forked from extern/shorewall_code
Bring News page up to date
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@8393 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
2ef0a32b7c
commit
5e629bbb79
@ -26,9 +26,12 @@ license is included in the section entitled <span
|
||||
href="GnuCopyright.htm" target="_self">GNU Free Documentation
|
||||
License</a></span>".
|
||||
</p>
|
||||
<p>February 23, 2008<br>
|
||||
<p>March 29, 2008<br>
|
||||
</p>
|
||||
<hr style="width: 100%; height: 2px;">
|
||||
<p><strong>2008-03-29 Shorewall 4.0.10</strong></p>
|
||||
<p><strong></strong></p>
|
||||
<pre>Problems corrected in Shorewall-perl 4.0.10.<br><br>1) Shorewall-perl 4.0.9 erroneously reported an error message when a<br> bridge port was defined in /etc/shorewall/interfaces:<br><br> ERROR: Your iptables is not recent enough to support bridge ports<br><br>2) Under Shorewall-perl, if an empty action was invoked or was named<br> in one of the DEFAULT_xxx options in shorewall.conf, an<br> iptables-restore error occured.<br><br>3) If $ADMIN was empty, then the rule:<br><br> ACCEPT loc:$ADMIN all<br><br> became<br><br> ACCEPT loc net<br><br> It is now flagged as an error.<br><br>4) Previously, Shorewall-perl would reject an IP address range in the<br> ecn and routestopped files.<br><br>5) A POLICY of ":" in /etc/shorewall/policy would produce Perl<br> run-time errors.<br><br>6) An INTERFACE of ":" in /etc/shorewall/interfaces would produce Perl<br> run-time errors.<br><br>7) A MARK of ":" in /etc/shorewall/tcrules would produce Perl<br> run-time errors.<br><br>Problems corrected in Shorewall-shell 4.0.10.<br><br>1) Specifying a value for ACCEPT_DEFAULT or QUEUE_DEFAULT resulted in<br> a fatal error at compile time.<br><br>Known Problems Remaining.<br><br>1) The 'refresh' command doesn't refresh the mangle table. So changes<br> made to /etc/shorewall/providers and/or /etc/shorewall/tcrules may<br> not be reflected in the running ruleset.<br><br>Other changes in 4.0.10.<br><br>1) The Sample configurations have been updated to set<br> LOG_MARTIANS=keep. In 4.2, this will be changed to<br> LOG_MARTIANS=Yes.<br><br>2) Shorewall-perl now generates a fatal error if a non-existant shell<br> variable is used in any configuration file (except<br> /etc/shorewall/params).<br><br>3) Shorewall-perl now supports an 'l2tp' tunnel type. It opens UDP<br> port 1701 in both directions and assumes that the source port will<br> also be 1701. Some implementations (particularly OS X) use a<br> different source port. In that case, you should use<br> 'generic:udp:1701' rather than 'l2tp'.<br></pre>
|
||||
<p><strong>2008-03-01 Shorewall 3.4.8</strong></p>
|
||||
<pre>1) Shorewall now removes any default bindings of ipsets before<br> attempting to reload them. Previously, default bindins were not<br> removed with the result that the ipsets could not be destroyed.<br><br><br>2) When HIGH_ROUTE_MARKS=Yes, unpredictable results could occur when<br> marking in the PREROUTING or OUTPUT chains. When a rule specified a<br> mark value > 255, the compiler was using the '--or-mark' operator<br> rather than the '--set-mark' operator with the result that when a<br> packet matched more than one rule, the resulting routing mark was<br> the logical product of the mark values in the rules.<br><br><br> Example:<br><br><br> 0x100 192.168.1.44 0.0.0.0/0<br> 0x200 0.0.0.0/0 0.0.0.0/0 tcp 25<br><br><br> A TCP packet from 192.168.1.44 with destination port 25 would end<br> up with a mark value of 0x300.<br><br><br>3) Shorewall now properly parses comma separated SOURCE (formerly<br> SUBNET) values in the masq configuration file. Previously, the comma<br> separated list was not split up into its components, resulting in an<br> invalid address being passed to the iptables command.<br><br><br> Example:<br><br><br> # /etc/shorewall/masq<br> #INTERFACE SUBNET ADDRESS PROTO PORT(S) IPSEC<br> eth0 192.168.2.1,192.168.2.3<br><br><br>4) Previously, specifying both an interface and a MAC address in the<br> SOURCE column of the tcrules file caused a failure at runtime.<br> Thanks to Justin Joseph for the patch.<br><br><br>5) Previously, specifying both an interface and an address in the<br> tcrules DEST column would cause an incomplete rule to be generated.<br><br><br> Example:<br><br><br> 1 192.168.1.4 eth2:206.124.146.177 tcp 22<br><br><br> The resulting tcrule would be as if this had been specified:<br><br><br> 1 0.0.0.0/0 eth2:206.124.146.177 tcp 22<br><br><br>6) When HIGH_ROUTE_MARKS=Yes, the routing rules generated to match<br> fwmarks to routing tables overflowed the designated range for such<br> marks (10000 - 11000).</pre>
|
||||
<hr>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user