mirror of
https://gitlab.com/shorewall/code.git
synced 2025-01-03 12:09:14 +01:00
fixed quotes, add CVS Id
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@995 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
parent
331b41c6dc
commit
7a0c2b61a7
@ -2,7 +2,7 @@
|
|||||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||||
<article>
|
<article>
|
||||||
<!---->
|
<!--$Id$-->
|
||||||
|
|
||||||
<articleinfo>
|
<articleinfo>
|
||||||
<title>Shorewall Errata</title>
|
<title>Shorewall Errata</title>
|
||||||
@ -45,8 +45,8 @@
|
|||||||
<listitem>
|
<listitem>
|
||||||
<para>If you are installing Shorewall for the first time and plan to
|
<para>If you are installing Shorewall for the first time and plan to
|
||||||
use the .tgz and install.sh script, you can untar the archive, replace
|
use the .tgz and install.sh script, you can untar the archive, replace
|
||||||
the 'firewall' script in the untarred directory with the one
|
the <quote>firewall</quote> script in the untarred directory with the
|
||||||
you downloaded below, and then run install.sh.</para>
|
one you downloaded below, and then run install.sh.</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
@ -90,8 +90,9 @@
|
|||||||
|
|
||||||
<itemizedlist>
|
<itemizedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>Using some versions of 'ash' (such as from RH8) as the
|
<para>Using some versions of <quote>ash</quote> (such as from RH8)
|
||||||
SHOREWALL_SHELL causes "shorewall [re]start" to fail with:<programlisting>    local: --limit: bad variable name
|
as the SHOREWALL_SHELL causes <quote>shorewall [re]start</quote> to
|
||||||
|
fail with:<programlisting>    local: --limit: bad variable name
|
||||||
   iptables v1.2.8: Couldn't load match `-j':/lib/iptables/libipt_-j.so:
|
   iptables v1.2.8: Couldn't load match `-j':/lib/iptables/libipt_-j.so:
|
||||||
   cannot open shared object file: No such file or directory
|
   cannot open shared object file: No such file or directory
|
||||||
   Try `iptables -h' or 'iptables --help' for more information.</programlisting></para>
|
   Try `iptables -h' or 'iptables --help' for more information.</programlisting></para>
|
||||||
@ -133,8 +134,8 @@
|
|||||||
<itemizedlist>
|
<itemizedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>If TC_ENABLED is set to yes in shorewall.conf then Shorewall
|
<para>If TC_ENABLED is set to yes in shorewall.conf then Shorewall
|
||||||
would fail to start with the error "ERROR:  Traffic
|
would fail to start with the error <quote>ERROR:  Traffic
|
||||||
Control requires Mangle"; that problem has been corrected in
|
Control requires Mangle</quote>; that problem has been corrected in
|
||||||
<ulink
|
<ulink
|
||||||
url="http://shorewall.net/pub/shorewall/errata/1.4.6/firewall">this
|
url="http://shorewall.net/pub/shorewall/errata/1.4.6/firewall">this
|
||||||
firewall script</ulink> which may be installed in
|
firewall script</ulink> which may be installed in
|
||||||
@ -153,8 +154,8 @@
|
|||||||
url="http://shorewall.net/pub/shorewall/errata/1.4.6/firewall">this
|
url="http://shorewall.net/pub/shorewall/errata/1.4.6/firewall">this
|
||||||
firewall script</ulink> which may be installed in
|
firewall script</ulink> which may be installed in
|
||||||
/usr/share/shorewall/firewall as described above. For all other
|
/usr/share/shorewall/firewall as described above. For all other
|
||||||
versions, you will have to edit your 'firewall' script (in
|
versions, you will have to edit your <quote>firewall</quote> script
|
||||||
versions 1.4.*, it is located in /usr/share/shorewall/firewall).
|
(in versions 1.4.*, it is located in /usr/share/shorewall/firewall).
|
||||||
Locate the function add_tcrule_() and in that function, replace this
|
Locate the function add_tcrule_() and in that function, replace this
|
||||||
line:<programlisting>   r=`mac_match $source` </programlisting>with<programlisting>      r="`mac_match $source` "</programlisting>Note
|
line:<programlisting>   r=`mac_match $source` </programlisting>with<programlisting>      r="`mac_match $source` "</programlisting>Note
|
||||||
that there must be a space before the ending quote!</para>
|
that there must be a space before the ending quote!</para>
|
||||||
@ -235,9 +236,9 @@
|
|||||||
|
|
||||||
<itemizedlist>
|
<itemizedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>When an 'add' or 'delete' command is executed,
|
<para>When an <quote>add</quote> or <quote>delete</quote> command is
|
||||||
a temporary directory created in /tmp is not being removed. This
|
executed, a temporary directory created in /tmp is not being
|
||||||
problem may be corrected by installing <ulink
|
removed. This problem may be corrected by installing <ulink
|
||||||
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall">this
|
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall">this
|
||||||
firewall script</ulink> in /usr/share/shorewall/firewall as
|
firewall script</ulink> in /usr/share/shorewall/firewall as
|
||||||
described above.</para>
|
described above.</para>
|
||||||
@ -250,8 +251,8 @@
|
|||||||
|
|
||||||
<itemizedlist>
|
<itemizedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>Some TCP requests are rejected in the 'common' chain
|
<para>Some TCP requests are rejected in the <quote>common</quote>
|
||||||
with an ICMP port-unreachable response rather than the more
|
chain with an ICMP port-unreachable response rather than the more
|
||||||
appropriate TCP RST response. This problem is corrected in <ulink
|
appropriate TCP RST response. This problem is corrected in <ulink
|
||||||
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def">this
|
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def">this
|
||||||
updated common.def file</ulink> which may be installed in
|
updated common.def file</ulink> which may be installed in
|
||||||
@ -265,8 +266,8 @@
|
|||||||
|
|
||||||
<itemizedlist>
|
<itemizedlist>
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>When a "shorewall check" command is executed, each
|
<para>When a <quote>shorewall check</quote> command is executed,
|
||||||
"rule" produces the harmless additional message:<programlisting>     /usr/share/shorewall/firewall: line 2174: [: =: unary operator expected</programlisting>You
|
each <quote>rule</quote> produces the harmless additional message:<programlisting>     /usr/share/shorewall/firewall: line 2174: [: =: unary operator expected</programlisting>You
|
||||||
may correct the problem by installing <ulink
|
may correct the problem by installing <ulink
|
||||||
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall">this
|
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall">this
|
||||||
corrected script</ulink> in /usr/share/shorewall/firewall as
|
corrected script</ulink> in /usr/share/shorewall/firewall as
|
||||||
@ -360,12 +361,12 @@ Aborted (core dumped)</programlisting>
|
|||||||
|
|
||||||
<para>The RedHat iptables RPM is compiled with debugging enabled but the
|
<para>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||||
user-space debugging code was not updated to reflect recent changes in the
|
user-space debugging code was not updated to reflect recent changes in the
|
||||||
Netfilter 'mangle' table. You can correct the problem by
|
Netfilter <quote>mangle</quote> table. You can correct the problem by
|
||||||
installing <ulink
|
installing <ulink
|
||||||
url="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">this
|
url="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">this
|
||||||
iptables RPM</ulink>. If you are already running a 1.2.5 version of
|
iptables RPM</ulink>. If you are already running a 1.2.5 version of
|
||||||
iptables, you will need to specify the --oldpackage option to rpm (e.g.,
|
iptables, you will need to specify the --oldpackage option to rpm (e.g.,
|
||||||
"iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</para>
|
<quote>iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm</quote>).</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
<section>
|
<section>
|
||||||
@ -400,13 +401,13 @@ Aborted (core dumped)</programlisting>
|
|||||||
192.0.2.22    eth0    192.168.9.22   yes     yes
|
192.0.2.22    eth0    192.168.9.22   yes     yes
|
||||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||||
|
|
||||||
<para> Error message is:</para>
|
<para>Error message is:</para>
|
||||||
|
|
||||||
<programlisting> Setting up NAT...
|
<programlisting> Setting up NAT...
|
||||||
iptables: Invalid argument
|
iptables: Invalid argument
|
||||||
Terminated</programlisting>
|
Terminated</programlisting>
|
||||||
|
|
||||||
<para>The solution is to put "no" in the LOCAL column. Kernel
|
<para>The solution is to put <quote>no</quote> in the LOCAL column. Kernel
|
||||||
support for LOCAL=yes has never worked properly and 2.4.18-10 has disabled
|
support for LOCAL=yes has never worked properly and 2.4.18-10 has disabled
|
||||||
it. The 2.4.19 kernel contains corrected support under a new kernel
|
it. The 2.4.19 kernel contains corrected support under a new kernel
|
||||||
configuraiton option; see <ulink
|
configuraiton option; see <ulink
|
||||||
@ -417,10 +418,10 @@ Aborted (core dumped)</programlisting>
|
|||||||
<title>Problems with RH Kernels after 2.4.20-9 and REJECT (also applies to
|
<title>Problems with RH Kernels after 2.4.20-9 and REJECT (also applies to
|
||||||
2.4.21-RC1)</title>
|
2.4.21-RC1)</title>
|
||||||
|
|
||||||
<para> Beginning with errata kernel 2.4.20-13.9, "REJECT --reject-with
|
<para>Beginning with errata kernel 2.4.20-13.9, <quote>REJECT
|
||||||
tcp-reset" is broken. The symptom most commonly seen is that REJECT
|
--reject-with tcp-reset</quote> is broken. The symptom most commonly seen
|
||||||
rules act just like DROP rules when dealing with TCP. A kernel patch and
|
is that REJECT rules act just like DROP rules when dealing with TCP. A
|
||||||
precompiled modules to fix this problem are available at <ulink
|
kernel patch and precompiled modules to fix this problem are available at
|
||||||
url="ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel">ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel</ulink>.</para>
|
<ulink url="ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel">ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel</ulink>.</para>
|
||||||
</section>
|
</section>
|
||||||
</article>
|
</article>
|
@ -2,7 +2,7 @@
|
|||||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||||
<article>
|
<article>
|
||||||
<!---->
|
<!--$Id$-->
|
||||||
|
|
||||||
<articleinfo>
|
<articleinfo>
|
||||||
<title>Fallback and Uninstall</title>
|
<title>Fallback and Uninstall</title>
|
||||||
@ -48,7 +48,7 @@
|
|||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>Type "./fallback.sh"</para>
|
<para>Type <quote>./fallback.sh</quote></para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</itemizedlist>
|
</itemizedlist>
|
||||||
|
|
||||||
@ -65,9 +65,9 @@
|
|||||||
<title>Falling Back to the Previous Version of Shorewall using rpm</title>
|
<title>Falling Back to the Previous Version of Shorewall using rpm</title>
|
||||||
|
|
||||||
<para>If your previous version of Shorewall was installed using RPM, you
|
<para>If your previous version of Shorewall was installed using RPM, you
|
||||||
may fall back to that version by typing "rpm -Uvh --force <old
|
may fall back to that version by typing <quote>rpm -Uvh --force <old
|
||||||
rpm>" at a root shell prompt (Example: "rpm -Uvh --force
|
rpm></quote> at a root shell prompt (Example: <quote>rpm -Uvh --force
|
||||||
/downloads/shorewall-3.1=0noarch.rpm" would fall back to the 3.1-0
|
/downloads/shorewall-3.1=0noarch.rpm</quote> would fall back to the 3.1-0
|
||||||
version of Shorewall).</para>
|
version of Shorewall).</para>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
@ -83,11 +83,11 @@
|
|||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>type "./uninstall.sh"</para>
|
<para>type <quote>./uninstall.sh</quote></para>
|
||||||
</listitem>
|
</listitem>
|
||||||
</itemizedlist>
|
</itemizedlist>
|
||||||
|
|
||||||
<para>If you installed using an rpm, at a root shell prompt type "rpm
|
<para>If you installed using an rpm, at a root shell prompt type
|
||||||
-e shorewall".</para>
|
<quote>rpm -e shorewall</quote>.</para>
|
||||||
</section>
|
</section>
|
||||||
</article>
|
</article>
|
Loading…
Reference in New Issue
Block a user