mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Only allow adavanced tunables when some kind of state tracking is enabled.

Browse Source
This commit is contained in:
Scott Ullrich 2007-05-29 22:07:57 +00:00
parent ea089c29dd
commit be4237b0ee
1 changed files with 23 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
etc/inc/filter.inc
View File

@ -1974,28 +1974,29 @@ function generate_user_filter_rule($rule, $ngcounter) {
} else {
$aline['flags'] = "keep state ";
}
if( isset($rule['source-track']) and $rule['source-track'] <> "" or
isset($rule['max-src-nodes']) and $rule['max-src-nodes'] <> "" or
isset($rule['max-src-conn-rate']) and $rule['max-src-conn-rate'] <> "" or
isset($rule['max-src-conn-rates']) and $rule['max-src-conn-rates'] <> "" or
isset($rule['max-src-states']) and $rule['max-src-states'] <> "" or
isset($rule['statetimeout']) and $rule['statetimeout'] <> "") {
$aline['flags'] .= "( ";
if(isset($rule['source-track']) and $rule['source-track'] <> "")
$aline['flags'] .= "source-track rule ";
if(isset($rule['max-src-nodes']) and $rule['max-src-nodes'] <> "")
$aline['flags'] .= "max-src-nodes " . $rule['max-src-nodes'] . " ";
if(isset($rule['max-src-states']) and $rule['max-src-states'] <> "")
$aline['flags'] .= "max-src-states " . $rule['max-src-states'] . " ";
if(isset($rule['statetimeout']) and $rule['statetimeout'] <> "")
$aline['flags'] .= "tcp.established " . $rule['statetimeout'] . " ";
if(isset($rule['max-src-conn-rate']) and $rule['max-src-conn-rate'] <> ""
and isset($rule['max-src-conn-rates']) and $rule['max-src-conn-rates'] <> "") {
$aline['flags'] .= "max-src-conn-rate " . $rule['max-src-conn-rate'] . " ";
$aline['flags'] .= "/" . $rule['max-src-conn-rates'] . ", overload <virusprot> flush global ";
}
$aline['flags'] .= " ) ";
}
if($aline['flags'])
if( isset($rule['source-track']) and $rule['source-track'] <> "" or
isset($rule['max-src-nodes']) and $rule['max-src-nodes'] <> "" or
isset($rule['max-src-conn-rate']) and $rule['max-src-conn-rate'] <> "" or
isset($rule['max-src-conn-rates']) and $rule['max-src-conn-rates'] <> "" or
isset($rule['max-src-states']) and $rule['max-src-states'] <> "" or
isset($rule['statetimeout']) and $rule['statetimeout'] <> "") {
$aline['flags'] .= "( ";
if(isset($rule['source-track']) and $rule['source-track'] <> "")
$aline['flags'] .= "source-track rule ";
if(isset($rule['max-src-nodes']) and $rule['max-src-nodes'] <> "")
$aline['flags'] .= "max-src-nodes " . $rule['max-src-nodes'] . " ";
if(isset($rule['max-src-states']) and $rule['max-src-states'] <> "")
$aline['flags'] .= "max-src-states " . $rule['max-src-states'] . " ";
if(isset($rule['statetimeout']) and $rule['statetimeout'] <> "")
$aline['flags'] .= "tcp.established " . $rule['statetimeout'] . " ";
if(isset($rule['max-src-conn-rate']) and $rule['max-src-conn-rate'] <> ""
and isset($rule['max-src-conn-rates']) and $rule['max-src-conn-rates'] <> "") {
$aline['flags'] .= "max-src-conn-rate " . $rule['max-src-conn-rate'] . " ";
$aline['flags'] .= "/" . $rule['max-src-conn-rates'] . ", overload <virusprot> flush global ";
}
$aline['flags'] .= " ) ";
}
}
if ($type == "reject" && $rule['protocol'] == "tcp") {
/* special reject packet */