diff --git a/Shorewall/changelog.txt b/Shorewall/changelog.txt index 21141406b..10e197b50 100644 --- a/Shorewall/changelog.txt +++ b/Shorewall/changelog.txt @@ -1,273 +1,3 @@ -Changes in 3.2.0 Final +Changes in 3.3.1 -1) Avoid extraneous double quotes in log rules generated at run-time. - -Changes in 3.2.0 RC 6 - -1) Correct generation of the balanced default route. - -2) Allow 'detect' in the ADDRESS column of the masq file. - -3) Correct some permission problems. - -------------------------------------------------------------------------------- -Changes in 3.2.0 RC 5 - -1) Fix DOA 'LITEDIR' problem in /sbin/shorewall. - -2) Stop the compiler from running iptables. - -3) Avoid problem with ash. - -4) Make the 'try' command use the correct SHOREWALL_SHELL. - -5) Don't defer Action/chain extension script processing until - run-time. - -6) Run extension script for policy chains. - -------------------------------------------------------------------------------- -Changes in 3.2.0 RC 4 - -1) Fix permissions on Limit file. - -2) Make progress messages product-specific. - -3) Add 'reload' command. - -------------------------------------------------------------------------------- -Changes in 3.2.0 RC 3 - -1) Remove hard directory references from compiled programs. - -2) Fix /nat <-> /proxyarp typo. - -3) Avoid use of symbolic link for /sbin/shorewall - -------------------------------------------------------------------------------- -Changes in 3.2.0 RC 2 - -1) Update versions. - -2) Rationalize the use of IPTABLES and LOGFORMAT. - -3) Allow Shorewall/Shorewall-lite coexistance under RPM - -------------------------------------------------------------------------------- -Changes in 3.2.0 RC 1 - -1) Update versions. - -------------------------------------------------------------------------------- -Changes in 3.2.0 Beta 8 - -1) Issue more helpful BRIDGING=No error messages. - -2) Implement "all-" in rules file. - -3) Add xmodules file. - -4) Detect devices in tcdevices entries. - -5) Fix for white-space in log prefix. - -6) Fix rule parsing of single excluded MAC address. - -------------------------------------------------------------------------------- -Changes in 3.2.0 Beta 7 - -1) Fix mark/mask validation. - -2) Restore traffic control to 'refresh'. - -3) Detect MTU for entries in /etc/shorewall/tcdevices. - -4) Avoid fatal error after missing forwardUPnP rule warning. - -------------------------------------------------------------------------------- -Changes in 3.2.0 Beta 6 - -1) Fix tc "notfound" errors when 'restart' is run out of ip-up.local. - -2) Allow 'detectnets' to work. - -3) Add TOS column to tcrules. - -4) Fix 'proxyarp' interface attribute handling. - -5) Fix default route generation in providers handling. - -6) Change interraction of 'track' and PREROUTING marking. - -------------------------------------------------------------------------------- -Changes in 3.2.0 Beta 5 - -1) Fix compilation problem on LEAF Bering. - -2) Remove traffic shaping code from the 'firewall' script to avoid - unmaintainable code duplication. - -3) Fix DETECT_DNAT_IPADDRS=No bug. - -4) Handle absense of mangle FORWARD chain. - -5) Rename the rtrules file to route_rules. - -6) Fix deletion of SNAT ip addresses. - -7) Accomodate ancient kernel's with no FORWARD or POSTROUTING in mangle. - -8) Clear SUBSYSLOCK on Debian/Ubuntu installs. - -------------------------------------------------------------------------------- -Changes in 3.2.0 Beta 4 - -1) Fix 'routeback' with bridge ports. - -2) Add support for explicit routing rules. - -3) Fix mktempdir problem. - -4) Implement HIGH_ROUTE_MARKS - -Changes in 3.2.0 Beta 3 - -1) Correct handling of verbosity in the 'try' command. - -2) Add IMPLICIT_CONTINUE option to shorewall.conf. - -3) Fix SAME/ADD_SNAT_ALIASES interaction. - -------------------------------------------------------------------------------- -Changes in 3.2.0 Beta 2 - -1) Make "shorewall start -f" work correctly. - -2) Remove SUBSYSLOCK code from default and debian footers. - -3) Add 'refreshed' extension script. - -4) Implement 'logdrop' and 'logreject' - -------------------------------------------------------------------------------- -Changes in 3.1.x. and 3.2.x - -1) Removal of dynamic zones. - -2) Implement 'generate' command. - -3) Implement 'super-quiet' mode using multiple -q options (e.g., -qq). - -4) Add back dynamic zones. - -5) Allow remote compiles. - -6) Change output of 'generate' to always be the file name entered (do not - prepend /var/lib/shorewall/) - -7) Remove some restrictions on remote compiles. - -8) Add error checking to generated script. - -9) Merge Fabio Longerai's 'length' patch. - -10) Add the "-p" option to the compile command. - -11) Fix 'check' bug in setup_masq - -12) Break compiler/firewall into two files - -13) Make Shoreall quiet for a change. - -14) Make "Compile-and-go" the only mode of operation. - -15) Remove -p - -16) Apply Tuomo's patches for IPSEC and Noecho. - -17) Fix bridging - -18) Fix QUEUE when used in the ESTABLISHED section. - -19) Apply Ed Suominen's patch to tcrules. -------------------------------------------------------------------------------- -3.1.5 - -20) Speed up compilation by rewriting 'fix_bang()'. - -21) Correct GATEWAY handling in the providers file. - -22) Remove sub-zone exclusion from DNAT/REDIRECT. - -23) Add compiled-program/library versioning scheme. - -------------------------------------------------------------------------------- -3.1.6 - -24) Apply Steven Springl's help patch. - -25) Fix 'allow/drop/reject' while Shorewall not running. - -26) Implement bi-directional macros. - -27) Fix TC bridge port handling. - -28) Fix/document "check -e" - -29) Automatically use capabilities file when non-root. - -30) Correct typo in help file ("help drop"). - -31) Added 'tcpsyn' - -------------------------------------------------------------------------------- -3.1.7 - -32) Change 'tcpsyn' to 'tcp:syn' - -33) Remove superfluous rules in MAC validation. - -34) Correct Makefile. - -35) Add -t option - -36) Restore log messages. - -37) Fix "shorewall capabilities" with VERBOSITY < 2. - -------------------------------------------------------------------------------- -3.1.8 - -38) Remove compile-time running of extension scripts. - -39) Correctly handle interfaces named 'inet'. - -40) SUBSYSLOCK functionality restored. - -------------------------------------------------------------------------------- -3.1.9 - -41) Fix Provider route generation when a specific gateway is specified. - -42) Be sure that restore file name is preserved regardless of 'set --' in - define_firewall().) - -43) Add Simon's redhat prog files. - -44) Add 'delete_nat' to compiled program. - -45) Move 'shorecap' to /usr/share/shorewall - -46) Add debian prog files. - -47) Correct syntax error in validate_policy() -------------------------------------------------------------------------------- -3.2.0 Beta 1. - -48) Streamlined some code in setup_tc1() - -49) Process /etc/shorewall/params at run-time. - -50) Add new modules to /etc/shorewall/modules. - -51) Make default behavior of "compile" distribution-neutral. +1) Once again, remove dynamic zones. diff --git a/Shorewall/compiler b/Shorewall/compiler index 48afecd88..8ced84022 100755 --- a/Shorewall/compiler +++ b/Shorewall/compiler @@ -615,31 +615,6 @@ macrecent_target() # $1 - interface [ -n "$MACLIST_TTL" ] && echo $(chain_base $1)_rec || echo RETURN } -# -# Functions for creating dynamic zone rules -# -dynamic_fwd() # $1 = interface -{ - echo $(chain_base $1)_dynf -} - -dynamic_in() # $1 = interface -{ - echo $(chain_base $1)_dyni -} - -dynamic_out() # $1 = interface -{ - echo $(chain_base $1)_dyno -} - -dynamic_chains() #$1 = interface -{ - local c=$(chain_base $1) - - echo ${c}_dyni ${c}_dynf ${c}_dyno -} - # # DNAT Chain from a zone # @@ -7396,22 +7371,6 @@ __EOF__ done fi - if [ -n "$DYNAMIC_ZONES" ]; then - progress_message "$DOING Dynamic Zone Chains..." - - for interface in $ALL_INTERFACES; do - for chain in $(dynamic_chains $interface); do - createchain $chain no - done - - chain=$(dynamic_in $interface) - createnatchain $chain - - run_iptables -A $(input_chain $interface) -j $chain - run_iptables -A $(forward_chain $interface) -j $(dynamic_fwd $interface) - run_iptables -A OUTPUT -o $interface -j $(dynamic_out $interface) - done - fi # # UPnP # @@ -7543,12 +7502,6 @@ activate_rules() addnatjump POSTROUTING $(snat_chain $interface) -o $interface done # - # Add jumps for dynamic nat chains - # - [ -n "$DYNAMIC_ZONES" ] && for interface in $ALL_INTERFACES ; do - addrulejump PREROUTING $(dynamic_in $interface) -i $interface - done - # # Add jumps from the builtin chains to the nat chains # addnatjump PREROUTING nat_in @@ -7579,10 +7532,8 @@ activate_rules() if [ -n "$is_ipsec" ]; then eval source_hosts=\$${zone}_hosts - [ -n "$DYNAMIC_ZONES" ] && create_zone_dyn_chain $zone $frwd_chain else eval source_hosts=\$${zone}_ipsec_hosts - [ -n "$DYNAMIC_ZONES" -a -n "$source_hosts" ] && create_zone_dyn_chain $zone $frwd_chain fi for host in $source_hosts; do @@ -7608,11 +7559,6 @@ activate_rules() echo $zone $type $source_hosts >> $STATEDIR/zones - if [ -n "$DYNAMIC_ZONES" ]; then - echo "$FW $zone $chain1" >> $STATEDIR/chains - echo "$zone $FW $chain2" >> $STATEDIR/chains - fi - need_broadcast= for host in $source_hosts; do @@ -7662,8 +7608,6 @@ activate_rules() [ -z "$chain" ] && continue # CONTINUE policy and there is no canonical chain. - [ -n "$DYNAMIC_ZONES" ] && echo "$zone $zone1 $chain" >> $STATEDIR/chains - if [ $zone = $zone1 ]; then # # Try not to generate superfluous intra-zone rules @@ -8650,7 +8594,6 @@ do_initialize() { SMURF_LOG_LEVEL= DISABLE_IPV6= BRIDGING= - DYNAMIC_ZONES= PKTTYPE= USEPKTYPE= RETAIN_ALIASES= @@ -8857,8 +8800,6 @@ do_initialize() { BLACKLISTNEWONLY=$(added_param_value_no BLACKLISTNEWONLY $BLACKLISTNEWONLY) DISABLE_IPV6=$(added_param_value_no DISABLE_IPV6 $DISABLE_IPV6) BRIDGING=$(added_param_value_no BRIDGING $BRIDGING) - DYNAMIC_ZONES=$(added_param_value_no DYNAMIC_ZONES $DYNAMIC_ZONES) - [ -n "$DYNAMIC_ZONES" -a -n "$EXPORT" ] && fatal_error "DYNAMIC_ZONES=Yes is incompatible with the -e option" STARTUP_ENABLED=$(added_param_value_yes STARTUP_ENABLED $STARTUP_ENABLED) RETAIN_ALIASES=$(added_param_value_no RETAIN_ALIASES $RETAIN_ALIASES) [ -n "${ADD_IP_ALIASES}${ADD_SNAT_ALIASES}" ] || RETAIN_ALIASES= diff --git a/Shorewall/firewall b/Shorewall/firewall index c0ad27fbe..39af93e40 100755 --- a/Shorewall/firewall +++ b/Shorewall/firewall @@ -383,31 +383,6 @@ macrecent_target() # $1 - interface [ -n "$MACLIST_TTL" ] && echo $(chain_base $1)_rec || echo RETURN } -# -# Functions for creating dynamic zone rules -# -dynamic_fwd() # $1 = interface -{ - echo $(chain_base $1)_dynf -} - -dynamic_in() # $1 = interface -{ - echo $(chain_base $1)_dyni -} - -dynamic_out() # $1 = interface -{ - echo $(chain_base $1)_dyno -} - -dynamic_chains() #$1 = interface -{ - local c=$(chain_base $1) - - echo ${c}_dyni ${c}_dynf ${c}_dyno -} - # # DNAT Chain from a zone # @@ -1325,95 +1300,6 @@ clear_firewall() { logger "Shorewall Cleared" } -# -# Process the ipsec information in the zones file -# -setup_ipsec() { - local zone using_ipsec= - - do_options() # $1 = _in, _out or "" - $2 = option list - { - local option opts newoptions= val - - [ x${2} = x- ] && return - - opts=$(separate_list $2) - - for option in $opts; do - val=${option#*=} - - case $option in - mss=[0-9]*) ;; - strict) newoptions="$newoptions --strict" ;; - next) newoptions="$newoptions --next" ;; - reqid=*) newoptions="$newoptions --reqid $val" ;; - spi=*) newoptions="$newoptions --spi $val" ;; - proto=*) newoptions="$newoptions --proto $val" ;; - mode=*) newoptions="$newoptions --mode $val" ;; - tunnel-src=*) newoptions="$newoptions --tunnel-src $val" ;; - tunnel-dst=*) newoptions="$newoptions --tunnel-dst $val" ;; - reqid!=*) newoptions="$newoptions ! --reqid $val" ;; - spi!=*) newoptions="$newoptions ! --spi $val" ;; - proto!=*) newoptions="$newoptions ! --proto $val" ;; - mode!=*) newoptions="$newoptions ! --mode $val" ;; - tunnel-src!=*) newoptions="$newoptions ! --tunnel-src $val" ;; - tunnel-dst!=*) newoptions="$newoptions ! --tunnel-dst $val" ;; - *) fatal_error "Invalid option \"$option\" for zone $zone" ;; - esac - done - - if [ -n "$newoptions" ]; then - [ -n "$POLICY_MATCH" ] || fatal_error "Your kernel and/or iptables does not support policy match" - eval ${zone}_is_complex=Yes - eval ${zone}_ipsec${1}_options=\"${newoptions# }\" - fi - } - - case $IPSECFILE in - zones) - f=zones - progress_message "Setting up IPSEC..." - ;; - *) - f=$IPSECFILE - strip_file $f - progress_message "Processing $f..." - using_ipsec=Yes - ;; - esac - - while read zone type options in_options out_options mss; do - expandv zone type options in_options out_options mss - - if [ -n "$using_ipsec" ]; then - validate_zone1 $zone || fatal_error "Unknown zone: $zone" - fi - - if [ -n "$type" ]; then - if [ -n "$using_ipsec" ]; then - case $type in - No|no) - ;; - Yes|yes) - [ -n "$POLICY_MATCH" ] || fatal_error "Your kernel and/or iptables does not support policy match" - eval ${zone}_is_ipsec=Yes - eval ${zone}_is_complex=Yes - eval ${zone}_type=ipsec4 - ;; - *) - fatal_error "Invalid IPSEC column contents" - ;; - esac - fi - - do_options "" $options - do_options "_in" $in_options - do_options "_out" $out_options - fi - - done < $TMP_DIR/$f -} - # # Delete existing Proxy ARP # @@ -1483,34 +1369,6 @@ delete_nat() { [ -d $STATEDIR ] && touch $STATEDIR/nat } -# -# Setup Network Mapping (NETMAP) -# -setup_netmap() { - - while read type net1 interface net2 ; do - expandv type net1 interface net2 - - list_search $interface $ALL_INTERFACES || \ - fatal_error "Unknown interface $interface in entry \"$type $net1 $interface $net2\"" - - case $type in - DNAT) - addnatrule $(input_chain $interface) -d $net1 -j NETMAP --to $net2 - ;; - SNAT) - addnatrule $(output_chain $interface) -s $net1 -j NETMAP --to $net2 - ;; - *) - fatal_error "Invalid type $type in entry \"$type $net1 $interface $net2\"" - ;; - esac - - progress_message " Network $net1 on $interface mapped to $net2 ($type)" - - done < $TMP_DIR/netmap -} - # # Setup ECN disabling rules # @@ -1835,368 +1693,6 @@ refresh_firewall() rm -rf $TMP_DIR } -# -# Add a host or networks to a zone -# -add_to_zone() # $1...${n-1} = [:] $n = zone -{ - local interface host zone z h z1 z2 chain - local dhcp_interfaces blacklist_interfaces maclist_interfaces - local tcpflags_interfaces newhostlist= - local rulenum source_chain dest_hosts iface hosts hostlist= - - nat_chain_exists() # $1 = chain name - { - qt $IPTABLES -t nat -L $1 -n - } - - do_iptables() # $@ = command - { - [ -n "$BRIDGING" ] && [ -f $TMP_DIR/physdev ] && rm -f $TMP_DIR/physdev - [ -n "$IPRANGE_MATCH" ] && [ -f $TMP_DIR/iprange ] && rm -f $TMP_DIR/iprange - - if ! $IPTABLES $@ ; then - error_message "ERROR: Can't add $newhost to zone $zone" - fi - } - - # - # Load $zones - # - determine_zones - # - # Validate Interfaces File - # - validate_interfaces_file - # - # Validate Hosts File - # - validate_hosts_file - # - # Validate IPSec File - # - f=$(find_file $IPSECFILE) - - [ -f $f ] && setup_ipsec $f - # - # Normalize host list - # - while [ $# -gt 1 ]; do - interface=${1%%:*} - host=${1#*:} - # - # Be sure that the interface was dynamic at last [re]start - # - if ! chain_exists $(input_chain $interface) ; then - startup_error "Unknown interface $interface" - fi - - if ! chain_exists $(dynamic_in $interface) ; then - startup_error "At last Shorewall [re]start, DYNAMIC_ZONES=No in shorewall.conf" - fi - - if [ -z "$host" ]; then - hostlist="$hostlist $interface:0.0.0.0/0" - else - for h in $(separate_list $host); do - hostlist="$hostlist $interface:$h" - done - fi - - shift - done - # - # Validate Zone - # - zone=$1 - - validate_zone $zone || startup_error "Unknown zone: $zone" - - [ "$zone" = $FW ] && startup_error "Can't add $1 to firewall zone" - - # - # Be sure that Shorewall has been restarted using a DZ-aware version of the code - # - [ -f ${VARDIR}/chains ] || startup_error "${VARDIR}/chains -- file not found" - [ -f ${VARDIR}/zones ] || startup_error "${VARDIR}/zones -- file not found" - # - # Check for duplicates and create a new zone state file - # - > ${VARDIR}/zones_$$ - - while read z type hosts; do - if [ "$z" = "$zone" ]; then - for h in $hostlist; do - list_search $h $hosts - if [ "$?" -gt 0 ]; then - newhostlist="$newhostlist $h" - else - error_message "$h already in zone $zone" - fi - done - - [ -z "$hosts" ] && hosts=$newhostlist || hosts="$hosts $newhostlist" - fi - - eval ${z}_hosts=\"$hosts\" - - echo "$z $type $hosts" >> ${VARDIR}/zones_$$ - done < ${VARDIR}/zones - - mv -f ${VARDIR}/zones_$$ ${VARDIR}/zones - - TERMINATOR=fatal_error - # - # Create a new Zone state file - # - for newhost in $newhostlist; do - # - # Isolate interface and host parts - # - interface=${newhost%%:*} - host=${newhost#*:} - # - # If the zone passed in the command has a dnat chain then insert a rule in - # the nat table PREROUTING chain to jump to that chain when the source - # matches the new host(s)# - # - chain=${zone}_dnat - - if nat_chain_exists $chain; then - do_iptables -t nat -A $(dynamic_in $interface) $(source_ip_range $host) $(match_ipsec_in $zone $newhost) -j $chain - fi - # - # Insert new rules into the filter table for the passed interface - # - while read z1 z2 chain; do - [ "$z1" = "$z2" ] && op="-I" || op="-A" - if [ "$z1" = "$zone" ]; then - if [ "$z2" = "$FW" ]; then - do_iptables $op $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j $chain - else - source_chain=$(dynamic_fwd $interface) - if is_ipsec_host $z1 $newhost ; then - do_iptables $op $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd - else - eval dest_hosts=\"\$${z2}_hosts\" - - for h in $dest_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - do_iptables $op $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain - fi - done - fi - fi - elif [ "$z2" = "$zone" ]; then - if [ "$z1" = "$FW" ]; then - # - # Add a rule to the dynamic out chain for the interface - # - do_iptables $op $(dynamic_out $interface) $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain - else - eval source_hosts=\"\$${z1}_hosts\" - - for h in $source_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - if is_ipsec_host $z1 $h; then - do_iptables $op ${z1}_dyn -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain - else - do_iptables $op $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $newhost) -j $chain - fi - fi - done - fi - fi - done < ${VARDIR}/chains - - progress_message "$newhost added to zone $zone" - - done - - rm -rf $TMP_DIR -} - -# -# Delete a host or networks from a zone -# -delete_from_zone() # $1 = [:] $2 = zone -{ - local interface host zone z h z1 z2 chain delhost - local dhcp_interfaces blacklist_interfaces maclist_interfaces tcpflags_interfaces - local rulenum source_chain dest_hosts iface hosts hostlist= - - # - # Load $zones - # - determine_zones - # - # Validate Interfaces File - # - validate_interfaces_file - # - # Validate Hosts File - # - validate_hosts_file - # - # Validate IPSec File - # - f=$(find_file ipsec) - - [ -f $f ] && setup_ipsec $f - - # - # Normalize host list - # - while [ $# -gt 1 ]; do - interface=${1%%:*} - host=${1#*:} - # - # Be sure that the interface was dynamic at last [re]start - # - if ! chain_exists $(input_chain $interface) ; then - startup_error "Unknown interface $interface" - fi - - if ! chain_exists $(dynamic_in $interface) ; then - startup_error "At last Shorewall [re]start, DYNAMIC_ZONES=No in shorewall.conf" - fi - - if [ -z "$host" ]; then - hostlist="$hostlist $interface:0.0.0.0/0" - else - for h in $(separate_list $host); do - hostlist="$hostlist $interface:$h" - done - fi - - shift - done - # - # Validate Zone - # - zone=$1 - - validate_zone $zone || startup_error "Unknown zone: $zone" - - [ "$zone" = $FW ] && startup_error "Can't delete from the firewall zone" - - # - # Be sure that Shorewall has been restarted using a DZ-aware version of the code - # - [ -f ${VARDIR}/chains ] || startup_error "${VARDIR}/chains -- file not found" - [ -f ${VARDIR}/zones ] || startup_error "${VARDIR}/zones -- file not found" - # - # Delete the passed hosts from the zone state file - # - > ${VARDIR}/zones_$$ - - while read z hosts; do - if [ "$z" = "$zone" ]; then - temp=$hosts - hosts= - - for host in $hostlist; do - found= - for h in $temp; do - if [ "$h" = "$host" ]; then - found=Yes - break - fi - done - - [ -n "$found" ] || error_message "WARNING: $host does not appear to be in zone $zone" - done - - for h in $temp; do - found= - for host in $hostlist; do - if [ "$h" = "$host" ]; then - found=Yes - break - fi - done - - [ -n "$found" ] || hosts="$hosts $h" - done - fi - - eval ${z}_hosts=\"$hosts\" - - echo "$z $hosts" >> ${VARDIR}/zones_$$ - done < ${VARDIR}/zones - - mv -f ${VARDIR}/zones_$$ ${VARDIR}/zones - - TERMINATOR=fatal_error - - for delhost in $hostlist; do - interface=${delhost%%:*} - host=${delhost#*:} - # - # Delete any nat table entries for the host(s) - # - qt_iptables -t nat -D $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $zone $delhost) -j ${zone}_dnat - # - # Delete rules rules the input chains for the passed interface - # - while read z1 z2 chain; do - if [ "$z1" = "$zone" ]; then - if [ "$z2" = "$FW" ]; then - qt_iptables -D $(dynamic_in $interface) $(match_source_hosts $host) $(match_ipsec_in $z1 $delhost) -j $chain - else - source_chain=$(dynamic_fwd $interface) - if is_ipsec_host $z1 $delhost ; then - qt_iptables -D $source_chain $(match_source_hosts $host) $(match_ipsec_in $z1 $newhost) -j ${z1}_frwd - else - eval dest_hosts=\"\$${z2}_hosts\" - - [ "$z2" = "$zone" ] && dest_hosts="$dest_hosts $hostlist" - - for h in $dest_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - qt_iptables -D $source_chain $(match_source_hosts $host) -o $iface $(match_dest_hosts $hosts) $(match_ipsec_out $z2 $h) -j $chain - fi - done - fi - fi - elif [ "$z2" = "$zone" ]; then - if [ "$z1" = "$FW" ]; then - qt_iptables -D $(dynamic_out $interface) $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain - else - eval source_hosts=\"\$${z1}_hosts\" - - for h in $source_hosts; do - iface=${h%%:*} - hosts=${h#*:} - - if [ "$iface" != "$interface" -o "$hosts" != "$host" ]; then - if is_ipsec_host $z1 $h; then - qt_iptables -D ${z1}_dyn -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain - else - qt_iptables -D $(dynamic_fwd $iface) $(match_source_hosts $hosts) -o $interface $(match_dest_hosts $host) $(match_ipsec_out $z2 $delhost) -j $chain - fi - fi - done - fi - fi - done < ${VARDIR}/chains - - progress_message "$delhost removed from zone $zone" - - done - - rm -rf $TMP_DIR -} - # # Determine the value for a parameter that defaults to Yes # @@ -2303,7 +1799,6 @@ do_initialize() { SMURF_LOG_LEVEL= DISABLE_IPV6= BRIDGING= - DYNAMIC_ZONES= PKTTYPE= USEPKTYPE= RETAIN_ALIASES= @@ -2507,7 +2002,6 @@ do_initialize() { BLACKLISTNEWONLY=$(added_param_value_no BLACKLISTNEWONLY $BLACKLISTNEWONLY) DISABLE_IPV6=$(added_param_value_no DISABLE_IPV6 $DISABLE_IPV6) BRIDGING=$(added_param_value_no BRIDGING $BRIDGING) - DYNAMIC_ZONES=$(added_param_value_no DYNAMIC_ZONES $DYNAMIC_ZONES) STARTUP_ENABLED=$(added_param_value_yes STARTUP_ENABLED $STARTUP_ENABLED) RETAIN_ALIASES=$(added_param_value_no RETAIN_ALIASES $RETAIN_ALIASES) [ -n "${ADD_IP_ALIASES}${ADD_SNAT_ALIASES}" ] || RETAIN_ALIASES= @@ -2668,36 +2162,6 @@ case "$COMMAND" in my_mutex_off ;; - add) - [ $# -lt 3 ] && usage - do_initialize - my_mutex_on - if ! shorewall_is_started ; then - echo "Shorewall Not Started" - [ -n "$TMP_DIR" ] && rm -rf $TMP_DIR - my_mutex_off - exit 2; - fi - shift - add_to_zone $@ - my_mutex_off - ;; - - delete) - [ $# -lt 3 ] && usage - do_initialize - my_mutex_on - if ! shorewall_is_started ; then - echo "Shorewall Not Started" - [ -n "$TMP_DIR" ] && rm -rf $TMP_DIR - my_mutex_off - exit 2; - fi - shift - delete_from_zone $@ - my_mutex_off - ;; - call) # # Undocumented way to call functions in ${SHAREDIR}/firewall directly diff --git a/Shorewall/help b/Shorewall/help index d67d9698c..61831ffba 100755 --- a/Shorewall/help +++ b/Shorewall/help @@ -28,28 +28,6 @@ case $1 in -add) - echo "add: add [:] ... - Adds a list of hosts or subnets to a dynamic zone usually used with VPN's. - - shorewall add interface:host-list ... zone - Adds the specified interface - (and host-list if included) to the specified zone. - - A host-list is a comma-separated list whose elements are: - - A host or network address - The name of a bridge port - The name of a bridge port followed by a colon (":") and a host or - network address. - - Example: - - shorewall add ipsec0:192.0.2.24 vpn1 -- adds the address 192.0.2.24 - from interface ipsec0 to the zone vpn1. - - See also \"help host\"" - ;; - address|host) echo "<$1>: May be either a host IP address such as 192.168.1.4 or a network address in @@ -122,28 +100,6 @@ debug) The word 'trace' is a synonym for 'debug'." ;; -delete) - echo "delete: delete [:] ... - Deletes a list of hosts or networks from a dynamic zone usually used with VPN's. - - shorewall delete interface[:host-list] ... zone - Deletes the specified - interfaces (and host list if included) from the specified zone. - - A host-list is a comma-separated list whose elements are: - - A host or network address - The name of a bridge port - The name of a bridge port followed by a colon (":") and a host or - network address. - - Example: - - shorewall delete ipsec0:192.0.2.24 vpn1 -- deletes the address - 192.0.2.24 from interface ipsec0 from zone vpn1 - - See also \"help host\"" - ;; - drop) echo "$1: $1
... Causes packets from the specified
to be ignored diff --git a/Shorewall/releasenotes.txt b/Shorewall/releasenotes.txt index faf630167..5b8e831cd 100644 --- a/Shorewall/releasenotes.txt +++ b/Shorewall/releasenotes.txt @@ -1,4 +1,4 @@ -Shorewall 3.2.0 +Shorewall 3.3.0 Note to users upgrading from Shorewall 2.x or 3.0 @@ -31,564 +31,17 @@ Note to users upgrading from Shorewall 2.x or 3.0 Please see the "Migration Considerations" below for additional upgrade information. -Problems Corrected in 3.2.0 Final - -1) Logging rules generated at run-time (such as smurf rules associated - with interfaces with 'detect' in the BROADCAST column of - /etc/shorewall/interfaces) contained extraneous double quotes - around the log prefix. - -Other changes in 3.2.0 Final +Problems corrected in 3.3.0 None. -Migration Considerations: +Migration Issues. -1) If you are upgrading from Shorewall 2.x, it is essential that you read - the Shorewall 3.0.8 (or later) release notes: +1) Support for dynamic zones has been removed from Shorewall + (/sbin/shorewall add and delete commands). Use ipsets to define + your dynamic zones as described at + http://www.shorewall.net/DynamicZones.html. - http://www.shorewall.net/pub/shorewall/3.0/shorewall-3.0.8/releasenotes.txt +New Features. -2) A number of macros have been split into two. The macros affected are: - - IMAP LDAP NNTP POP3 SMTP - - Each of these macros now handles only traffic on the native (plaintext) - port. There is a corresponding macro with S added to the end of the - name for the SSL version of the same protocol. Thus each macro results - in the insertion of only one port per invocation. - - The Web macro has not been split, but two new macros, HTTP and HTTPS have - been created. The Web macro is deprecated in favour of these new macros, - and may be removed from future Shorewall releases. - - These changes have been made to ensure no unexpected ports are opened due - to the use of macros. - -3) In previous Shorewall releases, DNAT and REDIRECT rules supported a - special syntax for exclusion of a sub-zone from the effect of the rule. - - Example: - - Z2 is a subzone of Z1: - - DNAT Z1!Z2 loc:192.168.1.4 ... - - That feature has never worked correctly when Z2 is a dynamic zone. - Furthermore, now that Shorewall supports exclusion lists, the capability - is redundant since the above rule can now be written in the form: - - DNAT Z1:! loc:192.168.1.4 ... - - Beginning with Shorewall 3.2.0, the special exclusion syntax will no - longer be supported. - -4) Important if you use the QUEUE target. - - In the /etc/shorewall/rules file and in actions, you may now specify - 'tcp:syn' in the PROTO column. 'tcp:syn' is equivalent to 'tcp' but also - requires that the SYN flag is set and the RST, FIN and ACK flags be - off ("--syn" is added to the iptables rule). - - As part of this change, Shorewall no longer adds the "--syn" option - to TCP rules that specify QUEUE as their target. - -5) Extension Scripts may require change - - In previous releases, extension scripts were executed during [re]start - by using the Bourne Shell "." operator. In addition to executing commands - during [re]start, these scripts had to "save" the commands to be executed - during "shorewall restore". - - This clumsiness has been eliminated in Shorewall 3.2. In Shorewall 3.2, - extension scripts are copied in-line into the compiled program and are - executed in-line during "start", "restart" and "restore". This - applies to all extension scripts except those associated with a - chain or action -- those extension scripts continue to be processed - at compile time. - - This new approach has two implications for existing scripts. - - a) It is no longer necessary to save the commands; so functions like - 'save_command', 'run_and_save_command' and 'ensure_and_save_command' - need no longer be called. For convenience, the generated program will - supply functions with these names: - - save_command() - does nothing - run_and_save_command() - runs the passed command - ensure_and_save_command() - runs the passed command and - stops/restores the firewall if the - command fails. - - These functions should provide for transparent migration of - scripts that use them until you can get around to eliminating - their use completely. - - b) When the extension script is copied into the compiled program, it - is indented to line up with the surrounding code. If you have 'awk' - installed on your system, the Shorewall compiler will correctly handle - line continuation (last character on the line = "\"). If you do not - have awk, it will not be possible to use line-continuation in your - extension scripts. - - In no case is it possible to continue a quoted string over multiple lines - without having additional whitespace inserted into the string. - -6) Beginning with this release, the way in which packet marking in the - PREROUTING chain interracts with the 'track' option in /etc/shorewall/providers - has changed in two ways: - - a) Packets arriving on a tracked interface are now passed to the PREROUTING - marking chain so that they may be marked with a mark other than the - 'track' mark (the connection still retains the 'track' mark). - - b) When HIGH_ROUTE_MARKS=Yes, you can still clear the mark on packets - in the PREROUTING chain (i.e., you can specify a mark value of zero). - -7) Kernel version 2.6.16 introduces 'xtables', a new common packet - filtering and connection tracking facility that supports both IPv4 - and IPv6. Because a different set of kernel modules must be loaded - for xtables, Shorewall now includes two 'modules' files: - - a) /usr/share/shorewall/modules -- the former - /etc/shorewall/modules - - b) /usr/share/shorewall/xmodules -- a new file that support - xtables. - - If you wish to use the new file, then simply execute this command: - - cp -f /usr/share/shorewall/xmodules /etc/shorewall/modules - -New Features: - -1) Shorewall has always been very noisy (lots of messages). No longer. - - You set the default level of verbosity using the VERBOSITY option in - shorewall.conf. If you don't set it (as would be the case of you use your - old shorewall.conf file) then VERBOSITY defaults to a value of 2 which - results in behavior compatible with previous Shorewall versions. - A value of 1 suppresses some of the output (like the old -q option did) - while a value of 0 makes Shorewall almost silent. A value of -1 - suppresses all output except warning and error messages. - - The value specified in the 3.2 shorewall.conf is 1. So you can make - Shorewall as verbose as previously using a single -v and you can make it - almost silent by using a single -q. - - If VERBOSITY is set at 2, you can still make a command nearly - silent by using two "q"s (e.g., shorewall -qq restart). - - In summary, each "q" subtracts one from VERBOSITY while each "v" adds one - to VERBOSITY. - - The "shorewall show log", "shorewall logwatch" and "shorewall dump" - commands require VERBOSITY to be greater than or equal to 3 to - display MAC addresses.This is consistent with the previous - implementation which required a single -v to enable MAC display but - means that if you set VERBOSITY=0 in shorewall.conf, then you will - need to include -vvv in commands that display log records in order - to have MACs displayed. - - To make the display of MAC addresses less cumbersome, a '-m' option has - been added to the "show" and logwatch commands: - - shorewall show -m log - shorewall logwatch -m - -2) A new 'shorewall compile' command has been added. - - shorewall compile [ -e ] [ ]