2002-08-13 22:45:21 +02:00
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
< html >
< head >
2002-09-29 23:42:38 +02:00
< meta http-equiv = "Content-Type"
content="text/html; charset=windows-1252">
2003-02-20 00:21:55 +01:00
< title > Shorewall 1.4 Errata< / title >
2002-08-13 22:45:21 +02:00
< meta name = "GENERATOR" content = "Microsoft FrontPage 5.0" >
2002-11-24 21:08:19 +01:00
< meta name = "ProgId" content = "FrontPage.Editor.Document" >
2002-08-22 23:21:41 +02:00
< meta name = "Microsoft Theme" content = "none" >
2003-02-20 00:21:55 +01:00
< meta name = "author" content = "Tom Eastep" >
2002-08-13 22:45:21 +02:00
< / head >
2003-10-07 00:38:40 +02:00
< body >
2003-12-03 00:51:46 +01:00
< p align = "center" > < / p >
< h1 style = "text-align: center;" > Shorewall Errata< br >
< / h1 >
< p align = "center" > < b > < u > IMPORTANT< / u > < / b > < / p >
2002-09-29 23:42:38 +02:00
< ol >
2003-10-07 00:38:40 +02:00
< li >
< p align = "left" > < b > < u > I< / u > f you use a Windows system to download
a corrected script, be sure to run the script through < u > < a
2003-06-18 22:03:19 +02:00
href="http://www.megaloman.com/%7Ehany/software/hd2u/"
2003-10-07 00:38:40 +02:00
style="text-decoration: none;"> dos2unix< / a > < / u > after you have moved
2003-12-03 00:51:46 +01:00
it
to your Linux system.< / b > < / p >
2003-10-07 00:38:40 +02:00
< / li >
< li >
< p align = "left" > < b > If you are installing Shorewall for the first
2003-12-03 00:51:46 +01:00
time and plan to use the .tgz and install.sh script, you can untar the
archive, replace the 'firewall' script in the untarred directory with
the one you downloaded below, and then run install.sh.< / b > < / p >
2003-10-07 00:38:40 +02:00
< / li >
< li >
< p align = "left" > < b > When the instructions say to install a
2003-12-03 00:51:46 +01:00
corrected firewall script in /usr/share/shorewall/firewall, you may
rename the existing file before copying in the new file.< / b > < / p >
2003-10-07 00:38:40 +02:00
< / li >
< li >
< p align = "left" > < b > < font color = "#ff0000" > DO NOT INSTALL CORRECTED
COMPONENTS ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER
2003-12-03 00:51:46 +01:00
BELOW. For example, do NOT install the 1.3.9a firewall script if you
are
running 1.3.7c.< / font > < / b > < br >
2003-10-07 00:38:40 +02:00
< / p >
< / li >
2002-09-29 23:42:38 +02:00
< / ol >
< ul >
2003-10-07 00:38:40 +02:00
< li > < b > < a href = "upgrade_issues.htm" > Upgrade Issues< / a > < / b > < / li >
< li > < b > < a href = "#V1.4" > Problems in Version 1.4< / a > < / b > < br >
< / li >
< li > < b > < a href = "errata_3.html" > Problems in Version 1.3< / a > < / b > < / li >
< li > < b > < a href = "errata_2.htm" > Problems in Version 1.2< / a > < / b > < / li >
< li > < b > < font color = "#660066" > < a href = "errata_1.htm" > Problems in
Version 1.1< / a > < / font > < / b > < / li >
< li > < b > < font color = "#660066" > < a href = "#iptables" > Problem with
iptables version 1.2.3 on RH7.2< / a > < / font > < / b > < / li >
< li > < b > < a href = "#Debug" > Problems with kernels > = 2.4.18 and
2003-12-03 00:51:46 +01:00
RedHat iptables< / a > < / b > < / li >
2003-10-07 00:38:40 +02:00
< li > < b > < a href = "#SuSE" > Problems installing/upgrading RPM on SuSE< / a > < / b > < / li >
< li > < b > < a href = "#Multiport" > Problems with iptables version 1.2.7 and
MULTIPORT=Yes< / a > < / b > < / li >
< li > < b > < a href = "#NAT" > Problems with RH Kernel 2.4.18-10 and NAT< / a > < / b > < / li >
< li > < b > < a href = "#REJECT" > Problems with RH Kernels after 2.4.20-9 and
2003-12-16 18:54:57 +01:00
REJECT (also applies to 2.4.21-RC1) < img src = "new10.gif" alt = "(New)"
width="28" height="12" border="0"> < / a > < br >
2003-10-07 00:38:40 +02:00
< / b > < / li >
2003-02-20 00:21:55 +01:00
< / ul >
2003-10-07 00:38:40 +02:00
< hr >
2003-02-20 00:21:55 +01:00
< h2 align = "left" > < a name = "V1.4" > < / a > Problems in Version 1.4< / h2 >
< h3 > < / h3 >
2003-12-03 00:51:46 +01:00
< h3 > 1.4.7< / h3 >
< ul >
< li > Using some versions of 'ash' (such as from RH8) as the
SHOREWALL_SHELL causes "shorewall [re]start" to fail with:< br >
< br >
local: --limit: bad variable name< br >
iptables v1.2.8: Couldn't load match
`-j':/lib/iptables/libipt_-j.so: < br >
cannot open shared object file: No such file or directory< br >
Try `iptables -h' or 'iptables --help' for more
information.< / li >
< li > When more than one ICMP type is listed in a rule and your kernel
includes multiport match support, the firewall fails to
start. < / li >
< li > Regardless of the setting of LOGUNCLEAN, the value
LOGUNCLEAN=info was used.< / li >
< li > After the following error message, Shorewall was left in an
inconsistent state:< br >
< br >
Error: Unable to determine the routes through interface xxx< br >
< / li >
< / ul >
These problems have been corrected in this < a
href="http://shorewall.net/pub/shorewall/errata/1.4.7/firewall">firewall
2003-12-16 18:54:57 +01:00
script< / a > which may be installed in /usr/share/shorewall/firewall as
2003-12-03 00:51:46 +01:00
described above.< br >
2003-08-09 19:14:58 +02:00
< h3 > 1.4.6< / h3 >
< ul >
2003-10-07 00:38:40 +02:00
< li > If TC_ENABLED is set to yes in shorewall.conf then Shorewall
would fail to start with the error "ERROR: Traffic Control
2003-12-03 00:51:46 +01:00
requires
Mangle"; that problem has been corrected in < a
2003-10-07 00:38:40 +02:00
href="http://shorewall.net/pub/shorewall/errata/1.4.6/firewall">this
firewall script< / a > which may be installed in
2003-12-16 18:54:57 +01:00
/use/share/shorewall/firewall as described above. This problem is also
2003-10-07 00:38:40 +02:00
corrected in bugfix release 1.4.6a.< / li >
< li > This problem occurs in all versions supporting traffic control.
If a MAC address is used in the SOURCE column, an error occurs as
follows:< br >
< br >
< font size = "3" > < tt > iptables v1.2.8: Bad mac adress
`00:08:B5:35:52:E7-d`< / tt > < / font > < br >
< br >
For Shorewall 1.4.6 and 1.4.6a users, this problem has been corrected
in < a href = "http://shorewall.net/pub/shorewall/errata/1.4.6/firewall" > this
firewall script< / a > which may be installed in
2003-12-16 18:54:57 +01:00
/usr/share/shorewall/firewall as described above. For all other
2003-12-03 00:51:46 +01:00
versions, you will have to edit your 'firewall' script (in versions
1.4.*, it is located in /usr/share/shorewall/firewall). Locate the
function add_tcrule_() and in that function, replace this line:< br >
2003-10-07 00:38:40 +02:00
< br >
< span style = "font-family: monospace;" > r=`mac_match
$source` < / span > < br >
< br >
with< br >
< br >
< span style = "font-family: monospace;" > r="`mac_match
$source` "< / span > < br >
< br >
Note that there must be a space before the ending quote!< br >
< / li >
2003-08-09 19:14:58 +02:00
< / ul >
2003-06-18 22:03:19 +02:00
< h3 > 1.4.4b< / h3 >
< ul >
2003-12-03 00:51:46 +01:00
< li > Shorewall is ignoring records in /etc/shorewall/routestopped that
have an empty second column (HOSTS). This problem may be corrected by
installing < a
2003-06-18 22:03:19 +02:00
href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.4b/firewall"
2003-10-07 00:38:40 +02:00
target="_top">this firewall script< / a > in
2003-12-03 00:51:46 +01:00
/usr/share/shorewall/firewall
as described above.< / li >
2003-10-07 00:38:40 +02:00
< li > The INCLUDE directive doesn't work when placed in the
/etc/shorewall/zones file. This problem may be corrected by installing < a
2003-06-18 22:03:19 +02:00
href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.4b/functions"
2003-10-07 00:38:40 +02:00
target="_top">this functions script< / a > in
/usr/share/shorewall/functions.< br >
< / li >
2003-06-18 22:03:19 +02:00
< / ul >
2003-07-16 20:59:33 +02:00
< h3 > 1.4.4-1.4.4a< / h3 >
2003-05-28 21:20:23 +02:00
< ul >
2003-10-07 00:38:40 +02:00
< li > Log messages are being displayed on the system console even
though the log level for the console is set properly according to < a
href="FAQ.htm#faq16">FAQ 16< / a > . This problem may be corrected by
installing < a
2003-07-16 20:59:33 +02:00
href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.4a/firewall"
2003-10-07 00:38:40 +02:00
target="_top">this firewall script< / a > in
2003-12-03 00:51:46 +01:00
/usr/share/shorewall/firewall
as described above.< br >
2003-10-07 00:38:40 +02:00
< / li >
2003-05-28 21:20:23 +02:00
< / ul >
2003-07-16 20:59:33 +02:00
< h3 > 1.4.4< br >
2003-10-07 00:38:40 +02:00
< / h3 >
2003-04-13 17:28:32 +02:00
< ul >
2003-10-07 00:38:40 +02:00
< li > If you have zone names that are 5 characters long, you may
experience problems starting Shorewall because the --log-prefix in a
logging rule is too long. Upgrade to Version 1.4.4a to fix this
problem..< / li >
2003-04-13 17:28:32 +02:00
< / ul >
2003-07-16 20:59:33 +02:00
< h3 > 1.4.3< / h3 >
2003-05-28 21:20:23 +02:00
< ul >
2003-10-07 00:38:40 +02:00
< li > The LOGMARKER variable introduced in version 1.4.3 was intended
to allow integration of Shorewall with Fireparse
(http://www.firewparse.com). Unfortunately, LOGMARKER only solved part
of the integration problem. I have implimented a new LOGFORMAT variable
which will replace LOGMARKER which has completely solved this problem
and is currently in production with fireparse here at shorewall.net.
2003-12-03 00:51:46 +01:00
The
updated files may be found at < a
2003-07-16 20:59:33 +02:00
href="ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.3/fireparse/"
2003-10-07 00:38:40 +02:00
target="_top">ftp://ftp1.shorewall.net/pub/shorewall/errata/1.4.3/fireparse/< / a > .
See the 0README.txt file for details.< br >
< / li >
2003-05-28 21:20:23 +02:00
< / ul >
2003-07-16 20:59:33 +02:00
< h3 > 1.4.2< / h3 >
2003-03-22 01:25:40 +01:00
< ul >
2003-10-07 00:38:40 +02:00
< li > When an 'add' or 'delete' command is executed, a temporary
directory created in /tmp is not being removed. This problem may be
corrected by installing < a
2003-07-16 20:59:33 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall"
2003-10-07 00:38:40 +02:00
target="_top">this firewall script< / a > in
2003-12-03 00:51:46 +01:00
/usr/share/shorewall/firewall
as described above. < br >
2003-10-07 00:38:40 +02:00
< / li >
2003-03-22 01:25:40 +01:00
< / ul >
2003-07-16 20:59:33 +02:00
< h3 > 1.4.1a, 1.4.1 and 1.4.0< / h3 >
2003-05-15 21:39:23 +02:00
< ul >
2003-10-07 00:38:40 +02:00
< li > Some TCP requests are rejected in the 'common' chain with an ICMP
port-unreachable response rather than the more appropriate TCP RST
response. This problem is corrected in < a
2003-07-16 20:59:33 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def"
2003-10-07 00:38:40 +02:00
target="_top">this updated common.def file< / a > which may be installed
in /etc/shorewall/common.def.< br >
< / li >
2003-05-15 21:39:23 +02:00
< / ul >
2003-07-16 20:59:33 +02:00
< h3 > 1.4.1< / h3 >
2003-05-15 21:39:23 +02:00
< ul >
2003-10-07 00:38:40 +02:00
< li > When a "shorewall check" command is executed, each "rule"
produces the harmless additional message:< br >
< br >
/usr/share/shorewall/firewall: line 2174: [: =:
2003-12-03 00:51:46 +01:00
unary operator
expected< br >
2003-10-07 00:38:40 +02:00
< br >
You may correct the problem by installing < a
2003-07-16 20:59:33 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall"
2003-10-07 00:38:40 +02:00
target="_top">this corrected script< / a > in
/usr/share/shorewall/firewall as described above.< br >
< / li >
2003-05-15 21:39:23 +02:00
< / ul >
2003-07-16 20:59:33 +02:00
< h3 > 1.4.0< / h3 >
< ul >
2003-10-07 00:38:40 +02:00
< li > When running under certain shells Shorewall will attempt to
2003-12-03 00:51:46 +01:00
create ECN rules even when /etc/shorewall/ecn is empty. You may either
just remove /etc/shorewall/ecn or you can install < a
2003-08-09 19:14:58 +02:00
href="http://www.shorewall.net/pub/shorewall/errata/1.4.0/firewall">this
2003-10-07 00:38:40 +02:00
correct script< / a > in /usr/share/shorewall/firewall as described above.< br >
< / li >
2003-07-16 20:59:33 +02:00
< / ul >
2003-10-07 00:38:40 +02:00
< hr width = "100%" size = "2" >
2002-09-29 23:42:38 +02:00
< h2 align = "left" > < a name = "Upgrade" > < / a > Upgrade Issues< / h2 >
2003-10-07 00:38:40 +02:00
< p align = "left" > The upgrade issues have moved to < a
2002-09-29 23:42:38 +02:00
href="upgrade_issues.htm">a separate page< / a > .< / p >
2003-10-07 00:38:40 +02:00
< hr >
< h3 align = "left" > < a name = "iptables" > < / a > < font color = "#660066" > Problem
with iptables version 1.2.3< / font > < / h3 >
< blockquote >
< p align = "left" > There are a couple of serious bugs in iptables 1.2.3
that prevent it from working with Shorewall. Regrettably, RedHat
released this buggy iptables in RedHat 7.2. < / p >
2002-09-29 23:42:38 +02:00
< p align = "left" > I have built a < a
2003-08-09 19:14:58 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3-3.i386.rpm">
2003-10-07 00:38:40 +02:00
corrected 1.2.3 rpm which you can download here< / a > and I have
2003-12-03 00:51:46 +01:00
also
built an < a
2003-08-09 19:14:58 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/iptables-1.2.4-1.i386.rpm">
2003-10-07 00:38:40 +02:00
iptables-1.2.4 rpm which you can download here< / a > . If you are
2003-12-03 00:51:46 +01:00
currently
running RedHat 7.1, you can install either of these RPMs < b > < u > before< / u >
< / b > you
upgrade to RedHat 7.2.< / p >
2003-10-07 00:38:40 +02:00
< p align = "left" > < font color = "#ff6633" > < b > Update 11/9/2001: < / b > < / font > RedHat
2003-12-03 00:51:46 +01:00
has released an iptables-1.2.4 RPM of their own which you can download
from< font color = "#ff6633" > < a
href="http://www.redhat.com/support/errata/RHSA-2001-144.html">http://www.redhat.com/support/errata/RHSA-2001-144.html< / a > .< / font > I
have installed this RPM on my firewall and it works fine.< / p >
2003-10-07 00:38:40 +02:00
< p align = "left" > If you would like to patch iptables 1.2.3 yourself,
the patches are available for download. This < a
2003-08-09 19:14:58 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/loglevel.patch">patch< / a >
2003-10-07 00:38:40 +02:00
which corrects a problem with parsing of the --log-level specification
while this < a
2003-08-09 19:14:58 +02:00
href="ftp://ftp.shorewall.net/pub/shorewall/errata/iptables-1.2.3/tos.patch">patch< / a >
2003-10-07 00:38:40 +02:00
corrects a problem in handling the TOS target.< / p >
2002-09-29 23:42:38 +02:00
< p align = "left" > To install one of the above patches:< / p >
< ul >
2003-10-07 00:38:40 +02:00
< li > cd iptables-1.2.3/extensions< / li >
< li > patch -p0 < < i > the-patch-file< / i > < / li >
2002-09-29 23:42:38 +02:00
< / ul >
2003-10-07 00:38:40 +02:00
< / blockquote >
2003-12-03 00:51:46 +01:00
< h3 > < a name = "Debug" > < / a > Problems with kernels > = 2.4.18 and RedHat
iptables< / h3 >
2003-10-07 00:38:40 +02:00
< blockquote >
< p > Users who use RedHat iptables RPMs and who upgrade to kernel
2.4.18/19 may experience the following:< / p >
< blockquote >
2002-09-29 23:42:38 +02:00
< pre > # shorewall start< br > Processing /etc/shorewall/shorewall.conf ...< br > Processing /etc/shorewall/params ...< br > Starting Shorewall...< br > Loading Modules...< br > Initializing...< br > Determining Zones...< br > Zones: net< br > Validating interfaces file...< br > Validating hosts file...< br > Determining Hosts in Zones...< br > Net Zone: eth0:0.0.0.0/0< br > iptables: libiptc/libip4tc.c:380: do_check: Assertion< br > `h-> info.valid_hooks == (1 < < 0 | 1 < < 3)' failed.< br > Aborted (core dumped)< br > iptables: libiptc/libip4tc.c:380: do_check: Assertion< br > `h-> info.valid_hooks == (1 < < 0 | 1 < < 3)' failed.< br > Aborted (core dumped)< br > < / pre >
2003-10-07 00:38:40 +02:00
< / blockquote >
< p > The RedHat iptables RPM is compiled with debugging enabled but the
user-space debugging code was not updated to reflect recent changes in
the Netfilter 'mangle' table. You can correct the problem by installing
< a
2003-08-09 19:14:58 +02:00
href="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">
2003-12-03 00:51:46 +01:00
this iptables RPM< / a > . If you are already running a 1.2.5 version of
iptables, you will need to specify the --oldpackage option to rpm
(e.g., "iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").< / p >
2003-10-07 00:38:40 +02:00
< / blockquote >
< h3 > < a name = "SuSE" > < / a > Problems installing/upgrading RPM on SuSE< / h3 >
< p > If you find that rpm complains about a conflict with kernel < =
2.2 yet you have a 2.4 kernel installed, simply use the "--nodeps"
option to rpm.< / p >
2002-09-29 23:42:38 +02:00
< p > Installing: rpm -ivh --nodeps < i > < shorewall rpm> < / i > < / p >
< p > Upgrading: rpm -Uvh --nodeps < i > < shorewall rpm> < / i > < / p >
2003-10-07 00:38:40 +02:00
< h3 > < a name = "Multiport" > < / a > < b > Problems with iptables version 1.2.7 and
MULTIPORT=Yes< / b > < / h3 >
< p > The iptables 1.2.7 release of iptables has made an incompatible
change to the syntax used to specify multiport match rules; as a
consequence, if you install iptables 1.2.7 you must be running
2003-12-03 00:51:46 +01:00
Shorewall
1.3.7a or later or:< / p >
2002-09-29 23:42:38 +02:00
< ul >
2003-10-07 00:38:40 +02:00
< li > set MULTIPORT=No in /etc/shorewall/shorewall.conf; or < / li >
< li > if you are running Shorewall 1.3.6 you may install < a
href="http://www.shorewall.net/pub/shorewall/errata/1.3.6/firewall">
2003-12-16 18:54:57 +01:00
this firewall script< / a > in /usr/lib/shorewall/firewall as described
2003-10-07 00:38:40 +02:00
above.< / li >
2002-09-29 23:42:38 +02:00
< / ul >
2002-11-09 19:06:34 +01:00
< h3 > < a name = "NAT" > < / a > Problems with RH Kernel 2.4.18-10 and NAT< br >
2003-10-07 00:38:40 +02:00
< / h3 >
/etc/shorewall/nat entries of the following form will result in
Shorewall being unable to start:< br >
< br >
< pre > #EXTERNAL INTERFACE INTERNAL ALL INTERFACES LOCAL< br > 192.0.2.22 eth0 192.168.9.22 yes yes< br > #LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE< / pre >
Error message is:< br >
2002-11-09 19:06:34 +01:00
< pre > Setting up NAT...< br > iptables: Invalid argument< br > Terminated< br > < br > < / pre >
2003-10-07 00:38:40 +02:00
The solution is to put "no" in the LOCAL column. Kernel support for
LOCAL=yes has never worked properly and 2.4.18-10 has disabled it. The
2003-12-03 00:51:46 +01:00
2.4.19 kernel contains corrected support under a new kernel
configuraiton option; see < a href = "Documentation.htm#NAT" > http://www.shorewall.net/Documentation.htm#NAT< / a > < br >
2003-10-07 00:38:40 +02:00
< br >
< h3 > < a name = "REJECT" > < / a > < b > Problems with RH Kernels after 2.4.20-9
2003-12-03 00:51:46 +01:00
and
REJECT (also applies to 2.4.21-RC1)< / b > < / h3 >
2003-10-07 00:38:40 +02:00
Beginning with errata kernel 2.4.20-13.9, "REJECT --reject-with
tcp-reset" is broken. The symptom most commonly seen is that REJECT
rules act just like DROP rules when dealing with TCP. A kernel patch
2003-12-03 00:51:46 +01:00
and
precompiled modules to fix this problem are available at < a
2003-06-18 22:03:19 +02:00
href="ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel"
target="_top">ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel< / a > .< br >
2003-10-07 00:38:40 +02:00
< hr >
2003-12-03 00:51:46 +01:00
< p > < font size = "2" > Last updated 10/11/2003 - < a href = "support.htm" > Tom
Eastep< / a > < / font > < / p >
2003-10-07 00:38:40 +02:00
< p > < a href = "copyright.htm" > < font size = "2" > Copyright< / font > <20> < font
2003-01-14 18:18:42 +01:00
size="2">2001, 2002, 2003 Thomas M. Eastep.< / font > < / a > < br >
2003-10-07 00:38:40 +02:00
< / p >
< br >
< br >
2002-08-13 22:45:21 +02:00
< / body >
2002-09-29 23:42:38 +02:00
< / html >
