Shorewall-1.4.7

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@756 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
2025-08-19 05:01:47 +02:00 · 2003-10-06 22:38:40 +00:00
parent acad75f82f
commit a30b326a4b
96 changed files with 26174 additions and 26168 deletions
--- a/Shorewall-docs/seattlefirewall_index.htm
+++ b/Shorewall-docs/seattlefirewall_index.htm
@@ -98,15 +98,12 @@ uninstalling what you have and installing a setup that matches the
 documentation on this site. See the <a href="two-interface.htm">Two-interface
 QuickStart Guide</a> for details.<br>
      <h2>News</h2>
-      <p><b>8/9/2003 - Snapshot 1.4.6_20030809</b><b> <img
+      <p><b>10/06/2003 - Shorewall 1.4.7</b><b> <img
 style="border: 0px solid ; width: 28px; height: 12px;"
- src="images/new10.gif" alt="(New)" title=""></b><b> </b></p>
-      <blockquote>
-        <p><a href="http://shorewall.net/pub/shorewall/Snapshots/">http://shorewall.net/pub/shorewall/Snapshots/</a><br>
-        <a href="ftp://shorewall.net/pub/shorewall/Snapshots/"
- target="_top">ftp://shorewall.net/pub/shorewall/Snapshots/</a></p>
-      </blockquote>
-      <b>Problems Corrected since version 1.4.6</b><br>
+ src="images/new10.gif" alt="(New)" title=""><br>
+      </b></p>
+      <b>Problems Corrected since version 1.4.6 (Those in bold font
+were corrected since 1.4.7 RC2)</b><br>
      <ol>
        <li>Corrected problem in 1.4.6 where the MANGLE_ENABLED
 variable was being tested before it was set.</li>
@@ -121,29 +118,108 @@ during "shorewall [re]start" when ADD_IP_ALIASES=Yes and ip addresses
 were being added to a PPP interface; the addresses were successfully
 added in spite of the messages.<br>
 &nbsp;&nbsp;&nbsp; <br>
-The firewall script has been modified to eliminate the error messages<br>
+The firewall script has been modified to eliminate the error messages</li>
+        <li>Interface-specific dynamic blacklisting chains are
+now displayed by "shorewall monitor" on the "Dynamic Chains" page
+(previously named "Dynamic Chain").</li>
+        <li>Thanks to Henry Yang, LOGRATE and LOGBURST now work again.</li>
+        <li>The 'shorewall reject' and
+'shorewall drop' commands now delete any existing rules for the subject
+IP address before adding a new DROP or REJECT rule. Previously, there
+could be many rules for the same IP address in the dynamic chain so
+that multiple 'allow' commands were required to re-enable traffic
+to/from the address.</li>
+        <li>When ADD_SNAT_ALIASES=Yes in
+shorewall.conf, the following entry in /etc/shorewall/masq resulted in
+a startup error:<br>
+&nbsp;<br>
+&nbsp;&nbsp; eth0 eth1&nbsp;&nbsp;&nbsp;&nbsp;
+206.124.146.20-206.124.146.24<br>
+          <br>
        </li>
+        <li>Shorewall previously choked over
+IPV6 addresses configured on interfaces in contexts where Shorewall
+needed to detect something about the interface (such as when "detect"
+appears in the BROADCAST column of the /etc/shorewall/interfaces file).</li>
+        <li>Shorewall will now load
+module files that are formed from the module name by appending ".o.gz".</li>
+        <li>When Shorewall adds a route to a
+proxy ARP host and such a route already exists, two routes resulted
+previously. This has been corrected so that the existing route is
+replaced if it already exists.</li>
+        <li>The rfc1918 file has been
+updated to reflect recent allocations.</li>
+        <li>The documentation of the
+USER SET column in the rules file has been corrected.</li>
+        <li>If there is no policy
+defined for
+the zones specified in a rule, the firewall script previously
+encountered a shell syntax error:<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+          <br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [: NONE: unexpected operator<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+          <br>
+Now, the absence of a policy generates an error message and the
+firewall is stopped:<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+          <br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; No policy defined from zone
+&lt;source&gt; to zone &lt;dest&gt;<br>
+          <br>
+        </li>
+        <li>Previously, if neither
+/etc/shorewall/common nor /etc/shorewall/common.def existed, Shorewall
+would fail to start and would not remove the lock file. Failure to
+remove the lock file resulted in the following during subsequent
+attempts to start:<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+          <br>
+&nbsp;&nbsp;&nbsp; Loading /usr/share/shorewall/functions...<br>
+&nbsp;&nbsp;&nbsp; Processing /etc/shorewall/params ...<br>
+&nbsp;&nbsp;&nbsp; Processing /etc/shorewall/shorewall.conf...<br>
+&nbsp;&nbsp;&nbsp; Giving up on lock file /var/lib/shorewall/lock<br>
+&nbsp;&nbsp;&nbsp; Shorewall Not Started<br>
+          <br>
+Shorewall now reports a fatal error if neither of these two files exist
+and correctly removes the lock fille.</li>
+        <li>The order of processing
+the
+various options has been changed such that blacklist entries now take
+precedence over the 'dhcp' interface setting.</li>
+        <li>The log message generated
+from the
+'logunclean' interface option has been changed to reflect a disposition
+of LOG rather than DROP.</li>
+        <li><span style="font-weight: bold;">When a user name and/or a
+group
+name was specified in the USER SET column and the destination zone was
+qualified with a IP address, the user and/or group name was not being
+used to qualify the rule.<br>
+&nbsp;<br>
+&nbsp;&nbsp;&nbsp; Example:<br>
+&nbsp;<br>
+&nbsp;&nbsp;&nbsp; ACCEPT fw&nbsp; net:192.0.2.12 tcp 23 - - - vladimir:<br>
+          <br>
+          </span></li>
+        <li><span style="font-weight: bold;">The /etc/shorewall/masq
+file has had the spurious "/" character at the front removed.</span></li>
      </ol>
      <b>Migration Issues:</b><br>
      <ol>
-        <li>Once you have installed this version of Shorewall, you must
-restart Shorewall before you may use the 'drop', 'reject', 'allow' or
-'save' commands.</li>
-        <li>To maintain strict compatibility with previous versions,
-current uses of "shorewall drop" and "shorewall reject" should be
-replaced with "shorewall dropall" and "shorewall rejectall" </li>
+        <li>Shorewall IP Traffic Accounting has changed since snapshot
+20030813 -- see the <a href="Accounting.html">Accounting Page</a> for
+details.</li>
+        <li>The Uset Set capability introduced in SnapShot 20030821 has
+changed -- see the <a href="UserSets.html">User Set page</a> for
+details.</li>
+        <li>The per-interface Dynamic Blacklisting facility introduced
+in the first post-1.4.6 Snapshot has been removed. The facility had too
+many idiosyncrasies for dial-up users to be a viable part of Shorewall.<br>
+        </li>
      </ol>
      <b>New Features:</b><br>
      <ol>
-        <li>Shorewall now creates a dynamic blacklisting chain for each
-interface defined in /etc/shorewall/interfaces. The 'drop' and 'reject'
-commands use the routing table to determine which of these chains is to
-be used for blacklisting the specified IP address(es).<br>
-          <br>
-Two new commands ('dropall' and 'rejectall') have been introduced that
-do what 'drop' and 'reject' used to do; namely, when an address is
-blacklisted using these new commands, it will be blacklisted on all of
-your firewall's interfaces.</li>
        <li>Thanks to Steve Herber, the 'help' command can now give
 command-specific help (e.g., shorewall help &lt;command&gt;).</li>
        <li>A new option "ADMINISABSENTMINDED" has been added to
@@ -225,11 +301,97 @@ facilitates testing of your firewall where multiple firewall interfaces
 are connected to the same HUB/Switch (all interfaces connected to the
 single HUB/Switch should have this option specified). Note that using
 such a configuration in a production environment is strongly
-recommended against.<br>
+recommended against.</li>
+        <li>The ADDRESS column in /etc/shorewall/masq may now include a
+comma-separated list of addresses and/or address ranges. Netfilter will
+use all listed addresses/ranges in round-robin fashion. \</li>
+        <li>An /etc/shorewall/accounting file has been added to allow
+for traffic accounting.&nbsp; See the <a href="Accounting.html">accounting
+documentation</a> for a description of this facility.</li>
+        <li>Bridge interfaces (br[0-9]) may now be used in
+/etc/shorewall/maclist.</li>
+        <li>ACCEPT, DNAT[-], REDIRECT[-] and LOG rules defined in
+/etc/shorewall/rules may now be rate-limited. For DNAT and REDIRECT
+rules, rate limiting occurs in the nat table DNAT rule; the
+corresponding ACCEPT rule in the filter table is not rate limited. If
+you want to limit the filter table rule, you will need o create two
+rules; a DNAT- rule and an ACCEPT rule which can be rate-limited
+separately.<br>
+&nbsp;<br>
+          <span style="font-weight: bold;">Warning: </span>When rate
+limiting is specified on a rule with "all" in the SOURCE or DEST
+fields, the limit will apply to each pair of zones individually rather
+than as a single limit for all pairs of covered by the rule.<br>
+&nbsp;<br>
+To specify a rate limit, <br>
+          <br>
+a) Follow ACCEPT, DNAT[-], REDIRECT[-] or LOG with<br>
+&nbsp;<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;
+&lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;] &gt;<br>
+&nbsp;<br>
+&nbsp;
+where<br>
+&nbsp;<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;rate&gt; is the sustained rate per
+&lt;interval&gt;<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;interval&gt; is "sec" or "min"<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;burst&gt; is the largest burst
+accepted within an &lt;interval&gt;. If not given, the default of 5 is
+assumed.<br>
+&nbsp;<br>
+There may be no white space between the ACTION and "&lt;" nor there may
+be any white space within the burst specification. If you want to
+specify logging of a rate-limited rule, the ":" and log level comes
+after the "&gt;" (e.g., ACCEPT&lt;2/sec:4&gt;:info ).<br>
+          <br>
+b) A new RATE LIMIT column has been added to the /etc/shorewall/rules
+file. You may specify the rate limit there in the format:<br>
+          <br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+&lt;rate&gt;/&lt;interval&gt;[:&lt;burst&gt;]<br>
+&nbsp;<br>
+Let's take an example:<br>
+&nbsp;<br>
+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+ACCEPT&lt;2/sec:4&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
+net&nbsp;&nbsp;&nbsp;&nbsp; dmz&nbsp;&nbsp;&nbsp;&nbsp;
+tcp&nbsp;&nbsp;&nbsp;&nbsp; 80<br>
+&nbsp;&nbsp;&nbsp; <br>
+The first time this rule is reached, the packet will be accepted; in
+fact, since the burst is 4, the first four packets will be accepted.
+After this, it will be 500ms (1 second divided by the rate<br>
+of 2) before a packet will be accepted from this rule, regardless of
+how many packets reach it. Also, every 500ms which passes without
+matching a packet, one of the bursts will be regained; if no packets
+hit the rule for 2 second, the burst will be fully recharged; back
+where we started.<br>
+        </li>
+        <li>Multiple chains may now be displayed in one "shorewall
+show" command (e.g., shorewall show INPUT FORWARD OUTPUT).</li>
+        <li>Output rules (those with $FW as the SOURCE) may now be
+limited to a set of local users and/or groups. See <a
+ href="UserSets.html">http://shorewall.net/UserSets.html</a>
+for details.<br>
+          <br>
        </li>
      </ol>
-      <p><b>8/5/2003 - Shorewall-1.4.6b</b><b> <img border="0"
- src="images/new10.gif" width="28" height="12" alt="(New)"> <br>
+      <p><b>8/27/2003 - Shorewall Mirror in Australia&nbsp;</b></p>
+      <p>Thanks to Dave Kempe and Solutions First (<a
+ href="http://www.solutionsfirst.com.au"><font size="3">http://www.solutionsfirst.com.au</font></a>),
+there is now a Shorewall Mirror in Australia:</p>
+      <p style="margin-left: 40px;"><a
+ href="http://www.shorewall.com.au" target="_top"><font size="3">http://www.shorewall.com.au</font></a><font
+ size="3"><br>
+      <a href="ftp://ftp.shorewall.com.au">ftp://ftp.shorewall.com.au</a></font><br>
+      </p>
+      <p><b>8/26/2003 - French Version of the Shorewall Setup
+Guide&nbsp;</b></p>
+Thanks to Fabien <font size="3">Demassieux, there is now a <a
+ href="shorewall_setup_guide_fr.htm">French translation of the
+Shorewall Setup Guide</a>. Merci Beacoup, Fabien!<br>
+      </font>
+      <p><b>8/5/2003 - Shorewall-1.4.6b</b><b>&nbsp; <br>
      </b></p>
      <b>Problems Corrected since version 1.4.6:</b><br>
      <ol>
@@ -317,7 +479,7 @@ Children's Foundation.</font></a> Thanks!</font></font></p>
    </tr>
  </tbody>
 </table>
-<p><font size="2">Updated 8/9/2003 - <a href="support.htm">Tom Eastep</a></font>
+<p><font size="2">Updated 10/06/2003 - <a href="support.htm">Tom Eastep</a></font>
 <br>
 </p>
 <br>