shorewall-init-5.0.15.6/0000755000000000000000000000000013062527166013415 5ustar rootrootshorewall-init-5.0.15.6/shorewallrc.redhat0000644000000000000000000000360113062527166017133 0ustar rootroot# # RedHat/FedoraShorewall 5.0 rc file # BUILD= #Default is to detect the build system HOST=redhat PREFIX=/usr #Top-level directory for shared files, libraries, etc. SHAREDIR=${PREFIX}/share #Directory for arch-neutral files. LIBEXECDIR=${PREFIX}/libexec #Directory for executable scripts. PERLLIBDIR=/usr/share/perl5/vendor_perl #Directory to install Shorewall Perl module directory CONFDIR=/etc #Directory where subsystem configurations are installed SBINDIR=/sbin #Directory where system administration programs are installed MANDIR=${SHAREDIR}/man #Directory where manpages are installed. INITDIR=/etc/rc.d/init.d #Directory where SysV init scripts are installed. INITFILE=$PRODUCT #Name of the product's installed SysV init script INITSOURCE=init.fedora.sh #Name of the distributed file to be installed as the SysV init script ANNOTATED= #If non-zero, annotated configuration files are installed SERVICEDIR=/lib/systemd/system #Directory where .service files are installed (systems running systemd only) SYSCONFFILE=sysconfig #Name of the distributed file to be installed as $SYSCONFDIR/$PRODUCT SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service SYSCONFDIR=/etc/sysconfig/ #Directory where SysV init parameter files are installed SPARSE= #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR VARLIB=/var/lib #Directory where product variable data is stored. VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored. DEFAULT_PAGER= #Pager to use if none specified in shorewall[6].conf shorewall-init-5.0.15.6/COPYING0000644000000000000000000004313513062525714014453 0ustar rootroot GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) 19yy This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) 19yy name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. shorewall-init-5.0.15.6/sysconfig0000644000000000000000000000112713062525714015342 0ustar rootroot# List the Shorewall products that Shorewall-init is to # initialize (space-separated list). # # Sample: PRODUCTS="shorewall shorewall6" # PRODUCTS="" # # Set this to 1 if you want Shorewall-init to react to # ifup/ifdown and NetworkManager events # IFUPDOWN=0 # # Set this to the name of the file that is to hold # ipset contents. Shorewall-init will load those ipsets # during 'start' and will save them there during 'stop'. # SAVE_IPSETS="" # # Where Up/Down events get logged # LOGFILE=/var/log/shorewall-ifupdown.log # Startup options - set verbosity to 0 (minimal reporting) OPTIONS="-V0" shorewall-init-5.0.15.6/uninstall.sh0000755000000000000000000001236713062527166015776 0ustar rootroot#!/bin/sh # # Script to back uninstall Shoreline Firewall # # (c) 2000-2016 - Tom Eastep (teastep@shorewall.net) # # Shorewall documentation is available at http://shorewall.sourceforge.net # # This program is part of Shorewall. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by the # Free Software Foundation, either version 2 of the license or, at your # option, any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # Usage: # # You may only use this script to uninstall the version # shown below. Simply run this script to remove Shorewall Firewall VERSION=5.0.15.6 PRODUCT=shorewall-init Product="Shorewall Init" usage() # $1 = exit status { ME=$(basename $0) echo "usage: $ME [ ]" exit $1 } fatal_error() { echo " ERROR: $@" >&2 exit 1 } qt() { "$@" >/dev/null 2>&1 } split() { local ifs ifs=$IFS IFS=: set -- $1 echo $* IFS=$ifs } mywhich() { local dir for dir in $(split $PATH); do if [ -x $dir/$1 ]; then return 0 fi done return 2 } remove_file() # $1 = file to restore { if [ -f $1 -o -L $1 ] ; then rm -f $1 echo "$1 Removed" fi } # # Change to the directory containing this script # cd "$(dirname $0)" finished=0 configure=1 while [ $finished -eq 0 ]; do option=$1 case "$option" in -*) option=${option#-} while [ -n "$option" ]; do case $option in h) usage 0 ;; v) echo "$Product Firewall Installer Version $VERSION" exit 0 ;; n*) configure=0 option=${option#n} ;; *) usage 1 ;; esac done shift ;; *) finished=1 ;; esac done # # Read the RC file # if [ $# -eq 0 ]; then if [ -f ./shorewallrc ]; then . ./shorewallrc elif [ -f ~/.shorewallrc ]; then . ~/.shorewallrc || exit 1 file=./.shorewallrc elif [ -f /usr/share/shorewall/shorewallrc ]; then . /usr/share/shorewall/shorewallrc else fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found" fi elif [ $# -eq 1 ]; then file=$1 case $file in /*|.*) ;; *) file=./$file ;; esac . $file || exit 1 else usage 1 fi if [ -f ${SHAREDIR}/shorewall-init/version ]; then INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall-init/version)" if [ "$INSTALLED_VERSION" != "$VERSION" ]; then echo "WARNING: Shorewall Init Version $INSTALLED_VERSION is installed" echo " and this is the $VERSION uninstaller." VERSION="$INSTALLED_VERSION" fi else echo "WARNING: Shorewall Init Version $VERSION is not installed" VERSION="" fi [ -n "${LIBEXEC:=${SHAREDIR}}" ] echo "Uninstalling Shorewall Init $VERSION" [ -n "$SANDBOX" ] && configure=0 INITSCRIPT=${CONFDIR}/init.d/shorewall-init if [ -f "$INITSCRIPT" ]; then if [ $configure -eq 1 ]; then if [ $HOST = openwrt ]; then if /etc/init.d/shorewall-init enabled; then /etc/init.d/shorewall-init disable fi elif mywhich updaterc.d ; then updaterc.d shorewall-init remove elif mywhich insserv ; then insserv -r $INITSCRIPT elif mywhich chkconfig ; then chkconfig --del $(basename $INITSCRIPT) fi fi remove_file $INITSCRIPT fi if [ -z "${SERVICEDIR}" ]; then SERVICEDIR="$SYSTEMD" fi if [ -n "$SERVICEDIR" ]; then [ $configure -eq 1 ] && systemctl disable shorewall-init.service rm -f $SERVICEDIR/shorewall-init.service fi if [ $HOST = openwrt ]; then [ "$(readlink -q ${SBINDIR}/ifup-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local [ "$(readlink -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifdown-local else [ "$(readlink -m -q ${SBINDIR}/ifup-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifup-local [ "$(readlink -m -q ${SBINDIR}/ifdown-local)" = ${SHAREDIR}/shorewall-init ] && remove_file ${SBINDIR}/ifdown-local fi remove_file ${CONFDIR}/default/shorewall-init remove_file ${CONFDIR}/sysconfig/shorewall-init remove_file ${CONFDIR}/NetworkManager/dispatcher.d/01-shorewall remove_file ${CONFDIR}/network/if-up.d/shorewall remove_file ${CONFDIR}/network/if-down.d/shorewall remove_file ${CONFDIR}/network/if-post-down.d/shorewall remove_file ${CONFDIR}/sysconfig/network/if-up.d/shorewall remove_file ${CONFDIR}/sysconfig/network/if-down.d/shorewall if [ -d ${CONFDIR}/ppp ]; then for directory in ip-up.d ip-down.d ipv6-up.d ipv6-down.d; do remove_file ${CONFDIR}/ppp/$directory/shorewall done for file in if-up.local if-down.local; do if [ -f ${CONFDIR}/ppp/$file ]; then if grep -qF Shorewall-based ${CONFDIR}/ppp/$FILE; then remove_file ${CONFDIR}/ppp/$FILE fi fi done fi rm -f ${SBINDIR}/shorewall-init rm -rf ${SHAREDIR}/shorewall-init rm -rf ${LIBEXECDIR}/shorewall-init echo "Shorewall Init Uninstalled" shorewall-init-5.0.15.6/init.openwrt.sh0000644000000000000000000000651113062525714016411 0ustar rootroot#!/bin/sh /etc/rc.common # The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V5.0 # # (c) 2010,2012-2014 - Tom Eastep (teastep@shorewall.net) # (c) 2016 - Matt Darfeuille (matdarf@gmail.com) # # On most distributions, this file should be called /etc/init.d/shorewall-init. # # This program is part of Shorewall. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by the # Free Software Foundation, either version 2 of the license or, at your # option, any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # # # arg1 of init script is arg2 when rc.common is sourced case "$action" in start|stop|boot) if [ "$(id -u)" != "0" ] then echo "You must be root to start, stop or restart \"Shorewall \"." exit 1 fi # check if shorewall-init is configured or not if [ -f "/etc/sysconfig/shorewall-init" ] then . /etc/sysconfig/shorewall-init if [ -z "$PRODUCTS" ] then exit 0 fi else exit 0 fi ;; enable|disable|enabled) # Openwrt related # start and stop runlevel variable START=19 STOP=91 ;; *) echo "Usage: /etc/init.d/shorewall-init {start|stop}" exit 1 esac # # The installer may alter this # . /usr/share/shorewall/shorewallrc # Locate the current PRODUCT's statedir setstatedir() { local statedir if [ -f ${CONFDIR}/${PRODUCT}/vardir ]; then statedir=$( . ${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR ) fi [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT} if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then ${SBINDIR}/$PRODUCT ${OPTIONS} compile $STATEDIR/firewall else return 0 fi } # Initialize the firewall start () { local PRODUCT local STATEDIR echo -n "Initializing \"Shorewall-based firewalls\": " for PRODUCT in $PRODUCTS; do if setstatedir; then if [ -x ${STATEDIR}/firewall ]; then if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then ${STATEDIR}/firewall ${OPTIONS} stop fi fi fi done if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then ipset -R < "$SAVE_IPSETS" fi } boot () { start } # Clear the firewall stop () { local PRODUCT local STATEDIR echo -n "Clearing \"Shorewall-based firewalls\": " for PRODUCT in $PRODUCTS; do if setstatedir; then if [ -x ${STATEDIR}/firewall ]; then ${STATEDIR}/firewall ${OPTIONS} clear fi fi done if [ -n "$SAVE_IPSETS" ]; then mkdir -p $(dirname "$SAVE_IPSETS") if ipset -S > "${SAVE_IPSETS}.tmp"; then grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" fi fi } shorewall-init-5.0.15.6/install.sh0000755000000000000000000003641413062527166015432 0ustar rootroot#!/bin/sh # # Script to install Shoreline Firewall Init # # (c) 2000-2016 - Tom Eastep (teastep@shorewall.net) # (c) 2010 - Roberto C. Sanchez (roberto@connexer.com) # # Shorewall documentation is available at http://shorewall.net # # This program is part of Shorewall. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by the # Free Software Foundation, either version 2 of the license or, at your # option, any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # VERSION=5.0.15.6 PRODUCT=shorewall-init Product="Shorewall Init" usage() # $1 = exit status { ME=$(basename $0) echo "usage: $ME [ ]" echo " $ME -v" echo " $ME -h" echo " $ME -n" exit $1 } fatal_error() { echo " ERROR: $@" >&2 exit 1 } split() { local ifs ifs=$IFS IFS=: set -- $1 echo $* IFS=$ifs } qt() { "$@" >/dev/null 2>&1 } mywhich() { local dir for dir in $(split $PATH); do if [ -x $dir/$1 ]; then return 0 fi done return 2 } cant_autostart() { echo echo "WARNING: Unable to configure shorewall init to start automatically at boot" >&2 } install_file() # $1 = source $2 = target $3 = mode { if cp -f $1 $2; then if chmod $3 $2; then if [ -n "$OWNER" ]; then if chown $OWNER:$GROUP $2; then return fi else return 0 fi fi fi echo "ERROR: Failed to install $2" >&2 exit 1 } make_directory() # $1 = directory , $2 = mode { mkdir -p $1 chmod 0755 $1 [ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1 } require() { eval [ -n "\$$1" ] || fatal_error "Required option $1 not set" } # # Change to the directory containing this script # cd "$(dirname $0)" # # Parse the run line # finished=0 configure=1 while [ $finished -eq 0 ] ; do option="$1" case "$option" in -*) option=${option#-} while [ -n "$option" ]; do case $option in h) usage 0 ;; v) echo "Shorewall-init Firewall Installer Version $VERSION" exit 0 ;; n*) configure=0 option=${option#n} ;; *) usage 1 ;; esac done shift ;; *) finished=1 ;; esac done # # Read the RC file # if [ $# -eq 0 ]; then # # Load packager's settings if any # if [ -f ./shorewallrc ]; then . ./shorewallrc || exit 1 file=~/.shorewallrc elif [ -f ~/.shorewallrc ]; then . ~/.shorewallrc || exit 1 file=./.shorewallrc else fatal_error "No configuration file specified and ~/.shorewallrc not found" fi elif [ $# -eq 1 ]; then file=$1 case $file in /*|.*) ;; *) file=./$file ;; esac . $file else usage 1 fi if [ -z "${VARLIB}" ]; then VARLIB=${VARDIR} VARDIR=${VARLIB}/${PRODUCT} elif [ -z "${VARDIR}" ]; then VARDIR=${VARLIB}/${PRODUCT} fi for var in SHAREDIR LIBEXECDIR CONFDIR SBINDIR VARLIB VARDIR; do require $var done [ -n "$SANDBOX" ] && configure=0 PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin [ $configure -eq 1 ] && ETC=/etc || ETC="${CONFDIR}" if [ -z "$BUILD" ]; then case $(uname) in cygwin*) BUILD=cygwin ;; Darwin) BUILD=apple ;; *) if [ -f /etc/os-release ]; then eval $(cat /etc/os-release | grep ^ID=) case $ID in fedora|rhel|centos|foobar) BUILD=redhat ;; debian|ubuntu) BUILD=debian ;; opensuse) BUILD=suse ;; *) BUILD="$ID" ;; esac elif [ -f /etc/debian_version ]; then BUILD=debian elif [ -f /etc/ubuntu_version ]; then BUILD=debian elif [ -f /etc/gentoo-release ]; then BUILD=gentoo elif [ -f /etc/redhat-release ]; then BUILD=redhat elif [ -f /etc/SuSE-release ]; then BUILD=suse elif [ -f /etc/slackware-version ] ; then BUILD=slackware elif [ -f /etc/arch-release ] ; then BUILD=archlinux elif [ -f ${CONFDIR}/openwrt_release ]; then BUILD=openwrt else BUILD=linux fi ;; esac fi case $BUILD in apple) [ -z "$OWNER" ] && OWNER=root [ -z "$GROUP" ] && GROUP=wheel ;; cygwin*|CYGWIN*) OWNER=$(id -un) GROUP=$(id -gn) ;; *) if [ $(id -u) -eq 0 ]; then [ -z "$OWNER" ] && OWNER=root [ -z "$GROUP" ] && GROUP=root fi ;; esac [ -n "$OWNER" ] && OWNERSHIP="$OWNER:$GROUP" [ -n "$HOST" ] || HOST=$BUILD case "$HOST" in debian) echo "Installing Debian-specific configuration..." ;; gentoo) echo "Installing Gentoo-specific configuration..." ;; redhat) echo "Installing Redhat/Fedora-specific configuration..." ;; slackware) echo "Shorewall-init is currently not supported on Slackware" >&2 exit 1 ;; archlinux) echo "Shorewall-init is currently not supported on Arch Linux" >&2 exit 1 ;; suse) echo "Installing SuSE-specific configuration..." ;; openwrt) echo "Installing Openwrt-specific configuration..." ;; linux) echo "ERROR: Shorewall-init is not supported on this system" >&2 exit 1 ;; *) echo "ERROR: Unsupported HOST distribution: \"$HOST\"" >&2 exit 1; ;; esac [ -z "$TARGET" ] && TARGET=$HOST if [ -n "$DESTDIR" ]; then if [ $(id -u) != 0 ] ; then echo "Not setting file owner/group permissions, not running as root." OWNERSHIP="" fi make_directory ${DESTDIR}${INITDIR} 0755 fi echo "Installing Shorewall Init Version $VERSION" # # Check for /usr/share/shorewall-init/version # if [ -f ${DESTDIR}${SHAREDIR}/shorewall-init/version ]; then first_install="" else first_install="Yes" fi if [ -n "$DESTDIR" ]; then mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d chmod 0755 ${DESTDIR}${CONFDIR}/logrotate.d fi # # Install the Firewall Script # if [ -n "$INITFILE" ]; then mkdir -p ${DESTDIR}${INITDIR} install_file $INITSOURCE ${DESTDIR}${INITDIR}/$INITFILE 0544 [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${INITDIR}/$INITFILE if [ -n "${AUXINITSOURCE}" ]; then install_file $INITSOURCE ${DESTDIR}${INITDIR}/$AUXINITFILE 0544 fi echo "SysV init script $INITSOURCE installed in ${DESTDIR}${INITDIR}/$INITFILE" fi # # Install the .service file # if [ -z "${SERVICEDIR}" ]; then SERVICEDIR="$SYSTEMD" fi if [ -n "$SERVICEDIR" ]; then mkdir -p ${DESTDIR}${SERVICEDIR} [ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 0644 [ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service" if [ -n "$DESTDIR" -o $configure -eq 0 ]; then mkdir -p ${DESTDIR}${SBINDIR} chmod 0755 ${DESTDIR}${SBINDIR} fi install_file shorewall-init ${DESTDIR}${SBINDIR}/shorewall-init 0700 [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/shorewall-init echo "CLI installed as ${DESTDIR}${SBINDIR}/shorewall-init" fi # # Create /usr/share/shorewall-init if needed # mkdir -p ${DESTDIR}${SHAREDIR}/shorewall-init chmod 0755 ${DESTDIR}${SHAREDIR}/shorewall-init # # Install logrotate file # if [ -d ${DESTDIR}${CONFDIR}/logrotate.d ]; then install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 0644 echo "Logrotate file installed as ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT" fi # # Create the version file # echo "$VERSION" > ${DESTDIR}/${SHAREDIR}/shorewall-init/version chmod 0644 ${DESTDIR}${SHAREDIR}/shorewall-init/version # # Remove and create the symbolic link to the init script # if [ -z "$DESTDIR" ]; then rm -f ${SHAREDIR}/shorewall-init/init ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/shorewall-init/init fi if [ $HOST = debian ]; then if [ -n "${DESTDIR}" ]; then mkdir -p ${DESTDIR}${ETC}/network/if-up.d/ mkdir -p ${DESTDIR}${ETC}/network/if-down.d/ mkdir -p ${DESTDIR}${ETC}/network/if-post-down.d/ elif [ $configure -eq 0 ]; then mkdir -p ${DESTDIR}${CONFDIR}/network/if-up.d/ mkdir -p ${DESTDIR}${CONFDIR}/network/if-down.d/ mkdir -p ${DESTDIR}${CONFDIR}/network/if-post-down.d/ fi if [ ! -f ${DESTDIR}${CONFDIR}/default/shorewall-init ]; then if [ -n "${DESTDIR}" ]; then mkdir -p ${DESTDIR}${ETC}/default fi [ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/default install_file sysconfig ${DESTDIR}${ETC}/default/shorewall-init 0644 echo "sysconfig file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}" fi IFUPDOWN=ifupdown.debian.sh else if [ -n "$DESTDIR" ]; then mkdir -p ${DESTDIR}${SYSCONFDIR} if [ -z "$RPM" ]; then if [ $HOST = suse ]; then mkdir -p ${DESTDIR}${ETC}/sysconfig/network/if-up.d mkdir -p ${DESTDIR}${ETC}/sysconfig/network/if-down.d elif [ $HOST = gentoo ]; then # Gentoo does not support if-{up,down}.d /bin/true elif [ $HOST = openwrt ]; then # Not implemented on openwrt /bin/true else mkdir -p ${DESTDIR}/${ETC}/NetworkManager/dispatcher.d fi fi fi if [ -n "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PRODUCT} ]; then install_file ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/$PRODUCT 0644 echo "${SYSCONFFILE} file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}" fi [ $HOST = suse ] && IFUPDOWN=ifupdown.suse.sh || IFUPDOWN=ifupdown.fedora.sh fi # # Install the ifupdown script # if [ $HOST != openwrt ]; then cp $IFUPDOWN ifupdown [ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ifupdown mkdir -p ${DESTDIR}${LIBEXECDIR}/shorewall-init install_file ifupdown ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown 0544 fi if [ -d ${DESTDIR}/etc/NetworkManager ]; then [ $configure -eq 1 ] || mkdir -p ${DESTDIR}${CONFDIR}/NetworkManager/dispatcher.d/ install_file ifupdown ${DESTDIR}${ETC}/NetworkManager/dispatcher.d/01-shorewall 0544 fi case $HOST in debian) if [ $configure -eq 1 ]; then install_file ifupdown ${DESTDIR}/etc/network/if-up.d/shorewall 0544 install_file ifupdown ${DESTDIR}/etc/network/if-down.d/shorewall 0544 install_file ifupdown ${DESTDIR}/etc/network/if-post-down.d/shorewall 0544 else install_file ifupdown ${DESTDIR}${CONFDIR}/network/if-up.d/shorewall 0544 install_file ifupdown ${DESTDIR}${CONFDIR}/network/if-down.d/shorewall 0544 install_file ifupdown ${DESTDIR}${CONFDIR}/network/if-post-down.d/shorewall 0544 fi ;; suse) if [ -z "$RPM" ]; then if [ $configure -eq 0 ]; then mkdir -p ${DESTDIR}${SYSCONFDIR}/network/if-up.d/ mkdir -p ${DESTDIR}${SYSCONFDIR}/network/if-down.d/ fi install_file ifupdown ${DESTDIR}${SYSCONFDIR}/network/if-up.d/shorewall 0544 install_file ifupdown ${DESTDIR}${SYSCONFDIR}/network/if-down.d/shorewall 0544 fi ;; redhat) if [ -z "$DESTDIR" ]; then install_local= if [ -f ${SBINDIR}/ifup-local -o -f ${SBINDIR}/ifdown-local ]; then if ! grep -qF Shorewall-based ${SBINDIR}/ifup-local || ! grep -qF Shorewall-based ${SBINDIR}/ifdown-local; then echo "WARNING: ${SBINDIR}/ifup-local and/or ${SBINDIR}/ifdown-local already exist; up/down events will not be handled" else install_local=Yes fi else install_local=Yes fi if [ -n "$install_local" ]; then install_file ifupdown ${DESTDIR}${SBINDIR}/ifup-local 0544 install_file ifupdown ${DESTDIR}${SBINDIR}/ifdown-local 0544 fi fi ;; esac if [ -z "$DESTDIR" ]; then if [ $configure -eq 1 -a -n "first_install" ]; then if [ $HOST = debian ]; then if [ -n "$SERVICEDIR" ]; then if systemctl enable ${PRODUCT}.service; then echo "Shorewall Init will start automatically at boot" fi elif mywhich insserv; then if insserv ${INITDIR}/shorewall-init; then echo "Shorewall Init will start automatically at boot" else cant_autostart fi elif mywhich update-rc.d ; then if update-rc.d $PRODUCT enable; then echo "$PRODUCT will start automatically at boot" echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable" else cant_autostart fi else cant_autostart fi elif [ $HOST = openwrt -a -f ${CONFDIR}/rc.common ]; then /etc/init.d/$PRODUCT enable if /etc/init.d/$PRODUCT enabled; then echo "$Product will start automatically at boot" else cant_autostart fi elif [ $HOST = gentoo ]; then # On Gentoo, a service must be enabled manually by the user, # not by the installer /bin/true else if [ -n "$SERVICEDIR" ]; then if systemctl enable shorewall-init.service; then echo "Shorewall Init will start automatically at boot" fi elif [ -x ${SBINDIR}/insserv -o -x /usr${SBINDIR}/insserv ]; then if insserv ${INITDIR}/shorewall-init ; then echo "Shorewall Init will start automatically at boot" else cant_autostart fi elif [ -x ${SBINDIR}/chkconfig -o -x /usr${SBINDIR}/chkconfig ]; then if chkconfig --add shorewall-init ; then echo "Shorewall Init will start automatically in run levels as follows:" chkconfig --list shorewall-init else cant_autostart fi elif [ -x ${SBINDIR}/rc-update ]; then if rc-update add shorewall-init default; then echo "Shorewall Init will start automatically at boot" else cant_autostart fi elif [ $HOST = openwrt -a -f ${CONFDIR}/rc.common ]; then /etc/init.d/$PRODUCT enable if /etc/init.d/shorewall-init enabled; then echo "$Product will start automatically at boot" else cant_autostart fi else cant_autostart fi fi fi else if [ $configure -eq 1 -a -n "$first_install" ]; then if [ $HOST = debian -a -z "$SERVICEDIR" ]; then if [ -n "${DESTDIR}" ]; then mkdir -p ${DESTDIR}/etc/rcS.d fi ln -sf ../init.d/shorewall-init ${DESTDIR}${CONFDIR}/rcS.d/S38shorewall-init echo "Shorewall Init will start automatically at boot" fi fi fi [ -z "${DESTDIR}" ] && [ ! -f ~/.shorewallrc ] && cp ${SHAREDIR}/shorewall/shorewallrc . if [ -d ${DESTDIR}/etc/ppp ]; then case $HOST in debian|suse) for directory in ip-up.d ip-down.d ipv6-up.d ipv6-down.d; do mkdir -p ${DESTDIR}/etc/ppp/$directory #SuSE doesn't create the IPv6 directories cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown ${DESTDIR}${CONFDIR}/ppp/$directory/shorewall done ;; redhat) # # Must use the dreaded ip_xxx.local file # for file in ip-up.local ip-down.local; do FILE=${DESTDIR}/etc/ppp/$file if [ -f $FILE ]; then if grep -qF Shorewall-based $FILE ; then cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown $FILE else echo "$FILE already exists -- ppp devices will not be handled" break fi else cp -fp ${DESTDIR}${LIBEXECDIR}/shorewall-init/ifupdown $FILE fi done ;; esac fi # # Report Success # echo "shorewall Init Version $VERSION Installed" shorewall-init-5.0.15.6/changelog.txt0000644000000000000000000004055213062527166016113 0ustar rootrootChanges in 5.0.15.6 1) Update release documents. 2) Backport fix for two-interface snat-file. Changes in 5.0.15.5 1) Update release documents. 2) Rebuild with corrected build50. Changes in 5.0.15.4 1) Update release documents. 2) Merge fixes from 5.1.3.1 and earlier. Changes in 5.0.15.3 1) Update release documents. 2) Merge three fixes from the 5.1.0 branch Changes in 5.0.15.2 1) Update release documents. 2) Merge four fixes from the 5.1.0 branch Changes in 5.0.15.1 1) Update release documents. 2) Make NFQUEUE non-terminating 3) IPv6 mDNS macro from Michele Baldessari. Changes in 5.0.15 Final 1) Update release documents. 2) Correct 'restore' exit status 3) Correct optimizer defect in merge_rules(). Changes in 5.0.15 RC 2 1) Update release documents. 2) Correct syntax error in Providers.pm. Changes in 5.0.15 RC 1 1) Update release documents. 2) Use $PAGER in 'show macro'. 3) Implement the -p option Changes in 5.0.15 Beta 1 1) Update release documents. 2) Preserve shell variables over 'update'. Changes in 5.0.14 Final 1) Update release documents. 2) Prevent multiple --to-source specifications in generated rules. 3) Fix installer re: snat file in $CONFDIR. Changes in 5.0.14 RC 2 1) Update release documents. 2) Correct detection of use of address variables. Changes in 5.0.14 RC 1 1) Update release documents. 2) Correctly translate +INLINE(...) 3) Deprecate INLINE_MATCHES=Yes 4) Correct an error message and move its generation. 5) Diosallow '+' in inline SNAT action bodies 6) Be sure NAT is enabled before process an snat file. 7) More documentation snat file updates. Changes in 5.0.14 Beta 2 1) Update release documents. 2) Force a reload when an optional interface is enabled and its IP address or gateway changed. 3) Correct MASQUERADE+ issue reported by Steven Springl. Changes in 5.0.14 Beta 1 1) Update release documents. 2) Supersede the 'masq' file with the 'snat' file. 3) Add SNAT action support 4) Merge 5.0.13 fixes. Changes in 5.0.13 Final 1) Update release documents. 2) Reverse ECN fix. 3) Restrict hypen in port ranges to numberic ports. 4) Correct typo in process_mangle_inline(). Changes in 5.0.13 RC 2 1) Update release documents. 2) Accept '-' as a port-range separator. 3) Correct shorewall6-masq examples. 4) Add -exists to ADD command with timeout 5) ECN fix. Changes in 5.0.13 RC 1 1) Update release documents. 2) Merge fix from 5.0.12. 3) Make the output of 'blacklist' dependent on the verbosity and clean up that output. 4) Detect bad characters in interface names. Changes in 5.0.13 Beta 2 1) Update release documents. 2) Add 'timeout' DYNAMIC_BLACKLISTING option 3) Add FIREWALL option in shorewall[6].conf. 4) Remove restrictions on IPv6 'balance' and 'fallback'. Changes in 5.0.13 Beta 1 1) Update release documents. 2) Roberto's typo fix in the mangle manpages. 3) Reorder the entries in the .conf files in ASCII collating sequence. 4) Correct DYNAMIC_BLACKLIST documentation. 4) Add 'disconnect' option to the DYNAMIC_BLACKLIST setting. Changes in 5.0.12 Final 1) Update release documents. 2) Correct permissions of files created by the 'save' command. Changes in 5.0.12 RC 3 1) Update release documents. 2) Correct disabled persistent' WRT start, restart and reload. 3) Don't assume that all probability-balanced interfaces are optional. Changes in 5.0.12 RC 2 1) Update release documents. 2) Handle down or missing interfaces in the disable logic. Changes in 5.0.12 RC 1 1) Update release documents. 2) Add DEFAULT_PAGER to shorewallrc. 3) Add support for the 'contiguous' time option. 4) Clear packet marks in PREROUTING and OUTPUT. Changes in 5.0.12 Beta 2 1) Update release documents. 2) Restore 'use Shorewall::Config(shorewall)' in ?PERL handling. 3) Make POSTROUTING the default chain for CHECKSUM. Changes in 5.0.12 Beta 1 1) Update release documents. 2) Minor cleanup in the Rules module 3) Allow zone lists in policy SOURCE and DEST columns. Changes in 5.0.11 Final 1) Update release documents. Changes in 5.0.11 RC 1 1) Update release documents. 2) Update module versions. 3) Allow provider interface to match wildcard interfaces entry. Changes in 5.0.11 Beta 2 1) Update release documents 2) Default DSCP rules to the POSTROUTING chain. 3) Correct 'trace' handing of in-rule comments. 4) Correct handling of a provider interface that matches a wildcard. 5) Re-add a handle to flow classifiers. Changes in 5.0.11 Beta 1 1) Update release documents 2) Allow 'comment' in alternate input. Changes in 5.0.10.1 1) Update release documents 2) Update Debian SysV init scripts (Roberto Sánchez). 3) Implement LOGFILE=systemd (Scott Shumate). Changes in 5.0.10 1) Update release documents 2) Avoid silly duplicate rules. Changes in 5.0.10 RC 1 1) Update release documents 2) Convert the RPMs to use systemd Changes in 5.0.10 Beta 2 1) Update release documents 2) Add 'dbl' interface option. 3) Transfer permissions during 'update' 4) Allow ':' in USER columns 5) Correct update/compatibility issues. Changes in 5.0.10 Beta 1 1) Update release documents 2) Allow can now re-enable addresses disabled using the 'blacklist' command. Changes in 5.0.9 Final 1) Update release documents 2) Document DOCKER fix. Changes in 5.0.9 RC 1 1) Update release documents 2) Cross-check core version during compilation. 3) Cross-check Shorewall6 version during IPv6 compilation. 4) Turn on AUTOMAKE in the sample configurations. 5) Date/time in 'date' format. Changes in 5.0.9 Beta 2 1) Update release documents 2) Improve compile date/time implementation 3) Add VERBOSE_MESSAGES option. 4) Allow NFLOG in the mangle file Changes in 5.0.9 Beta 1 1) Update release documents 2) Fix handling of optional provider with no IP address 3) Correct typos in the Events article 4) Implement standard error messages in the CLI 5) Include compile time and date in the output of 'status' 6) Apply Matt Darfeuille's patch set. Changes in 5.0.8 Final 1) Update release documents Changes in 5.0.8 RC 2 1) Update release documents. 2) Implement SW_LOGGERTAG 3) Correct logging of 'reloaded' message. 4) Enable compiler logging on reload and restart 5) Use uniform timestamp formatting on compiler messages 6) Flag 0 in the tcclasses MARK column 7) Correct tcclasses filter priority documentation. 8) Add an ESTABLISHED,RELATED rule for o => docker0 9) Add ?WARNING and ?INFO directives. Changes in 5.0.8 RC 1 1) Update release documents. 2) Correct date format in messages produced by startup_error(). 3) Correct many issues with save/restore of ipsets. 4) Update DHCP article (refresh -> reload) 5) Correct start command's handling of AUTOMAKE. 6) Place deprecated files with name collisions in a separate directory. 7) Create an undo_routing file for the main table. Changes in 5.0.8 Beta 4 1) Update release documents. 2) Use '-g' when the target is a terminating chain. 3) Catch case where a transformed rule jumps to its own chain. 4) Implement ipset-based blacklisting. 5) Add 'nodbl' interface option. 6) Correct handling of MINIUPNPD with DOCKER 7) Correct handling of interface options with multi-interface zones. 8) Merge Tuomo's new macros. 9) Reverse the order of Broadcast and ICMP checking in the default actions. Changes in 5.0.8 Beta 3 1) Update release documents. 2) Make the physical interface name a true synonym of the logical name. 3) Update IPv6 article. 4) Make IPv6 Drop Auth default consistent with IPv4. 5) Delete four IPv6 actions that duplicate their IPv4 counterparts 6) Allow reject method to be specified in REJECT and A_REJECT Changes in 5.0.8 Beta 2 1) Update release documents. 2) Correct handling of physical interface names in the nat-related INTERFACE columns. 3) Add MINIUPNPD option to shorewall.conf. 4) Document '+' in the MODULESDIR description. Changes in 5.0.7 Final 1) Update release documents. 2) Correct 3-interface doc. 3) Updates to the configuration basics document. 4) Small efficiency change. Changes in 5.0.7.2 1) Update release documents. 2) Fix warning when using older Perl versions. 3) Improve handling of inline matches Changes in 5.0.7.1 1) Update release documents. 2) Fix inline matches in rule with wildcard zones 3) Allow ';R' with DIVERT. Changes in 5.0.7 Final 1) Update release documents. 2) Correct 3-interface doc. 3) Updates to the configuration basics document. 4) Small efficiency change. Changes in 5.0.7 RC 1 1) Update release documents. 2) Add stab to ingress qdiscs. 3) Fix action in policing filters. 4) Correct handling of second visit to the same mangle action. 5) Correct action handling in ingress filters. 6) Tighten up editing of .conf options. Changes in 5.0.7 Beta 4 1) Update release documents. 2) Action and Inline options are now a bit map. 3) Implement 'audit' action option. 4) Make RST and NotSyn 'audit' actions. 5) Rename %actparms to %actparams. 6) Implement state action option 7) Update state actions to use the option. 8) Implement passed() in the compiler. 9) Update actions to use passed(). 10) Update release notes for 5.0.6.2. 11) Another fix for 'check -r' - this time regarding Docker=Yes 12) Make '&' and '|' work with CONNMARK 13) Allow MARK and CONNMARK in the rules file. Changes in 5.0.7 Beta 3 1) Update release documents. 2) Restore NotSyn parameter in action.Reject. 3) Add jump to DOCKER from OUTPUT. 4) More 'prerule' fixes in expand_rule() Changes in 5.0.7 Beta 2 1) Update release documents. 2) Move convert_tos() back to the Tc module. 3) Allow inline mangle actions. 4) Always look in the main routing table for default gateway. 5) 'check -r' and 'trace' compiler commands use the pager. 6) Add ?ERROR directive. 7) Eliminate ?begin perl .... ?end perl in many actions. 8) Implement '+' in inline matches to force those matches before column matches. 9) Use '+' to remove embedded Perl from the TCP-specific actions. 10) Fix nested inline action and macro invocations. Changes in 5.0.7 Beta 1 1) Update release documents. 2) Implement mangle actions. Changes in 5.0.6 Final 1) Update release documents. 2) Avoid duplicate routing rules with persistent providers. Changes in 5.0.6 RC 1 1) Update release documents. Changes in 5.0.6 Beta 5 1) Update release documents. 2) Generate docker0 rules when it is known to Shorewall 3) Avoid duplicated code out of save_dynamic_chains() 4) Remove dead code from define_firewall() 5) Save/Restore the DOCKER jump in the nat table OUTPUT chain. 6) Avoid a duplicated rule after restart when DOCKER=Yes Changes in 5.0.6 Beta 4 1) Update release documents. 2) Add the PAGER option Changes in 5.0.6 Beta 3 1) Update release documents. 2) Add sample ulogd.conf file to the logging article. 3) Added ECN action in shorewall-mangle(8). 4) Add DOCKER network support. 5) Save/restore docker0 FORWARD rules if that interface is not defined to Shorewall. Changes in 5.0.6 Beta 2 1) Update release documents. 2) Create SNMPtrap macro to supersede SNMPTrap 3) Fix two issues reported by Steven Springl. 4) Generate more compact conditional code when DOCKER=Yes 5) Correct stop/start handling when DOCKER=Yes Changes in 5.0.6 Beta 1 1) Update release documents. 2) Allow providers with no gateway 3) Add Docker support. Changes in 5.0.5 Final 1) Update release documents. Changes in 5.0.5 RC 2 1) Update release documents. 2) Update to Macros - Tuomo Soini 3) Update to Documenttion for new column names - Tuomo Soini Changes in 5.0.5 RC 1 1) Update release documents. 2) Correct indentation in the output of 'show macros'. Changes in 5.0.5 Beta 2 1) Update release documents. 2) Enhance rule tracking. Changes in 5.0.5 Beta 1 1) Update release documents. 2) Add origin comments to the .ip[6]tables-restore-input file 3) Correct test for interface assigned to two providers. Changes in 5.0.4 Final 1) Update release documents. Changes in 5.0.4 RC 2 1) Update release documents. 2) Handle @CALLER in policy actions 3) Sort red and codel options for reproducability. 4) Remove chain restrictions from -m geoip 5) Clean up sysconfig files. Changes in 5.0.4 RC 1 1) Update release documents. 2) Create unique chains when @caller is used. 3) Correct hashlimit in logging rules 4) Avoid errors when 'status -i' finds no .status files. 5) Improve the maintainability of action-tuple code Changes in 5.0.4 Beta 2 1) Update release documents. 2) Added HAProxy support. Changes in 5.0.4 Beta 1 1) Update release documents. 2) Shorewall-init installer support for OpenWRT. 3) sysconfig files included for additional distributions. 4) Make IP[6]TABLES transparent. 5) Specify the '--wait' option when creating the mangle table capability test chain. 6) Implement the WAIT_OPTION capability. 7) Assume 2.14 or later systemd (Tuomo Soini). Changes in 5.0.3 Final 1) Update release documents. Changes in 5.0.3 RC 2 1) Update release documents. 2) Allow a timeout to be specified in ADD rules. 3) Allow commas in log tags when LOGTAGONLY=Yes Changes in 5.0.3 RC 1 1) Update release documents. Changes in 5.0.3 Beta 2 1) Update release documents. 2) Merge 5.0.2.1 install/uninstall/configure changes from Matt. 3) Fix MAC handling in IPv6. 4) Another configure.pl fix from Matt. Changes in 5.0.3 Beta 1 1) Update release documents. 2) Merge Matt Darfeuille's installer/uninstaller changes. 3) Merge Tuomo Soini's column-name change and update manpages. 4) Redefine MODULESDIR. 5) Set IP_FORWARDING=keep in all shorewall6.conf files. Changes in 5.0.2.1 1) Update release documents. 2) Use 'netstat' if 'ss' isn't installed. 3) Install/Uninstall fixes from Matt Darfeuille. Changes in 5.0.2 Final 1) Update release documents. 2) 'configure' detects OpenWRT 3) Corrected the Shorewall6-lite uninstaller Changes in 5.0.2 RC 1 1) Update release documents. 2) Add OpenWRT support in the installers (Tom and Matt Darfeuille) 3) Correct mkdir command in mutex_on. 4) Add support for openWRT's 'lock' utility 5) Enable optional interface during 'start' and 'restart' Changes in 5.0.2 Beta 2 1) Update release documents. 2) Support for lib.cli-user 3) Support for OpenWRT BB and later 4) Correct installer/uninstaller issues 5) Improve circular buffer check 6) Correct HOST=default behavior 7) Allow remote- commands to return correct exit status Changes in 5.0.2 Beta 1 1) Update release documents. 2) Merge Tuomo's MSSQL fix. 3) Merge Tuomo's version removal fix. 4) Add 'persistent' options to providers, rtrules and routes 5) Add 'lib.cli-user' support. Changes in 5.0.1.1 1) Update release documents. 2) More version removal (Tuomo Soini). 3) Delete default route from main when load= or fallback. 4) Add 'persistent' options to providers, rtrules and routes. 5) Correct L2TP documentation. Changes in 5.0.1 1) Update release documents. 2) Replace LEGACY_RESTART with RESTART 3) Merge 'seconds' and 'minutes' change from 4.6.13. Changes in 5.0.0 1) Update release documents. 2) Remove options from 'update' warning messages. 3) Update documentation for obsolete file removal. 4) Apply Erich Titl's 'date' fix. Changes in 5.0.0 RC 1 1) Update release documents. 2) .service file fixes from Tuomo Soini Changes in 5.0.0 Beta 2 1) Update release documents. 2) Correct the 'reset' command 3) Allow table names in the reset command. 4) Add Gluster FS action Changes in 5.0.0 Beta 1 1) Update release documents. 2) Redefine 'reload' and 'restart'. 3) Eliminate service.214 files. 4) Add 'reload' to the service files. 5) Allow connlimit by destination. 6) Add the LEGACY_RESTART option. 7) Deimplement support for several old options 8) Merge from 4.6.12 9) Correct a warning message to refer to 'mangle' rather than 'tcrules'. 10) Drop support for the 'tos', 'tcrules', 'routestopped', 'notrack' and 'blacklist' files. 11) Disallow bare SECTION, COMMENT and FORMAT lines. 12) The -t update option also converts the 'tos' file. 13) Merge from 4.6.13. 14) Remove all of the individual options from the 'update' command. 15) Delimit inline matches with ';;'. 16) Allow log-tags in shorewall.conf options 17) Allow non-expoerts access to the user bits in the fw mark. 18) Add a PROBABILITY column to the masq files shorewall-init-5.0.15.6/releasenotes.txt0000644000000000000000000021642613062527166016662 0ustar rootroot---------------------------------------------------------------------------- S H O R E W A L L 5 . 0 . 1 5 . 6 ------------------------------ M a r c h 1 6 , 2 0 1 7 ---------------------------------------------------------------------------- I. PROBLEMS CORRECTED IN THIS RELEASE II. KNOWN PROBLEMS REMAINING III. NEW FEATURES IN THIS RELEASE IV. MIGRATION ISSUES V. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES ---------------------------------------------------------------------------- I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E ---------------------------------------------------------------------------- 5.0.15.6 1) Previously, the two-interface sample snat file contained a typo; 192.16.0.0/16 was inadvertently entered as 92.16.0.0/16. That has been corrected. 5.0.15.5 1) Shorewall 5.0.15.4 was built with a buggy toolset which resulted is the IPv4 installers being installed in the IPv6 packages. 5.0.15.5 is built with a corrected toolset. 5.0.15.4 1) Expansion of options appearing in shorewall[6].conf (e.g., $TCP_FLAGS_LOG_LEVEL) has been corrected. 2) Previously, 'all+' was treated the same as 'all' in the policy files. 3) Now, when systemd stops a Shorewall-generated firewall, the firewall is cleared rather than placed in the safe state. This is to maintain compatibility with the default SysVinit behavior and to conform to Debian rules which require that 'stop' undoes whatever 'start' did. 5.0.15.3 1) Previously, when SAVE_IPSETS=Yes or SAVE_IPSETS=ipv4, the restore phase of a rejected safe-restart would fail. That has been corrected. 2) It is now possible to include compact IPv6 addresses (those with "::") in IP6TABLES() parameters. Previously, such addresses resulted in an "INVALID ACTION..." error. 5.0.15.2 1) An optimizer defect that could result in start/reload/restart failures has been corrected. 2) Previously, when a list of zones appeared in a policy file entry, intra-zone traffic was affected even if neither the SOURCE nor DEST list ended in '+'. That has been corrected so that intra-zone traffic is included only when a '+' is present. 3) The 'ip xfrm' command is now used to dump the IPSEC SPD and SAD during 'shorewall dump' processing. Previously, this information was missing unless the ipsec-tools package was installed. As part of this change, empty policies are no longer printed and IPv6 SAD entries are now correctly listed. 5.0.15.1 1) Previously, rules in a chain that followed an unconditional NFQUEUE rule were discarded with the warning: WARNING: One or more unreachable rules in chain xxx have been discarded That problem has been corrected and such rules are now retained. 5.0.15 1) This release includes defect repair through Shorewall 5.0.14.1. 2) Previously, when the 'update' command transformed a superseded file's contents into a newer file, with the exception of the 'notrack' -> 'conntrack' conversion, the transformation was incomplete: a) All shell variables were expanded in the converted file. b) Any lines omitted by compiler directives ( ?if.... etc. ) were also omitted from the converted file. These deficiencies have been corrected. Now, shell variables are preserved in the converted file and omitted lines are now translated. EXCEPTIONS: Because the translations of the 'blacklist' and 'routestopped' files are not 1:1, omitted lines and compiler directives are not transferred to the converted files. If either are present, the compiler issues a warning: WARNING: "Omitted rules and compiler directives were not translated 3) In earlier versions, when USE_DEFAULT_RT=No in shorewall6.conf, the generated script would attempt to copy fe80:* routes from the DUPLICATE routing table to provider tables, which could fail. Now, the generated script ignores these routes. 4) Previously, if the 'restore' command failed, the failure was not corrected reflected in the exit status. The exit status now correctly indicates the outcome of the command. 5) A defect in OPTIMIZE level 4 processing, could previously result in the incorrect omission of a -i, -o, -s or -d rule option in an optimized rules. That defect has been corrected. ---------------------------------------------------------------------------- I I. K N O W N P R O B L E M S R E M A I N I N G ---------------------------------------------------------------------------- 1) On systems running Upstart, shorewall-init cannot reliably secure the firewall before interfaces are brought up. 2) The 'enable', 'reenable' and 'disable' commands do not work correctly in configurations with USE_DEFAULT_RT=No and optional providers listed in the DUPLICATE column. 3) While the 'ip' utility now accepts IPv6 routes with multiple 'nexthop' destinations, these routes are not balanced. They are rather instantiated as a sequence of single routes with different metrics. Furthermore, the 'ip route replace' command fails on such routes. Beginning with Shorewall6 5.0.15, the generated script will use a "delete..add.." sequence on these routes rather than a single "replace" command. ---------------------------------------------------------------------------- I I I. N E W F E A T U R E S I N T H I S R E L E A S E ---------------------------------------------------------------------------- 5.0.15.1 1) An IPv6 bi-directional mDNS macro has been contributed by Michele Baldessari. 5.0.15 1) The 'show macro' command now uses the configured PAGER, if any. 2) The PAGER may now be deactivated through use of the '-p' option (e.g., "shorewall -p show" ). ---------------------------------------------------------------------------- I V. M I G R A T I O N I S S U E S ---------------------------------------------------------------------------- 1) If you are migrating from Shorewall 4.4.x or earlier, please see http://www.shorewall.net/pub/shorewall/4.5/shorewall-4.5.21/releasenotes.txt 2) It is strongly recommended that you first upgrade your installation to a 4.6 release >= 4.6.12 prior to upgrading to Shorewall 5.0. Once you are on the Shorewall 4.6 release: - shorewall update -A If you also run Shorewall6: - shorewall6 update -A These steps are necessary because Shorewall 5.0: - Does not contain support for the 'tcrules' and 'tos' files -- existing 'tcrules' and 'tos' files must be converted to an equivalent set of 'mangle' file entries. - Does not contain support for the 'blacklist' file -- it must be converted to an equivalent 'blrules' file. - Does not contain support for the 'notrack' file -- it must be converted to an equivalent 'conntrack' file. - Does not contain support for the 'routestopped' file -- it must be converted to an equivalent 'stoppedrules' file. Note that you can run the update command(s) after you upgrade to Shorewall 5 but your firewall will not work correctly until you do those update(s). 3) The following configuration options have been eliminated: - EXPORTPARAMS - IPSECFILE - LEGACY_FASTSTART - LOGRATE * - LOGBURST * - WIDE_TC_MARKS * - HIGH_ROUTE_MARKS * - BLACKLISTNEWONLY * A fatal error results if those flagged with an asterisk ("*") appear in the .conf file -- run the 'shorewall[6] update' command to convert their settings to use supported options. A warning is issued if any of the rest appear in the .conf file. 'shorewall[6] update' will drop them from the file. 4) To make the command names more accurately reflect what they do, several changes have been included: a) Beginning with this release, the 'restart' command now does a true restart and is equivalent to a 'stop' followed by a 'start'. b) The pre-5.0.0 'load' command has been renamed 'remote-start'. c) The pre-5.0.0 'reload' command has been renamed 'remote-reload'. c) The 'reload' command now performs the same function as the pre-5.0.0 'restart' command. d) A 'remote-restart' command has been added to Shorewall and Shorewall6 to allow a remote 'restart' after updating the remote firewall system's compiled script. For those that can't get used to the idea of using 'reload' in place of 'restart', a RESTART option has been added. The option defaults to 'reload' for compatibility with earlier releases. If set to 'restart', then the 'restart' command does a true restart (stop followed by start) 5) While the WORKAROUNDS setting is still present in the shorewall[6].conf file: a) It's default setting has been changed to No. b) All workarounds for old distributions have been eliminated. 6) Beginning with Shorewall 5.0.0, all macros and actions are assumed to be FORMAT-2. FORMAT-1 macros and actions are no longer supported and will be silently processed as if they were FORMAT-2. For most macros and actions, this change will be of no concern, but may cause compilation errors in rare cases. To review, FORMAT-1 actions have the following columns: TARGET SOURCE DEST PROTO DEST PORT(S) SOURCE PORT(S) RATE USER/GROUP MARK FORMAT-1 macros have these columns: TARGET SOURCE DEST PROTO DEST PORT(S) SOURCE PORT(S) RATE USER/GROUP FORMAT-2 actions and macros, on the other hand, have: TARGET SOURCE DEST PROTO DEST PORT(S) SOURCE PORT(S) ORIGINAL DEST RATE USER/GROUP MARK CONNLIMIT TIME HEADERS (Only valid for IPv6) SWITCH HELPER To summarize, if your action or macro only uses the first 6 columns (which most do), then it will process fine as FORMAT-2. Otherwise, it must be modified to place specifications in the proper columns. 7) COMMENT, FORMAT and SECTION lines must now begin with a question mark ("?"). The 'update' command will change all bare COMMENT, FORMAT and SECTION lines to include the question mark. 8) Beginning with Shorewall 5.0.8, the IPv6 default treatment of Auth (TCP 113) is now consistent with IPv4; nothing special is done with these requests, so they are simply logged and dropped. IMPORTANT: If you want to continue to reject Auth requests, you can do so by changing your DROP_DEFAULT setting to make the second parameter REJECT. For example, if you currently have: DROP_DEFAULT=Drop you can change it to: DROP_DEFAULT="Drop(-,REJECT)" ---------------------------------------------------------------------------- V. N O T E S F R O M O T H E R 5 . 0 R E L E A S E S ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 4 ---------------------------------------------------------------------------- 1) This release includes defect repair up through Shorewall 5.0.13.4. 2) When the address variable for an optional interface was used, and the interface did not have an IP address when the firewall was started, then enabling the interface did not previously create/alter the rules that use the address variable. Also, if the IP address of a disabled interface changed, enabling the interface did not update/add rules using the interface's gateway address variable. Now, if the IP address of a disabled optional interface changes from its value (if any) when the netfilter ruleset was instantiated, then after a successful 'enable', the ruleset is automatically reloaded if the interface's address variable was used. Similarly, if 'detect' is specified as the GATEWAY for an optional provider, then if the gateway at the time that the provider is successfully enabled is different from that (if any) when the netfilter ruleset was instantiated, then the ruleset is automatically reloaded if the provider interface's run-time gateway variable was used. As part of this change, if an IP address is specified as the GATEWAY for a provider, then the run-time gateway variable for the provider's interface is expanded at compile time rather than at runtime. Example: #PROVIDER NUMBER MARK DUPLICATE INTRFACE GATEWAY OPTIONS COPY foo 1 1 - eth0 1.2.3.4 primary - Then %eth0 will be expanded at compile time to '1.2.3.4'. 3) Previously, the ADDRESS column in /etc/shorewall[6]/masq was documented as allowing a list of addresses and/or address ranges. That feature depended on iptables support which is no longer present in current distributions. The code now disallows more than one address[-range] and the documentation has been changed accordingly. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 1 4 ---------------------------------------------------------------------------- 1) /etc/shorewall[6]/masq has been superseded by /etc/shorewall[6]/snat. The new 'snat' file is similar to most of the other configuration files in that the first column specifies the ACTION to be performed, the second contains the SOURCE and so on. The 'shorewall[6] update' command will convert an existing masq file into the equivalent 'snat' file and will rename masq to masq.bak. See shorewall[6]-snat(5) for details. 2) Actions (both inline and regular) are now supported out of the new snat file. Like other actions, these 'SNAT actions' must be declared in the /etc/shorewall[6]/actions file where the new 'nat' option must be specified. Like other actions, the action rules are placed in a file named action.. Those rules have the same format as those in the snat file with two restrictions: 1. The '+' is not allowed in the ACTION column to specify that the rules should be applied before one-to-one NAT. It must rather be specified when the action is invoked. 2. Interface names are not permitted in the DEST column, so all of the rules apply to the interface(s) specified when the action was invoked. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 3 ---------------------------------------------------------------------------- 5.0.13.4 1) DETECT_DNAT_IPADDRS=Yes in shorewall6.conf previously resulted in an incorrect test in the generated script (0.0.0.0 was used rather than ::). That has been corrected. 2) Use of an inline mangle action could cause the compiler to fail with the following diagnostic: Use of uninitialized value in bitwise and (&) at /usr/share/shorewall/Shorewall/Rules.pm line 4826, <$currentfile> line 6. That has been corrected. 3) Handling of ipsets in the tcfilters file has been corrected (Luigi). 4) Previously, ipsets used in the tcfilters file were not auto-created. That has been corrected. 5) Previously, the compiler would issue a Perl runtime diagnostic if a tcclasses entry with the 'occurs' option appeared before the entry with the 'default' option. That has been corrected (Luigi). 5.0.13.3 1) When the effective verbosity was < 2 and the 'disconnect' option was specified in DYNAMIC_BLACKLIST, a successful 'blacklist' command would issue the following error message and would produce no other output. sed: -e expression #1, char 8: unknown command: `/' 5.0.13.2 1) Fix number 1 in 5.0.13.1 uncovered a latent defect that was not discovered until after release. The defect caused the compiler to crash when all of the following were true: 1) LOAD_HELPERS_ONLY=Yes and a capabilities file was not being used. 2) SAVE_IPSETS=Yes or SAVE_IPSETS=ipv4 in shorewall.conf. 3) Ipset-based dynamic blacklisting was being used. 4) No other ipset-based rules appeared in the configuration. This defect has been corrected. 5.0.13.1 1) Previously, Shorewall ipset creation could fail on older releases, such as Centos 6, with a message similar to the following: WARNING: ipset lvpn does not exist; creating it as an hash:net set ipset v6.11: Unknown argument: `counters' Try `ipset help' for more information. That problem has been corrected so that the ipset is now created successfully. 2) Another problem with the DEST column in inline mangle action bodies has been corrected. 5.0.13 1) This release contains defect repair from 5.0.12.1. 2) The compiler now detects shell metacharacters in interface names defined in /etc/shorewall[6]/interfaces. Previously, such characters could cause runtime failures in the generated script. 3) Previously, the compiler ignored DEST column entries in inline mangle action bodies. That value is now used unless it is '-', in which case the DEST column value in the action invocation is used. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 1 3 ---------------------------------------------------------------------------- 1) A 'disconnect' option has been added to the DYNAMIC_BLACKLIST setting. The option is only accepted for ipset-based dynamic blacklisting and requires that the 'conntrack' utility be installed. See shorewall[6].conf(5) for details. With this option, when an address is blackliseted using the 'blacklist' command, the conntrack utility is used to break all connections from that address. If the 'src-dst' option is also specified in the BLACKLIST setting, then all connections to the address are also broken. If the effective VERBOSITY is greater than 0, then a messages is displayed that indicated the number of flows deleted by the command. If the effective VERBOSITY is 2, the conntrack entries delected by the command are also displayed. This option is more efficient for packet processing than including the ESTABLISHED state in the BLACKLIST setting. 2) A 'timeout' option has been added to the DYNAMIC_BLACKLIST setting. The option is only accepted for ipset-based dynamic blacklisting and causes entries in the blacklist ipset to be automatically deleted if they are not matched within a specified time. See shorewall[6].conf(5) for details. 3) A new FIREWALL option has been added to shorewall[6].conf. This option is intended to be used on an admisitrative system in configurations of remote firewalls. It defines the DNS name or IP address of the remote system so that the system name does not have to be given in the remote-start, remote-reload and remote-restart commmands. See shorewall[6](8) for details. 4) Shorewall6 now allows more that one provider to specify the 'balance' or 'fallback' options. 5) When using port numbers (as opposed to service names), the hyphen ("-") is now accepted as the separator in port ranges. When service names are used, the colon (":") must still be used. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 2 ---------------------------------------------------------------------------- 1) Minor cleanup, mostly commentary, in the Rules.pm module. 2) In Shorewall 5.0.7, The assumed 'use Shorewall::Config(shorewall)' statement in ?PERL and ?BEGIN PERL...?END PERL handling was inadvertently removed. This results in Perl compilation errors if the 'shorewall' function is invoked. The statement has now been restored. 3) Previously, the firewall would fail to start if the configuration contained a CHECKSUM rule without a chain designator and MARK_IN_FORWARD_CHAIN=No. Now, the compiler defaults these rules to the POSTROUTING chain and forbids them in the PREROUTING chain. 4) Recently, a case was observed where certain incoming packets had a non-zero packet mark in the raw PREROUTING chain, causing them to be misrouted. To guard against this issue, packet marks are now cleared at the top of the PREROUTING and OUTPUT mangle chains when the new ZERO_MARKS option is set to yes. Note that ZERO_MARKS=Yes can break IPSEC in multi-ISP configurations. 5) Two distinct problems have been corrected in the 'disable' command logic: a) If a balanced or fallback interface was down or had been deleted, then the 'disable' command could fail. b) If a persistent optional interface was down, then the generated script would fail when it attempted to add routes out of the interface. 6) Previously, the generated script would attempt to reenable a disabled persistent provider at each 'start', 'reload' or 'restart'. Now, disabled persistent providers are handled the same as other providers and require the 'enable' or 'reenable' command to enable them. 7) Previously, the generated script assumed that all probability-balanced providers (those with the 'load' option specified) were optional. That assumption has been removed. 8) Previously, the permissions of files created by the 'save' command were more relaxed than necessary. This has been corrected. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 1 2 ---------------------------------------------------------------------------- 1) You may now place comma-separated zone lists in the SOURCE and DEST columns in /etc/shorewall[6]/policy. Example: #SOURCE DEST POLICY ... loc,dmz net REJECT That line is equivalent to: #SOURCE DEST POLICY ... loc net REJECT dmz net REJECT If the same zone appears in both columns, the default ACCEPT intrazone policy is not overridden unless the list is followed immediately by '+'. Example: #SOURCE DEST POLICY ... dmz,loc loc,dmz+ REJECT That line is equivalent to: #SOURCE DEST POLICY ... dmz loc REJECT dmz dmz REJECT loc loc REJECT loc dmz REJECT Without the plus sine, it would be equivalent to #SOURCE DEST POLICY ... dmz loc REJECT loc dmz REJECT 2) Distribution maintainers may now set a default pager via the configure and configure.pl programs in Shorewall-core to set DEFAULT_PAGER in the generated shorewallrc file. The Shorewall-provided shorewallrc files for Debian currently specify 'less' for DEFAULT_PAGER. The other shorewallrc files do not specify DEFAULT_PAGER. If shorewall[6].conf does not specify PAGER then the DEFAULT_PAGER setting is used. 3) The 'contiguous' option is now supported in TIME columns. When the 'timestop' value is smaller than the 'timestart' value, match this as a single time period instead distinct intervals. Example: weekdays=Mo×tart=23:00×top=01:00 Will match Monday, for one hour from midnight to 1 a.m., and then again for another hour from 23:00 onwards. If this is unwanted, e.g. if you would like 'match for two hours from Monday 23:00 onwards' you need to also specify the 'contiguous' option in the example above. See http://www.shorewall.org/configuration_file_basics.htm#TIME for additional TIME column examples. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 1 ---------------------------------------------------------------------------- 1) This release contains defect repair through Shorewall 5.0.10.1. 2) In Shorewall 5.0, the default chain for DSCP rules was inadvertently chained to PREROUTING (FORWARD, if MARK_IN_FORWARD_CHAIN=Yes). The default is now restored to POSTROUTING, its earlier value. 3) When 'trace' was specified, previously the output of ip[6]tables rules containing a comment were displayed incorrectly. The "-m comment --comment" specification was missing and the comment was not enclosed in double quotes. This has been corrected. 4) Previously, if a provider interface matched only a wildcard entry (one whose physical interface name ended in '+'), then the generated script would always find the interface to be unusable. That has been corrected. 5) A change released in 5.0.9.1 and that allowed simple traffic shaping to support more than 9 interfaces prevented some users' configurations from starting. That has been corrected. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 1 1 ---------------------------------------------------------------------------- 1) When using the alternate input form, it is now possible to specify a comment to be attached to the generated ip[6]tables rule. Simply use the 'comment' keyword. If the comment contains embedded white space, then it must be enclosed in double quotes. Any double quotes embedded in the comment must be escaped using a backslash. Example: ACCEPT net $FW { proto=tcp, dport=22, comment="Accept \"SSH\"" } 2) OPTIMIZE level 16 no longer deletes duplicate COUNT rules, allowing multiple similar COUNT rules in a chain. 3) Beginning with this release, source RPMs are available on the download sites. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 0 ---------------------------------------------------------------------------- 5.0.10.1 1) Several issues with the Debian SysV init scripts have been corrected: a) The scripts now issue progress messages for the 'stop' command based on the setting of SAFESTOP in /etc/default/shorewall*. b) The firewall is now stopped or cleared in runlevel 1 (minimal), based on the setting of SAFESTOP. c) A typo in the Shorewall init script prevented the force-stop command from working correctly. Roberto Sánchez. 5.0.10 1) This release includes defect repair through Shorewall 5.0.9.2. 2) Previously, the 'update' commmand could result in updated files having the user's default permissions rather than the permissions of the original file. That has been corrected. 3) A number of update and update-compatibility issues have been corrected: a) : (e.g., "fred:") is once again accepted in USER columns. b) The USER column in the mangle file can once again be specified when :T is the chain designator. c) The 'notrack' file is now correctly appended to the 'mangle' file during update. d) IPMARK entries in 'tcrules' are now correctly converted into the 'mangle' file. 4) When multiple zones are configured on an interface, the 'tcpflags', 'nosmurfs' and 'maclist' options could previously result in silly duplicate rules. That problem has been corrected. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 1 0 ---------------------------------------------------------------------------- 5.0.10.1 1) You can now specify LOGFILE=systemd to cause 'journelctl -r' to be used to read the system log (journel). Scott Sumate. 5.0.10 1) The 'allow' command can now remove entries from the ipset-based dynamic blacklists. allow
... 2) A new 'dbl' (Dynamic Blacklist) option is now available in the 'interfaces' file. Possible settings are: none - equivalent to specifying 'nodbl'. src - packets entering the firewall on the interface have their source IP address checked against the ipset-based blacklist. dst - packets entering the firewall on the interface have their destination IP address checked against the ipset-based blacklist. src-dst - packets entering the firewall on the interface have their source IP address checked against the ipset-based blacklist. Packets originating on the fireawll and leaving through the interface have their destination IP address checked against the ipset-based blacklist. The normal setting for an internet-facing interface will be either 'src' or 'src-dst'. The normal setting for an internal interface will be either 'none' or 'dst'. 3) The RPMs from shorewall.net are now created to assume that systemd is being used. They are targeted specifically at OpenSuSE and have been verified on OpenSuSE 42.1. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 9 ---------------------------------------------------------------------------- 1) This release contains defect repair through Shorewall 5.0.8.2. 2) Previously, if: - DOCKER=Yes - docker0 was defined in /etc/shorewall/interfaces - Docker was not running then Shorewall would fail to start with an error similar to this iptables-restore v1.4.21: Couldn't load target `DOCKER': No such file or directory Error occurred at line: 29 Try `iptables-restore -h' or 'iptables-restore --help' for more information. ERROR: /sbin/iptables-restore Failed. This has been corrected such that Shorewall starts correctly under these conditions. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 9 ---------------------------------------------------------------------------- 1) The file 'lib.core' has been renamed 'lib.runtime' to more accurately reflect the file's role. 2) The CLI now produces helpful error messages rather than simply dumping out the complete usage syntax. 3) The 'status' and 'version -a" command outputs now include the time and date when the current firewall script was compiled. This feature implements a new 'info' command that is recognized by the compiled script. That command produces output similar to the following: compiled Thu Apr 28 14:18:58 2016 by Shorewall version 5.0.9 Note 1: The time and date of compilation will only be displayed after the firewall script has been compiled using this or a later Shorewall release. Note 2: Information about the current firewall script is only displayed by the 'version -a' command when the command is executed by root. Caution: If you execute 'shorewall compile', a subsequent 'status' command will display the compilation information for the newly compiled script and not for the one that was used to instantiate the running firewall configuration. Note that the compilation date/time, in this case, will be later than the started date/time: Example: State:Started Sun Apr 24 12:22:18 PDT 2016 from /etc/shorewall/ (/var/lib/shorewall/firewall compiled Thu Apr 28 14:18:58 2016 by Shorewall version 5.0.9) 4) The ?INFO and ?WARNING directives added in Shorewall 5.0.8 include the current filename and line number in the generated message. That behavior can be suppressed by using ?INFO! AND ?WARNING! instead. Additionally, the default behavior can be changed by setting VERBOSE_MESSAGES=No in shorewall[6].conf. In that case, including the exclaimation point causes the filename and line number to be included. 5) NFLOG(...) is now supported in the mangle files. 6) The compiler now checks the version of the installed Shorewall-core and issues a warning message if there is a mis-match. Example (folded to fit within 72 columns): WARNING: Version Mismatch: Shorewall-core is version 5.0.8.2, while the Shorewall version is 5.0.9-Beta2 When compiling for IPv6, the Shorewall6 version is also verified and a similar warning is issued in the case of a mismatch. 7) The sample configurations now have AUTOMAKE enabled. 8) Full date and time strings generated by the compiler are now in 'date' format rather than Perl's 'localtime' format. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 8 ---------------------------------------------------------------------------- 1) This release includes defect repair through Shorewall 5.0.7.2 2) If a physical interface name was used in the INTERFACE column of an entry in /etc/shorewall/masq, then previously a Perl diagnostic was issued as the masq rule was being processed and the iptables rule and its containing chain were dropped by the optimizer. That has been corrected so that physical interface names are handled correctly. Similar issues with physical names in the INTERFACE column of the nat, netmap and ecn files have also been resolved. 3) The optional plus sign ('+') in the MODULESDIR setting, added in Shorewall 5.0.3, is now documented in the shorewall[6].conf manpages. 4) Address variables that specified the physical interface name previously caused Perl diagnostics to be issued and wrong code to be generated. That has been corrected. 5) The IPv6 default treatment of Auth (TCP 113) is now consistent with IPv4; nothing special is done with these requests, so they are simply logged and dropped or rejected. IMPORTANT: If you want to continue to silengly reject Auth requests, you can do so by changing your xxx_DEFAULT settings to make the second parameter 'Reject'. For example, if you currently have: DROP_DEFAULT=Drop REJECT_DEFAULT=Reject you can change it to: DROP_DEFAULT="Drop(-,REJECT)" REJECT_DEFAULT="Reject(-,REJECT)" 6) Previously, if a zone had two or more interfaces, then the interfaces' option rules (DHCP, dynamic blacklisting, etc.) could be moved into the fw->zone chain without being restricted to their respective interfaces. This could result in needless duplication of rules. These rules are now kept in separate chains which, if they are identical, will be combined by the optimizer if OPTIMIZE level 8 is enabled. 7) A number of issues have been resolved with saving/restoring ipsets in Shorewall and Shorewall6. - Even if Shorewall's SAVE_IPSETS was set to ipv4, restarting one configuration would attempt to flush/destroy the ipsets for the other address family. - The same set could be saved multiple times, with the result that ipset error messages were issued during 'shorewall[6] start'. - Needless repetition of code was generated due to the use of compile-time loops rather than run-time loops. 8) Previously, when AUTOMAKE=Yes, the 'start' command would not regenerate an out-of-date firewall script. 9) A couple of recent changes have resulted in file name collisions on Cygwin with its underlying case-insensitive filesystem. To avoid these collisions. - /usr/share/shorewall/deprecated and /usr/share/shorewall6/deprecated directories have been created. - When a name collision occurs, the file with the older name is moved to the deprecated directory - The compiler automatically searches the deprecated directory (both directories in the case of Shorewall6) for files. In this release, macro.SNMPTraps and action.A_Reject were moved to /usr/share/shorewall/deprecated/. Note that both are deprecated - Reject accepts an 'audit' parameter, and macro.SNMPTraps has been superseded by macro.SNMPtraps. 10) Previously, the 'reload' command did not produce a system log message when it succeeded. That has been corrected. 11) Previously, when compilation was done as part of a reload or restart operation, compiler logging to the STARTUP_LOG was suppressed. Such logging is now enabled. 12) The compiler now uses a uniform format for timestamps in the STARTUP_LOG and on standard output (when the -t option is specified). Previously, some messages suppressed a leading zero in the hour where others did not. Now, the leading zero is never suppressed for compatibility with the timestamps produced by the generated script. 13) Previously, the compiler would allow 0 to be specified in the MARK column of the tcclasses file, resulting in a run-time failure: Setting up Traffic Control... RTNETLINK answers: Invalid argument We have an error talking to the kernel ERROR: Command "tc filter add dev eth0 protocol all parent 1:0 prio 276 handle 0 fw classid 1:10" Failed Now, the following error is generated by the compiler: ERROR: MARK value must be non-zero As part of this change, the shorewall[6]-tcclasses(5) manpages have been updated: - Specifity a filter priority in the MARK column is now documented (this feature has been in the code for several years) - The default priorities of the filters for tos= and tcp-ack have been correcgted. 14) For consistency with Docker, when bridge docker0 is listed in /etc/shorewall/interfaces, the following rule is now generated: -A FORWARD -o docker0 -m conntrack \ --ctstate RELATED,ESTABLISHED -j ACCEPT 15) Previously, the safe-* commands did not direct the compiler to write to the STARTUP_LOG. That has been corrected. The commands which direct the compiler to write to that log are now: start try refresh reload restart safe-* ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 8 ---------------------------------------------------------------------------- 1) Support for later versions of miniupnpd has been added in the form of a MINIUPNPD option in shorewall.conf. If set to Yes, Shorewall will create a chain in the nat table named MINIUPNPD-POSTROUTING and will add jumps from POSTROUTING to that chain for each interface with the upnpd option specified. Default is No. The contents of the chain are preserved over 'shorewall reload' and 'shorewall restart' operations. 2) The REJECT and A_REJECT actions may now take an optional parameter that specifies the way in which the packet is to be rejected. See shorewall[6]-rules(5) for details. 3) The standard action files and shell libraries now have a uniform format for their header comments (Tuomo Soini). 4) The compiler now uses the iptables goto (-g) parameter rather than the jump (-j) parameter, when the target is a terminating chain (does not have any rules with the RETURN target and the last rule in the chain is an unconditional jump to a terminating target or chain). 5) The compiler now raises an error if the target of a chain's rule is the chain itself. 6) The compiler now raises an error if the action specified in REJECT_ACTION contains a RETURN (CONTINUE) jump or if the last rule in the action is not an unconditional jump to a terminating target. 7) The Drop and Reject default actions now accept a sixth parameter that specifies the action to be taken on UPnP packets. Previously, the same action was performed on UPnP as was performed on late DNS replies. The default is DROP in both cases. 8) Heretofore, when DYNAMIC_BLACKLISTING=Yes, blacklists were checked on packets arriving and leaving on all interfaces. Now, individual interfaces may be exempted from dynamic blacklisting through use of the "nodbl" interface option. 9) Prior to this release, dynamic blacklisting has been implemented using rules in an ip[6]tables chain. This scales poorly when there are a large number of blacklisted addresses. Beginning with this release, dynamic blacklisting can be ipset- based. See DYNAMIC_BLACKLIST in shorewall.conf(5) and shorewall6.conf(5) and the 'blacklist' command in shorewall(8) and shorewall6(8). As part of this change, ipsets created by Shorewall are now of type hash:net with the 'timeout 0 counters' options, rather than hash:ip with no options. This allows both network and individual host addresses to be added to these ipsets, a timeout to be specified when addresses are added to the ipsets, and visibility into matches on individual members of the ipset. 10) New new Redis macros have been added, one for Redis Cluster and the other for Redis Sentinal (Tuomo Soini). 11) The system log messages created by Shorewall via the 'logger' utility may now be augmented using logger's -t (--tag) option through use of the SW_LOGGERTAG environmental variable. If this variable is set to a non-empty value, then its contents will be passed as the -t option (e.g. logger -t "$SW_LOGGERTAG" ...). 12) Similar to ?ERROR, which was introduced in Shorewall 5.0.7, this release supports additional ?WARNING and ?INFO directives ?ERROR ?WARNING ?INFO The is written to STDERR prefaced by the directive name (WARNING or INFO) followed by a colon (':'). It is also written to the STARTUP_LOG if: - A STARTUP_LOG has been configured - The command is start, try, restart, reload, refresh or one of the safe-* commands Unlike ?ERROR, ?WARNING and ?INFO do not cause compilation to be aborted. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 7 ---------------------------------------------------------------------------- 5.0.7.2 1) When using older versions of Perl, the following warnings were generated with 5.0.7 and 5.0.7.1. Found = in conditional, should be == at /usr/share/perl5/Shorewall/Chains.pm line 8630. Found = in conditional, should be == at /usr/share/perl5/Shorewall/Chains.pm line 8635. That has been corrected. (Tuomo Soini) 2) Several typos in the manpages have been corrected (Roberto Sánchez). 3) Previously, if an inline match was used in the last line of an action, then the inline match could also be applied to the jump to the action's chain. That has been corrected so that the jump to the chain contains the correct set of matches. 5.0.7.1 1) In 5.0.6.2 and 5.0.7, use of an inline match in a rule that generated multiple ip[6]tables rules caused only the first generated rule to contain the inline match. That has been corrected. 2) In 5.0.7, if ':R' was specified with the DIVERT action, an error message was erroneously generated. That has been corrected. 5.0.7 1) This release includes defect repair from Shorewall 5.0.6.2. 2) Previously, the compiler failed to catch invalid action/chain combinations which caused iptables-restore failures when such combinations were present in the configuration. That has been corrected. 3) An issue involving nested inlined action and macro invocations has been resolved. 4) The '&' (and) and '|' (or) symbols were previously ignored when the action was CONNMARK (mangle file). These symbols now work as documented. 5) When 'DOCKER=Yes', 'check -r' would previously fail. The command now works correctly. 6) Previously, the specified linklayer, overhead, mtu, mpu and tsize were not applied to ingress qdiscs that provide IN-BANDWIDTH limiting. That has been corrected so that these options also apply to inbound traffic. IMPORTANT: If you have specified linklayer, overhead, etc., then after this fix is installed, your inbound speed will be less than it was before the fix. You are advised to re-test and possibly adjust your IN-BANDWIDTH accordingly. 7) The syntax which Shorewall previously used to define ingress filters is misinterpreted by the tc utility, with the result that rather than dropping packets exceeding the IN-BANDWIDTH, the filter instead reclassified them. That caused 'packet reclassify loop' errors during periods of high inbound traffic. The compiler now generates the options in the 'tc add filter' command in an order that tc handles correctly. 8) If a log level was specified in one of the *_DEFAULT options, the compiler would previously raise a fatal error when applying the default action. That has been corrected. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 7 ---------------------------------------------------------------------------- 1) Actions may now be used in the mangle file. To be used in the mangle file, an action must be declared in the actions file with the 'mangle' option. Actions with this option may only be used in the mangle file (or in other actions with the mangle option); they may not be used in the rules file. Mangle actions may be inlined using the 'inline' option in the actions file. A new template file (/usr/share/shorewall/action.mangletemplate) is included in the release for use in creating mangle actions. 2) The 'check -r' command now uses the PAGER program unless the -d option is also specified. Additionally, when the compiler runs with 'trace', the PAGER program is used unless -d is set. 3) It is now possible to raise an error if a condition isn't met using the ?ERROR directive. ?ERROR The text after ?ERROR is displayed in a standard Shorewall error message. 4) Using the new ?ERROR directive, embedded Perl has been eliminated from a number of standard actions. Example from action.GlusterFS: ?if @1 !~ /^\d+/ || ! @1 || @1 > 1024 ?error Invalid value for Bricks (@1) ?elsif @2 !~ /^[01]$/ ?error Invalid value for IB (@2) ?endif The above logic insures that the first action paramater is a non-zero number <= 1024 and that the second parameter is either 0 or 1. If 2000 is passed for the first parameter, the following error message is generated: ERROR: Invalid value for Bricks (2000) /usr/share/shorewall/action.GlusterFS (line 15) from /etc/shorewall/rules (line 45) 5) Previously, inline matches were placed after column-generated matches in the generated rule. This meant that "-p' could not be used in inline matches. Beginning with this release, if the first non-blank characters in an inline match is '+', then the remainder of the inline matches are placed at the front of the generated rule. There are a couple of restrictions: a. When -p is used in an inline match and the PROTO column is supplied, then an error is generated unless the resolved contents of the column matches the protocol specified in the inline match. This means that only protocol numbers should appear in the inline match. b. Use of -i, -s, -o, or -d (or their long-form equivalents) in an inline match will result in a compilation error if the contents of the columns generates the same match. 6) The TCPFlags action has been modified to use '+' in inline matches rather than embedded Perl with perl_action_tcp_handler() calls. 7) A new 'audit' action option has been added. Such actions are expected to have at least two parameters; the first is a target and the second is either omitted or is 'audit'. Two existing standard actions (RST and NotSyn) have this characteristic and they have been converted to use the 'audit' option, eliminating embedded Perl within their bodies. 8) Within an action body, if a parameter is omitted in a DEFAULTS statement, then the value of the corresponding action and Shorewall variables is '-', while if the parameter is specified as '-' in the parameter list, the value of the variables is '' if expanded before the DEFAULTS statement. Additionally, when an expression is evaluated, the value 0 evaluates as false; so '?IF @n' and 'IF $n' both fail if the nth parameter is passed with value zero. To make testing of the presense of parameters more efficient and uniform, an new function has been added for use in ?IF and ?ELSEIF: ?IF [!] passed() where is an action or Shoreall variable. 'passed(@n)' and 'passed($n)' evaluate to true if the nth parameter is not empty and its contents are other than '-'. If '!' is present, the result is inverted. In this simple form, the expression is evaluated by the compiler without having to invoke the (expensive) Perl exec() function. The 'passed' function may also be used in more complex expressions, but exec() will be invoked to evaluate those expressions. 9) The MARK and CONNMARK targets are now available in the rules file, macros, and actions. Mark ranges are not currently supported with these targets. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 6 ---------------------------------------------------------------------------- 1) This release includes defect repair through Shorewall 5.0.5.1. 2) Previously, the generated function define_firewall() contained logic for handling the 'stop' and 'clear' commands. Beginning with this release, the function will no longer include that logic, since the function is not called when processing those commands. 3) The 'persistent' option on a provider previously resulted in a duplicate routing rule was created each time that the provider was disabled. This has been corrected so that duplicate rules are not created. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 6 ---------------------------------------------------------------------------- 1) The GATEWAY column in /etc/shorewall[6]/providers may now contain the keyword 'none'. This will create a routing table with no default route, to allow handling policy-routing senarios where a default route is not required. 2) Previously, when both Shorewall and Docker were used on the same system, one of two approaches had to be followed: a) Run docker with --iptables=false and use Shorewall to configure Netfilter. b) Run docker with ---iptables=true and use extension scripts to save/restore the Docker-generated rules. The first is complex and the second is difficult to do in a way that insures that changes to the Shorewall configuration aren't lost during restart/reload. In this release, a new DOCKER option is available in shorewall.conf. When DOCKER=Yes, the generated script takes responsibility for saving and restoring the Docker-generated rules. The Shorewall implementation assumes that the default 'docker0' bridge is being used. It is recommended that docker0 be assigned to a zone in /etc/shorewall/interfaces. When you do that, the setting of 'routeback' for that interface determines whether inter-container communication is allowed. If docker0 is not listed in the interfaces file, then the generated script will save/restore the FORWARD chain rules for that interface. If you are using Docker's network features where bridges with names of the form br-xxxxxxxxxxxx are created, those bridges should not be defined to Shorewall. Note that DOCKER=Yes is currently supported only in Shorewall and not in Shorewall6. 3) A new SNMPtrap macro has been added and is intended to supersede SNMPTrap. The latter is now deprecated, but is still available for use. 4) As an alternative to entries in the ecn file, the IPv4 mangle file now supports an ECN target for clearing the ECN flags in the TCP header. See shorewall-mangle(8) for details. 5) The remainder of the documentation has been updated to use the new column headings. 6) Beginning with this release, voluminous CLI output to terminals from 'show' and 'dump' commands may be automatically paged using a program like 'less' or 'more'. The pager program to be used, if any, is specified using the PAGER option in shorewall[6].conf. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 5 ---------------------------------------------------------------------------- 1) Previously, an interface could be erroneously assigned to two different providers and the compiler did not flag that as an error. The compiler now correctly catches this violation. 2) The alignment of the output of the 'shorewall[6] show macros' command has been corrected. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 5 ---------------------------------------------------------------------------- 1) The .ip[6]tables-restore-input file may now include comments which indicate the origin of the rules, similar to the ip[6]tables comments that are generated when TRACK_RULES=Yes in shorewall[6].conf. This additional information is added when TRACK_RULES=File. Note: This change also enhances TRACK_RULES=Yes by adding tracking comments to additional generated ip[6]tables rules. 2) The output of 'shorewall[6] show actions' is now sorted. 3) The macro file headers have been updated to use the new column names. Also, some macros now invoke other macros rather than duplicating their rules. This is intended to ease future maintenance (Tuomo Soini). 4) Additional documentation articles have been updated to use the new column names (Tuomo Soini). ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 4 ---------------------------------------------------------------------------- 1) There previously existed a slight possibility that starting both Shorewall and Shorewall6 simultaneously could lead to a failure such as this one: Dec 18 13:18:35 elmo.example.com shorewall6[1889]: Loading Modules... Dec 18 13:18:38 elmo.example.com shorewall6[1889]: Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Dec 18 13:18:40 elmo.example.com shorewall6[1889]: ERROR: Cannot Create Mangle chain fooX2349 Dec 18 13:18:40 elmo.example.com systemd[1]: shorewall6.service: main process exited, code=exited, status=255/n/a That problem can no longer occur. 2) Previously, when a source- or destination-specific RATE was specified on a logging rule (LOG, ULOG or NFLOG), the compiler incorrectly applied both the specified RATE as well as the global LOGLIMIT. That has been corrected so that only the specified RATE is applied. 3) Previously, when @caller was used within an action body, the compiler would not create unique ip[6]tables chains for each invocation of the action, even though the invocations had different values of @caller. Now, each invocation of such an action creates a separate ip[6]tables chain for each unique caller. 4) Previously, the 'status -i' command produced error output when there were no optional interfaces. That erroneous output is no longer produced. 5) Traffic shaping configurations that use red or codel will now produce consistent compiled scripts. Previously, these configurations could produce equivalent but different scripts on consecutive compilations. 6) Previously, the Shoreall compiler enforced old rules about where country codes could appear. As those restrictions have now been removed, the compiler no longer issues messages such as these: ERROR: A countrycode list may not be used in this context ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 4 ---------------------------------------------------------------------------- 1) Shorewall Init is now supported on OpenWRT. 2) The IPTABLES and IP6TABLES actions in the rules and mangle files can now correctly handle logging targets (LOG, ULOG and NFLOG). Previously, an attempt to use these targets would result in an error similar to: ERROR: LOG requires a level 3) To further reduce the possibility of failures caused by Shorewall and Shorewall6 starting concurrently, a new WAIT_OPTION capability has been implemented. On systems with that capability, all 'iptables' and 'ip6tables' commands will use the --wait option. 4) The .214.service files have been removed and the .service files (with the exception of Debian) have been updated to use the network-pre.target (Tuomo Soini). 5) Shorewall, Shorewall6, Shorewall-lite and Shorewall6-lite now install /etc/sysconfig/ files for specifying start/restart/reload options on those distributions that use /etc/sysconfig. 6) The mangle file now supports an DIVERTHA action that provides support for HAProxy. To setup the HAProxy configuration described at http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x, place this entry in shorewall-providers(5): #NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS TProxy 1 - - lo - tproxy and use this DIVERTHA entry: #ACTION SOURCE DEST PROTO ... DIVERTHA - - tcp ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 3 ---------------------------------------------------------------------------- 1) This release includes defect repair through Shorewall 5.0.2.1. 2) To avoid interference with other subsystem settings, all released shorewall6.conf files now specify IP_FORWARDING=keep. Previously, the settings were inconsistent among the various sample files. 3) This release includes more fixes to the configure, install and uninstall scripts (Matt Darfeuille). 4) Previously, Shorewall6 rejected rules in which the SOURCE contained both an interface name and a MAC address (in Shorewall format). That defect has been corrected so that such rules are now accepted. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 3 ---------------------------------------------------------------------------- 1) The MODULESDIR option in shorewall[6].conf has been extended to allow specification of additional directories to be added to those defaulted by Shorewall. If the specified value begins with "+", then the remainder of the value is assumed to be a colon-separated list of directory names that are relative to /lib/modules/`uname -r`. For example, to load the xt_RTPENGINE module, you would create /etc/shorewall/modules as follows: INCLUDE /usr/share/shorewall/modules loadmodule xt_RTPENGINE You would then set MODULESDIR as: MODULESDIR="+extra/rtpengine" 2) Previously, some of the column headings in the configuration files required two lines to display. For example, in the rules file: #ACTION SOURCE DESTINATION PROTOCOL DEST SOURCE # PORT(S) PORT(S) To use the alternative input format for such two-word columns, a one-word abbreviation was required. For example, DEST PORTS(S) is abbreviated as 'dport' and SOURCE PORT(S) is abbreviated as 'sport'. The two-line column headings are also a nuisance for Emacs users because when the key is struck, Emacs positions the cursor based on the white space in the preceding line. So if an ACTION is typed and the key is then depressed, rather than position the cursor in the SOURCE column, Emacs positions it in the DEST PORT(S) column. To eliminate these issues, the multi-word columns have been relabled to use their abbreviated names. Note that this relabelling does not require modification of existing configurations. It simply means that the sample files released with Shorewall and the manpages that describe column-oriented files now use the abbreviated names rather than the previous names (Tuomo Soini and Tom Eastep). 3) ADD rules may now include a timeout value which will override any timeout that was specified when the related ipset was created. 4) Commas are now allowed in log tags when LOGTAGONLY=Yes. Previously, characters after the first comma in a log tag were discarded when LOGTAGONLY=Yes. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 2 ---------------------------------------------------------------------------- 5.0.2.1 1) When processing the 'dump' command, the CLI now uses 'netstat' to print socket information when the 'ss' utility is not installed. 2) Several defects in the installers/uninstallers have been corrected (Matt Darfeuille). 5.0.2 1) This release includes defect repair up through Shoreall 5.0.1.1. 2) The MSSQL macro now allows UDP port 1434 (Tuomo Soini). 3) A number of issues with param file processing on Cygwin have been corrected. The most serious of these issues was introduction of syntax errors into the generated firewall script. 4) More version numbers have been removed from configuration files and Macros (Tuomo Soini). 5) The check for use of a circular kernel log buffer (as opposed to a log file) has been improved. 6) Previously, HOST=default was accepted by configure[.pl], but the generated shorewallrc file was unusable. Now, HOST=default is equivalent to HOST=linux. 7) Previously, if a circular log buffer was being used, the output of various commands still displayed '/var/log/messages' as the log file. Now, it is displayed as 'logread'. 8) The 'remote-*' commands now return correct exit status. 9) Previously, if LOCKFILE specified a file in a directory other than $VARDIR, and that directory did not exist, it was not created automatically. 10) Previously, optional interfaces were not enabled during 'start' and 'restart' unless there was at least one entry in the 'providers' file. This resulted in these interfaces not appearing in the output of 'shorewall[6] status -i'. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 2 ---------------------------------------------------------------------------- 1) The providers file now supports a 'persistent' option. When specified, this option removes the need to configure host routes to systems used as the 'checkip' in LSM. As part of this change, two other configuration files have changed: a) The 'rtrules' file now allows the rule priority to be followed by an exclaimation mark ("!"). b) An OPTION column has been added to the 'routes' file. The only option currently supported is 'persistent'. The option affects the routing configuration when the provider is disabled: - The provider's routing table still exists and contains the provider's default route. - Unless 'noautosrc' is specified, connections originating from the interfaces IP address(es) are routed via the provider's default gateway. - Routing rules for the provider that specify '!' after the priority are left in place. - 'persistent' routes for the provider are left in place, allowing communication with local networks that are still accessible. 2) It is now possible to replace any function in the CLI libraries except for get_config(). This is accomplished by placing the replacement function(s) in a shell library named 'lib.cli-user' in a directory on the CONFIG_PATH. This allows for customization of commands as well as working around distribution-specific issues. 3) Support for OpenWRT versions BB and later has been added. Included in this support are: - The log display commands (show log, logwatch, etc.) no longer depend on the 'tac' utility (although it will be used if it is installed). - Shorewall-core's 'configure' script detects OpenWRT and accepts HOST=openwrt as an argument. - Shorewall-core, Shorewall-lite and Shoreawll6-lite installers support openwrt. Additionally, those installers no longer depend on the 'install' utility. - Shorewall[6]-lite will use OpenWRT's 'lock' utility to create the LOCKFILE. A special thanks to Matt Darfeuille for his help in making this support possible. 4) Configuration files and extension scripts now have uniform introductory comments (Tuomo Soini). ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 ---------------------------------------------------------------------------- 1) Previously, if statistical load balancing was used in the providers file, the default route in the main table was not deleted during firewall start/restart. That route is now correctly deleted. 2) Certain files in /etc/shorewall[6] previously had permissions 644. Those have been changed to 600 to match the other files in the directories. 3) Previously, the CLI programs did not deal properly with the absense of the 'hostname' utility. Now, if that utility is not present, the programs look for 'uname' and if it is present, they use the 'uname -n' command. If neither 'hostname' nor 'uname' are installed, the programs display 'localhost' as the system name. ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 1 ---------------------------------------------------------------------------- 1) 'second' and 'minute' are now allowed in the LOGLIMIT specification in place of 'sec' and 'min' respectively. This enhancement was present in Shorewall 4.6.13 but was not available in Shoreall 5.0.0. 2) The LEGACY_RESTART option has been superseded by the RESTART option. RESTART may be set as follows: RESTART=reload Causes the 'restart' command to perform the same action as the 'reload' command. This is the default if RESTART is not set. RESTART=restart Causes the 'restart' command to perform a true restart (stop followed by start). If LEGACY_RESTART is present in shorewall[6].conf and RESTART is not, then its setting will govern the behavior of 'restart'. The 'update' command will convert the LEGACY_RESTART setting to the equivalent RESTART setting. ---------------------------------------------------------------------------- P R O B L E M S C O R R E C T E D I N 5 . 0 . 0 ---------------------------------------------------------------------------- 1) This release includes defect repair up through Shorewall 4.6.13.1. 2) The compiled script now uses the %e date format rather than %_d, for Busybox compatibilty. (Erich Titl) ---------------------------------------------------------------------------- N E W F E A T U R E S I N 5 . 0 . 0 ---------------------------------------------------------------------------- 1) To make the command names more accurately reflect what they do, several changes have been included: a) Beginning with this release, the 'restart' command now does a true restart and is equivalent to a 'stop' followed by a 'start'. b) The pre-5.0.0 'load' command has been renamed 'remote_start'. c) The pre-5.0.0 'reload' command has been renamed 'remote_reload'. c) The 'reload' command now performs the same function as the pre-5.0.0 'restart' command. d) A 'remote_restart' command has been added to Shorewall and Shorewall6 to allow a remote 'restart' after updating the remote firewall system's compiled script. 2) For those that can't get used to the idea of using 'reload' in place of 'restart', a LEGACY_RESTART option has been added. The option defaults to No but if set to Yes, then the 'restart' command does what it has always done. 3) It is now possible to limit connections by destination address in the rules file by prefixing the CONNLIMIT setting with 'd:'. 4) While the WORKAROUNDS setting is still present in the shorewall[6].conf files: a) Its default setting has been changed to No. b) All workarounds for old distributions have been eliminated. See the Migration Issues for additional information. 5) A number of configuration options have been eliminated: - EXPORTPARAMS - IPSECFILE - LEGACY_FASTSTART - LOGRATE * - LOGBURST * - WIDE_TC_MARKS * - HIGH_ROUTE_MARKS * - BLACKLISTNEWONLY * A fatal error results if those flagged with an asterisk ("*") appear in the .conf file -- run the 'shorewall[6] update' command to convert their settings to use supported options. A warning is issued if any of the rest appear in the .conf file. 'shorewall[6] update' will drop them from the file. 7) The -b, -D, -r, -s, -t and -n options have been removed from the 'update' command. The command now behaves as if all of those options had been specified. 6) Support has been removed for the 'blacklist', 'tcrules', 'routestopped', 'notrack' and 'tos' files. The 'update' command will: - convert the 'tcrules' and 'tos' files to the equivalent 'mangle' file. - convert the 'blacklist' file into an equivalent 'blrules' file. - convert the routestopped' file into the equivalent 'stoppedrules' file. - convert a 'notrack' file to the equivalent 'conntrack' file. 7) Beginning with this release, all macros and actions are assumed to be FORMAT-2. FORMAT-1 macros and actions are no longer supported and will be silently processed as if they were FORMAT-2. For most macros and actions, this change will be of no concern, but may cause compilation errors in rare cases. 8) Beginning with this release, COMMENT, FORMAT and SECTION lines must begin with a question mark ("?"). The 'update' command makes these changes for you. 9) As an alternative to INLINE_MATCHES=Yes, you may now specify inline matches (raw ip[6]tables text) after a double semicolon (';;'). Example from the 'masq' file to split SNAT between two public addresses on eth1: #INTERFACE SOURCE ADDRESS eth1 - 1.2.3.1 ;; -m statistic --mode random --probability 0.50 eth1 - 1.2.3.2 10) Options in shorewall[6].conf that accept a log level now also allow specification of a log tag. Example: TCP_FLAGS_LOG_LEVEL=info:,tcpflags 11) A PROBABILITY column has been added to the masq file. One usage scenario is to balance SNAT between two or more IP addresses on a WAN interface: #INTERFACE SOURCE ADDRESS eth1 - 1.2.3.4 { probability=0.50 } eth2 - 1.2.3.5 12) Previously, when chain names were included in a 'reset' command, they were assumed to be filter table chains. Now, both a table name and a chain name can be given (e.g., mangle:PREROUTING). The specified table remains the default for the remainder of the command unless a following entry also includes a table name. 13) An action for Gluster FS (action.GlusterFS) has been added. See the action file for a description of the parameters. shorewall-init-5.0.15.6/init.suse.sh0000755000000000000000000000732213062525714015676 0ustar rootroot#! /bin/bash # The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V5.0 # # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] # # (c) 2010,2012 - Tom Eastep (teastep@shorewall.net) # # On most distributions, this file should be called /etc/init.d/shorewall. # # Complete documentation is available at http://shorewall.net # # This program is free software; you can redistribute it and/or modify # it under the terms of Version 2 of the GNU General Public License # as published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # # ### BEGIN INIT INFO # Provides: shorewall-init # Required-Start: $local_fs # Required-Stop: $local_fs # Default-Start: 2 3 5 # Default-Stop: 0 1 6 # Short-Description: Initialize the firewall at boot time # Description: Place the firewall in a safe state at boot time # prior to bringing up the network. ### END INIT INFO #Return values acc. to LSB for all commands but status: # 0 - success # 1 - generic or unspecified error # 2 - invalid or excess argument(s) # 3 - unimplemented feature # 4 - insufficient privilege # 5 - program is not installed # 6 - program is not configured # 7 - program is not running if [ "$(id -u)" != "0" ] then echo "You must be root to start, stop or restart \"Shorewall \"." exit 4 fi # check if shorewall-init is configured or not if [ -f "/etc/sysconfig/shorewall-init" ] then . /etc/sysconfig/shorewall-init if [ -z "$PRODUCTS" ] then echo "No PRODUCTS configured" exit 6 fi else echo "/etc/sysconfig/shorewall-init not found" exit 6 fi # # The installer may alter this # . /usr/share/shorewall/shorewallrc # set the STATEDIR variable setstatedir() { local statedir if [ -f ${CONFDIR}/${PRODUCT}/vardir ]; then statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR ) fi [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT} if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then ${SBINDIR}/$PRODUCT ${OPTIONS} compile -c else return 0 fi } # Initialize the firewall shorewall_start () { local PRODUCT local STATEDIR echo -n "Initializing \"Shorewall-based firewalls\": " for PRODUCT in $PRODUCTS; do if setstatedir; then if [ -x $STATEDIR/firewall ]; then if ! ${SBIN}/$PRODUCT status > /dev/null 2>&1; then $STATEDIR/$PRODUCT/firewall ${OPTIONS} stop fi fi fi done if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then ipset -R < "$SAVE_IPSETS" fi } # Clear the firewall shorewall_stop () { local PRODUCT local STATEDIR echo -n "Clearing \"Shorewall-based firewalls\": " for PRODUCT in $PRODUCTS; do if setstatedir; then if [ -x ${STATEDIR}/firewall ]; then ${STATEDIR}/firewall ${OPTIONS} clear fi fi done if [ -n "$SAVE_IPSETS" ]; then mkdir -p $(dirname "$SAVE_IPSETS") if ipset -S > "${SAVE_IPSETS}.tmp"; then grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" fi fi } case "$1" in start) shorewall_start ;; stop) shorewall_stop ;; reload|forced-reload) ;; *) echo "Usage: /etc/init.d/shorewall-init {start|stop}" exit 1 ;; esac exit 0 shorewall-init-5.0.15.6/ifupdown.suse.sh0000644000000000000000000000546313062525714016567 0ustar rootroot#!/bin/sh # # SuSE ifupdown script for Shorewall-based products # # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] # # (c) 2010,2013 - Tom Eastep (teastep@shorewall.net) # # Shorewall documentation is available at http://shorewall.net # # This program is free software; you can redistribute it and/or modify # it under the terms of Version 2 of the GNU General Public License # as published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # setstatedir() { local statedir if [ -f ${CONFDIR}/${PRODUCT}/vardir ]; then statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR ) fi [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT} if [ ! -x $STATEDIR/firewall ]; then if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then ${SBINDIR}/$PRODUCT compile fi fi } SuSE_ppp() { NEWPRODUCTS= INTERFACE="$1" case $0 in /etc/ppp/ip-*) # # IPv4 # for product in $PRODUCTS; do case $product in shorewall|shorewall-lite) NEWPRODUCTS="$NEWPRODUCTS $product"; ;; esac done ;; /etc/ppp/ipv6-*) # # IPv6 # for product in $PRODUCTS; do case $product in shorewall6|shorewall6-lite) NEWPRODUCTS="$NEWPRODUCTS $product"; ;; esac done ;; *) exit 0 ;; esac PRODUCTS="$NEWPRODUCTS" case $0 in *up/*) COMMAND=up ;; *) COMMAND=down ;; esac } IFUPDOWN=0 PRODUCTS= # # The installer may alter this # . /usr/share/shorewall/shorewallrc if [ -f /etc/default/shorewall-init ]; then . /etc/default/shorewall-init elif [ -f /etc/sysconfig/shorewall-init ]; then . /etc/sysconfig/shorewall-init fi [ "$IFUPDOWN" = 1 -a -n "$PRODUCTS" ] || exit 0 PHASE='' case $0 in /etc/ppp*) # # SUSE ppp # SuSE_ppp ;; *) # # SuSE ifupdown system # INTERFACE="$2" case $0 in *dispatcher.d*) INTERFACE="$1" COMMAND="$2" ;; *if-up.d*) COMMAND=up ;; *if-down.d*) COMMAND=down ;; *) exit 0 ;; esac ;; esac [ -n "$LOGFILE" ] || LOGFILE=/dev/null for PRODUCT in $PRODUCTS; do setstatedir if [ -x $VARLIB/$PRODUCT/firewall ]; then ( ${VARLIB}/$PRODUCT/firewall -V0 $COMMAND $INTERFACE >> $LOGFILE 2>&1 ) || true fi done exit 0 shorewall-init-5.0.15.6/shorewall-init.service.debian0000644000000000000000000000075613062525714021166 0ustar rootroot# # The Shoreline Firewall (Shorewall) Packet Filtering Firewall # # Copyright 2011 Jonathan Underwood # Copyright 2015 Tom Eastep # [Unit] Description=Shorewall firewall (bootup security) Before=network.target [Service] Type=oneshot RemainAfterExit=yes EnvironmentFile=-/etc/default/shorewall-init StandardOutput=syslog ExecStart=/sbin/shorewall-init start ExecStop=/sbin/shorewall-init stop [Install] WantedBy=basic.target shorewall-init-5.0.15.6/shorewallrc.cygwin0000644000000000000000000000237413062527166017172 0ustar rootroot# # Cygwin Shorewall 5.0 rc file # BUILD=cygwin HOST=cygwin PREFIX=/usr #Top-level directory for shared files, libraries, etc. SHAREDIR=${PREFIX}/share #Directory for arch-neutral files. LIBEXECDIR=${PREFIX}/share #Directory for executable scripts. PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory CONFDIR=/etc #Directory where subsystem configurations are installed SBINDIR=/bin #Directory where system administration programs are installed MANDIR=${SHAREDIR}/man #Directory where manpages are installed. INITDIR=/etc/init.d #Unused on Cygwin INITFILE= #Unused on Cygwin INITSOURCE= #Unused on Cygwin ANNOTATED= #Unused on Cygwin SERVICEDIR= #Unused on Cygwin SERVICEFILE= #Unused on Cygwin SYSCONFDIR= #Unused on Cygwin SPARSE=Yes #Only install $PRODUCT/$PRODUCT.conf in $CONFDIR. VARLIB=/var/lib #Unused on Cygwin DEFAULT_PAGER= #Pager to use if none specified in shorewall[6].conf shorewall-init-5.0.15.6/init.debian.sh0000755000000000000000000001024013062525714016132 0ustar rootroot#!/bin/sh # # The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V5.0 # # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] # # (c) 2010,2012 - Tom Eastep (teastep@shorewall.net) # # On most distributions, this file should be called /etc/init.d/shorewall. # # Complete documentation is available at http://shorewall.net # # This program is free software; you can redistribute it and/or modify # it under the terms of Version 2 of the GNU General Public License # as published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # ### BEGIN INIT INFO # Provides: shorewall-init # Required-Start: $local_fs # X-Start-Before: $network # Required-Stop: $local_fs # X-Stop-After: $network # Default-Start: S # Default-Stop: 0 1 6 # Short-Description: Initialize the firewall at boot time # Description: Place the firewall in a safe state at boot time prior to # bringing up the network ### END INIT INFO . /lib/lsb/init-functions export VERBOSITY=0 if [ "$(id -u)" != "0" ] then echo "You must be root to start, stop or restart \"Shorewall \"." exit 1 fi echo_notdone () { echo "not done." exit 1 } not_configured () { echo "#### WARNING ####" echo "the firewall won't be initialized unless it is configured" if [ "$1" != "stop" ] then echo "" echo "Please read about Debian specific customization in" echo "/usr/share/doc/shorewall-init/README.Debian.gz." fi echo "#################" exit 0 } # set the STATEDIR variable setstatedir() { local statedir if [ -f ${CONFDIR}/${PRODUCT}/vardir ]; then statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR ) fi [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT} if [ $PRODUCT = shorewall -o $PRODUCT = shorewall6 ]; then ${SBINDIR}/$PRODUCT ${OPTIONS} compile -c else return 0 fi } # # The installer may alter this # . /usr/share/shorewall/shorewallrc # check if shorewall-init is configured or not if [ -f "$SYSCONFDIR/shorewall-init" ] then . $SYSCONFDIR/shorewall-init if [ -z "$PRODUCTS" ] then not_configured fi else not_configured fi # Initialize the firewall shorewall_start () { local PRODUCT local STATEDIR echo -n "Initializing \"Shorewall-based firewalls\": " for PRODUCT in $PRODUCTS; do if setstatedir; then if [ -x ${STATEDIR}/firewall ]; then # # Run in a sub-shell to avoid name collisions # ( if ! ${STATEDIR}/firewall status > /dev/null 2>&1; then ${STATEDIR}/firewall ${OPTIONS} stop fi ) fi fi done echo "done." if [ -n "$SAVE_IPSETS" -a -f "$SAVE_IPSETS" ]; then echo -n "Restoring ipsets: " if ! ipset -R < "$SAVE_IPSETS"; then echo_notdone fi echo "done." fi return 0 } # Clear the firewall shorewall_stop () { local PRODUCT local STATEDIR echo -n "Clearing \"Shorewall-based firewalls\": " for PRODUCT in $PRODUCTS; do if setstatedir; then if [ -x ${STATEDIR}/firewall ]; then ${STATEDIR}/firewall ${OPTIONS} clear fi fi done echo "done." if [ -n "$SAVE_IPSETS" ]; then echo "Saving ipsets: " mkdir -p $(dirname "$SAVE_IPSETS") if ipset -S > "${SAVE_IPSETS}.tmp"; then grep -qE -- '^(-N|create )' "${SAVE_IPSETS}.tmp" && mv -f "${SAVE_IPSETS}.tmp" "$SAVE_IPSETS" else echo_notdone fi echo "done." fi return 0 } case "$1" in start) shorewall_start ;; stop) shorewall_stop ;; reload|force-reload) ;; *) echo "Usage: $0 {start|stop|reload|force-reload}" exit 1 esac exit 0 shorewall-init-5.0.15.6/ifupdown.fedora.sh0000644000000000000000000000471113062525714017043 0ustar rootroot#!/bin/sh # # Redhat/Fedora/Centos/Foobar ifupdown script for Shorewall-based products # # This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt] # # (c) 2010,2013 - Tom Eastep (teastep@shorewall.net) # # Shorewall documentation is available at http://shorewall.net # # This program is free software; you can redistribute it and/or modify # it under the terms of Version 2 of the GNU General Public License # as published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # # Get startup options (override default) OPTIONS= setstatedir() { local statedir if [ -f ${CONFDIR}/${PRODUCT}/vardir ]; then statedir=$( . /${CONFDIR}/${PRODUCT}/vardir && echo $VARDIR ) fi [ -n "$statedir" ] && STATEDIR=${statedir} || STATEDIR=${VARLIB}/${PRODUCT} if [ ! -x "$STATEDIR/firewall" ]; then if [ $PRODUCT == shorewall -o $PRODUCT == shorewall6 ]; then ${SBINDIR}/$PRODUCT $OPTIONS compile fi fi } IFUPDOWN=0 PRODUCTS= # # The installer may alter this # . /usr/share/shorewall/shorewallrc if [ -f /etc/default/shorewall-init ]; then . /etc/default/shorewall-init elif [ -f /etc/sysconfig/shorewall-init ]; then . /etc/sysconfig/shorewall-init fi [ "$IFUPDOWN" = 1 -a -n "$PRODUCTS" ] || exit 0 PHASE='' case $0 in /etc/ppp*) INTERFACE="$1" case $0 in *ip-up.local) COMMAND=up ;; *ip-down.local) COMMAND=down ;; *) exit 0 ;; esac ;; *) # # RedHat ifup/down system # INTERFACE="$1" case $0 in *ifup*) COMMAND=up ;; *ifdown*) COMMAND=down ;; *dispatcher.d*) COMMAND="$2" ;; *) exit 0 ;; esac ;; esac [ -n "$LOGFILE" ] || LOGFILE=/dev/null for PRODUCT in $PRODUCTS; do setstatedir if [ -x "$STATEDIR/firewall" ]; then echo "`date --rfc-3339=seconds` $0: Executing $STATEDIR/firewall $OPTIONS $COMMAND $INTERFACE" >> $LOGFILE 2>&1 ( $STATEDIR/firewall $OPTIONS $COMMAND $INTERFACE >> $LOGFILE 2>&1 ) || true fi done exit 0 shorewall-init-5.0.15.6/configure0000755000000000000000000001223313062527166015325 0ustar rootroot#!/bin/bash # # Shorewall Packet Filtering Firewall RPM configuration program - V4.6 # # (c) 2012,2014 - Tom Eastep (teastep@shorewall.net) # # Shorewall documentation is available at http://www.shorewall.net # # This program is part of Shorewall. # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by the # Free Software Foundation, either version 2 of the license or, at your # option, any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, see . # # Usage: ./configure [