From 79aab860bc3215c377a0eab859f9acb8ff254d29 Mon Sep 17 00:00:00 2001 From: teastep Date: Mon, 9 Jul 2007 19:39:28 +0000 Subject: [PATCH] Fix manpages; Add vardir to config file list; annotate manpage index git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@6829 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb --- Shorewall-common/changelog.txt | 2 + Shorewall-common/releasenotes.txt | 3 + Shorewall-perl/Shorewall/Interfaces.pm | 2 +- Shorewall-perl/Shorewall/Nat.pm | 2 + Shorewall-perl/Shorewall/Rules.pm | 2 +- docs/Manpages.xml | 168 +++++++++++++----------- docs/configuration_file_basics.xml | 8 +- manpages-lite/shorewall-lite-vardir.xml | 8 +- manpages/shorewall-vardir.xml | 10 +- 9 files changed, 116 insertions(+), 89 deletions(-) diff --git a/Shorewall-common/changelog.txt b/Shorewall-common/changelog.txt index 0ca69d9e3..1209a7d98 100644 --- a/Shorewall-common/changelog.txt +++ b/Shorewall-common/changelog.txt @@ -10,6 +10,8 @@ Changes in 4.0.0 RC 2 5) Fix LITEDIR mess. +6) Fix IPSEC. + Changes in 4.0.0 RC 1 1) shorewall-perl RPM no longer installable under shorewall 3.4. diff --git a/Shorewall-common/releasenotes.txt b/Shorewall-common/releasenotes.txt index c2ee3a94b..cee0e3ee6 100644 --- a/Shorewall-common/releasenotes.txt +++ b/Shorewall-common/releasenotes.txt @@ -61,6 +61,9 @@ Problems corrected in 4.0.0 RC 2. (compiler, shorewall-common and shorewall-lite) must be version 4.0.0-RC2 or later. +4) Several bugs in Shorewall-perl's handling of ipsec zones have been + corrected. + Other changes in Shorewall 4.0.0 RC 2. 1) The -f option is no longer the default when Shorewall is started at diff --git a/Shorewall-perl/Shorewall/Interfaces.pm b/Shorewall-perl/Shorewall/Interfaces.pm index e8d098cff..e39a415ce 100644 --- a/Shorewall-perl/Shorewall/Interfaces.pm +++ b/Shorewall-perl/Shorewall/Interfaces.pm @@ -144,7 +144,7 @@ sub add_group_to_zone($$$$$) push @{$arrayref}, { options => $options, hosts => \@newnetworks, - ipsec => $type eq 'ipsec' ? 'ipsec' : 'none' }; + ipsec => $type eq 'ipsec4' ? 'ipsec' : 'none' }; } # diff --git a/Shorewall-perl/Shorewall/Nat.pm b/Shorewall-perl/Shorewall/Nat.pm index a1fa45286..b5ac67f51 100644 --- a/Shorewall-perl/Shorewall/Nat.pm +++ b/Shorewall-perl/Shorewall/Nat.pm @@ -137,6 +137,8 @@ sub setup_one_masq($$$$$$$) } else { $rule .= do_ipsec_options $ipsec; } + } elsif ( $capabilities{POLICY_MATCH} ) { + $rule .= '-m policy --pol none --dir out '; } # diff --git a/Shorewall-perl/Shorewall/Rules.pm b/Shorewall-perl/Shorewall/Rules.pm index 20976cc04..c3e8e8bfa 100644 --- a/Shorewall-perl/Shorewall/Rules.pm +++ b/Shorewall-perl/Shorewall/Rules.pm @@ -1471,7 +1471,7 @@ sub generate_matrix() { if ( $capabilities{POLICY_MATCH} ) { my $type = $zoneref->{type}; - my $source_ref = ( $zoneref->{hosts}{ipsec} ) || {}; + my $source_ref = ( $zoneref->{hosts}{ipsec4} ) || {}; if ( $config{DYNAMIC_ZONES} ) { no warnings; diff --git a/docs/Manpages.xml b/docs/Manpages.xml index 87d39f7a3..bd602fef6 100644 --- a/docs/Manpages.xml +++ b/docs/Manpages.xml @@ -53,90 +53,103 @@ accounting + url="manpages/shorewall-accounting.html">accounting - Define IP + accounting rules. + + actions - + Declare user-defined actions. + + blacklist + - Static blacklisting. + + ecn - Disabling + Explicit Congestion Notification + + exclusion + - Excluding hosts from a network or zone + + hosts - + Define multiple zones accessed through a single interface + + interfaces - + Define the interfaces on the system and optionally associate them with + zones. + + maclist - + Define MAC verification. + + masq - Define + Masquerade/SNAT + + nat - Define + one-to-one NAT. + + nesting - + How to define nested zones. + + netmap - How + to map addresses from one net to another. + + params - + Assign values to shell variables used in other files. + + policy - + Define high-level policies for connections between zones. + + providers + - Define routing tables, usually for mutliple internet links. + + proxyarp - + Define Proxy ARP. + + rfc1918 - + Specify address ranges affected by the + interface option. actions + url="manpages/shorewall-route_rules.html">route_rules - Define + routing rules. blacklist + url="manpages/shorewall-routestopped.html">routestopped - + Specify connections to be permitted when Shorewall is in the stopped + state. - ecn + rules - + Specify exceptions to policies, including DNAT and REDIRECT. + + tcclasses + - Define htb classes for traffic shaping. + + tcdevices + - Specify speed of devices for traffic shaping. + + tcrules - + Define packet marking rules, usually for traffic shaping. + + tos - Define + TOS field manipulation. + + tunnels - + Define VPN connections with endpoints on the firewall. + + shorewall.conf + - Specify values for global Shorewall options. exclusion + url="manpages/shorewall.conf.html">shorewall-lite.conf - Specify + values for global Shorewall Lite options. + + vardir - + Redefine the directory where Shorewall keeps its state + information. hosts + url="manpages/shorewall-lite-vardir.html">vardir-lite - Redefine + the directory where Shorewall Lite keeps its state information. - interfaces - - maclist - - masq - - nat - - nesting - - netmap - - params - - policy - - providers - - proxyarp - - rfc1918 - - route_rules - - routestopped - - rules - - tcclasses - - tcdevices - - tcrules - - tos - - tunnels - - shorewall.conf - - shorewall-lite.conf - - vardir - - vardir-lite - - zones + zones - + Declare Shorewall zones.l @@ -144,10 +157,11 @@ Section 8 — Administrative Commands - shorewall + shorewall - + /sbin/shorewall command syntax and semantics. - shorewall-lite + shorewall-lite + - /sbin/shorewall-lite command syntax and semantics. \ No newline at end of file diff --git a/docs/configuration_file_basics.xml b/docs/configuration_file_basics.xml index f8caac0a0..bf1bf32f1 100644 --- a/docs/configuration_file_basics.xml +++ b/docs/configuration_file_basics.xml @@ -185,10 +185,16 @@ /etc/shorewall/route_rules (Added in Shorewall 3.2.0) - Defines routing rules to be used in conjunction - with the routing tables devined in + with the routing tables defined in /etc/shorewall/providers. + + /etc/shorewall/vardir - (Added in + Shoreall 4.0.0-RC2) - Determines the directory where Shorewall + maintains its state. + + /usr/share/shorewall/actions.std - Actions defined by Shorewall. diff --git a/manpages-lite/shorewall-lite-vardir.xml b/manpages-lite/shorewall-lite-vardir.xml index 30c8cc454..59bb77509 100644 --- a/manpages-lite/shorewall-lite-vardir.xml +++ b/manpages-lite/shorewall-lite-vardir.xml @@ -9,7 +9,7 @@ vardir - Shorewall file + Shorewall Lite file @@ -22,9 +22,9 @@ Description This file does not exist by default. You may create the file if you - want to change the directory used by Shorewall to store state information, - including compiled firewall scripts. By default, the directory used is - /var/lib/shorewall-lite/. + want to change the directory used by Shorewall Lite to store state + information, including compiled firewall scripts. By default, the + directory used is /var/lib/shorewall-lite/. The file contains a single variable assignment: diff --git a/manpages/shorewall-vardir.xml b/manpages/shorewall-vardir.xml index 9c1a1dffd..bbc83d215 100644 --- a/manpages/shorewall-vardir.xml +++ b/manpages/shorewall-vardir.xml @@ -22,9 +22,9 @@ Description This file does not exist by default. You may create the file if you - want to change the directory used by Shorewall lite to store state - information, including compiled firewall scripts. By default, the - directory used is /var/lib/shorewall/. + want to change the directory used by Shorewall to store state information, + including compiled firewall scripts. By default, the directory used is + /var/lib/shorewall/. The file contains a single variable assignment: @@ -32,7 +32,7 @@ where directory is the name of a directory. If you add this file, you should copy the files from - /var/lib/shorewall-lite to the new directory before + /var/lib/shorewall to the new directory before performing a shorewall restart. @@ -61,4 +61,4 @@ shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5) - + \ No newline at end of file