2006-08-04
+
2006-08-11
July 24, 2006
+
August 10, 2006
Shorewall Problems Corrected in 3.2.22006-07-24 End of support for Shorewall 2.4
1) Previously, the "shorewall stop" command would create empty files
named /nat and /proxyarp.
2) Scripts compiled for export did not support the 'reset' command. As
a result, on firewall systems running Shorewall Lite the command
"shorewall-lite reset" failed.
Other Shorewall changes in 3.2.2
1) The way in which options in /etc/shorewall-lite/shorewall.conf are
handled has been changed. Previously, problems would occur if
options were set differently in the shorewall.conf file located in
a firewall's export directory on the administrative system and in
/etc/shorewall-lite/shorewall.conf on the firewall system.
To eliminate those problems, both Shorewall and Shorewall Lite have
been modified. Now, settings in /etc/shorewall-lite/shorewall.conf
override settings from the export directory. Any variable not set
(or set to the empty value) in /etc/shorewall-lite/shorewall.conf
will get its value from the shorewall.conf file in the firewall's
export directory (see
http://www.shorewall.conf/CompiledPrograms.html for a description
of "export directories").
The "shorewall compile -e" and "shorewall [re]load" commands now
create two files -- the script file and an auxiliary configuration
file. The name of the auxiliary configuration file is formed by
appending ".conf" to the name of the firewall script. So, the
"[re]load" command now creates both 'firewall' and 'firewall.conf'
and the command copies both files to /var/lib/shorewall-lite/ on
the firewall system.
The shorewall.conf file released with Shorewall Lite now sets no
option values. So by default, the options that the firewall
system will use are determined entirely by the shorewall.conf file
in the export directory.
If you are upgrading from an earlier 3.2 release, I recommend that
you modify your /etc/shorewall-lite/shorewall.conf file(s) to set
all variables to the empty value (e.g., IPTABLES= ). This will
allow your Shorewall Lite installation(s) to conform to the new
option convention. Both the administrative system and the firewalls
must be running 3.2.2 or later and each firewall's configuration
must be recompiled and re-exported for changes to take effect.
2) The 'shorewall show capabilites' command now accepts a '-f' (file)
option (e.g., shorewall show -f capabilities). When '-f' is given,
the output is the same as the output from the 'shorecap' program
that is included in Shorewall Lite and can be used to generate a
capabilities file for use during compilation.
WARNING: The output is only meaningful when the command is run by
root.
3) The manner in which Shorewall determines the presence of the
'physdev match' capability has been modified to accomodate the
upcoming kernel change that will remove much of the functionality
of the match.
4) The install.sh script now supports a -n option:
./install.sh -n
When -n is given, no backup of the current configuration is
performed. This is used primarily by Shorewall developers as it
allows repeated installs of the same version without destroying
the backup of the prior version.
5) The "shorewall [re]load" command(s) now support a -s option:
Example:
shorewall reload -s gateway
The option causes the configuration on the firewall to be saved if
[re]start is successfull.
6) A new 'optional' option has been added to
/etc/shorewall/providers. If this option is specified, if the
interface specified in the INTERFACES column isn't up and
configured with an IPv4 address then a warning message is issued
and the provider is not configured.
Shorewall Lite Problems Corrected in 3.2.2
1) The comments at the front of /sbin/shorewall-lite previously
referred to the program as 'shorewall' rather than
'shorewall-lite'.
2) Vestiges of the 'check' command remained. Example:
gateway:~ # shorewall-lite check
/sbin/shorewall: line 1283: check_command: command not found
gateway:~ #
Other Shorewall Lite changes in 3.2.2
1) The way in which options in /etc/shorewall-lite/shorewall.conf are
handled has been changed. Previously, problems would occur if
options were set differently in the shorewall.conf file located in
a firewall's export directory on the administrative system and in
/etc/shorewall-lite/shorewall.conf on the firewall system.
To eliminate those problems, both Shorewall and Shorewall Lite have
been modified. Now, settings in /etc/shorewall-lite/shorewall.conf
override settings from the export directory. Any variable not set
(or set to the empty value) in /etc/shorewall-lite/shorewall.conf
will get its value from the shorewall.conf file in the firewall's
export directory (see
http://www.shorewall.conf/CompiledPrograms.html for a description
of "export directories").
The "shorewall compile -e" and "shorewall [re]load" commands now
create two files -- the script file and an auxiliary configuration
file. If the command is "shorewall compile -e <dir> foo" then the
firewall script will be named 'foo' and the auxiliary configuration
file will be named 'foo.conf'. The "[re]load" command now created
both 'firewall' and 'firewall.conf' and copies both files to
/var/lib/shorewall-lite/ on the firewall system.
The shorewall.conf file released with Shorewall Lite now sets no
option values. So by default, the options that the firewall
system will use are determined entirely by the shorewall.conf file
in the export directory.
If you are upgrading from an earlier 3.2 release, I recommend that
you modify your /etc/shorewall-lite/shorewall.conf file(s) to set
all variables to the empty value (e.g., IPTABLES= ). This will
allow your Shorewall Lite installation(s) to conform to the new
default.
2) The 'shorewall-lite show capabilites' command now accepts a '-f'
option (e.g., shorewall-lite show -f capabilities). When '-f' is
given, the output is the same as the output from the 'shorecap'
program.
WARNING: The output is only meaningful when the command is run by
root.
3) The manner in which Shorewall lite determines the presence of the
'physdev match' capability has been modified to accomodate the
upcoming kernel change that will remove much of the functionality
of the match.
4) The install.sh script now supports a -n option:
./install.sh -n
When -n is given, no backup of the current configuration is
performed. This is used primarily by Shorewall developers as it
allows repeated installs of the same version without destroying
the backup of the prior version.
The current Stable Version is 3.2.1 -- Get it from the +
The current Stable Version is 3.2.2 -- Get it from the download sites. Here are the release + href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.2/releasenotes.txt">release notes and here are the known + href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.2/known_problems.txt">known problems and updates.
+ href="http://www.shorewall.net/pub/shorewall/3.2/shorewall-3.2.2/errata/">updates.The current Development Version is 3.3.0 -- No releases of that
version are available yet.
@@ -30,7 +30,7 @@ Foundation; with no Invariant Sections, with no Front-Cover, and with
no Back-Cover Texts. A copy of the license is included in the section
entitled “GNU Free
Documentation License”.
2006-07-21
+2006-08-10