- 
-
-
- |
-
-
-
- |
-
-
-
-
- |
-
|
+ |
+
+ |
+
January 16, 2007
+
February 10, 2007
Problems Corrected in 3.2.9+
1) While most distributions store the Shorewall Lite compiled program
in /var/lib/shorewall-lite/, Shorewall includes features that allow
that location to be changed on a per-distribution basis. The
default for a particular distribution may be determined by the
command "shorewall[-lite] show config".
teastep@lists:~/shorewall/trunk$ shorewall show config
Default CONFIG_PATH is /etc/shorewall:/usr/share/shorewall
LITEDIR is /var/lib/shorewall-lite
teastep@lists:~/shorewall/trunk$
The LITEDIR setting is the location where the compiled script
should be placed. Unfortunately, the "shorewall [re]load" command
previously used the setting on the administrative system rather
than the one from the firewall system so it was possible for that
command to upload the compiled script to the wrong directory.
To work around this problem, Shorewall now determines the LITEDIR
setting on the firewall system and uses that setting for uploading
the compiled script and its companion .conf file.
2) Previously, IP ranges and ipset names were handled incorrectly in
the last column of the maclist file with the result that run-time
errors occured.
3) The new SIP and H323 Netfilter helper modules were not being
automatically loaded by Shorewall. They have now been added to the
/usr/share/shorewall[-lite]/modules files.
Other Changes in 3.2.9
1) Previously, 'ipsecnat' tunnels allowed AH traffic by default
(unless 'isecnat:noah' was given). Given that AH is incompatible
with nat-traversal, 'ipsecnat' now implies 'ipsecnat:noah'.
2) A macro that handles SixXS has been contributed by Christian
Roessner.
3) It is rather difficult to code a 'params' file that assigns other
than constant values such that it works correctly with Shorewall
Lite. To work around this problem, a new EXPORTPARAMS option
has been added to shorewall.conf. When EXPORTPARAMS=No, the
'params' file is no longer copied to the compiler output.
With EXPORTPARAMS=No, if you need to set environmental variables on
the firewall system for use by your extension scripts, then do so
in the init extension script.
The default is EXPORTPARAMS=Yes to retain the current behavior. So
if you are happy with the current behavior, you need make no change
to your shorewall.conf file.
Problems Corrected in 3.2.8diff --git a/web/shorewall_index.htm b/web/shorewall_index.htm index 0e3d990ef..b94779c7a 100644 --- a/web/shorewall_index.htm +++ b/web/shorewall_index.htm @@ -20,7 +20,7 @@ Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”. -
1) The 'ash' shell produced an error when processing an entry with a
log tag from /etc/shorewall/rules.
2) If the file /etc/shorewall/init did not exist, then the compiler
would incorrectly copy /usr/share/shorewall/init into the
compiled script. /usr/share/shorewall/init is a symbolic link
to the Shorewall init script (usually /etc/init.d/shorewall).
3) Previously, "ipp2p:udp" was incorrectly rejected in the PROTO
column of an action definition.
Other Changes in 3.2.8.
1) New macros for network printing protocols have been added,
courtesy of Tuomo Soini. Tuomo also provided a macro for TFTP.
The print-oriented macros are:
macro.IPP
macro.Jetdirect
macro.Printer
2007-02-01
+2007-02-10
Introduction
@@ -104,17 +104,17 @@ Features page.
The current
Stable Release version
-is 3.2.8
+is 3.2.9