The Shorewall team is pleased to announce the availability of Shorewall
4.4.4.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 4 . 4 . 4
----------------------------------------------------------------------------
1) In some simple one-interface configurations, the following Perl
run-time error messages were issued:
Generating Rule Matrix...
Use of uninitialized value in concatenation (.) or string at
/usr/share/shorewall/Shorewall/Chains.pm line 649.
Use of uninitialized value in concatenation (.) or string at
/usr/share/shorewall/Shorewall/Chains.pm line 649.
Creating iptables-restore input...
2) The Shorewall operations log (specified by STARTUP_LOG) is now
secured 0600.
3) Previously, the compiler generated an incorrect test for interface
availability in the generated code for adding route rules. The
result was that the rules were always added, regardless of the
state of the provider''s interface. Now, the rules are only added
when the interface is available.
4) When TC_WIDE_MARKS=Yes and class numbers are not explicitly
specified in /etc/shorewall/tcclasses, duplicate class numbers
result. A typical error message is:
ERROR: Command "tc class add dev eth3 parent 1:1 classid
1:1 htb rate 1024kbit ceil 100000kbit prio 1 quantum 1500"
Failed
Note that the class ID of the class being added is a duplicate of
the parent''s class ID.
Also, when TC_WIDE_MARKS=Yes, values > 255 in the MARK column of
/etc/shorewall/tcclasses were rejected.
----------------------------------------------------------------------------
K N O W N P R O B L E M S R E M A I N I N G
----------------------------------------------------------------------------
None.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 4 . 4 . 4
----------------------------------------------------------------------------
1) The Shorewall packages now include a logrotate configuration file.
2) The limit of 15 entries in a port list has been relaxed in
/etc/shorewall/routestopped.
3) The following seemingly valid configuration produces a fatal
error reporting "Duplicate interface name (p+)"
/etc/shorewall/zones:
#ZONE TYPE
fw firewall
world ipv4
z1:world bport4
z2:world bport4
/etc/shorewall/interfaces:
#ZONE INTERFACE BROADCAST OPTIONS
world br0 - bridge
world br1 - bridge
z1 br0:p+
z2 br1:p+
This error occurs because the Shorewall implementation requires
that each bridge port must have a unique name.
To work around this problem, a new ''physical'' interface
option has
been created. The above configuration may be defined using the
following in /etc/shorewall/interfaces:
#ZONE INTERFACE BROADCAST OPTIONS
world br0 - bridge
world br1 - bridge
z1 br0:x+ - physical=p+
z2 br1:y+ - physical=p+
In this configuration, ''x+'' is the logical name for ports
p+ on
bridge br0 while ''y+'' is the logical name for ports p+ on
bridge
br1.
If you need to refer to a particular port on br1 (for example
p1023), you write it as y1023; Shorewall will translate that name
to p1023 when needed.
It is allowed to have a physical name ending in ''+'' with a
logical
name that does not end with ''+''. The reverse is not
allowed; if the
logical name ends in ''+'' then the physical name must also
end in
''+''.
This feature is not restricted to bridge ports. Beginning with this
release, the interface name in the INTERFACE column can be
considered a logical name for the interface, and the actual
interface name is specified using the ''physical'' option.
If no
''physical'' option is present, then the physical name is
assumed to
be the same as the logical name. As before, the logical interface
name is used throughout the rest of the configuration to refer to
the interface.
4) Previously, Shorewall has used the character ''2'' to form
the name
of chains involving zones and/or the word ''all'' (e.g.,
fw2net,
all2all). When zones names are given numeric suffixes, these
generated names are hard to read (e.g., foo1232bar). To make these
names clearer, a ZONE2ZONE option has been added.
ZONE2ZONE has a default value of "2" but can also be given the
value "-" (e.g., ZONE2ZONE="-") which causes Shorewall
to separate
the two parts of the name with a hyphen (e.g., foo123-bar).
5) Only one instance of the following warning is now generated;
previously, one instance of a similar warning was generated for
each COMMENT encountered.
COMMENTs ignored -- require comment support in iptables/Netfilter
6) The shorewall and shorewall6 utilities now support a ''show
policies'' command. Once Shorewall or Shorewall6 has been restarted
using a script generated by this version, the ''show
policies''
command will list each pair of zones and give the applicable
policy. If the policy is enforced in a chain, the name of the chain
is given.
Example:
net => loc DROP using chain net2all
Note that implicit intrazone ACCEPT policies are not displayed for
zones associated with a single network where that network
doesn''t specify ''routeback''.
7) The ''show'' and ''dump'' commands now
support an ''-l'' option which
causes chain displays to include the rule number of each rule.
(Type ''iptables -h'' and look for
''--line-number'')
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day
trial. Simplify your report design, integration and deployment - and focus on
what you do best, core application coding. Discover what''s new with
Crystal Reports now. http://p.sf.net/sfu/bobj-july
On Saturday 21 November 2009 18:32:06 Tom Eastep wrote:> --------------------------------------------------------------------------- >- N E W F E A T U R E S I N 4 . 4 . 4 > --------------------------------------------------------------------------- >- > 2) The limit of 15 entries in a port list has been relaxed in > /etc/shorewall/routestopped. >Tom If I specify more than 15 ports in routestopped the following message is produced: ERROR: A port list in this file may only have up to 15 ports : /etc/shorewall2/routestopped (line 12) Steven. ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
Steven Jan Springl wrote:> On Saturday 21 November 2009 18:32:06 Tom Eastep wrote: >> --------------------------------------------------------------------------- >> - N E W F E A T U R E S I N 4 . 4 . 4 >> --------------------------------------------------------------------------- >> - >> 2) The limit of 15 entries in a port list has been relaxed in >> /etc/shorewall/routestopped. >> > > Tom > > If I specify more than 15 ports in routestopped the following message is > produced: > > ERROR: A port list in this file may only have up to 15 > ports : /etc/shorewall2/routestopped (line 12)Crap -- I changed all of the rule generation but neglected to remove the test. Attached patch should fix it. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
On Saturday 21 November 2009 22:22:07 Tom Eastep wrote:> Steven Jan Springl wrote: > > On Saturday 21 November 2009 18:32:06 Tom Eastep wrote: > >> ------------------------------------------------------------------------ > >>--- - N E W F E A T U R E S I N 4 . 4 . 4 > >> ------------------------------------------------------------------------ > >>--- - > >> 2) The limit of 15 entries in a port list has been relaxed in > >> /etc/shorewall/routestopped. > > > > Tom > > > > If I specify more than 15 ports in routestopped the following message is > > produced: > > > > ERROR: A port list in this file may only have up to 15 > > ports : /etc/shorewall2/routestopped (line 12) > > Crap -- I changed all of the rule generation but neglected to remove the > test. Attached patch should fix it. > > -TomTom That''s fixed it. Thanks. Steven. ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
Tom Issuing a shorewall6 start produces the following message: Undefined subroutine &Shorewall::Rules::match_source_interface called at /usr/share/shorewall/Shorewall/Rules.pm line 2319. Steven. ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
Steven Jan Springl wrote:> Tom > > Issuing a shorewall6 start produces the following message: > > Undefined subroutine &Shorewall::Rules::match_source_interface called > at /usr/share/shorewall/Shorewall/Rules.pm line 2319.The trigger is the presence of a bridge, not IPv6. Patch attached. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
On Saturday 21 November 2009 23:30:56 Tom Eastep wrote:> Steven Jan Springl wrote: > > Tom > > > > Issuing a shorewall6 start produces the following message: > > > > Undefined subroutine &Shorewall::Rules::match_source_interface called > > at /usr/share/shorewall/Shorewall/Rules.pm line 2319. > > The trigger is the presence of a bridge, not IPv6. Patch attached. > > -TomTom That''s worked. Thanks. Steven. ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
On Saturday 21 November 2009 18:32:06 Tom Eastep wrote:> 6) The shorewall and shorewall6 utilities now support a ''show > policies'' command.Tom: Command ''shorewall show policies'' works, but command ''shorewall6 show policies'' is invalid. Steven. ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
Steven Jan Springl wrote:> On Saturday 21 November 2009 18:32:06 Tom Eastep wrote: > >> 6) The shorewall and shorewall6 utilities now support a ''show >> policies'' command. > > Tom: > > Command ''shorewall show policies'' works, > but command ''shorewall6 show policies'' is invalid.Wonder where I managed to lose that -- I had tested it on my own firewall. Patch attached. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
On Monday 23 November 2009 21:48:23 Tom Eastep wrote:> Steven Jan Springl wrote: > > On Saturday 21 November 2009 18:32:06 Tom Eastep wrote: > >> 6) The shorewall and shorewall6 utilities now support a ''show > >> policies'' command. > > > > Tom: > > > > Command ''shorewall show policies'' works, > > but command ''shorewall6 show policies'' is invalid. > > Wonder where I managed to lose that -- I had tested it on my own firewall. > > Patch attached. > > -TomTom That''s worked. Thanks. Steven. ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july
Steven Jan Springl wrote:> That''s worked. Thanks.Thanks for testing, Steven! -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________ ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what''s new with Crystal Reports now. http://p.sf.net/sfu/bobj-july