shorewall_code/Shorewall/releasenotes.txt

Shorewall 4.3.7

Shorewall 4.3 is the development thread for Shorewall 4.4 which will be
released late in 2009.

----------------------------------------------------------------------------
               R E L E A S E  4 . 3  H I G H L I G H T S
----------------------------------------------------------------------------

1) Support for Shorewall-shell has been discontinued. Shorewall-perl
   has been combined with Shorewall-common to produce a single
   Shorewall package.

2) The interfaces file OPTIONs have been extended to largely remove the
   need for the hosts file.

3) It is now possible to define PREROUTING and OUTPUT marking rules
   that cause new connections to use the same provider as an existing
   connection of the same kind.

4) Dynamic Zone support is once again available for IPv4; ipset support is
   required in your kernel and in iptables.

----------------------------------------------------------------------------
                    M I G R A T I O N   I S S U E S
----------------------------------------------------------------------------

1)  The 'shorewall stop', 'shorewall clear', 'shorewall6 stop' and
    'shorewall6 clear' commands no longer read the 'routestopped'
    file. The 'routestopped' file used is the one that was present at
    the last 'start', 'restart' or 'restore' command.

2)  The old macro parameter syntax (e.g., SSH/ACCEPT) is now deprecated
    in favor of the new syntax (e.g., SSH(ACCEPT)). The 4.3 documentation
    uses the new syntax exclusively, although the old syntax
    continues to be supported.

----------------------------------------------------------------------------
          P R O B L E M S   C O R R E C T E D   I N   4 . 3 . 7
----------------------------------------------------------------------------

1)  Klemens Rutz reported a problem that affects all Shorewall-perl 4.2
    and 4.3 versions.

    The problem:

    a) Only occurs when there are more than one non-firewall zone.
    b) Results in the following interface options not being applied to
      forwarded traffic.

	blacklist
	dhcp
	maclist (when MACLIST_TABLE=filter)
	norfc1918
	nosmurfs
	tcpflags

2)  Matt LaPlante reported a problem whereby a valid DNAT- rule was
    badly mis-handled.

    The rule:

       DNAT-	loc	net:1.2.3.4:2525	tcp	25

    The result:

     WARNING: Destination zone (1.2.3.4) ignored : /etc/shorewall/rules (line 459)
     Can't call method "inet_htoa" without a package or object reference at
       /usr/share/shorewall-perl/Shorewall/IPAddrs.pm line 150,
      <$currentfile> line 459.

3)  Previously, OPTIONS were not allowed with a bridge port in
    /etc/shorewall/interfaces. That oversight has been corrected and
    now the following OPTIONS are allowed:

    	blacklist
	maclist
	norfc1918
	nosmurfs
	routeback
	tcpflags

----------------------------------------------------------------------------
             K N O W N   P R O B L E M S   R E M A I N I N G
----------------------------------------------------------------------------

None.

----------------------------------------------------------------------------
                N E W   F E A T U R E S   I N   4 . 3 . 7
----------------------------------------------------------------------------

1)  The file /var/lib/shorewall/.restore has been renamed to
    /var/lib/shorewall/firewall. A similar change has been made in
    Shorewall6.

    When a successful start or restart is completed, the script that
    executed the command copies itself to to
    /var/lib/shorewall[6/firewall.

2)  Dynamic zone support is once again available for IPv4. This support 
    is built on top of ipsets so you must have installed the
    xtable-addons.

    Dynamic zones are available when Shorewall-lite is used as well.

    Note that the dynamic zone support built into Shorewall provides no
    additional functionality over what is provided by simply defining a
    zone in terms of an ipset (see
    http://www1.shorewall.net/ipsets.html#Dynamic). 

    You define a zone as having dynamic content in one of two ways:

    - By specifying nets=dynamic in the OPTIONS column of an entry for
      the zone in /etc/shorewall/interfaces; or

    - By specifying <interface>:dynamic in the HOST(S) column of an
      entry for the zone in /etc/shorewall/hosts.

    When there are any dynamic zones present in your configuration, 
    Shorewall (Shorewall-lite) will:

    a) Execute the following commands during 'shorewall start' or
    'shorewall-lite start'.

           ipset -U :all: :all:
	   ipset -U :all: :default:
	   ipset -F
	   ipset -X   
	   ipset -R < ${VARDIR}/ipsets.save

       where $VARDIR normally contains /var/lib/shorewall
       (/var/lib/shorewall-lite) but may be modified by
       /etc/shorewall/vardir (/etc/shorewall-lite/vardir).


    b) During 'start', 'restart' and 'restore' processing, Shorewall
       will then attempt to create an ipset named <zone>_<interface>
       for each zone/interface pair that has been specified as
       dynamic. The type of ipset created is 'iphash' so that only
       individual IPv4 addresses may be added to the set.

    c) Execute the following commands during 'shorewall stop' or
       'shorewall-lite stop':

           if ipset -S > ${VARDIR}/ipsets.tmp; then
              mv -f ${VARDIR}/ipsets.tmp ${VARDIR}/ipsets.save
	   fi

    The 'shorewall add' and 'shorewall delete' commands are supported
    with their original syntax:

           add <interface>[:<host-list>] ... <zone>

           delete <interface>[:<host-list>] ... <zone>

    In addition, the 'show dynamic' command is added that lists the dynamic
    content of a zone.

    	    show dynamic <zone>

    These commands are supported by shorewall-lite as well.

----------------------------------------------------------------------------
                 N E W   F E A T U R E S   IN   4 . 3
----------------------------------------------------------------------------

1)  The Shorewall packaging has been completely revamped in Shorewall
    4.3.

    The new packages are:

    - Shorewall.   Includes the former Shorewall-common and
                   Shorewall-perl packages. Includes everything needed
                   to create an IPv4 firewall.

    - Shorewall6.  Requires Shorewall. Adds the components necessary to
      		   create an IPv6 firewall.

    - Shorewall-lite

		   May be installed on a firewall system to run
		   IPv4 firewall scripts generated by Shorewall.

    - Shorewall6-lite

		   May be installed on a firewall system to run
		   IPv6 firewall scripts generated by Shorewall.

2)  The interfaces file supports a new 'nets=' option. This option
    allows users to restrict a zone's definition to particular networks
    through an interface without having to use the hosts file.

    Example interfaces file:

    #ZONE	INTERFACE	BROADCAST		OPTIONS
    loc		eth3		detect			dhcp,logmartians=1,routefilter=1,nets=172.20.1.0/24
    dmz     	eth4		detect			logmartians=1,routefilter=1,nets=206.124.146.177
    net		eth0		detect			dhcp,blacklist,tcpflags,optional,routefilter=0,nets=(!172.20.0.0/24,206.124.146.177)
    net		eth2		detect			dhcp,blacklist,tcpflags,optional,upnp,routefilter=0,nets=(!172.20.0.0/24,206.124.146.177)
    loc		tun+		detect			nets=172.20.0.0/24
    #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

    Note that when more than one network address is listed, the list
    must be enclosed in parentheses. Notice also that exclusion may be
    used.

    The first entry in the above interfaces file is equivalent to the
    following:

    interfaces:

    #ZONE	INTERFACE	BROADCAST		OPTIONS
    -		eth0		detect			dhcp,logmartians=1,routefilter=1

    hosts:

    #ZONE	HOST(S)					OPTIONS
    loc		$INT_IF:192.20.1.0/24			broadcast

    Note that the 'broadcast' option is automatically assumed and need
    not be explicitly specified.

3)  Some websites run applications that require multiple connections
    from a client browser. Where multiple 'balanced' providers are
    configured, this can lead to problems when some of the connections
    are routed through one provider and some through another.

    To work around this issue, the SAME target has been added to
    /etc/shorewall/tcrules. SAME may be used in the PREROUTING and
    OUTPUT chains. When used in PREROUTING, it causes matching
    connections from an individual local system to all use the same
    provider.

    For example:

    	SAME:P	192.168.1.0/24	-	tcp	80,443

    If a host in 192.168.1.0/24 attempts a connection on TCP port 80 or
    443 and it has sent a packet on either of those ports in the last
    five minutes then the new connection will use the same provider as
    the connection over which that last packet was sent.

    When used in the OUTPUT chain, it causes all matching connections
    to an individual remote system to all use the same provider.

    For example:

    	SAME	$FW	-	tcp	80,443

    If the firewall attempts a connection on TCP port 80 or
    443 and it has sent a packet on either of those ports in the last
    five minutes to the same remote system then the new connection will
    use the same provider as the connection over which that last packet
    was sent.

    Important note: SAME only works with providers that have the
    'track' option specified in /etc/shorewall/providers.