[Shorewall-devel] send patchs

Juan J. Prieto
Mon, 23 May 2005 00:28:10 -0000

Hi,

El vie, 20-05-2005 a las 12:48 -0700, Tom Eastep
escribi?:
> Juan J. Prieto wrote:
> >
> >
> >   Also, some of our clients need to permit all new traffic during
> > iptables compilling (shorewall start or restart) because they have a
> > great number of zones and rules, so I have had to add a new
> > configuration variable POLICY_ACCEPT_STARTING. If it is set to
''Yes'',
> > then DROP default policy will be added at the end of compilling
period.
> >
>
> I have added the CROSSBEAM patch to 2.4.0 but I''m withholding the
> POLICY_ACCEPT_STARTING patch for now. I really don''t like the idea
of an
> option that opens the firewall completely like this one does.

  Ok, I understand and I agree with you. In fact, I warned my clients
that it is a security hole, so they use it at their own risk. But they
insist in such feature. Anyway, I agree in not include such feature in
standard shorewall distribution.

  Tom, do you need I give you a hand in some development line?

Regards.

--
Juan Jes?s Prieto - Consultor?a TI
jjprieto@eneotecnologia.com
http://www.eneotecnologia.com
---------------------------------------
fingerprint: BFC2 0370 7708 F800 0BEC  60A4 EC71 4BB1 CC85 99F5