Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:12.1
shorewall
shorewall.changes
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File shorewall.changes of Package shorewall
------------------------------------------------------------------- Sat Oct 15 16:58:32 UTC 2011 - toganm@opensuse.org - Update to 4.4.24.1 * When the logical and physical name of an interface were different, including the logical name in the tcdevices file caused the device's classes to be ignored. This defect was introduced in Shorewall 4.4.23. * Remove the ExecReload from all services, since systemd doesn't allow an ExecReload for OneShot services. Also, add a missing After=network.target to shorewall.service. - Fixed Url typo in the spec ------------------------------------------------------------------- Mon Oct 10 07:17:47 UTC 2011 - toganm@opensuse.org - Update to 4.4.24. For more details see changelog.txt and releasenotes.txt * This release includes all problem corrections from releases 4.4.23.1-4.4.23.3. * The 'fallback' option without =<weight> previously produced invalid 'ip' commands. ------------------------------------------------------------------- Thu Sep 29 14:56:11 UTC 2011 - toganm@opensuse.org - reworked systemd related rpm macros for 12.1 ------------------------------------------------------------------- Sat Sep 17 11:20:49 UTC 2011 - toganm@opensuse.org - Update to 4.4.23.3 * When providers were present that specify neither 'balance' nor 'fallback', then the following message was issued during compilation and 'enable' of the interface would fail. Use of uninitialized value $weight in concatenation (.) or string at /usr/share/shorewall/Shorewall/Providers.pm line 644. * TC_ENABLED=Shared was broken in Shorewall 4.4.23, 4.4.23.1 and 4.4.23.2. It produced a shell script with syntax errors. - Backported patches removed. ------------------------------------------------------------------- Fri Sep 16 15:06:03 UTC 2011 - toganm@opensuse.org - Update to 4.4.23.2 For more details see changelog.txt and releasenotes.txt - Support of systemd for openSUSE 12.1 - Backported patches WEIGHT.patch and SHARED.patch fixing a harmless message and traffic shaping issues respectively ------------------------------------------------------------------- Sat Aug 20 18:47:26 UTC 2011 - toganm@opensuse.org - Update to 4.4.22.3. Corrections in this release are below. * On older distributions where 'shorewall show capabilities' indicates 'Connection Tracking Match: Not Available', harmless Perl diagnostics like the following could be issued: Use of uninitialized value $list in pattern match (m//) at /usr/share/shorewall/Shorewall/Config.pm line 1273, <$currentfile> line 14. Use of uninitialized value $list in split at /usr/share/shorewall/Shorewall/Config.pm line 1275, <$currentfile> line 14. * On older distributions where 'shorewall show capabilities' indicates 'Mangle FORWARD Chain: Not Available', entries in the ecn file generated the following Perl Diagnostic: Use of uninitialized value in hash element at /usr/share/shorewall/Shorewall/Chains.pm line 1119. * Previously, if a provider interface was derived from an optional wildcard entry in /etc/shorewall/providers, then the interface was never considered to be usable. Example: /etc/shorewall/interfaces: #ZONE INTERFACE BROADCAST OPTIONS net ppp+ - optionsl /etc/shorewall/providers:net #PROVIDER NUMBER MARK INTERFACE ... ISP1 1 1 ppp0 * When 'shorewall update' or 'shorewall6 update' results in no change to the .conf file, a message is issued, the .bak file is removed and the command terminates without error. ------------------------------------------------------------------- Fri Aug 12 08:28:00 UTC 2011 - toganm@opensuse.org - patch the Perl diagnostic with a WARNING message. ------------------------------------------------------------------- Tue Aug 9 19:22:07 UTC 2011 - toganm@opensuse.org - Update to 4.4.22.2 * On older distributions where 'shorewall show capabilities' indicates 'Connection Tracking Match: Not Available', Shorewall 4.4.22 and 4.4.22.1 generated invalid iptables-restore input. * Previously, the compiler always placed '#!/bin/sh' on the first line of the generated script. It now uses the setting of SHOREWALL_SHELL on that line rather than '/bin/sh'. Note that SHOREWALL_SHELL defaults to '/bin/sh' so this change only affects those who specify a different shell. - Patched REDIRECT rule ------------------------------------------------------------------- Thu Aug 4 05:13:07 UTC 2011 - toganm@opensuse.org - Update to 4.4.22.1 * Previously, if the name of a zone began with 'all', then entries for that zone in /etc/shorewall/rules and /etc/shoreawll6/rules treated the name the same as 'all'. This defect is present in Shorewall 4.4.13 through 4.4.22. * Previously, when LOAD_HELPERS_ONLY=No, harmless iptables-restore warnings as follows could be generated: ... Running /usr/local/sbin/iptables-restore... --set option deprecated, please use --match-set --set option deprecated, please use --match-set IPv4 Forwarding Enabled ------------------------------------------------------------------- Wed Aug 3 15:45:01 UTC 2011 - toganm@opensuse.org - Update to 4.4.22. For more details see changelog.txt and releasenotes.txt * Under rare conditions, long port lists (>15 ports) could result in the following failure when optimization level 4 was enabled. Use of uninitialized value in numeric gt (>) at /usr/share/shorewall/Shorewall/Chains.pm line 1264. ERROR: Internal error in Shorewall::Chains::decrement_reference_count at /usr/share/shorewall/Shorewall/Chains.pm line 1264 * All corrections included in Shorewall 4.4.21.1. - A bug in recent versions of Shorewall that could result in rules that are wider in scope than intended was fixed by applying a patch by the upstream. ------------------------------------------------------------------- Tue Jul 19 22:06:11 UTC 2011 - toganm@opensuse.org - Update to 4.4.21.1 Changes in this release are: * A harmless Perl run-time "uninitialized variable" diagnostic has been eliminated from the compiler. The diagnostic was issued while displaying the capabilities. * As the result of a typo, an orphan filter chain named FORWAR could be created under rare circumstances. This chain was deleted by OPTIMIZE level 4. * The SNAT options --persistent and --randomize now work properly (/etc/shorewall/masq). * The LOGMARK log level was previously generated invalid iptables input making it unusable. That has been corrected. The syntax for LOGMARK is now: LOGMARK(<priority>) where <priority> is a syslog priority (1-7 or debug, info, notice, etc.). Example rule: #ACTION SOURCE DEST PROTO DEST # PORT(S) LOG:LOGMARK(info) lan dmz udp 1234 ------------------------------------------------------------------- Mon Jul 11 08:13:36 UTC 2011 - toganm@opensuse.org - Update to 4.4.21 For more details see changelog.txt and releasenotes.txt * The Shorewall and Shorewall6 'load' and 'reload' commands now use the .conf file in the current working directory. * The 'balance' and 'fallback' options in /etc/shorewall/providers have always been mutually exclusive but the compiler previously didn't enforce that restriction. Now it does. * The ipset modules are now automatically loaded by Shorewall6 when LOAD_HELPERS_ONLY=No is specified in shorewall6.conf. Additionally, there is now a /usr/share/shorewall6/modules.ipset file that lists all of the required modules. * TPROXY descriptions have been added to shorewall-tcrules(5) and shorewall6-tcrules(5). ------------------------------------------------------------------- Thu Jun 16 06:59:20 UTC 2011 - toganm@opensuse.org - Update to 4.4.20.3. Changes in this release are * Deprecated options have been removed from the .conf files. They remain in the man pages. * A simple configuration like the 'Universal' sample that includes a single wildcard interface ('+' in the INTERFACE column) produces a ruleset that blocks all incoming packets. As part of correcting this defect, which was introduced in 4.4.20.2, one or more superfluous rules (which could never match) have been eliminated from most configurations. ------------------------------------------------------------------- Wed Jun 15 06:57:32 UTC 2011 - toganm@opensuse.org - Update to 4.4.20.2 * A defect introduced in 4.4.20 could cause the following failure at start/restart: ERROR: Command "tc qdisc add dev eth0 parent 1:11 handle 1: sfq quantum 12498 limit 127 perturb 10" failed * The 'sfilter' interface option introduced in 4.4.20 was only applied to forwarded traffic. Now it is also applied to traffic addressed to the firewall itself. * Issues with iptables-restore is corrected * IPSEC traffic is now (correctly) excluded from sfilter. * The following incorrect warning message has been eliminated: WARNING: sfilter is ineffective with FASTACCEPT=Yes ------------------------------------------------------------------- Tue Jun 7 14:14:12 UTC 2011 - toganm@opensuse.org - Update to 4.4.20.1 * The address of the Free Software Foundation has been corrected in the License files. * The shorewall[6].conf file installed in /usr/share/shorewall[6]/configfiles is no longer modified for use with Shorewall[6]-lite. When creating a new configuration for a remote forewall, two lines need to be modified in the copy CONFIG_PATH=/usr/share/shorewall (or shorewall6) STARTUP_LOG=/var/log/shorewall-lite-init.log (or shorewall6-lite-init.log) ------------------------------------------------------------------- Mon Jun 6 07:30:14 UTC 2011 - toganm@opensuse.org - Update to 4.4.20 *Removed backported patches for openSUSE specific locations as they are incorporated in upstream. - Changes in 4.4.20 (for more read changelog.txt and releasenotes.txt) * Support for the AUDIT target has been added. AUDIT is a feature of the 2.6.39 kernel and iptables 1.4.10 that allows security auditing of access decisions. ------------------------------------------------------------------- Wed May 18 11:03:16 UTC 2011 - toganm@opensuse.org - Update to 4.4.19.4 * Previously, the compiler would allow a degenerate entry (only the BAND specified) in /etc/shorewall/tcpri. Such an entry now raises a compilation error. * Previously, it was possible to specify tcfilters and tcrules that classified traffic with the class-id of a non-leaf HFSC class. Such classes are not capabable of handling packets. Shorewall now generates a compile-time warning in this case and ignores the entry. If a non-leaf class is specified as the default class, then Shorewall now generates a compile-time error since that configuration allows no network traffic to flow. * Traditionally, Shorewall has not checked for the existance of ipsets mentioned in the configuration, potentially resulting in a run-time start/restart failure. Now, the compiler will issue a WARNING if: a) The compiler is being run by root. b) The compilation isn't producing a script to run on a remote system under a -lite product. c) An ipset appearing in the configuration does not exist on the local system. * As previously implemented, the 'refresh' command could fail or could result in a ruleset other than what was intended. If there had been changes in the ruleset since it was originally started/restarted/restored that added or deleted sequenced chains (chains such as ~lognnn and ~exclnnn), the resulting ruleset could jump to the wrong such chains or could fail to 'refresh' successfully. This issue has been corrected as follows. When a 'refresh' is done and individual chains are involved, then each table that contains both sequenced chains and one of the chains being refreshed is refreshed in its entirety. For example, if 'shorwall refresh foo' is issued and the filter table (which is the default) contains any sequenced chains, then the entire table is reloaded. Note that this reload operation is atomic so no packets are passed through an inconsistent configuration. * When 'shorewall6 refresh' was run previously, a harmless 'ip6tables: Chain exists' message was generated. - Reworked backported patches so shorewall still uses openSUSE specific locations - Fix the zone definitions in shorewall6/Samples6/zones examples ------------------------------------------------------------------- Wed May 11 16:17:38 UTC 2011 - toganm@opensuse.org - Update to 4.4.19.3 * incompatibility with gawk has been corrected * Previously, an entry in the USER/GROUP column in the rules and tcrules files could cause run-time start/restart failures if the rule(s) being added did not have the firewall as the source (rules file) and were not being added to the POSTROUTING chain (:T designator in the tcrules file). This error is now caught by the compiler. * Shorewall now insures that a route to a default gateway exists in the main table before it attempts to add a default route through that gateway in a provider table. This prevents start/restart failures in the rare event that such a route does not exist. * CLASSIFY TC rules can apply to traffic exiting only the interface associated with the class-id specified in the first column. * Fixes start of shorewall6 (bnc#693162) ------------------------------------------------------------------- Fri May 6 08:03:49 UTC 2011 - toganm@opensuse.org - Update to 4.4.19.2 For more details see changelog.txt and releasenotes.txt * In Shorewall-shell, there was the ability to specify IPSET names in the ORIGINAL DEST column of DNAT and REDIRECT rules. That ability, inadvertently dropped in Shorewall-perl, has been restored * Several problems with complex TC have been corrected: * Double exclusion involving ipset lists was previously not detected, resulting in anomalous behavior. ------------------------------------------------------------------- Mon Apr 18 09:42:37 UTC 2011 - toganm@opensuse.org - Update to 4.4.19.1 * Eliminate silly duplicate rule when stopped. * Don't believe that all nexthop routes are default routes. * Restore :<low port>-<high port> in masq file. * Correct default route safe/restore. - backported paths related patches from git as they are in mainstream now ------------------------------------------------------------------- Wed Apr 13 17:23:31 UTC 2011 - toganm@opensuse.org - Shorewall packages have their openSUSE specific locations now * Executable files in /usr/lib/shorewall*. These include; getparams compiler.pl wait4ifup shorecap ifupdown * Perl Modules in /usr/lib/perl5/vendor_perl/PERL_VERSION/Shorewall. - Updated to 4.4.19 (for more info please consult changelog.txt and releasenotes.txt) * Corrected a problem in optimize level 4 that resulted in the following compile-time failure Can't use an undefined value as an ARRAY reference at /usr/share/shorewall/Shorewall/Chains.pm line 862. * If a DNAT or REDIRECT rule applied to a source zone with an interface defined with 'physical=+', then the nat table 'dnat' chain might have been created but not referenced. This prevented the DNAT or REDIRECT rule from working correctly. * Previously, if a variable set in /etc/shorewall/params was given a value containing shell metacharacters, then the compiled script would contain syntax errors. * The pathname of the 'conntrack' binary was erroneously printed in the output of 'shorewall6 show connections'. * Correct a problem whereby incorrect Netfilter rules were generated when a bridge with ports was given a logical name. * If a bridge interface had subordinate ports defined in /etc/shorewall/interface, then an ipsec entry (either ipsec zone or the 'ipsec' option specified) in /etc/shorewall/hosts resulted in the compiler generating an incorrect Netfilter configuration. * A fatal error is now raised if '!0' appears in the PROTO column of files that have that column. This avoids an iptables-restore failure at run time. ------------------------------------------------------------------- Mon Apr 4 17:11:01 UTC 2011 - toganm@opensuse.org - Updated to 4.4.18.2 * SAVE_IPSETS=Yes didn't work unless there is a dynamic zone defined. * If a logical name was given to a bridge and the ports on the bridge were defined in /etc/shorewall/interfac, then the compiler could generate matches that used the logical name rather than the physical name. ------------------------------------------------------------------- Mon Mar 21 08:46:40 UTC 2011 - toganm@opensuse.org - Updated to 4.4.18.1 * An issue with params processing on RHEL6 has been corrected. The problem manifested as the following type of warning: WARNING: Param line (export OLDPWD) ignored at /usr/share/shorewall/Shorewall/Config.pm line 2993. * The editing of the value of the TC_PRIOMAP option has been tightened. Previously, many invalid settings were allowed, resulting in run-time tc command failures. * The Shorewall Lite and Shorewall6 Lite installers now install the 'helpers' modules file. Previously, this file was not installed with the result that both 'shorewall[6]-lite show capabilities' and 'shorecap' failed. * Previously, if an icmp or icmp6 type which included both a type and a code was used in the tcfilters file, 'start' and 'restart' would fail with a 'tc' error. ------------------------------------------------------------------- Fri Mar 11 23:46:49 UTC 2011 - toganm@opensuse.org - Updated to 4.4.18 * for accounting modules xtables-addons must be installed - Changes in 4.4.18 (for more read changelog.txt and releasenotes.txt) * The modules files are now just a driver that INCLUDEs several new files and one old file: * Beginning with Shorewall 4.4.18, the accounting structure can be created with three root chains: - accountin: Rules that are valid in the INPUT chain (may not specify an output interface). - accountout: Rules that are valid in the OUTPUT chain (may not specify an input interface or a MAC address). - accountfwd: Other rules. * Internals Change: The Policy.pm module has been merged into the Rules.pm module. ------------------------------------------------------------------- Thu Feb 10 16:24:41 UTC 2011 - toganm@opensuse.org - Updated to 4.4.17 * This release adds support for per-IP accounting using the ACCOUNT target. That target is only available when xtables-addons is installed. - Changes in 4.4.17 (for more read changelog.txt and releasenotes.txt) * Previously, Shorewall did not check the length of the names of accounting chains and manual chains. This could result in errors when loading the resulting ruleset. Now, the compiler issues an error for chain names longer than 29 characters. Additionally, the compiler now ensures that these chain names are composed only of letters, digits, underscores ('_') and dashes ("-"). This eliminates Perl runtime errors or other failures when a chain name is embedded within a regular expression. * Several issues with complex traffic shaping have been resolved: a) Specifying IPv6 network addresses in the SOURCE or DEST columns of /etc/shorewall6/tcfilters now works correctly. Previously, Perl runtime warnings occurred and an invalid tc command was generated. b) Previously, if flow= was specified on a parent class, a perl runtime warning occurred and an invalid tc command was generated. This combination is now flagged as an error at compile time. c) There is now an ipv6 tcfilters skeleton included with Shorewall6. * Several issues with accounting are corrected. a) If an accounting rule of the form: chain1 chain2 was configured and neither chain was referenced again in the configuration, then an internal error was generated when optimize level 4 was selected and OPTIMIZE_ACCOUNTING=Yes. b) If there was only a single accounting rule and that rule specified an interface in the SOURCE or DEST columns, then the generated ruleset would fail to load when OPTIMIZE_ACCOUNTING=Yes. c) If a per-IP accounting table name appeared in more than one rule and the specified network was not the same in all occurrences, then the generated ruleset would fail to load. This is now flagged as an error at compile time. * Two defects in compiler module loading have been corrected: a) Previously, the kernel/net/ipv6/netfilter/ directory was not searched. b) A Perl diagnostic was issued when running on a monolithic kernel when the modutils package was installed. * A line containing only 'INCLUDE' appearing in an extension script now generates a compile-time diagnostic rather than a run-time diagnostic. * Previously, the uninstall.sh scripts used insserv (if installed) on Debian-based systems. These scripts now use the preferred tool (updaterc.d). * Beginning with 4.4.16, compilation would fail if an empty shell variable was referenced in a config file on a system where /bin/sh is the Bourne Again Shell (bash). * In earlier versions. if OPTIMIZE=8 then the ruleset displayed by 'check -r' was the same as when OPTIMIZE=0 (unoptimized). Similarly, if OPTIMIZE=9 then the ruleset displayed was the same as when OPTIMIZE=1. * Startup could previously fail on a system where kernel module autoloading was not available and where TC_ENABLED=Simple was specified in shorewall.conf or shorewall6.conf. * Previously, a 'done.' message could be printed at the end of command processing even when the command had failed. Now, such a message only appears if the command completed successfully. ------------------------------------------------------------------- Sat Jan 22 19:00:26 UTC 2011 - toganm@opensuse.org - Updated to 4.4.16.1 * Beginning with 4.4.16, compilation would fail if an empty shell variable was referenced in a config file on a system where /bin/sh is the Bourne Again Shell (bash). ------------------------------------------------------------------- Wed Jan 12 18:23:38 UTC 2011 - toganm@opensuse.org - fix fillup for shorewall-init so it will be copied to sysconfig directory - link network/scripts/shorewall to if-up.d and if-down.d - Changes in 4.4.16 (for more read changelog.txt and releasenotes.txt) + If the output of 'env' contained a multi-line value, then compilation failed with an Internal Error. The code has been changed so that the compiler now handles multi-line values correctly. * In 4.4.15, output to Standard Out (FD 1) generated by /etc/shorewall/params (/etc/shorewall6/params) was redirected to /dev/null. It is now redirected to Standard Error (FD 2). * If a params file did not appear in the CONFIG_PATH, compilation failed with the error: .: 31: Can't open /etc/shorewall6/params ERROR: Processing of /etc/shorewall6/params failed * Previously, proxy ARP with logical interface names did not work. Symptoms included numerous Perl runtime error messages. * Previously, the root of a wildcard name erroneously matched that name. For example 'eth' matched 'eth+'. Now there must be at least one additional character (e.g., 'eth4'). * Use of logical interface names in the notrack and ecn files resulted in perl runtime warning messages. * The use of wildcard-matching names in certain contexts would result in anomalous behavior. Among the symptoms were: - Perl run-time messages similar to this one: Use of uninitialized value in numeric comparison (<=>) at /usr/share/shorewall/Shorewall/Zones.pm line 1334. - Failure to treat the interface as optional or required. * Where two ISPs share the same interface, if one of the ISPs was not reachable, an iptables-restore error such as this occurred: iptables-restore v1.4.10: Bad mac address "-j" * Previously, under very rare circumstances, a chain would be optimized away while there were still jumps to the chain. This caused Shorewall start/restart to fail during iptables-restore. 11) Previously, the setting of BLACKLIST_DISPOSITION was not validated. Now, an error is raised unless the value is DROP or REJECT. ------------------------------------------------------------------- Mon Jan 3 10:54:16 UTC 2011 - toganm@opensuse.org - Update to version 4.4.15.3 - Changes in 4.4.15.3 * Previously, the root of a wildcard name erroneously matched that name. For example 'eth' matched 'eth+'. Now there must be at least one additional character (e.g., 'eth4'). * Use of logical interface names in the notrack and ecn files resulted in perl runtime warning messages. * The use of wildcard-matching names in certain contexts would result in perl run-time messages similar to this one: Use of uninitialized value in numeric comparison (<=>) at /usr/share/shorewall/Shorewall/Zones.pm line 1334. * Under very rare circumstances, a chain could be optimized away even when there are jumps to the chain. This resulted in a start/restart failure. - Changes in 4.4.15.2 * Previously, proxy ARP with logical interface names did not work. Symptoms included numerous Perl runtime error messages. * Previously, unknown interface names in the proxyarp and tcinterfaces files resulted in Perl runtime errors. ------------------------------------------------------------------- Thu Dec 2 20:49:39 UTC 2010 - toganm@opensuse.org - Upgrade to version 4.4.15.1 - Changes in version 4.4.15.1 1) If the output of 'env' contained a multi-line value, then compilation failed with an Internal Error. The code has been changed to ignore all but the first line of a multi-line value. 2) If a params file did not appear in the CONFIG_PATH, compilation failed with the error: .: 31: Can't open /etc/shorewall6/params ERROR: Processing of /etc/shorewall6/params failed ------------------------------------------------------------------- Thu Dec 2 09:38:00 UTC 2010 - toganm@opensuse.org - Update to version 4.4.15 - Changes in Shorewall 4.4.15 1) Add macros from Tuomo Soini. 2) Corrected macro.JAP. 3) Added fatal_error() functions to the -lite CLIs. RC 1 1) Another Perl 5.12 warning. 2) Avoid anomalous behavior regarding syn flood chains. 3) Add HEADERS column for IPv6 Beta 2 1) Tweaks to IPv6 tcfilters 2) Add support for explicit provider routes 3) Fix shared TC tcfilters handling. Beta 1 1) Handle exported VERBOSE. 2) Modernize handling of the params file. 3) Fix NULL_ROUTE_RFC1918 4) Fix problem of appending incorrect files. 5) Implement shared TC. ------------------------------------------------------------------- Thu Nov 25 10:20:58 UTC 2010 - toganm@opensuse.org - Added README.openSUSE which warns the user ------------------------------------------------------------------- Wed Nov 24 22:21:47 UTC 2010 - toganm@opensuse.org - Fix init-4.4.14.patch - Cleaned spec file - Removed Provides shoreline_firewall - Until upstream clarifies non-executable scripts put them under rpmlintrc - TODO * the code files should go into %_libexecdir/shorewall, only non-executable data is for %_datadir/shorewall. ------------------------------------------------------------------- Wed Nov 24 10:57:37 UTC 2010 - toganm@opensuse.org - Included docs-html to the packaging as well - Patches have the version number reflecting the diff to the original ------------------------------------------------------------------- Thu Nov 11 16:55:07 UTC 2010 - toganm@opensuse.org - Initial packaging of shorewall for opensuse
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor