holm/shorewall_code
1
0
Fork 0
forked from extern/shorewall_code
Code Pull Requests Activity

Initiate 4.4.16

Browse Source
This commit is contained in:
Tom Eastep 2010-11-30 17:30:11 -08:00
parent 6ef0f0f9d3
commit cae5ddc7e0
19 changed files with 180 additions and 154 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Shorewall-init/install.sh
View File

@ -23,7 +23,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

6
Shorewall-init/shorewall-init.spec
View File

@ -1,6 +1,6 @@
%define name shorewall-init %define name shorewall-init
%define version 4.4.15 %define version 4.4.16
%define release 0base %define release 0Beta1
Summary: Shorewall-init adds functionality to Shoreline Firewall (Shorewall). Summary: Shorewall-init adds functionality to Shoreline Firewall (Shorewall).
Name: %{name} Name: %{name}
@ -99,6 +99,8 @@ fi
%doc COPYING changelog.txt releasenotes.txt %doc COPYING changelog.txt releasenotes.txt
%changelog %changelog
* Tue Nov 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta1
* Fri Nov 26 2010 Tom Eastep tom@shorewall.net * Fri Nov 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0base - Updated to 4.4.15-0base
* Mon Nov 22 2010 Tom Eastep tom@shorewall.net * Mon Nov 22 2010 Tom Eastep tom@shorewall.net

2
Shorewall-init/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall-lite/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

6
Shorewall-lite/shorewall-lite.spec
View File

@ -1,6 +1,6 @@
%define name shorewall-lite %define name shorewall-lite
%define version 4.4.15 %define version 4.4.16
%define release 0base %define release 0Beta1
Summary: Shoreline Firewall Lite is an iptables-based firewall for Linux systems. Summary: Shoreline Firewall Lite is an iptables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -102,6 +102,8 @@ fi
%doc COPYING changelog.txt releasenotes.txt %doc COPYING changelog.txt releasenotes.txt
%changelog %changelog
* Tue Nov 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta1
* Fri Nov 26 2010 Tom Eastep tom@shorewall.net * Fri Nov 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0base - Updated to 4.4.15-0base
* Mon Nov 22 2010 Tom Eastep tom@shorewall.net * Mon Nov 22 2010 Tom Eastep tom@shorewall.net

2
Shorewall-lite/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall/Perl/Shorewall/Config.pm
View File

@ -353,7 +353,7 @@ sub initialize( $ ) {
EXPORT => 0, EXPORT => 0,
STATEMATCH => '-m state --state', STATEMATCH => '-m state --state',
UNTRACKED => 0, UNTRACKED => 0,
VERSION => "4.4.15", VERSION => "4.4.16-Beta1",
CAPVERSION => 40415 , CAPVERSION => 40415 ,
); );

4
Shorewall/changelog.txt
View File

@ -1,3 +1,7 @@
Changes in Shorewall 4.4.16
None.
Changes in Shorewall 4.4.15 Changes in Shorewall 4.4.15
1) Add macros from Tuomo Soini. 1) Add macros from Tuomo Soini.

2
Shorewall/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall/known_problems.txt
View File

@ -1 +1 @@
There are no known problems in Shorewall 4.4.15 There are no known problems in Shorewall 4.4.16-Beta1

276
Shorewall/releasenotes.txt
View File

@ -13,65 +13,7 @@ VI. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES
I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
1) Previously, if None.
a) syn flood protection was enabled in a policy that
specified 'all' for the SOURCE or DEST, and
b) there was only one pair of zones matching that policy, and
c) PROPAGATE_POLICIES=Yes in shorewall.conf, and
d) logging was specified on the policy
then the chain implementing the chain had "all" in its name while
the logging rule did not.
Example
On a simple standalone configuration, /etc/shorewall/policy
has:
#SOURCE DEST POLICY LOGGING
net all DROP info
then the chain implementing syn flood protection would be named
@net2all while the logging rule would indicate net2fw.
Now, the chain will be named @net2fw.
2) If the current environment exported the VERBOSE variable with a
non-zero value, then startup would fail.
3) If a route existed for an entire RFC1918 subnet (10.0.0.0/8,
172.20.0.0/12 or 192.168.0.0/16), then setting
NULL_ROUTE_RFC1918=Yes would cause the route to be replaced with an
'unreachable' one.
4) Shorewall6 failed to start correctly if all the following were true:
- Shorewall was installed using the tarball. It may have
subsequently been installed using a distribution-specific package
or the rpm from shorewall.net without first unstalling the
tarball components.
- Shorewall6 was installed using a distribution-specific package or
the rpm from shorewall.net.
- The file /etc/shorewall6/init was not created.
5) If an interface with physical='+' is given the 'optional' or
'required' option, then invalid shell variables names were
generated by the compiler.
6) The contributed macro macro.JAP generated a fatal error when used.
The root cause was a defect in parameter processing in nested
macros (if 'PARAM' was passed to an nested macro invocation, it was
not expanded to the current parameter value).
7) Previously, if find_first_interface_address() failed when running
shorewall-lite or shoreawll6-lite, the following unhelpful message
was issued:
/usr/share/shorewall-lite/lib.common: line 449: startup_error: command
not found
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
I I. K N O W N P R O B L E M S R E M A I N I N G I I. K N O W N P R O B L E M S R E M A I N I N G
@ -84,79 +26,7 @@ VI. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES
I I I. N E W F E A T U R E S I N T H I S R E L E A S E I I I. N E W F E A T U R E S I N T H I S R E L E A S E
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
1) Munin and Squid macros have been contributed by Tuomo Soini. None.
2) The Shorewall6 accounting, tcrules and rules files now include a
HEADERS column which allows matching based on the IPv6 extension and
protocol headers included in a packet.
The contents of the column are:
[any:|exactly:]<header list>
where <header list> is a comma-separated list of headers from the
following:
Long Name Short Name Number
--------------------------------------
auth ah 51
esp esp 50
d hop-by-hop hop 0
route ipv6-route 41
frag ipv6-frag 44
none ipv6-nonxt 59
protocol proto 255
If 'any:' is specified, the rule will match if any of the listed
headers are present. If 'exactly:' is specified, the will match
packets that exactly include all specified headers. If neither is
given, 'any:' is assumed.
This change adds a new capability (Header Match) so if you use a
capabilities file, you will need to regenerate using this release.
3) It is now possible to add explicit routes to individual provider
routing tables using the /etc/shorewall/routes (/etc/shorewall6/routes)
file.
See the shorewall-routes (5) and/or the shorewall6-routes (5) manpage.
4) Previously, /usr/share/shorewall/compiler.pl expected the contents
of the params file to be passed in the environment. Now, the
compiler invokes a small shell program
(/usr/share/shorewall/getparams) to process the file and to pass
the (variable,value) pairs back to the compiler.
Shell variable expansion uses the value from the params file if the
parameter was set in that file. Otherwise the current environment
is used. If the variable does not appear in either place, an error
message is generated.
5) Shared IPv4/IPv6 traffic shaping configuraiton is now
available. The device and class configuration can be included in
either the Shorewall or the Shorewall6 configuration. To place it
in the Shorewall configuration:
a) Set TC_ENABLED=Internal in shorewall.conf
b) Set TC_ENABLED=Shared in shorewall6.conf
c) Create symbolic link /etc/shorewall6/tcdevices pointing to
/etc/shorewall/tcdevices.
d) Create symbolic link /etc/shorewall6/tcclasses pointing to
/etc/shorewall/tcclasses.
e) Entries for both IPv4 and IPv6 can be included in
/etc/shorewall/tcfilters. This file has been extended to allow
both IPv4 and IPv6 entries to be included in a single file.
f) Packet marking rules are included in both configurations'
tcrules file as needed. CLASSIFY rules in
/etc/shorewall6/tcrules are validated against the Shorewall TC
configuration.
In this setup, the tcdevices and tcclasses will only be updated
when Shorewall is restarted. The IPv6 marking rules are updated
when Shorewall6 is restarted.
The above configuration may be reversed to allow Shorewall6 to
control the TC configuration.
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
I V. R E L E A S E 4 . 4 H I G H L I G H T S I V. R E L E A S E 4 . 4 H I G H L I G H T S
@ -377,6 +247,148 @@ d hop-by-hop hop 0
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S V I. P R O B L E M S C O R R E C T E D A N D N E W F E A T U R E S
I N P R I O R R E L E A S E S I N P R I O R R E L E A S E S
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 4 . 4 . 1 5
----------------------------------------------------------------------------
1) Previously, if
a) syn flood protection was enabled in a policy that
specified 'all' for the SOURCE or DEST, and
b) there was only one pair of zones matching that policy, and
c) PROPAGATE_POLICIES=Yes in shorewall.conf, and
d) logging was specified on the policy
then the chain implementing the chain had "all" in its name while
the logging rule did not.
Example
On a simple standalone configuration, /etc/shorewall/policy
has:
#SOURCE DEST POLICY LOGGING
net all DROP info
then the chain implementing syn flood protection would be named
@net2all while the logging rule would indicate net2fw.
Now, the chain will be named @net2fw.
2) If the current environment exported the VERBOSE variable with a
non-zero value, then startup would fail.
3) If a route existed for an entire RFC1918 subnet (10.0.0.0/8,
172.20.0.0/12 or 192.168.0.0/16), then setting
NULL_ROUTE_RFC1918=Yes would cause the route to be replaced with an
'unreachable' one.
4) Shorewall6 failed to start correctly if all the following were true:
- Shorewall was installed using the tarball. It may have
subsequently been installed using a distribution-specific package
or the rpm from shorewall.net without first unstalling the
tarball components.
- Shorewall6 was installed using a distribution-specific package or
the rpm from shorewall.net.
- The file /etc/shorewall6/init was not created.
5) If an interface with physical='+' is given the 'optional' or
'required' option, then invalid shell variables names were
generated by the compiler.
6) The contributed macro macro.JAP generated a fatal error when used.
The root cause was a defect in parameter processing in nested
macros (if 'PARAM' was passed to an nested macro invocation, it was
not expanded to the current parameter value).
7) Previously, if find_first_interface_address() failed when running
shorewall-lite or shoreawll6-lite, the following unhelpful message
was issued:
/usr/share/shorewall-lite/lib.common: line 449: startup_error: command
not found
----------------------------------------------------------------------------
N E W F E A T U R E S I N 4 . 4 . 1 5
----------------------------------------------------------------------------
1) Munin and Squid macros have been contributed by Tuomo Soini.
2) The Shorewall6 accounting, tcrules and rules files now include a
HEADERS column which allows matching based on the IPv6 extension and
protocol headers included in a packet.
The contents of the column are:
[any:|exactly:]<header list>
where <header list> is a comma-separated list of headers from the
following:
Long Name Short Name Number
--------------------------------------
auth ah 51
esp esp 50
d hop-by-hop hop 0
route ipv6-route 41
frag ipv6-frag 44
none ipv6-nonxt 59
protocol proto 255
If 'any:' is specified, the rule will match if any of the listed
headers are present. If 'exactly:' is specified, the will match
packets that exactly include all specified headers. If neither is
given, 'any:' is assumed.
This change adds a new capability (Header Match) so if you use a
capabilities file, you will need to regenerate using this release.
3) It is now possible to add explicit routes to individual provider
routing tables using the /etc/shorewall/routes (/etc/shorewall6/routes)
file.
See the shorewall-routes (5) and/or the shorewall6-routes (5) manpage.
4) Previously, /usr/share/shorewall/compiler.pl expected the contents
of the params file to be passed in the environment. Now, the
compiler invokes a small shell program
(/usr/share/shorewall/getparams) to process the file and to pass
the (variable,value) pairs back to the compiler.
Shell variable expansion uses the value from the params file if the
parameter was set in that file. Otherwise the current environment
is used. If the variable does not appear in either place, an error
message is generated.
5) Shared IPv4/IPv6 traffic shaping configuraiton is now
available. The device and class configuration can be included in
either the Shorewall or the Shorewall6 configuration. To place it
in the Shorewall configuration:
a) Set TC_ENABLED=Internal in shorewall.conf
b) Set TC_ENABLED=Shared in shorewall6.conf
c) Create symbolic link /etc/shorewall6/tcdevices pointing to
/etc/shorewall/tcdevices.
d) Create symbolic link /etc/shorewall6/tcclasses pointing to
/etc/shorewall/tcclasses.
e) Entries for both IPv4 and IPv6 can be included in
/etc/shorewall/tcfilters. This file has been extended to allow
both IPv4 and IPv6 entries to be included in a single file.
f) Packet marking rules are included in both configurations'
tcrules file as needed. CLASSIFY rules in
/etc/shorewall6/tcrules are validated against the Shorewall TC
configuration.
In this setup, the tcdevices and tcclasses will only be updated
when Shorewall is restarted. The IPv6 marking rules are updated
when Shorewall6 is restarted.
The above configuration may be reversed to allow Shorewall6 to
control the TC configuration.
---------------------------------------------------------------------------- ----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 4 . 4 . 1 4 P R O B L E M S C O R R E C T E D I N 4 . 4 . 1 4
---------------------------------------------------------------------------- ----------------------------------------------------------------------------

6
Shorewall/shorewall.spec
View File

@ -1,6 +1,6 @@
%define name shorewall %define name shorewall
%define version 4.4.15 %define version 4.4.16
%define release 0base %define release 0Beta1
Summary: Shoreline Firewall is an iptables-based firewall for Linux systems. Summary: Shoreline Firewall is an iptables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -109,6 +109,8 @@ fi
%doc COPYING INSTALL changelog.txt releasenotes.txt Contrib/* Samples %doc COPYING INSTALL changelog.txt releasenotes.txt Contrib/* Samples
%changelog %changelog
* Tue Nov 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta1
* Fri Nov 26 2010 Tom Eastep tom@shorewall.net * Fri Nov 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0base - Updated to 4.4.15-0base
* Mon Nov 22 2010 Tom Eastep tom@shorewall.net * Mon Nov 22 2010 Tom Eastep tom@shorewall.net

2
Shorewall/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall6-lite/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

6
Shorewall6-lite/shorewall6-lite.spec
View File

@ -1,6 +1,6 @@
%define name shorewall6-lite %define name shorewall6-lite
%define version 4.4.15 %define version 4.4.16
%define release 0base %define release 0Beta1
Summary: Shoreline Firewall 6 Lite is an ip6tables-based firewall for Linux systems. Summary: Shoreline Firewall 6 Lite is an ip6tables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -93,6 +93,8 @@ fi
%doc COPYING changelog.txt releasenotes.txt %doc COPYING changelog.txt releasenotes.txt
%changelog %changelog
* Tue Nov 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta1
* Fri Nov 26 2010 Tom Eastep tom@shorewall.net * Fri Nov 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0base - Updated to 4.4.15-0base
* Mon Nov 22 2010 Tom Eastep tom@shorewall.net * Mon Nov 22 2010 Tom Eastep tom@shorewall.net

2
Shorewall6-lite/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

2
Shorewall6/install.sh
View File

@ -22,7 +22,7 @@
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
# #
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {

6
Shorewall6/shorewall6.spec
View File

@ -1,6 +1,6 @@
%define name shorewall6 %define name shorewall6
%define version 4.4.15 %define version 4.4.16
%define release 0base %define release 0Beta1
Summary: Shoreline Firewall 6 is an ip6tables-based firewall for Linux systems. Summary: Shoreline Firewall 6 is an ip6tables-based firewall for Linux systems.
Name: %{name} Name: %{name}
@ -98,6 +98,8 @@ fi
%doc COPYING INSTALL changelog.txt releasenotes.txt tunnel ipsecvpn ipv6 Samples6 %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel ipsecvpn ipv6 Samples6
%changelog %changelog
* Tue Nov 30 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.16-0Beta1
* Fri Nov 26 2010 Tom Eastep tom@shorewall.net * Fri Nov 26 2010 Tom Eastep tom@shorewall.net
- Updated to 4.4.15-0base - Updated to 4.4.15-0base
* Mon Nov 22 2010 Tom Eastep tom@shorewall.net * Mon Nov 22 2010 Tom Eastep tom@shorewall.net

2
Shorewall6/uninstall.sh
View File

@ -26,7 +26,7 @@
# You may only use this script to uninstall the version # You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall # shown below. Simply run this script to remove Shorewall Firewall
VERSION=4.4.15 VERSION=4.4.16-Beta1
usage() # $1 = exit status usage() # $1 = exit status
{ {