forked from extern/shorewall_code
Compare commits
3 Commits
5.2.0-RC2
...
5.2.0-base
| Author | SHA1 | Date | |
|---|---|---|---|
|
7630d3cdb1 | ||
|
|
90df607d79 | ||
|
f012244acd |
@@ -356,7 +356,7 @@ sub generate_script_2() {
|
||||
# Note: This function is not called when $command eq 'check'. So it must have no side effects other
|
||||
# than those related to writing to the output script file.
|
||||
#
|
||||
sub generate_script_3($) {
|
||||
sub generate_script_3() {
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
progress_message2 "Creating iptables-restore input...";
|
||||
@@ -582,8 +582,8 @@ sub compile_info_command() {
|
||||
#
|
||||
sub compiler {
|
||||
|
||||
my ( $scriptfilename, $directory, $verbosity, $timestamp , $debug, $chains , $log , $log_verbosity, $preview, $confess , $update , $annotate , $config_path, $shorewallrc , $shorewallrc1 ) =
|
||||
( '', '', -1, '', 0, '', '', -1, 0, 0, 0, 0, , '' , '/usr/share/shorewall/shorewallrc', '' );
|
||||
my ( $scriptfilename, $directory, $verbosity, $timestamp , $debug, $log , $log_verbosity, $preview, $confess , $update , $annotate , $config_path, $shorewallrc , $shorewallrc1 ) =
|
||||
( '', '', -1, '', 0, '', -1, 0, 0, 0, 0, , '' , '/usr/share/shorewall/shorewallrc', '' );
|
||||
|
||||
$export = 0;
|
||||
$test = 0;
|
||||
@@ -612,7 +612,6 @@ sub compiler {
|
||||
timestamp => { store => \$timestamp, validate => \&validate_boolean } ,
|
||||
debug => { store => \$debug, validate => \&validate_boolean } ,
|
||||
export => { store => \$export , validate => \&validate_boolean } ,
|
||||
chains => { store => \$chains },
|
||||
log => { store => \$log },
|
||||
log_verbosity => { store => \$log_verbosity, validate => \&validate_verbosity } ,
|
||||
test => { store => \$test },
|
||||
@@ -882,7 +881,7 @@ sub compiler {
|
||||
# N E T F I L T E R L O A D
|
||||
# (Produces setup_netfilter(), setup_arptables(), chainlist_reload() and define_firewall() )
|
||||
#
|
||||
generate_script_3( $chains );
|
||||
generate_script_3();
|
||||
#
|
||||
# We must reinitialize Shorewall::Chains before generating the iptables-restore input
|
||||
# for stopping the firewall
|
||||
|
||||
@@ -32,7 +32,6 @@
|
||||
# --directory=<directory> # Directory where configuration resides (default is /etc/shorewall)
|
||||
# --timestamp # Timestamp all progress messages
|
||||
# --debug # Print stack trace on warnings and fatal error.
|
||||
# --refresh=<chainlist> # Make the 'refresh' command refresh a comma-separated list of chains rather than 'blacklst'.
|
||||
# --log=<filename> # Log file
|
||||
# --log_verbosity=<number> # Log Verbosity range -1 to 2
|
||||
# --family=<number> # IP family; 4 = IPv4 (default), 6 = IPv6
|
||||
@@ -63,7 +62,6 @@ usage: compiler.pl [ <option> ... ] [ <filename> ]
|
||||
[ --timestamp ]
|
||||
[ --debug ]
|
||||
[ --confess ]
|
||||
[ --refresh=<chainlist> ]
|
||||
[ --log=<filename> ]
|
||||
[ --log-verbose={-1|0-2} ]
|
||||
[ --test ]
|
||||
@@ -88,7 +86,6 @@ my $verbose = 0;
|
||||
my $timestamp = 0;
|
||||
my $debug = 0;
|
||||
my $confess = 0;
|
||||
my $chains = ':none:';
|
||||
my $log = '';
|
||||
my $log_verbose = 0;
|
||||
my $help = 0;
|
||||
@@ -114,8 +111,6 @@ my $result = GetOptions('h' => \$help,
|
||||
'timestamp' => \$timestamp,
|
||||
't' => \$timestamp,
|
||||
'debug' => \$debug,
|
||||
'r=s' => \$chains,
|
||||
'refresh=s' => \$chains,
|
||||
'log=s' => \$log,
|
||||
'l=s' => \$log,
|
||||
'log_verbosity=i' => \$log_verbose,
|
||||
@@ -143,7 +138,6 @@ compiler( script => $ARGV[0] || '',
|
||||
timestamp => $timestamp,
|
||||
debug => $debug,
|
||||
export => $export,
|
||||
chains => $chains,
|
||||
log => $log,
|
||||
log_verbosity => $log_verbose,
|
||||
test => $test,
|
||||
|
||||
@@ -135,6 +135,21 @@
|
||||
<listitem>
|
||||
<para>CHAIN_SCRIPTS (Removed in Shorewall 5.1).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>MODULE_SUFFIX (Removed in Shorewall 5.1.7). Shorewall can now
|
||||
locate modules independent of their suffix (extension).</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>INLINE_MATCHES (Removed in Shorewall 5.2). Inline matches are
|
||||
now separated from column-oriented input by two adjacent semicolons
|
||||
(";;").</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>MAPOLDACTIONS (Removed in Shorewall 5.2). </para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>A compilation warning is issued when any of these options are
|
||||
@@ -173,17 +188,18 @@
|
||||
<title>Obsolete Configuration Files</title>
|
||||
|
||||
<para>Support has been removed for the 'blacklist', 'tcrules',
|
||||
'routestopped', 'notrack' and 'tos' files.</para>
|
||||
'routestopped', 'notrack', 'tos' and 'masq' files.</para>
|
||||
|
||||
<para>The <option>-t</option> and <option>-b</option> options of the
|
||||
<command>update</command> command are still available to convert the
|
||||
'tcrules' and 'tos' files to the equivalent 'mangle' file and to convert
|
||||
the 'blacklist' file into an equivalent 'blrules' file.</para>
|
||||
<para>The <command>update</command> command is available to convert the
|
||||
'tcrules' and 'tos' files to the equivalent 'mangle' file, to convert
|
||||
the 'blacklist' file into an equivalent 'blrules' file, and to convert
|
||||
the 'masq' file to the equivalent 'snat' file.</para>
|
||||
|
||||
<para>As in Shorewall 4.6.12, the <option>-s</option> option is
|
||||
available to convert the 'routestopped' file into the equivalent
|
||||
'stoppedrules' file and the <option>-n</option> option is available to
|
||||
convert a 'notrack' file to the equivalent 'conntrack' file.</para>
|
||||
<para>As in Shorewall 4.6.12, the <command>update</command> command
|
||||
converts the 'routestopped' file into the equivalent 'stoppedrules' file
|
||||
and converts a 'notrack' file to the equivalent 'conntrack' file.</para>
|
||||
|
||||
<para>Note that in Shorewall 5.2, the update command </para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@@ -367,6 +383,33 @@
|
||||
equivalent RESTART setting.</para>
|
||||
</note>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>refresh</title>
|
||||
|
||||
<para>Given the availability of ipset-based blacklisting, the
|
||||
<command>refresh</command> command was eliminated in Shorewall
|
||||
5.2.</para>
|
||||
|
||||
<para>Some users may have been using <command>refresh</command> as a
|
||||
lightweight form of <command>reload</command>. The most common of these
|
||||
uses seem to be for reloading traffic shaping after an interface has
|
||||
gone down and come back up. The best way to handle this situation under
|
||||
5.2 is to make the interface 'optional' in your
|
||||
/etc/shorewall[6]/interfaces file, then either:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Install Shorewall-init and enable IFUPDOWN; or</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Use the <command>reenable</command> command when the interface
|
||||
comes back up in place of the <command>refresh</command>
|
||||
command.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@@ -423,9 +466,14 @@
|
||||
<section>
|
||||
<title>Upgrading to Shorewall 5</title>
|
||||
|
||||
<para>It is strongly recommended that you first upgrade your installation
|
||||
to a 4.6 release that supports the <option>-A</option> option to the
|
||||
<command>update</command> command; 4.6.13.2 or later is preferred.</para>
|
||||
<para><important>
|
||||
<para>For detailed upgrade information, please consult the 'Migration
|
||||
Issues' section of the release notes for the version that you are
|
||||
upgrading to.</para>
|
||||
</important>It is strongly recommended that you first upgrade your
|
||||
installation to a 4.6 release that supports the <option>-A</option> option
|
||||
to the <command>update</command> command; 4.6.13.2 or later is
|
||||
preferred.</para>
|
||||
|
||||
<para>Once you are on that release, execute the <command>shorewall update
|
||||
-A</command> command (and <command>shorewall6 update -A</command> if you
|
||||
@@ -445,7 +493,9 @@
|
||||
have been removed -- the updates triggered by those options are now
|
||||
performed unconditionally. The <option>-i </option>and <option>-A
|
||||
</option>options have been retained - both enable checking for issues that
|
||||
could result if INLINE_MATCHES were to be set to Yes.</para>
|
||||
could result if INLINE_MATCHES were to be set to Yes. The -i option was
|
||||
removed in Shorewall 5.2, given that the INLINE_MATCHES option was also
|
||||
removed.</para>
|
||||
|
||||
<section>
|
||||
<title id="CHAIN_SCRIPTS">CHAIN_SCRIPTS Removal</title>
|
||||
|
||||
@@ -42,7 +42,7 @@
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>The currently-supported Shorewall <ulink
|
||||
url="ReleaseModel.html">major release</ulink>s are 5.0 and 5.1.</para>
|
||||
url="ReleaseModel.html">major release</ulink>s are 5.0 , 5.1 and 5.2.</para>
|
||||
|
||||
<note>
|
||||
<para>Shorewall versions earlier than 5.0.0 are no longer supported;
|
||||
|
||||
Reference in New Issue
Block a user