From cb26cacac5bd86da9c6377c0ecf8a6800ba346e1 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Tue, 30 Jun 2009 07:09:02 -0700 Subject: [PATCH] Update News for Beta 3 --- web/News.htm | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/web/News.htm b/web/News.htm index 7e8f69dae..2644aea58 100644 --- a/web/News.htm +++ b/web/News.htm @@ -23,9 +23,19 @@ license is included in the section entitled GNU Free Documentation License".

-

June 18, 2009
+

June 30, 2009

+

2009-06-39 Shorewall 4.4.0 Beta 3
+

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta3/releasenotes.txt
+ +

2009-06-21 Shorewall 4.4.0 Beta 2
+

+
Read the details at http://www1.shorewall.net/pub/shorewall/development/4.4/shorewall-4.4.0-Beta2/releasenotes.txt
+

2009-06-18 Shorewall 4.2.10

Problems corrected in Shorewall 4.2.10

1)  A 'large quantum' warning log message during restart has been
    eliminated. The log message occurred when an interface with a large
    OUT-BANDWIDTH was defined in /etc/shorewall/tcdevices.

2)  When a REJECT rule included a log entry, the disposition in the log
    message was incorrectly shown as 'reject' rather than 'REJECT'.

3)  When 'forward' was specified on one or more interfaces in
    /etc/shorewall6/interfaces, the progress message "Compiling
    Interface forwarding..." was issued multiple times. Now, only one
    instance of the message is generated.

4)  A typing error in the IPv6 two-interface sample shorewall6.conf
    file has been corrected. This error prevented the compiler from
    being able to find macros in /usr/share/shorewall/.

Known Problems Remaining:

1)  When exclusion is used in an entry in /etc/shorewall/hosts, then
    Shorewall-shell produces an invalid iptables rule if any of the 
    following OPTIONS are also specified in the entry:    

        blacklist
        maclist
        norfc1918
        tcpflags

2)  Shorewall-shell generates inversion rules which produce
    warnings with iptables 1.4.3.  

    Example:

        iptables -A  lan2fw  -p 6  --dport 999  -s ! 192.168.20.1  -j ACCEPT

    with iptables 1.4.3.1 the following information message is produced:

    Using intrapositioned negation (`--option ! this`) is deprecated in
    favor of extrapositioned (`! --option this`).

    We don't intend to fix this. It's time to migrate to Shorewall-perl
    anyway.

New Features in Shorewall 4.2.10

1)  Shorewall's suppport for dynamic gateways on interfaces managed by
    dhclient works on OpenSuSE systems but not on some other
    distributions.

    In order to generalize support for learning the gateway for dynamic
    interfaces, a new 'findgw' extension script (user exit) has been
    added.

    The exit will be invoked in a function that has a single argument:

        $1 = <name of an interface>

    If the function can determine the gateway for the passed interface,
    it should write the gateway to standard out. Here is a sample
    /etc/shorewall/findgw that works with dhclient (dhcp3) in Debian
    Lenny:

    if [ -f /var/lib/dhcp3/dhclient.${1}.leases ]; then
       grep 'option routers' /var/lib/dhcp3/dhclient.${1}.leases |\
          tail -n 1 |\
          while read j1 j2 gateway; do\
              echo $gateway | sed 's/;//';\
          done
    fi

    The same code works on Ubuntu Jaunty if you replace the first '.'
    with '-' and replace '.leases' with '.lease' (don't you just love
    the consistency between distributions?).

    That code also works on CentOS if you replace 'dhcp3' by
    'dhclient'.

    'findgw' files that have been customized for various distributions
    may be found at
    http://www.shorewall.net/pub/shorewall/contrib/findgw.