forked from extern/shorewall_code
Update version
Signed-off-by: Tom Eastep <teastep@shorewall.net> git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@9697 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
f91a5dbf0c
commit
5ea4f651eb
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -22,7 +22,7 @@
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
%define name shorewall-lite
|
||||
%define version 4.3.7
|
||||
%define version 4.3.8
|
||||
%define release 0base
|
||||
|
||||
Summary: Shoreline Firewall Lite is an iptables-based firewall for Linux systems.
|
||||
@ -98,6 +98,8 @@ fi
|
||||
%doc COPYING changelog.txt releasenotes.txt
|
||||
|
||||
%changelog
|
||||
* Tue Mar 17 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.8-0base
|
||||
* Sun Mar 01 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.7-0base
|
||||
* Fri Feb 27 2009 Tom Eastep tom@shorewall.net
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Shorewall Firewall
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,3 +1,7 @@
|
||||
Changes in Shorewall 4.3.8
|
||||
|
||||
None.
|
||||
|
||||
Changes in Shorewall 4.3.7
|
||||
|
||||
1) Fix forward treatment of interface options.
|
||||
|
||||
@ -22,7 +22,7 @@
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
Shorewall 4.3.7
|
||||
Shorewall 4.3.8
|
||||
|
||||
Shorewall 4.3 is the development thread for Shorewall 4.4 which will be
|
||||
released late in 2009.
|
||||
@ -36,49 +36,10 @@ released late in 2009.
|
||||
continues to be supported.
|
||||
|
||||
----------------------------------------------------------------------------
|
||||
P R O B L E M S C O R R E C T E D I N 4 . 3 . 7
|
||||
P R O B L E M S C O R R E C T E D I N 4 . 3 . 8
|
||||
----------------------------------------------------------------------------
|
||||
|
||||
1) Klemens Rutz reported a problem that affects all Shorewall-perl 4.2
|
||||
and 4.3 versions.
|
||||
|
||||
The problem:
|
||||
|
||||
a) Only occurs when there are more than one non-firewall zone.
|
||||
b) Results in the following interface options not being applied to
|
||||
forwarded traffic.
|
||||
|
||||
blacklist
|
||||
dhcp
|
||||
maclist (when MACLIST_TABLE=filter)
|
||||
norfc1918
|
||||
nosmurfs
|
||||
tcpflags
|
||||
|
||||
2) Matt LaPlante reported a problem whereby a valid DNAT- rule was
|
||||
badly mis-handled.
|
||||
|
||||
The rule:
|
||||
|
||||
DNAT- loc net:1.2.3.4:2525 tcp 25
|
||||
|
||||
The result:
|
||||
|
||||
WARNING: Destination zone (1.2.3.4) ignored : /etc/shorewall/rules (line 459)
|
||||
Can't call method "inet_htoa" without a package or object reference at
|
||||
/usr/share/shorewall-perl/Shorewall/IPAddrs.pm line 150,
|
||||
<$currentfile> line 459.
|
||||
|
||||
3) Previously, OPTIONS were not allowed with a bridge port in
|
||||
/etc/shorewall/interfaces. That oversight has been corrected and
|
||||
now the following OPTIONS are allowed:
|
||||
|
||||
blacklist
|
||||
maclist
|
||||
norfc1918
|
||||
nosmurfs
|
||||
routeback
|
||||
tcpflags
|
||||
None.
|
||||
|
||||
----------------------------------------------------------------------------
|
||||
K N O W N P R O B L E M S R E M A I N I N G
|
||||
@ -87,79 +48,10 @@ released late in 2009.
|
||||
None.
|
||||
|
||||
----------------------------------------------------------------------------
|
||||
N E W F E A T U R E S I N 4 . 3 . 7
|
||||
N E W F E A T U R E S I N 4 . 3 . 8
|
||||
----------------------------------------------------------------------------
|
||||
|
||||
1) The file /var/lib/shorewall/.restore has been renamed to
|
||||
/var/lib/shorewall/firewall. A similar change has been made in
|
||||
Shorewall6.
|
||||
|
||||
When a successful start or restart is completed, the script that
|
||||
executed the command copies itself to to
|
||||
/var/lib/shorewall[6/firewall.
|
||||
|
||||
2) Dynamic zone support is once again available for IPv4. This support
|
||||
is built on top of ipsets so you must have installed the
|
||||
xtable-addons.
|
||||
|
||||
Dynamic zones are available when Shorewall-lite is used as well.
|
||||
|
||||
Note that the dynamic zone support built into Shorewall provides no
|
||||
additional functionality over what is provided by simply defining a
|
||||
zone in terms of an ipset (see
|
||||
http://www1.shorewall.net/ipsets.html#Dynamic).
|
||||
|
||||
You define a zone as having dynamic content in one of two ways:
|
||||
|
||||
- By specifying nets=dynamic in the OPTIONS column of an entry for
|
||||
the zone in /etc/shorewall/interfaces; or
|
||||
|
||||
- By specifying <interface>:dynamic in the HOST(S) column of an
|
||||
entry for the zone in /etc/shorewall/hosts.
|
||||
|
||||
When there are any dynamic zones present in your configuration,
|
||||
Shorewall (Shorewall-lite) will:
|
||||
|
||||
a) Execute the following commands during 'shorewall start' or
|
||||
'shorewall-lite start'.
|
||||
|
||||
ipset -U :all: :all:
|
||||
ipset -U :all: :default:
|
||||
ipset -F
|
||||
ipset -X
|
||||
ipset -R < ${VARDIR}/ipsets.save
|
||||
|
||||
where $VARDIR normally contains /var/lib/shorewall
|
||||
(/var/lib/shorewall-lite) but may be modified by
|
||||
/etc/shorewall/vardir (/etc/shorewall-lite/vardir).
|
||||
|
||||
|
||||
b) During 'start', 'restart' and 'restore' processing, Shorewall
|
||||
will then attempt to create an ipset named <zone>_<interface>
|
||||
for each zone/interface pair that has been specified as
|
||||
dynamic. The type of ipset created is 'iphash' so that only
|
||||
individual IPv4 addresses may be added to the set.
|
||||
|
||||
c) Execute the following commands during 'shorewall stop' or
|
||||
'shorewall-lite stop':
|
||||
|
||||
if ipset -S > ${VARDIR}/ipsets.tmp; then
|
||||
mv -f ${VARDIR}/ipsets.tmp ${VARDIR}/ipsets.save
|
||||
fi
|
||||
|
||||
The 'shorewall add' and 'shorewall delete' commands are supported
|
||||
with their original syntax:
|
||||
|
||||
add <interface>[:<host-list>] ... <zone>
|
||||
|
||||
delete <interface>[:<host-list>] ... <zone>
|
||||
|
||||
In addition, the 'show dynamic' command is added that lists the dynamic
|
||||
content of a zone.
|
||||
|
||||
show dynamic <zone>
|
||||
|
||||
These commands are supported by shorewall-lite as well.
|
||||
None.
|
||||
|
||||
----------------------------------------------------------------------------
|
||||
N E W F E A T U R E S IN 4 . 3
|
||||
@ -257,3 +149,73 @@ None.
|
||||
Important note: SAME only works with providers that have the
|
||||
'track' option specified in /etc/shorewall/providers.
|
||||
|
||||
4) The file /var/lib/shorewall/.restore has been renamed to
|
||||
/var/lib/shorewall/firewall. A similar change has been made in
|
||||
Shorewall6.
|
||||
|
||||
When a successful start or restart is completed, the script that
|
||||
executed the command copies itself to to
|
||||
/var/lib/shorewall[6/firewall.
|
||||
|
||||
5) Dynamic zone support is once again available for IPv4. This support
|
||||
is built on top of ipsets so you must have installed the
|
||||
xtable-addons.
|
||||
|
||||
Dynamic zones are available when Shorewall-lite is used as well.
|
||||
|
||||
Note that the dynamic zone support built into Shorewall provides no
|
||||
additional functionality over what is provided by simply defining a
|
||||
zone in terms of an ipset (see
|
||||
http://www1.shorewall.net/ipsets.html#Dynamic).
|
||||
|
||||
You define a zone as having dynamic content in one of two ways:
|
||||
|
||||
- By specifying nets=dynamic in the OPTIONS column of an entry for
|
||||
the zone in /etc/shorewall/interfaces; or
|
||||
|
||||
- By specifying <interface>:dynamic in the HOST(S) column of an
|
||||
entry for the zone in /etc/shorewall/hosts.
|
||||
|
||||
When there are any dynamic zones present in your configuration,
|
||||
Shorewall (Shorewall-lite) will:
|
||||
|
||||
a) Execute the following commands during 'shorewall start' or
|
||||
'shorewall-lite start'.
|
||||
|
||||
ipset -U :all: :all:
|
||||
ipset -U :all: :default:
|
||||
ipset -F
|
||||
ipset -X
|
||||
ipset -R < ${VARDIR}/ipsets.save
|
||||
|
||||
where $VARDIR normally contains /var/lib/shorewall
|
||||
(/var/lib/shorewall-lite) but may be modified by
|
||||
/etc/shorewall/vardir (/etc/shorewall-lite/vardir).
|
||||
|
||||
|
||||
b) During 'start', 'restart' and 'restore' processing, Shorewall
|
||||
will then attempt to create an ipset named <zone>_<interface>
|
||||
for each zone/interface pair that has been specified as
|
||||
dynamic. The type of ipset created is 'iphash' so that only
|
||||
individual IPv4 addresses may be added to the set.
|
||||
|
||||
c) Execute the following commands during 'shorewall stop' or
|
||||
'shorewall-lite stop':
|
||||
|
||||
if ipset -S > ${VARDIR}/ipsets.tmp; then
|
||||
mv -f ${VARDIR}/ipsets.tmp ${VARDIR}/ipsets.save
|
||||
fi
|
||||
|
||||
The 'shorewall add' and 'shorewall delete' commands are supported
|
||||
with their original syntax:
|
||||
|
||||
add <interface>[:<host-list>] ... <zone>
|
||||
|
||||
delete <interface>[:<host-list>] ... <zone>
|
||||
|
||||
In addition, the 'show dynamic' command is added that lists the dynamic
|
||||
content of a zone.
|
||||
|
||||
show dynamic <zone>
|
||||
|
||||
These commands are supported by shorewall-lite as well.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
%define name shorewall
|
||||
%define version 4.3.7
|
||||
%define version 4.3.8
|
||||
%define release 0base
|
||||
|
||||
Summary: Shoreline Firewall is an iptables-based firewall for Linux systems.
|
||||
@ -172,6 +172,8 @@ fi
|
||||
%doc COPYING INSTALL changelog.txt releasenotes.txt Contrib/* Samples
|
||||
|
||||
%changelog
|
||||
* Tue Mar 17 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.8-0base
|
||||
* Sun Mar 01 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.7-0base
|
||||
* Fri Feb 27 2009 Tom Eastep tom@shorewall.net
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Shorewall Firewall
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -22,7 +22,7 @@
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
%define name shorewall6-lite
|
||||
%define version 4.3.7
|
||||
%define version 4.3.8
|
||||
%define release 0base
|
||||
|
||||
Summary: Shoreline Firewall 6 Lite is an ip6tables-based firewall for Linux systems.
|
||||
@ -89,6 +89,8 @@ fi
|
||||
%doc COPYING changelog.txt releasenotes.txt
|
||||
|
||||
%changelog
|
||||
* Tue Mar 17 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.8-0base
|
||||
* Sun Mar 01 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.7-0base
|
||||
* Fri Feb 27 2009 Tom Eastep tom@shorewall.net
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Shorewall Firewall
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -28,7 +28,7 @@
|
||||
# shown below. Simply run this script to revert to your prior version of
|
||||
# Shoreline Firewall.
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -22,7 +22,7 @@
|
||||
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
#
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
%define name shorewall6
|
||||
%define version 4.3.7
|
||||
%define version 4.3.8
|
||||
%define release 0base
|
||||
|
||||
Summary: Shoreline Firewall 6 is an ip6tables-based firewall for Linux systems.
|
||||
@ -144,6 +144,8 @@ fi
|
||||
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel ipsecvpn ipv6 Samples6
|
||||
|
||||
%changelog
|
||||
* Tue Mar 17 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.8-0base
|
||||
* Sun Mar 01 2009 Tom Eastep tom@shorewall.net
|
||||
- Updated to 4.3.7-0base
|
||||
* Fri Feb 27 2009 Tom Eastep tom@shorewall.net
|
||||
|
||||
@ -26,7 +26,7 @@
|
||||
# You may only use this script to uninstall the version
|
||||
# shown below. Simply run this script to remove Shorewall Firewall
|
||||
|
||||
VERSION=4.3.7
|
||||
VERSION=4.3.8
|
||||
|
||||
usage() # $1 = exit status
|
||||
{
|
||||
|
||||
Loading…
Reference in New Issue
Block a user