{_all} = $config->existsOrig("p2p all"); + $self->{_p2p}->{_apple} = $config->existsOrig("p2p applejuice"); + $self->{_p2p}->{_bit} = $config->existsOrig("p2p bittorrent"); + $self->{_p2p}->{_dc} = $config->existsOrig("p2p directconnect"); + $self->{_p2p}->{_edk} = $config->existsOrig("p2p edonkey"); + $self->{_p2p}->{_gnu} = $config->existsOrig("p2p gnutella"); + $self->{_p2p}->{_kazaa} = $config->existsOrig("p2p kazaa"); + # TODO: need $config->exists("$level source") in Vyatta::Config.pm $src->setupOrig("$level source"); $dst->setupOrig("$level destination"); @@ -286,6 +320,21 @@ sub rule { } } + my $p2p = undef; + if (defined($self->{_p2p}->{_all})) { + $p2p = '--apple --bit --dc --edk --gnu --kazaa '; + } else { + my @apps = qw(apple bit dc edk gnu kazaa); + foreach (@apps) { + if (defined($self->{_p2p}->{"_$_"})) { + $p2p .= "--$_ "; + } + } + } + if (defined($p2p)) { + $rule .= " -m ipp2p $p2p "; + } + my $chain = $self->{_name}; my $rule_num = $self->{_rule_number}; my $rule2 = undef; diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/all/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/all/node.def new file mode 100644 index 0000000..3359454 --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/all/node.def @@ -0,0 +1 @@ +help: Match AppleJuice/BitTorrent/Direct Connect/eDonkey/eMule/Gnutella/KaZaA application packets diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/applejuice/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/applejuice/node.def new file mode 100644 index 0000000..35c2182 --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/applejuice/node.def @@ -0,0 +1 @@ +help: Match AppleJuice application packets diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/bittorrent/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/bittorrent/node.def new file mode 100644 index 0000000..a6330de --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/bittorrent/node.def @@ -0,0 +1 @@ +help: Match BitTorrent application packets diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/directconnect/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/directconnect/node.def new file mode 100644 index 0000000..ab11805 --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/directconnect/node.def @@ -0,0 +1 @@ +help: Match Direct Connect application packets diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/edonkey/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/edonkey/node.def new file mode 100644 index 0000000..25a97e5 --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/edonkey/node.def @@ -0,0 +1 @@ +help: Match eDonkey/eMule application packets diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/gnutella/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/gnutella/node.def new file mode 100644 index 0000000..52d9d6c --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/gnutella/node.def @@ -0,0 +1 @@ +help: Match Gnutella application packets diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/kazaa/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/kazaa/node.def new file mode 100644 index 0000000..a6eab48 --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/kazaa/node.def @@ -0,0 +1 @@ +help: Match KaZaA application packets diff --git a/templates/firewall/modify/node.tag/rule/node.tag/p2p/node.def b/templates/firewall/modify/node.tag/rule/node.tag/p2p/node.def new file mode 100644 index 0000000..9013fe5 --- /dev/null +++ b/templates/firewall/modify/node.tag/rule/node.tag/p2p/node.def @@ -0,0 +1 @@ +help: Set P2P application packet matching diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/all/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/all/node.def new file mode 100644 index 0000000..3359454 --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/all/node.def @@ -0,0 +1 @@ +help: Match AppleJuice/BitTorrent/Direct Connect/eDonkey/eMule/Gnutella/KaZaA application packets diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/applejuice/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/applejuice/node.def new file mode 100644 index 0000000..35c2182 --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/applejuice/node.def @@ -0,0 +1 @@ +help: Match AppleJuice application packets diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/bittorrent/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/bittorrent/node.def new file mode 100644 index 0000000..a6330de --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/bittorrent/node.def @@ -0,0 +1 @@ +help: Match BitTorrent application packets diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/directconnect/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/directconnect/node.def new file mode 100644 index 0000000..ab11805 --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/directconnect/node.def @@ -0,0 +1 @@ +help: Match Direct Connect application packets diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/edonkey/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/edonkey/node.def new file mode 100644 index 0000000..25a97e5 --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/edonkey/node.def @@ -0,0 +1 @@ +help: Match eDonkey/eMule application packets diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/gnutella/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/gnutella/node.def new file mode 100644 index 0000000..52d9d6c --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/gnutella/node.def @@ -0,0 +1 @@ +help: Match Gnutella application packets diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/kazaa/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/kazaa/node.def new file mode 100644 index 0000000..a6eab48 --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/kazaa/node.def @@ -0,0 +1 @@ +help: Match KaZaA application packets diff --git a/templates/firewall/name/node.tag/rule/node.tag/p2p/node.def b/templates/firewall/name/node.tag/rule/node.tag/p2p/node.def new file mode 100644 index 0000000..9013fe5 --- /dev/null +++ b/templates/firewall/name/node.tag/rule/node.tag/p2p/node.def @@ -0,0 +1 @@ +help: Set P2P application packet matching |