Example/Crash bug in /etc/masq

Matt LaPlante
Tue, 30 Aug 2005 13:10:18 -0000

Using the latest Debian release of shorewall (2.4.1-3) there seems to be an
unfortunate bug in the masq script, either with the doc or the program
itself, or both.  In /etc/shorewall/masq there is the following entry:

#       SUBNET -- Subnet that you wish to masquerade. You can specify this
as
#                 a subnet or as an interface. If you give the name of an
#                 interface, you must have iproute installed and the
interface
#                 must be up before you start the firewall.
#
#                 In order to exclude a subset of the specified SUBNET, you
#                 may append "!" and a comma-separated list of IP
addresses
#                 and/or subnets that you wish to exclude.
#
#                 Example: eth1!192.168.1.4,192.168.32.0/27
#

Well last night I found the example to be grievously mistaken; for when I
entered this:

eth1!192.168.4.0/24     eth0

...in my config, it promptly crashed shorewall on restart.  This effectively
cut me off from my remote firewall making me a less than happy camper.  I
found the resolution to the problem was to add a colon:

eth1:!192.168.4.0/24     eth0

I don''t know if this works as intended, but at very least shorewall
doesn''t
crash when I do it.

I checked with the 2.4.3 normal release, and the example remains the same as
with the Debian package.  Unless this was fixed very recently, I think it
would be an issue that needs to be addressed globally.

-
Matt




-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing
& QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf