diff --git a/New/Shorewall/Accounting.pm b/New/Shorewall/Accounting.pm index 7c6fb0f99..2547e3f61 100644 --- a/New/Shorewall/Accounting.pm +++ b/New/Shorewall/Accounting.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Accounting.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Accounting.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Actions.pm b/New/Shorewall/Actions.pm index 1ec34b9d9..c5c05f103 100644 --- a/New/Shorewall/Actions.pm +++ b/New/Shorewall/Actions.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Actions.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Actions.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Chains.pm b/New/Shorewall/Chains.pm index c3c4b0917..4ab075fc6 100644 --- a/New/Shorewall/Chains.pm +++ b/New/Shorewall/Chains.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Chains.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Chains.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Common.pm b/New/Shorewall/Common.pm index 75c2ce026..d73ecd95e 100644 --- a/New/Shorewall/Common.pm +++ b/New/Shorewall/Common.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Common.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Common.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Config.pm b/New/Shorewall/Config.pm index 398bb0260..81c3f6e0d 100644 --- a/New/Shorewall/Config.pm +++ b/New/Shorewall/Config.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Config.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Config.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # @@ -374,7 +374,13 @@ sub get_configuration() { default_yes_no 'LOGTAGONLY' , ''; default_yes_no 'RFC1918_STRICT' , ''; default_yes_no 'SAVE_IPSETS' , ''; + + warning_message 'SAVE_IPSETS=Yes is not supported by Shorewall4 ' . VERSION if $config{SAVE_IPSETS}; + default_yes_no 'MAPOLDACTIONS' , ''; + + warning_message 'MAPOLDACTIONS=Yes is not supported by Shorewall4 ' . VERSION if $config{MAPOLDACTIONS}; + default_yes_no 'FASTACCEPT' , ''; default_yes_no 'IMPLICIT_CONTINUE' , ''; default_yes_no 'HIGH_ROUTE_MARKS' , ''; @@ -564,11 +570,7 @@ sub generate_aux_config() { create_temp_aux_config; - my $date = localtime; - - emit "# -# Shorewall auxiliary configuration file created by Shorewall version $ENV{VERSION} - $date -#"; + emit( "#\n# Shorewall auxiliary configuration file created by Shorewall4 version " . VERSION . ' - ' . localtime . "\n#" ); for my $option qw(VERBOSITY LOGFILE LOGFORMAT IPTABLES PATH SHOREWALL_SHELL SUBSYSLOCK RESTOREFILE SAVE_IPSETS) { conditionally_add_option $option; diff --git a/New/Shorewall/Hosts.pm b/New/Shorewall/Hosts.pm index 0899c313e..d3fc6e3b2 100644 --- a/New/Shorewall/Hosts.pm +++ b/New/Shorewall/Hosts.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Hosts.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Hosts.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/IPAddrs.pm b/New/Shorewall/IPAddrs.pm index abadfe270..2b7fe82ee 100644 --- a/New/Shorewall/IPAddrs.pm +++ b/New/Shorewall/IPAddrs.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/IPAddrs.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/IPAddrs.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Interfaces.pm b/New/Shorewall/Interfaces.pm index c7a9d4db2..f74e7fdb2 100644 --- a/New/Shorewall/Interfaces.pm +++ b/New/Shorewall/Interfaces.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Interfaces.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Interfaces.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Macros.pm b/New/Shorewall/Macros.pm index 8de9b4005..cc8285b5a 100644 --- a/New/Shorewall/Macros.pm +++ b/New/Shorewall/Macros.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Macros.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Macros.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Nat.pm b/New/Shorewall/Nat.pm index 37705a169..51b6aacd7 100644 --- a/New/Shorewall/Nat.pm +++ b/New/Shorewall/Nat.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Nat.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Nat.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Policy.pm b/New/Shorewall/Policy.pm index 5dc8984cd..9b78bbfd7 100644 --- a/New/Shorewall/Policy.pm +++ b/New/Shorewall/Policy.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Policy.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Policy.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Providers.pm b/New/Shorewall/Providers.pm index 335f2424b..891cc45a2 100644 --- a/New/Shorewall/Providers.pm +++ b/New/Shorewall/Providers.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Providers.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Providers.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Proxyarp.pm b/New/Shorewall/Proxyarp.pm index 0807b2345..709f3c936 100644 --- a/New/Shorewall/Proxyarp.pm +++ b/New/Shorewall/Proxyarp.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Proxyarp.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Proxyarp.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Rules.pm b/New/Shorewall/Rules.pm index f6cf3c66c..ec6664257 100644 --- a/New/Shorewall/Rules.pm +++ b/New/Shorewall/Rules.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Rules.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Rules.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Tc.pm b/New/Shorewall/Tc.pm index 259d307bf..bb22e140f 100644 --- a/New/Shorewall/Tc.pm +++ b/New/Shorewall/Tc.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Tc.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Tc.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Tunnels.pm b/New/Shorewall/Tunnels.pm index 8c126432d..d7210d4bb 100644 --- a/New/Shorewall/Tunnels.pm +++ b/New/Shorewall/Tunnels.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Tunnels.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Tunnels.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/Shorewall/Zones.pm b/New/Shorewall/Zones.pm index 463867d64..df028b892 100644 --- a/New/Shorewall/Zones.pm +++ b/New/Shorewall/Zones.pm @@ -1,5 +1,5 @@ # -# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Zones.pm +# Shorewall4 3.9 -- /usr/share/shorewall4/Shorewall/Zones.pm # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # diff --git a/New/compiler.pl b/New/compiler.pl index 7be2a5193..ddf35fa7d 100755 --- a/New/compiler.pl +++ b/New/compiler.pl @@ -1,6 +1,6 @@ #! /usr/bin/perl -w # -# The Shoreline Firewall (Shorewall) Packet Filtering Firewall Compiler - V3.9 +# The Shoreline Firewall4 (Shorewall4) Packet Filtering Firewall Compiler - V3.9 # # This program is under GPL [http://www.gnu.org/copyleft/gpl.htm] # @@ -595,11 +595,11 @@ sub compile_firewall( $ ) { report_capabilities if $ENV{VERBOSE} > 1; - fatal_error( 'Shorewall ' . VERSION . ' requires Conntrack Match Support' ) + fatal_error( 'Shorewall4 ' . VERSION . ' requires Conntrack Match Support' ) unless $capabilities{CONNTRACK_MATCH}; - fatal_error( 'Shorewall ' . VERSION . ' requires Extended Multi-port Match Support' ) + fatal_error( 'Shorewall4 ' . VERSION . ' requires Extended Multi-port Match Support' ) unless $capabilities{XMULTIPORT}; - fatal_error( 'Shorewall ' . VERSION . ' requires Address Type Match Support' ) + fatal_error( 'Shorewall4 ' . VERSION . ' requires Address Type Match Support' ) unless $capabilities{ADDRTYPE}; fatal_error 'BRIDGING=Yes is not supported by the ' . VERSION . ' Perl-based compiler' if $config{BRIDGING}; diff --git a/New/releasenotes.txt b/New/releasenotes.txt index f8561c378..76456f92c 100644 --- a/New/releasenotes.txt +++ b/New/releasenotes.txt @@ -1,6 +1,8 @@ -Shorewall 3.9.0 +Shorewall4 3.9.0 + +This companion product to Shorewall 3.4.2 and later includes a complete +rewrite of the compiler in Perl. -This release includes a complete rewrite of the compiler in Perl. The good news: @@ -9,15 +11,15 @@ b) The compiler is very fast. c) The compiler generates a firewall script that uses iptables-restore; so the script is very fast. d) Use of the perl compiler is optional! The old slow clunky - Bourne-shell compiler is still there. + Bourne-shell compiler is still available. The bad news: -There are a number of incompatibilities between 3.9.0 using the -Perl-based compiler and earlier versions. +There are a number of incompatibilities between the Perl-based compiler +and the Bourne-shell one. -a) This version requires the following capabilities in your kernel - and iptables. +a) The Perl-based compiler requires the following capabilities in your + kernel and iptables. - addrtype match - conntrack match @@ -33,7 +35,7 @@ c) The BROADCAST column in the interfaces file is essentailly unused; receive a warning. d) Because the compiler is now written in Perl, your compile-time - extension scripts for earlier version will no longer work. + extension scripts from earlier versions will no longer work. e) The 'refresh' command is now synonamous with 'restart'. @@ -63,10 +65,44 @@ g) Currently, support for ipsets is untested. That will change with iii) If you specify ipsets in your routestopped file then Shorewall must be cleared in order to reload your ipsets. + As a consequence, scripts generated by the Perl-based compiler will + ignore /etc/shorewall/ipsets and will issue a warning if you set + SAVE_IPSETS=Yes in shorewall.conf. +Installation +------------ +1) Unpack the tarball. + $ tar -jxf shorewall4-3.9.0-1.tar.bz2 + $ pwd + /home/teastep/shorewall/ + $ ls + shorewall4-3.9.0/ + $ +2) As root, create a symbolic link to the directory containing the unpacked + files. + $ ln -sf /home/teastep/shorewall/ /usr/share/shorewall4 - +Using the New compiler +---------------------- + +By default, the old Bourne-shell based compiler will be used. + +There is one change in Shorewall operation that is triggered when +/usr/share/shorewall4 exists and is either a directory or a symbolic +link that points to a directory: Your params file will be processed +with the shell's '-a' option set which will automatically export any +variables that you set or create. + +To actually use the new compiler, add this to shorewall.conf: + + SHOREWALL4=Yes + +If you add this setting to /etc/shorewall/shorewall.conf then by +default, the new compiler will be used on the system. If you add it to +shorewall.conf in a separate directory (such as a Shorewall-lite export +directory) then the new compiler will only be used when you compile +from that directory.