holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Restore ipset binding capability

Browse Source
This commit is contained in:
Tom Eastep 2009-08-08 08:26:22 -07:00
parent 1051c44f51
commit 1a5027de9f
2 changed files with 28 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Shorewall/Perl/Shorewall/Chains.pm
View File

@ -1819,19 +1819,28 @@ sub iprange_match() {
} }
# #
# Get set flags (ipsets) -- Given that ipset no longer supports binding, # Get set flags (ipsets).
# This function simply constructs the proper
# --set specification.
# #
sub get_set_flags( $$ ) { sub get_set_flags( $$ ) {
my ( $setname, $option ) = @_; my ( $setname, $option ) = @_;
my $options = $option;
$setname =~ s/^!//; # Caller has already taken care of leading ! $setname =~ s/^!//; # Caller has already taken care of leading !
if ( $setname =~ /^(.*)\[([1-6])\]$/ ) {
$setname = $1;
my $count = $2;
$options .= ",$option" while --$count > 0;
} elsif ( $setname =~ /^(.*)\[(.*)\]$/ ) {
$setname = $1;
$options = $2;
}
$setname =~ s/^\+//; $setname =~ s/^\+//;
fatal_error "Invalid ipset name ($setname)" unless $setname =~ /^[a-zA-Z]\w*/; fatal_error "Invalid ipset name ($setname)" unless $setname =~ /^[a-zA-Z]\w*/;
"--set $setname $option " "--set $setname $options "
} }
# #

34
Shorewall/releasenotes.txt
View File

@ -107,11 +107,7 @@ Shorewall 4.4.0
/etc/shorewall/tcrules or /etc/shorewall/tcfilters. You will need /etc/shorewall/tcrules or /etc/shorewall/tcfilters. You will need
to renumber the class IDs for devices 10 and greater. to renumber the class IDs for devices 10 and greater.
7) Jozsef Kadlecsik has removed the set binding capability from ipset 7) Support for the 'norfc1918' interface and host option has been
3.1. As a consequence, Shorewall 4.4 no longer supports set
binding.
8) Support for the 'norfc1918' interface and host option has been
removed. If 'norfc1918' is specified for an entry in either the removed. If 'norfc1918' is specified for an entry in either the
interfaces or the hosts file, a warning is issued and the option is interfaces or the hosts file, a warning is issued and the option is
ignored. Simply remove the option to avoid the warning. ignored. Simply remove the option to avoid the warning.
@ -126,7 +122,7 @@ Shorewall 4.4.0
Users who currently use 'norfc1918' are encouraged to consider Users who currently use 'norfc1918' are encouraged to consider
using NULL_ROUTE_RFC1918=Yes instead. using NULL_ROUTE_RFC1918=Yes instead.
9) The install.sh scripts in the Shorewall and Shorewall6 packages no 8) The install.sh scripts in the Shorewall and Shorewall6 packages no
longer create a backup copy of the existing configuration. If you longer create a backup copy of the existing configuration. If you
want your configuration backed up prior to upgrading, you will want your configuration backed up prior to upgrading, you will
need to do that yourself. need to do that yourself.
@ -134,7 +130,7 @@ Shorewall 4.4.0
As part of this change, the fallback.sh scripts are no longer As part of this change, the fallback.sh scripts are no longer
released. released.
10) In earlier releases, if an ipsec zone was defined as a sub-zone of 9) In earlier releases, if an ipsec zone was defined as a sub-zone of
an ipv4 or ipv6 zone using the special <child>:<parent>,... syntax, an ipv4 or ipv6 zone using the special <child>:<parent>,... syntax,
CONTINUE policies for the sub-zone did not work as CONTINUE policies for the sub-zone did not work as
expected. Traffic that was not matched by a sub-zone rule was not expected. Traffic that was not matched by a sub-zone rule was not
@ -142,7 +138,7 @@ Shorewall 4.4.0
In 4.4.0, such traffic IS compared against the parent zone rules. In 4.4.0, such traffic IS compared against the parent zone rules.
11) The name 'any' is now reserved and may not be used as a zone name. 10) The name 'any' is now reserved and may not be used as a zone name.
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 4 . 4 . 0 P R O B L E M S C O R R E C T E D I N 4 . 4 . 0
@ -175,6 +171,9 @@ Shorewall 4.4.0
commands did not properly suppress redundant fields in the records commands did not properly suppress redundant fields in the records
(host name, and leading constant part of the LOGPREFIX). (host name, and leading constant part of the LOGPREFIX).
4) Given that Jozsef Kadlecsik has not yet released ipset 3.1, ipset
bindings are once again supported.
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
K N O W N P R O B L E M S R E M A I N I N G K N O W N P R O B L E M S R E M A I N I N G
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
@ -735,10 +734,7 @@ None.
OUT-BANDWIDTH. Maximum delay is 10ms. Maximum packet OUT-BANDWIDTH. Maximum delay is 10ms. Maximum packet
size is 1500 bytes. size is 1500 bytes.
20) Support for ipset bindings has been removed. Jozsef Kadlecsik has 20) Optional TOS and LENGTH fields have been added to the tcfilters
already removed such support from ipset itself.
21) Optional TOS and LENGTH fields have been added to the tcfilters
file. file.
The TOS field may contain any of the following: The TOS field may contain any of the following:
@ -757,10 +753,10 @@ None.
inclusive. Packets with a total length that is strictly less that inclusive. Packets with a total length that is strictly less that
the specified value will match the rule. the specified value will match the rule.
22) Support for 'norfc1918' has been removed. See the Migration 21) Support for 'norfc1918' has been removed. See the Migration
Considerations above. Considerations above.
23) A 'upnpclient' option has been added to 22) A 'upnpclient' option has been added to
/etc/shorewall/interfaces. This option is intended for laptop users /etc/shorewall/interfaces. This option is intended for laptop users
who always run Shorewall on their system yet need to run who always run Shorewall on their system yet need to run
UPnP-enabled client apps such as Transmission (BitTorrent client). UPnP-enabled client apps such as Transmission (BitTorrent client).
@ -770,7 +766,7 @@ None.
that, like all aspects of UPnP, this is a security hole so use this that, like all aspects of UPnP, this is a security hole so use this
option at your own risk. option at your own risk.
24) 'iptrace' and 'noiptrace' commands have been added to both 23) 'iptrace' and 'noiptrace' commands have been added to both
/sbin/shorewall and /sbin/shorewall6. /sbin/shorewall and /sbin/shorewall6.
These are low-level debugging commands that cause These are low-level debugging commands that cause
@ -797,15 +793,15 @@ None.
shorewall noiptrace -d 206.124.146.176 shorewall noiptrace -d 206.124.146.176
25) A USER/GROUP column has been added to /etc/shorewall/masq. The 24) A USER/GROUP column has been added to /etc/shorewall/masq. The
column works similarly to USER/GROUP columns in other Shorewall column works similarly to USER/GROUP columns in other Shorewall
configuration files. Only locally-generated traffic is matched. configuration files. Only locally-generated traffic is matched.
26) A new extension script, 'lib.private' has been added. This file is 25) A new extension script, 'lib.private' has been added. This file is
intended to include declarations of shell functions that will be intended to include declarations of shell functions that will be
called by the other run-time extension scripts. called by the other run-time extension scripts.
27) Paul Gear has contributed the following macros: 26) Paul Gear has contributed the following macros:
macro.Webcache (originally named macro.DG) macro.Webcache (originally named macro.DG)
macro.IPPbrd macro.IPPbrd
@ -813,7 +809,7 @@ None.
macro.RIPbi macro.RIPbi
macro.mDNS macro.mDNS
28) The default value of DISABLE_IPV6 has been changed from 'Yes' to 27) The default value of DISABLE_IPV6 has been changed from 'Yes' to
'No' in all sample shorewall.conf files. Shorewall6 should be 'No' in all sample shorewall.conf files. Shorewall6 should be
installed to restrict IPv6 traffic. installed to restrict IPv6 traffic.