forked from extern/shorewall_code
fixed quotes, add CVS Id
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@995 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
mhnoyes
parent
331b41c6dc
commit
7a0c2b61a7
@ -2,7 +2,7 @@
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<article>
|
||||
<!---->
|
||||
<!--$Id$-->
|
||||
|
||||
<articleinfo>
|
||||
<title>Shorewall Errata</title>
|
||||
@ -45,8 +45,8 @@
|
||||
<listitem>
|
||||
<para>If you are installing Shorewall for the first time and plan to
|
||||
use the .tgz and install.sh script, you can untar the archive, replace
|
||||
the 'firewall' script in the untarred directory with the one
|
||||
you downloaded below, and then run install.sh.</para>
|
||||
the <quote>firewall</quote> script in the untarred directory with the
|
||||
one you downloaded below, and then run install.sh.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@ -90,8 +90,9 @@
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Using some versions of 'ash' (such as from RH8) as the
|
||||
SHOREWALL_SHELL causes "shorewall [re]start" to fail with:<programlisting>    local: --limit: bad variable name
|
||||
<para>Using some versions of <quote>ash</quote> (such as from RH8)
|
||||
as the SHOREWALL_SHELL causes <quote>shorewall [re]start</quote> to
|
||||
fail with:<programlisting>    local: --limit: bad variable name
|
||||
   iptables v1.2.8: Couldn't load match `-j':/lib/iptables/libipt_-j.so:
|
||||
   cannot open shared object file: No such file or directory
|
||||
   Try `iptables -h' or 'iptables --help' for more information.</programlisting></para>
|
||||
@ -133,8 +134,8 @@
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>If TC_ENABLED is set to yes in shorewall.conf then Shorewall
|
||||
would fail to start with the error "ERROR:  Traffic
|
||||
Control requires Mangle"; that problem has been corrected in
|
||||
would fail to start with the error <quote>ERROR:  Traffic
|
||||
Control requires Mangle</quote>; that problem has been corrected in
|
||||
<ulink
|
||||
url="http://shorewall.net/pub/shorewall/errata/1.4.6/firewall">this
|
||||
firewall script</ulink> which may be installed in
|
||||
@ -153,8 +154,8 @@
|
||||
url="http://shorewall.net/pub/shorewall/errata/1.4.6/firewall">this
|
||||
firewall script</ulink> which may be installed in
|
||||
/usr/share/shorewall/firewall as described above. For all other
|
||||
versions, you will have to edit your 'firewall' script (in
|
||||
versions 1.4.*, it is located in /usr/share/shorewall/firewall).
|
||||
versions, you will have to edit your <quote>firewall</quote> script
|
||||
(in versions 1.4.*, it is located in /usr/share/shorewall/firewall).
|
||||
Locate the function add_tcrule_() and in that function, replace this
|
||||
line:<programlisting>   r=`mac_match $source` </programlisting>with<programlisting>      r="`mac_match $source` "</programlisting>Note
|
||||
that there must be a space before the ending quote!</para>
|
||||
@ -235,9 +236,9 @@
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>When an 'add' or 'delete' command is executed,
|
||||
a temporary directory created in /tmp is not being removed. This
|
||||
problem may be corrected by installing <ulink
|
||||
<para>When an <quote>add</quote> or <quote>delete</quote> command is
|
||||
executed, a temporary directory created in /tmp is not being
|
||||
removed. This problem may be corrected by installing <ulink
|
||||
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.2/firewall">this
|
||||
firewall script</ulink> in /usr/share/shorewall/firewall as
|
||||
described above.</para>
|
||||
@ -250,8 +251,8 @@
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Some TCP requests are rejected in the 'common' chain
|
||||
with an ICMP port-unreachable response rather than the more
|
||||
<para>Some TCP requests are rejected in the <quote>common</quote>
|
||||
chain with an ICMP port-unreachable response rather than the more
|
||||
appropriate TCP RST response. This problem is corrected in <ulink
|
||||
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1a/common.def">this
|
||||
updated common.def file</ulink> which may be installed in
|
||||
@ -265,8 +266,8 @@
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>When a "shorewall check" command is executed, each
|
||||
"rule" produces the harmless additional message:<programlisting>     /usr/share/shorewall/firewall: line 2174: [: =: unary operator expected</programlisting>You
|
||||
<para>When a <quote>shorewall check</quote> command is executed,
|
||||
each <quote>rule</quote> produces the harmless additional message:<programlisting>     /usr/share/shorewall/firewall: line 2174: [: =: unary operator expected</programlisting>You
|
||||
may correct the problem by installing <ulink
|
||||
url="ftp://ftp.shorewall.net/pub/shorewall/errata/1.4.1/firewall">this
|
||||
corrected script</ulink> in /usr/share/shorewall/firewall as
|
||||
@ -360,12 +361,12 @@ Aborted (core dumped)</programlisting>
|
||||
|
||||
<para>The RedHat iptables RPM is compiled with debugging enabled but the
|
||||
user-space debugging code was not updated to reflect recent changes in the
|
||||
Netfilter 'mangle' table. You can correct the problem by
|
||||
Netfilter <quote>mangle</quote> table. You can correct the problem by
|
||||
installing <ulink
|
||||
url="http://www.shorewall.net/pub/shorewall/iptables-1.2.5-1.i386.rpm">this
|
||||
iptables RPM</ulink>. If you are already running a 1.2.5 version of
|
||||
iptables, you will need to specify the --oldpackage option to rpm (e.g.,
|
||||
"iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm").</para>
|
||||
<quote>iptables -Uvh --oldpackage iptables-1.2.5-1.i386.rpm</quote>).</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@ -400,13 +401,13 @@ Aborted (core dumped)</programlisting>
|
||||
192.0.2.22    eth0    192.168.9.22   yes     yes
|
||||
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE</programlisting>
|
||||
|
||||
<para> Error message is:</para>
|
||||
<para>Error message is:</para>
|
||||
|
||||
<programlisting> Setting up NAT...
|
||||
iptables: Invalid argument
|
||||
Terminated</programlisting>
|
||||
|
||||
<para>The solution is to put "no" in the LOCAL column. Kernel
|
||||
<para>The solution is to put <quote>no</quote> in the LOCAL column. Kernel
|
||||
support for LOCAL=yes has never worked properly and 2.4.18-10 has disabled
|
||||
it. The 2.4.19 kernel contains corrected support under a new kernel
|
||||
configuraiton option; see <ulink
|
||||
@ -417,10 +418,10 @@ Aborted (core dumped)</programlisting>
|
||||
<title>Problems with RH Kernels after 2.4.20-9 and REJECT (also applies to
|
||||
2.4.21-RC1)</title>
|
||||
|
||||
<para> Beginning with errata kernel 2.4.20-13.9, "REJECT --reject-with
|
||||
tcp-reset" is broken. The symptom most commonly seen is that REJECT
|
||||
rules act just like DROP rules when dealing with TCP. A kernel patch and
|
||||
precompiled modules to fix this problem are available at <ulink
|
||||
url="ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel">ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel</ulink>.</para>
|
||||
<para>Beginning with errata kernel 2.4.20-13.9, <quote>REJECT
|
||||
--reject-with tcp-reset</quote> is broken. The symptom most commonly seen
|
||||
is that REJECT rules act just like DROP rules when dealing with TCP. A
|
||||
kernel patch and precompiled modules to fix this problem are available at
|
||||
<ulink url="ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel">ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel</ulink>.</para>
|
||||
</section>
|
||||
</article>
|
||||
@ -2,7 +2,7 @@
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
|
||||
<article>
|
||||
<!---->
|
||||
<!--$Id$-->
|
||||
|
||||
<articleinfo>
|
||||
<title>Fallback and Uninstall</title>
|
||||
@ -48,7 +48,7 @@
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Type "./fallback.sh"</para>
|
||||
<para>Type <quote>./fallback.sh</quote></para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
@ -65,9 +65,9 @@
|
||||
<title>Falling Back to the Previous Version of Shorewall using rpm</title>
|
||||
|
||||
<para>If your previous version of Shorewall was installed using RPM, you
|
||||
may fall back to that version by typing "rpm -Uvh --force <old
|
||||
rpm>" at a root shell prompt (Example: "rpm -Uvh --force
|
||||
/downloads/shorewall-3.1=0noarch.rpm" would fall back to the 3.1-0
|
||||
may fall back to that version by typing <quote>rpm -Uvh --force <old
|
||||
rpm></quote> at a root shell prompt (Example: <quote>rpm -Uvh --force
|
||||
/downloads/shorewall-3.1=0noarch.rpm</quote> would fall back to the 3.1-0
|
||||
version of Shorewall).</para>
|
||||
</section>
|
||||
|
||||
@ -83,11 +83,11 @@
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>type "./uninstall.sh"</para>
|
||||
<para>type <quote>./uninstall.sh</quote></para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>If you installed using an rpm, at a root shell prompt type "rpm
|
||||
-e shorewall".</para>
|
||||
<para>If you installed using an rpm, at a root shell prompt type
|
||||
<quote>rpm -e shorewall</quote>.</para>
|
||||
</section>
|
||||
</article>
|
||||
Loading…
Reference in New Issue
Block a user