forked from extern/shorewall_code
Minor Cleanup
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@3382 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
89f7d3220d
commit
72e5f6e53a
@ -17,7 +17,8 @@ Note to users upgrading from Shorewall 2.x or 3.0
|
||||
|
||||
While you are at it, if you have a file named /etc/shorewall/rfc1918 then
|
||||
please check that file. If it has addresses listed that are NOT in one of
|
||||
these three ranges, then please rename the file to /etc/shorewall/rfc1918.old.
|
||||
these three ranges, then please rename the file to
|
||||
/etc/shorewall/rfc1918.old.
|
||||
|
||||
10.0.0.0 - 10.255.255.255
|
||||
172.16.0.0 - 172.31.255.255
|
||||
@ -33,18 +34,16 @@ Problems Corrected in 3.1.4
|
||||
|
||||
New Features added in 3.1.4
|
||||
|
||||
1) The /etc/shorewall/maclist file has a new column layout. The first column is
|
||||
now DISPOSITION. This column determines what to do with matching packets and
|
||||
can have the value ACCEPT or DROP (if MACLIST_TABLE=filter, it can also
|
||||
contain REJECT). This change is upward compatible so your existing maclist
|
||||
file can still be used.
|
||||
1) The /etc/shorewall/maclist file has a new column layout. The first column
|
||||
is now DISPOSITION. This column determines what to do with matching
|
||||
packets and can have the value ACCEPT or DROP (if MACLIST_TABLE=filter, it
|
||||
can also contain REJECT). This change is upward compatible so your existing
|
||||
maclist file can still be used.
|
||||
|
||||
ACCEPT, DROP and REJECT may be optionally followed by a log level to cause the
|
||||
packet to be logged.
|
||||
ACCEPT, DROP and REJECT may be optionally followed by a log level to
|
||||
cause the packet to be logged.
|
||||
|
||||
2) Shorewall has always been very noisy (lots of messages). No more. The default
|
||||
for new users is now to be very quiet and you get more detail using the -v option
|
||||
(or -vv if you want the old noisy behavior).
|
||||
2) Shorewall has always been very noisy (lots of messages). No more.
|
||||
|
||||
You set the default level of verbosity using the VERBOSITY option in
|
||||
shorewall.conf. If you don't set it (as would be the case of you use your
|
||||
@ -52,22 +51,28 @@ New Features added in 3.1.4
|
||||
the old default. A value of 1 suppresses some of the output (like the old
|
||||
-q option did) while a value of 0 makes Shorewall almost silent.
|
||||
|
||||
The value specified in the 3.2 shorewall.conf is 1. So you can make Shorewall
|
||||
as verbose as previously using a single -v and you can make it silent by using
|
||||
a single -1.
|
||||
The value specified in the 3.2 shorewall.conf is 1. So you can make
|
||||
Shorewall as verbose as previously using a single -v and you can make it
|
||||
silent by using a single -q.
|
||||
|
||||
If the default is set at 2, you can still make a command silent by using two
|
||||
"q"s (e.g., shorewall -qq restart).
|
||||
If the default is set at 2, you can still make a command silent by using
|
||||
two "q"s (e.g., shorewall -qq restart).
|
||||
|
||||
In summary, each "q" subtracts one from VERBOSITY while each "v" adds one to
|
||||
VERBOSITY.
|
||||
In summary, each "q" subtracts one from VERBOSITY while each "v" adds one
|
||||
to VERBOSITY.
|
||||
|
||||
The "shorewall show log", "shorewall logwatch" and "shorewall dump" commands
|
||||
require VERBOSE to be greater than or equal to 3 to display MAC addresses.
|
||||
This is consistent with the previous implementation which required a single
|
||||
-v to enable MAC display but means that if you set VERBOSITY=0 in shorewall.conf,
|
||||
then you will need to include -vvv in commands that display log records in
|
||||
order to have MACs displayed.
|
||||
The "shorewall show log", "shorewall logwatch" and "shorewall dump"
|
||||
commands require VERBOSE to be greater than or equal to 3 to display MAC
|
||||
addresses.This is consistent with the previous implementation which
|
||||
required a single -v to enable MAC display but means that if you set
|
||||
VERBOSITY=0 in shorewall.conf, then you will need to include -vvv in
|
||||
commands that display log records in order to have MACs displayed.
|
||||
|
||||
3) Shorewall now implements the 'start' and 'restart' using a "compile and
|
||||
go" approach. See the details under the first new feature below.
|
||||
|
||||
4) The "-p" option to the 'compile' command is gone. Generation of a
|
||||
complete program is now the default.
|
||||
|
||||
Migration Considerations:
|
||||
|
||||
@ -77,7 +82,8 @@ New Features:
|
||||
|
||||
1) A new 'shorewall generate' command has been added.
|
||||
|
||||
shorewall generate [ -v ] [ -q ] [ -e ] [ <config directory> ] <script file>
|
||||
shorewall generate [ -v ] [ -q ] [ -e ] [ <config directory> ] <script
|
||||
file>
|
||||
|
||||
where:
|
||||
|
||||
@ -91,12 +97,13 @@ New Features:
|
||||
on a system without Shorewall installed.
|
||||
<config directory> Is an optional directory to be searched for
|
||||
configuration files prior to those listed
|
||||
in CONFIG_DIR in /etc/shorewall/shorewall.conf.
|
||||
in CONFIG_DIR in
|
||||
/etc/shorewall/shorewall.conf.
|
||||
<script file> Is the name of the output file.
|
||||
|
||||
The 'generate' command processes the configuration and writes a script file
|
||||
which may then be executed (either directly or using the 'shorewall restore'
|
||||
command) to configure the firewall.
|
||||
The 'generate' command processes the configuration and writes a script
|
||||
file which may then be executed (either directly or using the
|
||||
'shorewall restore' command) to configure the firewall.
|
||||
|
||||
'compile' is a synonym for 'generate':
|
||||
|
||||
@ -105,12 +112,12 @@ New Features:
|
||||
The generated script contains error checking and will terminate if an
|
||||
important command fails. Before terminating:
|
||||
|
||||
a) The script will check for the existence of the restore script specified
|
||||
by the RESTOREFILE variable in shorewall.conf. If that restore script
|
||||
exists, it is executed.
|
||||
a) The script will check for the existence of the restore script
|
||||
specified by the RESTOREFILE variable in shorewall.conf. If that
|
||||
restore script exists, it is executed.
|
||||
|
||||
b) If the restore script doesn't exist but Shorewall appears to be installed
|
||||
on the system, an "/sbin/shorewall stop" command is executed.
|
||||
b) If the restore script doesn't exist but Shorewall appears to be
|
||||
installed on the system, an "/sbin/shorewall stop" command is executed.
|
||||
|
||||
Some additional considerations:
|
||||
|
||||
@ -123,14 +130,15 @@ New Features:
|
||||
2) The 'detectnets' interface option is not allowed.
|
||||
|
||||
b) If you have extension scripts, they may need modification. Some of
|
||||
the scripts will be run at compile time, rather than when the generated
|
||||
script is executed. The standard functions like 'run_iptables' and
|
||||
'log_rule_limit' will write the iptables command to the script file
|
||||
rather than executing the command. As always, you can check $COMMAND
|
||||
to determine which shorewall command is being executed.
|
||||
the scripts will be run at compile time, rather than when the
|
||||
generated script is executed. The standard functions like
|
||||
'run_iptables' and 'log_rule_limit' will write the iptables command
|
||||
to the script file rather than executing the command. As always, you
|
||||
can check $COMMAND to determine which shorewall command is being
|
||||
executed.
|
||||
|
||||
Extension Scripts that are run at compile time rather than at run-time
|
||||
are:
|
||||
Extension Scripts that are run at compile time rather than at
|
||||
run-time are:
|
||||
|
||||
- params
|
||||
- init
|
||||
@ -138,7 +146,8 @@ New Features:
|
||||
- initdone
|
||||
- start
|
||||
- started
|
||||
- All scripts associated with a given chain such as Action chains
|
||||
- All scripts associated with a given chain such as Action
|
||||
chains
|
||||
|
||||
In addition to 'generate', a 'shorewall reload' command has been added.
|
||||
|
||||
@ -149,11 +158,13 @@ New Features:
|
||||
The 'reload' command creates a script using 'generate' and if there are
|
||||
no errors, it then restores that script. It is equivalent to:
|
||||
|
||||
if shorewall generate /var/lib/shorewall/.reload; then restore .reload; fi
|
||||
if shorewall generate /var/lib/shorewall/.reload; then
|
||||
restore .reload;
|
||||
fi
|
||||
|
||||
The advantage of using reload over restart is that reload results in new
|
||||
connections being dropped for a much shorter time. Here are the results of
|
||||
tests that I conducted on my own firewall:
|
||||
connections being dropped for a much shorter time. Here are the results
|
||||
of tests that I conducted on my own firewall:
|
||||
|
||||
A) shorewall restart (Shorewall 3.0.4)
|
||||
|
||||
@ -176,10 +187,10 @@ New Features:
|
||||
sys 0m0.608s
|
||||
|
||||
The time difference between B and C reflects the difference between
|
||||
"iptables-restore" and multiple executions of "iptables". The system is a
|
||||
1.4Ghz Celeron with 512MB RAM.
|
||||
"iptables-restore" and multiple executions of "iptables". The system is
|
||||
a 1.4Ghz Celeron with 512MB RAM.
|
||||
|
||||
Compilation generates a complete program This program is suitable for
|
||||
Compilation generates a complete program. This program is suitable for
|
||||
installation into /etc/init.d and, when generated with the "-e" option,
|
||||
can serve as your firewall on a system that doesn't even have Shorewall
|
||||
installed.
|
||||
@ -193,14 +204,20 @@ New Features:
|
||||
<program> [ -q ] [ -v ] [ -n ] status
|
||||
<program> [ -q ] [ -v ] [ -n ] version
|
||||
|
||||
The "shorewall start" and "shorewall restart" commands have been rewritten
|
||||
to use compilation. They both compile a temporary program then run it. This
|
||||
results in a slightly longer elapsed time than the similar commands required
|
||||
under earlier versions of Shorewall but new connections are blocked for a
|
||||
much smaller percentage of that time as shown by the numbers above. Under
|
||||
Shorewall 3.1.4, "shorewall restart" takes roughly 20.5 seconds on my
|
||||
firewall:
|
||||
The "shorewall start" and "shorewall restart" commands have been
|
||||
rewritten to use compilation. They both compile a temporary program
|
||||
then run it. This results in a slightly longer elapsed time than the
|
||||
similar commands required under earlier versions of Shorewall but new
|
||||
connections are blocked for a much smaller percentage of that time as
|
||||
shown by the numbers above. Under Shorewall 3.1.4, "shorewall restart"
|
||||
takes roughly 20.5 seconds on my firewall:
|
||||
|
||||
real 0m20.206s
|
||||
user 0m7.412s
|
||||
sys 0m12.773s
|
||||
|
||||
As a final part of this change, the "check" command now compiles the
|
||||
current configuration then discards the generated script. So "check"
|
||||
performs all of the same checks that compile does. Note that there is
|
||||
still no guarantee that the generated script won't encounter run-time
|
||||
errors.
|
||||
|
||||
@ -179,7 +179,11 @@ validate_restorefile() # $* = label
|
||||
{
|
||||
case $RESTOREFILE in
|
||||
*/*)
|
||||
echo " ERROR: $@ must specify a simple file name: $RESTOREFILE" >&2
|
||||
error_message "ERROR: $@ must specify a simple file name: $RESTOREFILE"
|
||||
exit 2
|
||||
;;
|
||||
.*)
|
||||
error_message "ERROR: Reserved File Name: $RESTOREFILE"
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
@ -488,6 +492,7 @@ save_config() {
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
#
|
||||
# Start Command Executor
|
||||
#
|
||||
@ -1802,6 +1807,10 @@ case "$COMMAND" in
|
||||
VERBOSE=$(($VERBOSE + 1 ))
|
||||
option=${option#v}
|
||||
;;
|
||||
q*)
|
||||
VERBOSE=$(($VERBOSE - 1 ))
|
||||
option=${option#q}
|
||||
;;
|
||||
-)
|
||||
finished=1
|
||||
option=
|
||||
|
||||
Loading…
Reference in New Issue
Block a user