Update web site for 3.3.6/3.2.7

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@5121 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

web/News.htm

@@ -20,11 +20,14 @@ Texts. A copy of the license is included in the section entitled “<span
  class="quote"><a href="GnuCopyright.htm" target="_self">GNU Free
 Documentation License</a></span>”.<br>
 </p>
-<p>November 18, 2006<br>
+<p>December 14, 2006<br>
 </p>
 <hr style="width: 100%; height: 2px;">
 <p></p>
 <!-- Shorewall Release 3.0.5 -->
+<span style="font-weight: bold;">2006-11-14 Shorewall 3.2.7<br>
+</span><span style="font-weight: bold;"></span>
+<pre>Problems Corrected in 3.2.7<br><br>1)  Handling of saved ipsets in /etc/shorewall/ipsets is broken when<br>    used on a system running Shorewall Lite. If there is a file named<br>    'ipsets' on the CONFIG_PATH when the firewall script is compiled,<br>    then the compiled script attempts to restore the ipsets from that<br>    file (which may not exist on the firewall system).<br><br>2)  The 'try' command failed on systems whose /bin/sh is Busybox ash:<br><br>        /sbin/shorewall: export: 2158: Illegal option -n<br><br>3)  Previously, Shorewall has assumed that the root user is named<br>    'root'. Beginning with this release, the root user may have a<br>    different name. This required the addition of an '-r' option for<br>    the 'shorewall load' and 'shorewall reload' commands.<br><br>        [re]load [ -e ] [ -c ] [ -r &lt;root user&gt; ] [ &lt;dir&gt; ] system<br><br>    Example: shorewall reload -r foobar firewall<br><br>4)  On systems with a light-weight shell such as ash or dash for /bin/sh,<br>    the output of "shorewall show macros" was garbled.<br><br>Other Changes in 3.2.7<br><br>1)  Prior to this release, on firewall systems with Shorewall Lite<br>    installed, the local modules file is used to determine which kernel<br>    modules to load. Beginning with this release, if there is a<br>    'modules' file in the export directory when the firewall script is<br>    compiled, then that file will be copied into the compiled script<br>    and used on the firewall system.<br><br>2)  When syslogd is run with the -C option (which in some<br>    implementations causes syslogd to log to an in-memory circular<br>    buffer), /sbin/shorewall will now use the 'logread' command to read<br>    the log from that buffer. This is for combatibility with OpenWRT.<br><br>3)  Failures of the start, restart and restore commands are now logged<br>    using 'logger'. These failures are logged with the 'kern' facility <br>    and 'err' priority. As part of this change, normal state changes<br>    are now logged with the 'kern' facility and 'info' priority.<br></pre>
 <span style="font-weight: bold;">2006-11-18 Shorewall 3.2.6<br>
 </span><span style="font-weight: bold;"></span>
 <pre>Problems Corrected in 3.2.6.<br><br>1)  When using a light-weight shell (e.g., ash) with multiple<br>providers, the /etc/iproute2/rt_tables database may become corrupted.<br><br>2)  A startup error occurred when the LENGTH or TOS column was<br>    non-empty in /etc/shorewall/tcrules.<br><br>3)  A startup error resulted when whitespace as included in LOGFORMAT.<br><br>4)  Previously, when conntrack match support was not available, the<br>    'norfc1918' option on an interface or host group was incorrectly<br>    filtering IPSEC traffic whose source IP address was reserved by RFC<br>    1918.<br><br>5)  If a DNAT or REDIRECT rule was used where the effective policy<br>    between the source and final destination zones is ACCEPT, the ACCEPT<br>    part of the rule was not generated. This was intended as an<br>    optimizaiton but it could lead to confusing results if there was a<br>    DROP or REJECT rule following.<br><br>    This optimization has been removed. You may always use DNAT- and<br>    REDIRECT- to suppress generation of the ACCEPT rule.<br><br>6)  Shorewall[-lite] previously would return an error exit status to a<br>    "start" command where Shorewall was already running. It not returns<br>    a "success" status.<br><br>7)  The install.sh scripst have been corrected to work properly when <br>    used to create packages on Slackware and Arch Linux.<br><br>5)  A change in version 3.2.5 broke Mac Filtration in some<br>    cases. Result was:<br><br>      Setting up MAC Filtration -- Phase 1...<br>      iptables v1.3.6: policy match: invalid policy `--dir'<br>      Try `iptables -h' or 'iptables --help' for more information.<br>      ERROR: Command "/sbin/iptables -A eth1_fwd -s 0.0.0.0/0 -m state <br>             --state NEW -m policy --pol --dir in -j eth1_mac" Failed<br><br>6)  At VERBOSITY 1 and higher, the 'shorewall add' and 'shorewall<br>    delete' commands generated a fractured message. The message<br>    contents depended in the setting of IPSECFILE as follows:<br><br>    IPSECFILE=ipsec<br><br>        ipsec...<br><br>    IPSECFILE=zones<br><br>        IPSEC...<br><br>    The messages have been corrected and are only produced at VERBOSITY<br>    2 and higher as follows:<br><br>    IPSECFILE=ipsec<br><br>        Processing /etc/shorewall/ipsec...<br><br>    IPSECFILE=zones<br><br>        Processing IPSEC...<br><br>7)  Previously, when &lt;action&gt;:none appeared in a rule, the name of the<br>    action chain created was preceded by "%" and might have a one- or<br>    two-digit number appended. If both &lt;action&gt; and &lt;action&gt;:none<br>    appeared, then two chains were created. This has been corrected<br>    such that &lt;action&gt; and &lt;action&gt;:none are treated identically.<br><br>8)  If SAVE_IPSETS=Yes in shorewall.conf, the "shorewall[-lite] save"<br>    command produced error messages as follows:<br><br>       Dynamic Rules Saved<br>       Currently-running Configuration Saved to /var/lib/shorewall/restore<br>       grep: /var/lib/shorewall/restore-base: No such file or directory<br>       grep: /var/lib/shorewall/restore-base: No such file or directory<br>       Current Ipset Contents Saved to<br>       /var/lib/shorewall/restore-ipsets<br><br>9)  If BRIDGING=No in shorewall.conf, then an attempt to define a zone<br>    using ipsets fails as follows:<br><br>    ERROR: BRIDGING=Yes is needed for this zone definition: z eth0:+iset<br><br>Other Changes in 3.2.6.<br><br>1)  The "shorewall [re]load" command now supports a "-c" option.<br><br>    Example:<br><br>        shorewall reload -c gateway<br><br>    When -c is given, Shorewall will capture the capabilities of the<br>    remote system to a file named "capabilities" in the export<br>    directory before compiling the configuration.<br><br>    If the file "capabilities" does not currently exist in the <br>    export directory then "-c" is automatically assumed.<br><br>2)  If 0 (zero) is specified for the IN-BANDWIDTH in<br>    /etc/shorewall/tcdevices then no ingress qdisc will be created for<br>    the device.<br></pre>

web/shorewall_index.htm

@@ -20,7 +20,7 @@ Foundation; with no Invariant Sections, with no Front-Cover, and with
 no Back-Cover Texts. A copy of the license is included in the section
 entitled “<a href="GnuCopyright.htm" target="_self">GNU Free
 Documentation License</a>”.</p>
-<p>2006-11-19</p>
+<p>2006-12-14</p>
 <hr>
 <h2>Table of Contents</h2>
 <p style="margin-left: 0.42in; margin-bottom: 0in;"><a href="#Intro">Introduction
@@ -104,17 +104,17 @@ Features page</a>.<br>
 <h3><a name="Releases"></a>Current Shorewall Versions</h3>
 <p style="margin-left: 40px;">The <span style="font-weight: bold;">current
 Stable Release</span> version
-is&nbsp; 3.2.6<br>
+is&nbsp; 3.2.7<br>
 </p>
 <ul style="margin-left: 40px;">
   <li>Here are the <a
- href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.6/releasenotes.txt">release
+ href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.7/releasenotes.txt">release
 notes</a> <br>
   </li>
   <li>Here are the <a
- href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.6/known_problems.txt">known
+ href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.7/known_problems.txt">known
 problems</a> and <a
- href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.6/errata/">updates</a>.</li>
+ href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.7/errata/">updates</a>.</li>
 </ul>
 <div style="margin-left: 40px;">The <span style="font-weight: bold;">previous
 Stable Release</span> version is 3.0.9<br>
@@ -130,17 +130,17 @@ problems</a> and <a
 </ul>
 The <span style="font-weight: bold;">current Development Release</span>
 version
-is 3.3.5<br>
+is 3.3.6<br>
 </div>
 <ul style="margin-left: 40px;">
   <li>Here are the <a
- href="http://www1.shorewall.net/pub/shorewall/development/3.3/shorewall-3.3.5/releasenotes.txt">release
+ href="http://www1.shorewall.net/pub/shorewall/development/3.3/shorewall-3.3.6/releasenotes.txt">release
 notes</a> <br>
   </li>
   <li>Here are the <a
- href="http://www.shorewall.net/pub/shorewall/development/3.3/shorewall-3.3.5/known_problems.txt">known
+ href="http://www.shorewall.net/pub/shorewall/development/3.3/shorewall-3.3.6/known_problems.txt">known
 problems</a> and <a
- href="http://www.shorewall.net/pub/shorewall/development/3.3/shorewall-3.3.5/errata/">updates</a>.</li>
+ href="http://www.shorewall.net/pub/shorewall/development/3.3/shorewall-3.3.6/errata/">updates</a>.</li>
 </ul>
 <div style="margin-left: 40px;">Get them from the <a
  href="download.htm">download sites</a></div>