shorewall_code/Shorewall-common/releasenotes.txt

Shorewall 4.3.3

Notice:

There are two incompatible changes in this release.

1)  Rather than square brackets ([]), addresses following an interface
    name are now enclosed in angle brackets (<>). This change is made
    to avoid confusion in the documentation with the meta characters
    '[' and ']'.

2)  Only those macros that have different contents in IPv6 are now
    included in /usr/share/shorewall6/. As a consequence,
    /usr/share/shorewall must be added to your CONFIG_PATH in
    /etc/shorewall6/shorewall6.conf.

----------------------------------------------------------------------------
               R E L E A S E  4 . 3  H I G H L I G H T S
----------------------------------------------------------------------------
1) Support is included for IPv6.

   Minimun system requirements:

   - Kernel 2.6.25 or later.
   - iptables 1.4.0 or later with 1.4.1 strongly recommended.
   - Perl 5.10 if you wish to use DNS names in your IPv6 config files. 
     In that case you will also have to install Perl Socket6 support.

Problems Corrected in 4.3.3

1)  Previously, if IP6TABLES wasn't specified in shorewall6.conf, it
    was set to iptables rather than ip6tables.

Other changes in 4.3.3

1)  In as much as ip6tables doesn't support the ECN target, the 'ecn'
    file has been removed and its processing disabled. 

2)  The 'maclist' option is now supported in /etc/shorewall6/interfaces
    and in /etc/shorewall6/hosts.

    The following IPv6 traffic is exempt from MAC validation:

    a) Multicast.
    b) Source or destination is a link-level address (ff80::/10).

3)  Traffic shaping is now enabled in Shorewall6. See below.

4)  Shorewall6 and Shorewall6 Lite now check the kernel version during
    'start' processing. If the kernel version is less than 2.6.25, a 
    fatal error is generated.

5)  The AllowICMPs macro has been converted to a standard action. This
    allows for more efficient processing in the case where ipv6-icmp is
    specified as the PROTO in the invocation of AllowICMPs.

    e.g.,

	AllowICMPs	$FW	net	ipv6-icmp

6)  A 'proxyndp' option has been added to
    /etc/shorewall6/interfaces. The option is the IPv6 analog of the
    'proxyarp' option in /etc/shorewall/interfaces.

7)  Source anycast addresses defined by RFC 2526 are now trapped by
    'nosmurfs'.

8)  Manpages are now included for Shorewall6 and Shorewall6-lite.

Migration Issues.

   None.

New Features in Shorewall 4.3

1) Two new packages are included:

   a) Shorewall6 - analagous to Shorewall-common but handles IPv6
      rather than IPv4.

   b) Shorewall6-lite - analagous to Shorewall-lite but handles IPv6
      rather than IPv4.

   The packages store their configurations in /etc/shorewall6/ and
   /etc/shorewall6-lite/ respectively.  

   The fact that the packages are separate from their IPv4 counterparts
   means that you control IPv4 and IPv6 traffic separately (the same
   way that Netfilter does). Starting/Stopping the firewall for one
   address family has no effect on the other address family.

   Other features of Shorewall6 are:

   a) There is no NAT of any kind (most people see this as a giant step
      forward). When an ISP assigns you a public IPv6 address, you are
      actually assigned an IPv6 'prefix' which is like an IPv4
      subnet. A 64-bit prefix allows 4 billion squared individual hosts
      (the size of the current IPv4 address space squared).

   b) The default zone type is ipv6.

   c) The currently-supported interface options in Shorewall6 are:

	blacklist
        bridge
	dhcp
	nosmurfs (traps multicast and Subnet-router anycast addresses
        used as the packet source address).
	optional
	routeback
	sourceroute
        tcpflags
	mss
	forward (setting it to 0 makes the router behave like a host
                 on that interface rather than like a router).

   d)  The currently-supported host options in Shorewall6 are:

	blacklist
	routeback
	tcpflags

   e)  Traffic Shaping is disabled by default. The tcdevices and
       tcclasses files are address-family independent so
       to use the Shorewall builtin Traffic Shaper, TC_ENABLED=Internal
       should be specified in Shorewall or in Shorewall6 but not in
       both. In the configuration where the internal traffic shaper is
       not enabled, CLEAR_TC=No should be specified.

       tcfilters are not available in Shorewall6.

   f)  When both an interface and an address or address list need to
       be specified in a rule, the address or list must be enclosed in
       angle brackets. Example:

        #ACTION      SOURCE		                        DEST
	ACCEPT	     net:eth0:<2001:19f0:feee::dead:beef:cafe>	dmz

       Note that this includes MAC addresses as well as IPv6 addresses.

       The HOSTS column in /etc/shorewall6/hosts also uses this
       convention:

           #ZONE      HOSTS					OPTIONS
           chat6      eth0:<2001:19f0:feee::dead:beef:cafe>

       Even when an interface is not specified, it is permitted to
       enclose addresses in <> to improve readability. Example:

           #ACTION      SOURCE		DEST
	   ACCEPT	net:<2001:1::1>	$FW

   g)  The options available in shorewall6.conf are a subset of those
       available in shorewall.conf.

   h)  The Socket6.pm Perl module is required if you include DNS names
       in your Shorewall6 configuration. Note that it is loaded the
       first time that a DNS name is encountered so if it is missing,
       you get a message similar to this one:

       ...
       Checking /etc/shorewall6/rules...
       Can't locate Socket6.pm in @INC (@INC contains: /root ...
       teastep@ursa:~/Configs/standalone6$