Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation;
@@ -20,21 +20,32 @@ Texts. A copy of the license is included in the section entitled “GNU Free
Documentation License”.
December 14, 2006
+
January 16, 2007
Problems Corrected in 3.2.8+ +
1) The 'ash' shell produced an error when processing an entry with a
log tag from /etc/shorewall/rules.
2) If the file /etc/shorewall/init did not exist, then the compiler
would incorrectly copy /usr/share/shorewall/init into the
compiled script. /usr/share/shorewall/init is a symbolic link
to the Shorewall init script (usually /etc/init.d/shorewall).
3) Previously, "ipp2p:udp" was incorrectly rejected in the PROTO
column of an action definition.
Other Changes in 3.2.8.
1) New macros for network printing protocols have been added,
courtesy of Tuomo Soini. Tuomo also provided a macro for TFTP.
The print-oriented macros are:
macro.IPP
macro.Jetdirect
macro.Printer
+
2006-12-14 Shorewall 3.2.7
Problems Corrected in 3.2.7-2006-11-18 Shorewall 3.2.6
1) Handling of saved ipsets in /etc/shorewall/ipsets is broken when
used on a system running Shorewall Lite. If there is a file named
'ipsets' on the CONFIG_PATH when the firewall script is compiled,
then the compiled script attempts to restore the ipsets from that
file (which may not exist on the firewall system).
2) The 'try' command failed on systems whose /bin/sh is Busybox ash:
/sbin/shorewall: export: 2158: Illegal option -n
3) Previously, Shorewall has assumed that the root user is named
'root'. Beginning with this release, the root user may have a
different name. This required the addition of an '-r' option for
the 'shorewall load' and 'shorewall reload' commands.
[re]load [ -e ] [ -c ] [ -r <root user> ] [ <dir> ] system
Example: shorewall reload -r foobar firewall
4) On systems with a light-weight shell such as ash or dash for /bin/sh,
the output of "shorewall show macros" was garbled.
Other Changes in 3.2.7
1) Prior to this release, on firewall systems with Shorewall Lite
installed, the local modules file is used to determine which kernel
modules to load. Beginning with this release, if there is a
'modules' file in the export directory when the firewall script is
compiled, then that file will be copied into the compiled script
and used on the firewall system.
2) When syslogd is run with the -C option (which in some
implementations causes syslogd to log to an in-memory circular
buffer), /sbin/shorewall will now use the 'logread' command to read
the log from that buffer. This is for combatibility with OpenWRT.
3) Failures of the start, restart and restore commands are now logged
using 'logger'. These failures are logged with the 'kern' facility
and 'err' priority. As part of this change, normal state changes
are now logged with the 'kern' facility and 'info' priority.
Problems Corrected in 3.2.6.-2006-10-28 Shorewall 3.2.5
1) When using a light-weight shell (e.g., ash) with multiple
providers, the /etc/iproute2/rt_tables database may become corrupted.
2) A startup error occurred when the LENGTH or TOS column was
non-empty in /etc/shorewall/tcrules.
3) A startup error resulted when whitespace as included in LOGFORMAT.
4) Previously, when conntrack match support was not available, the
'norfc1918' option on an interface or host group was incorrectly
filtering IPSEC traffic whose source IP address was reserved by RFC
1918.
5) If a DNAT or REDIRECT rule was used where the effective policy
between the source and final destination zones is ACCEPT, the ACCEPT
part of the rule was not generated. This was intended as an
optimizaiton but it could lead to confusing results if there was a
DROP or REJECT rule following.
This optimization has been removed. You may always use DNAT- and
REDIRECT- to suppress generation of the ACCEPT rule.
6) Shorewall[-lite] previously would return an error exit status to a
"start" command where Shorewall was already running. It not returns
a "success" status.
7) The install.sh scripst have been corrected to work properly when
used to create packages on Slackware and Arch Linux.
5) A change in version 3.2.5 broke Mac Filtration in some
cases. Result was:
Setting up MAC Filtration -- Phase 1...
iptables v1.3.6: policy match: invalid policy `--dir'
Try `iptables -h' or 'iptables --help' for more information.
ERROR: Command "/sbin/iptables -A eth1_fwd -s 0.0.0.0/0 -m state
--state NEW -m policy --pol --dir in -j eth1_mac" Failed
6) At VERBOSITY 1 and higher, the 'shorewall add' and 'shorewall
delete' commands generated a fractured message. The message
contents depended in the setting of IPSECFILE as follows:
IPSECFILE=ipsec
ipsec...
IPSECFILE=zones
IPSEC...
The messages have been corrected and are only produced at VERBOSITY
2 and higher as follows:
IPSECFILE=ipsec
Processing /etc/shorewall/ipsec...
IPSECFILE=zones
Processing IPSEC...
7) Previously, when <action>:none appeared in a rule, the name of the
action chain created was preceded by "%" and might have a one- or
two-digit number appended. If both <action> and <action>:none
appeared, then two chains were created. This has been corrected
such that <action> and <action>:none are treated identically.
8) If SAVE_IPSETS=Yes in shorewall.conf, the "shorewall[-lite] save"
command produced error messages as follows:
Dynamic Rules Saved
Currently-running Configuration Saved to /var/lib/shorewall/restore
grep: /var/lib/shorewall/restore-base: No such file or directory
grep: /var/lib/shorewall/restore-base: No such file or directory
Current Ipset Contents Saved to
/var/lib/shorewall/restore-ipsets
9) If BRIDGING=No in shorewall.conf, then an attempt to define a zone
using ipsets fails as follows:
ERROR: BRIDGING=Yes is needed for this zone definition: z eth0:+iset
Other Changes in 3.2.6.
1) The "shorewall [re]load" command now supports a "-c" option.
Example:
shorewall reload -c gateway
When -c is given, Shorewall will capture the capabilities of the
remote system to a file named "capabilities" in the export
directory before compiling the configuration.
If the file "capabilities" does not currently exist in the
export directory then "-c" is automatically assumed.
2) If 0 (zero) is specified for the IN-BANDWIDTH in
/etc/shorewall/tcdevices then no ingress qdisc will be created for
the device.
Problems Corrected in 3.2.5-2006-10-6 Shorewall 3.0.9
1) Entries such as the following in /etc/shorewall/masq generate a
run-time error:
eth0 eth1!192.168.1.12 206.124.146.176
Omitting the exclusion (!192.168.1.12) avoids the error.
2) Previously, the 'provider' portion of the packet mark was not being
cleared after routing for traffic that originates on the firewall
itself.
3) In prior releases, it was not possible to mark an outgoing packet
with a high mark (HIGH_ROUTE_MARKS=Yes) when the packet originated
on the firewall itself.
4) The detected capabilities were not displayed by 'shorewall dump'
when the effective VERBOSITY was less than 2.
Other changes in 3.2.5
1) For users whose kernel and iptables have Extended MARK Target
support, it is now possible to logically AND or OR a value into the
current packet mark by preceding the mark value (and optional mask)
with an ampersand ("&") or vertical bar ("|") respectively.
Example: To logically OR the value 4 into the mark value for
packets from 192.168.1.1:
#MARK SOURCE
|4 192.168.1.1
2) A new macro (macro.RDP) has been added for Microsoft Remote
Desktop. This macro was contributed by Tuomo Soini.
3) A new 'maclog' extension file has been added. This file is
processed just before logging based on the setting of
MACLIST_LOG_LEVEL is done. When the script is copyied at compile
time, the CHAIN variable will contain the name of the chain where
rules should be inserted. Remember that if you have specified
MACLIST_TABLE=mangle, then your run_iptables commands should
include "-t mangle".
4) Beginning with this release, Shorewall and Shorewall lite will
share the same change log and release notes.
Problems corrected in 3.0.9diff --git a/web/shorewall_index.htm b/web/shorewall_index.htm index cc0bf00f3..3aa9ffbb3 100644 --- a/web/shorewall_index.htm +++ b/web/shorewall_index.htm @@ -12,7 +12,7 @@
1) When using a light-weight shell like ash or dash, "shorewall
[re]start" fails when using the built-in traffic shaper. The error
messages resemble these:
local: 3: eth0:: bad variable name
ERROR: Command "tc class add dev eth0 parent 1: classid 1:1 htb rate 800kbit mtu" Failed
2) The output formating of the 'hits' command under BusyBox 1.2.0 has
been corrected.
3) In prior versions, setting 'mss=' in /etc/shorewall/zones did not
affect traffic to/from the firewall zone. That has been corrected.
4) Previously, using IP address ranges in the accounting file could
cause non-fatal iptables errors during shorewall [re]start.
Other changes in 3.0.9
1) It is now possible to use the special value 'detect' in the ADDRESS
column of /etc/shorewall/masq. This allows you to specify SNAT (as
opposed to MASQUERADE) without having to know the ip address of the
external interface. Shorewall must be restarted each time that the
external address (the address of the interface named in the
INTERFACE column) changes.
2) Experimental optimization for PPP devices has been added to the
providers file. If you omit the GATEWAY column for a ppp device (or
enter "-" in the column) then Shorewall will generate routes
for the named INTERFACE that do not specify a gateway IP address
(the peer address will be assumed).
3) Normally, Shorewall tries to protect users from themselves by
preventing PREROUTING and OUTPUT tcrules from being applied to
packets that have been marked by the 'track' option in
/etc/shorewall/providers.
If you really know what you are doing and understand packet marking
thoroughly, you can set TC_EXPERT=Yes in shorewall.conf and
Shorewall will not include these cautionary checks.
4) Previously, CLASSIFY tcrules were always processed out of the
POSTROUTING chain. Beginning with this release, they are processed
out of the POSTROUTING chain *except* when the SOURCE is
$FW[:<address>] in which case the rule is processed out of the
OUTPUT chain.
Copyright -© 2001-2006 Thomas M. Eastep
+© 2001-2007 Thomas M. EastepPermission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software @@ -20,7 +20,7 @@ Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.
-2006-12-27
+2007-01-16
Introduction
@@ -104,17 +104,17 @@ Features page.
The current
Stable Release version
-is 3.2.7
+is 3.2.8