shorewall-lite-5.0.15.6/ 0000755 0000000 0000000 00000000000 13062527166 013407 5 ustar root root shorewall-lite-5.0.15.6/shorecap 0000755 0000000 0000000 00000005006 13062525714 015137 0 ustar root root #!/bin/sh
#
# Shorewall Lite Packet Filtering Firewall Capabilities Detector
#
# (c) 2006,2007,2008,2009,2010,2014 - Tom Eastep (teastep@shorewall.net)
#
# This file should be placed in /sbin/shorewall.
#
# Shorewall documentation is available at http://shorewall.sourceforge.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see ] [ MODULESDIR= ] [ MODULE_SUFFIX="" ] shorecap > capabilities
#
# Now move the capabilities file to the compilation system. The file must
# be placed in a directory on the CONFIG_PATH to be used when compiling firewalls
# for the target system.
#
# Default values for the two variables are:
#
# IPTABLES - iptables
# MODULESDIR - /lib/modules/$(uname -r)/kernel/net/ipv4/netfilter
# MODULE_SUFFIX - "o gz xz ko o.gz o.xz ko.gz ko.xz"
#
# Shorewall need not be installed on the target system to run shorecap. If the '-e' flag is
# used during firewall compilation, then the generated firewall program will likewise not
# require Shorewall to be installed.
g_program=shorewall-lite
#
# This is modified by the installer when ${SHAREDIR} != /usr/share
#
. /usr/share/shorewall/shorewallrc
g_sharedir="$SHAREDIR"/shorewall-lite
g_confdir="$CONFDIR"/shorewall-lite
g_readrc=1
. ${SHAREDIR}/shorewall/lib.cli
. /usr/share/shorewall-lite/configpath
[ -n "$PATH" ] || PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin:/usr/local/sbin
SHOREWALL_VERSION=$(cat /usr/share/shorewall-lite/version)
[ -n "$IPTABLES" ] || IPTABLES=$(mywhich iptables)
g_tool=$IPTABLES
VERBOSITY=0
load_kernel_modules No
determine_capabilities
report_capabilities1
shorewall-lite-5.0.15.6/shorewallrc.redhat 0000644 0000000 0000000 00000003601 13062527166 017125 0 ustar root root #
# RedHat/FedoraShorewall 5.0 rc file
#
BUILD= #Default is to detect the build system
HOST=redhat
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/libexec #Directory for executable scripts.
PERLLIBDIR=/usr/share/perl5/vendor_perl #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/sbin #Directory where system administration programs are installed
MANDIR=${SHAREDIR}/man #Directory where manpages are installed.
INITDIR=/etc/rc.d/init.d #Directory where SysV init scripts are installed.
INITFILE=$PRODUCT #Name of the product's installed SysV init script
INITSOURCE=init.fedora.sh #Name of the distributed file to be installed as the SysV init script
ANNOTATED= #If non-zero, annotated configuration files are installed
SERVICEDIR=/lib/systemd/system #Directory where .service files are installed (systems running systemd only)
SYSCONFFILE=sysconfig #Name of the distributed file to be installed as $SYSCONFDIR/$PRODUCT
SERVICEFILE= #Name of the file to install in $SYSTEMD. Default is $PRODUCT.service
SYSCONFDIR=/etc/sysconfig/ #Directory where SysV init parameter files are installed
SPARSE= #If non-empty, only install $PRODUCT/$PRODUCT.conf in $CONFDIR
VARLIB=/var/lib #Directory where product variable data is stored.
VARDIR=${VARLIB}/$PRODUCT #Directory where product variable data is stored.
DEFAULT_PAGER= #Pager to use if none specified in shorewall[6].conf
shorewall-lite-5.0.15.6/modules.tc 0000644 0000000 0000000 00000001324 13062527166 015407 0 ustar root root #
# Shorewall -- /usr/share/shorewall/modules.tc
#
# Traffic Shaping Modules File
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
loadmodule sch_sfq
loadmodule sch_ingress
loadmodule sch_hfsc
loadmodule sch_htb
loadmodule sch_prio
loadmodule sch_tbf
loadmodule sch_fq_codel
loadmodule cls_u32
loadmodule cls_fw
loadmodule cls_flow
loadmodule cls_basic
loadmodule act_police
shorewall-lite-5.0.15.6/COPYING 0000644 0000000 0000000 00000043135 13062525714 014445 0 ustar root root GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor,
Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
Copyright (C) 19yy
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) 19yy name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.
shorewall-lite-5.0.15.6/sysconfig 0000644 0000000 0000000 00000000331 13062525714 015330 0 ustar root root #
# Global start/restart/reload/stop options
#
OPTIONS=""
#
# Start options
#
STARTOPTIONS=""
#
# Restart options
#
RESTARTOPTIONS=""
#
# Reload options
#
RELOADOPTIONS=""
#
# Stop options
#
STOPOPTIONS=""
# EOF
shorewall-lite-5.0.15.6/uninstall.sh 0000755 0000000 0000000 00000011005 13062527166 015754 0 ustar root root #!/bin/sh
#
# Script to back uninstall Shoreline Firewall
#
# (c) 2000-2016 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://shorewall.sourceforge.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see ] [ ]"
echo "where is one of"
echo " -h"
echo " -v"
echo " -n"
exit $1
}
fatal_error()
{
echo " ERROR: $@" >&2
exit 1
}
qt()
{
"$@" >/dev/null 2>&1
}
split() {
local ifs
ifs=$IFS
IFS=:
set -- $1
echo $*
IFS=$ifs
}
mywhich() {
local dir
for dir in $(split $PATH); do
if [ -x $dir/$1 ]; then
return 0
fi
done
return 2
}
remove_file() # $1 = file to restore
{
if [ -f $1 -o -L $1 ] ; then
rm -f $1
echo "$1 Removed"
fi
}
finished=0
configure=1
while [ $finished -eq 0 ]; do
option=$1
case "$option" in
-*)
option=${option#-}
while [ -n "$option" ]; do
case $option in
h)
usage 0
;;
v)
echo "$Product Firewall Installer Version $VERSION"
exit 0
;;
n*)
configure=0
option=${option#n}
;;
*)
usage 1
;;
esac
done
shift
;;
*)
finished=1
;;
esac
done
#
# Read the RC file
#
if [ $# -eq 0 ]; then
if [ -f ./shorewallrc ]; then
. ./shorewallrc
elif [ -f ~/.shorewallrc ]; then
. ~/.shorewallrc || exit 1
file=./.shorewallrc
elif [ -f /usr/share/shorewall/shorewallrc ]; then
. /usr/share/shorewall/shorewallrc
else
fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
fi
elif [ $# -eq 1 ]; then
file=$1
case $file in
/*|.*)
;;
*)
file=./$file
;;
esac
. $file
else
usage 1
fi
if [ -f ${SHAREDIR}/shorewall-lite/version ]; then
INSTALLED_VERSION="$(cat ${SHAREDIR}/shorewall-lite/version)"
if [ "$INSTALLED_VERSION" != "$VERSION" ]; then
echo "WARNING: Shorewall Lite Version $INSTALLED_VERSION is installed"
echo " and this is the $VERSION uninstaller."
VERSION="$INSTALLED_VERSION"
fi
else
echo "WARNING: Shorewall Lite Version $VERSION is not installed"
VERSION=""
fi
echo "Uninstalling Shorewall Lite $VERSION"
[ -n "$SANDBOX" ] && configure=0
if [ $configure -eq 1 ]; then
if qt iptables -L shorewall -n && [ ! -f ${SBINDIR}/shorewall ]; then
shorewall-lite clear
fi
fi
if [ -L ${SHAREDIR}/shorewall-lite/init ]; then
if [ $HOST = openwrt ]; then
if [ $configure -eq 1 ] && /etc/init.d/shorewall-lite enabled; then
/etc/init.d/shorewall-lite disable
fi
FIREWALL=$(readlink ${SHAREDIR}/shorewall-lite/init)
else
FIREWALL=$(readlink -m -q ${SHAREDIR}/shorewall-lite/init)
fi
elif [ -n "$INITFILE" ]; then
FIREWALL=${INITDIR}/${INITFILE}
fi
if [ -f "$FIREWALL" ]; then
if [ $configure -eq 1 ]; then
if mywhich updaterc.d ; then
updaterc.d shorewall-lite remove
elif mywhich insserv ; then
insserv -r $FIREWALL
elif mywhich chkconfig ; then
chkconfig --del $(basename $FIREWALL)
fi
fi
remove_file $FIREWALL
fi
[ -z "$SERVICEDIR" ] && SERVICEDIR="$SYSTEMD"
if [ -n "$SERVICEDIR" ]; then
[ $configure -eq 1 ] && systemctl disable ${PRODUCT}
rm -f $SERVICEDIR/shorewall-lite.service
fi
rm -f ${SBINDIR}/shorewall-lite
rm -rf ${CONFDIR}/shorewall-lite
rm -rf ${VARDIR}
rm -rf ${SHAREDIR}/shorewall-lite
rm -rf ${LIBEXECDIR}/shorewall-lite
rm -f ${CONFDIR}/logrotate.d/shorewall-lite
rm -f ${SYSCONFDIR}/shorewall-lite
if [ -n "${MANDIR}" ]; then
rm -f ${MANDIR}/man5/shorewall-lite*
rm -f ${MANDIR}/man8/shorewall-lite*
fi
echo "Shorewall Lite Uninstalled"
shorewall-lite-5.0.15.6/configpath 0000644 0000000 0000000 00000000266 13062525714 015455 0 ustar root root #
# Shorewall Lite version 5 - Default Config Path
#
# /usr/share/shorewall-lite/configpath
#
CONFIG_PATH=${CONFDIR}/shorewall-lite:${SHAREDIR}/shorewall-lite:${SHAREDIR}/shorewall
shorewall-lite-5.0.15.6/init.openwrt.sh 0000755 0000000 0000000 00000005404 13062525714 016406 0 ustar root root #!/bin/sh /etc/rc.common
#
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
#
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012,2014 - Tom Eastep (teastep@shorewall.net)
# (c) 2015 - Matt Darfeuille - (matdarf@gmail.com)
#
# On most distributions, this file should be called /etc/init.d/shorewall.
#
# Complete documentation is available at http://shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see ]"
echo " $ME -v"
echo " $ME -h"
echo " $ME -n"
exit $1
}
fatal_error()
{
echo " ERROR: $@" >&2
exit 1
}
split() {
local ifs
ifs=$IFS
IFS=:
set -- $1
echo $*
IFS=$ifs
}
qt()
{
"$@" >/dev/null 2>&1
}
mywhich() {
local dir
for dir in $(split $PATH); do
if [ -x $dir/$1 ]; then
echo $dir/$1
return 0
fi
done
return 2
}
cant_autostart()
{
echo
echo "WARNING: Unable to configure $Product to start automatically at boot" >&2
}
delete_file() # $1 = file to delete
{
rm -f $1
}
install_file() # $1 = source $2 = target $3 = mode
{
if cp -f $1 $2; then
if chmod $3 $2; then
if [ -n "$OWNER" ]; then
if chown $OWNER:$GROUP $2; then
return
fi
else
return 0
fi
fi
fi
echo "ERROR: Failed to install $2" >&2
exit 1
}
make_directory() # $1 = directory , $2 = mode
{
mkdir -p $1
chmod 755 $1
[ -n "$OWNERSHIP" ] && chown $OWNERSHIP $1
}
require()
{
eval [ -n "\$$1" ] || fatal_error "Required option $1 not set"
}
#
# Change to the directory containing this script
#
cd "$(dirname $0)"
if [ -f shorewall-lite ]; then
PRODUCT=shorewall-lite
Product="Shorewall Lite"
else
PRODUCT=shorewall6-lite
Product="Shorewall6 Lite"
fi
#
# Parse the run line
#
finished=0
configure=1
while [ $finished -eq 0 ] ; do
option=$1
case "$option" in
-*)
option=${option#-}
while [ -n "$option" ]; do
case $option in
h)
usage 0
;;
v)
echo "$Product Firewall Installer Version $VERSION"
exit 0
;;
n*)
configure=0
option=${option#n}
;;
*)
usage 1
;;
esac
done
shift
;;
*)
finished=1
;;
esac
done
#
# Read the RC file
#
if [ $# -eq 0 ]; then
if [ -f ./shorewallrc ]; then
. ./shorewallrc || exit 1
file=./shorewallrc
elif [ -f ~/.shorewallrc ]; then
. ~/.shorewallrc
elif [ -f /usr/share/shorewall/shorewallrc ]; then
. /usr/share/shorewall/shorewallrc
else
fatal_error "No configuration file specified and /usr/share/shorewall/shorewallrc not found"
fi
elif [ $# -eq 1 ]; then
file=$1
case $file in
/*|.*)
;;
*)
file=./$file
;;
esac
. $file
else
usage 1
fi
if [ -z "${VARLIB}" ]; then
VARLIB=${VARDIR}
VARDIR=${VARLIB}/${PRODUCT}
elif [ -z "${VARDIR}" ]; then
VARDIR=${VARLIB}/${PRODUCT}
fi
for var in SHAREDIR LIBEXECDIR CONFDIR SBINDIR VARLIB VARDIR; do
require $var
done
[ -n "${INITFILE}" ] && require INITSOURCE && require INITDIR
PATH=${SBINDIR}:/bin:/usr${SBINDIR}:/usr/bin:/usr/local/bin:/usr/local${SBINDIR}
[ -n "$SANDBOX" ] && configure=0
#
# Determine where to install the firewall script
#
cygwin=
if [ -z "$BUILD" ]; then
case $(uname) in
cygwin*|CYGWIN*)
BUILD=cygwin
;;
Darwin)
BUILD=apple
;;
*)
if [ -f /etc/os-release ]; then
eval $(cat /etc/os-release | grep ^ID)
case $ID in
fedora|rhel|centos|foobar)
BUILD=redhat
;;
debian)
BUILD=debian
;;
gentoo)
BUILD=gentoo
;;
opensuse)
BUILD=suse
;;
*)
BUILD="$ID"
;;
esac
elif [ -f ${CONFDIR}/debian_version ]; then
BUILD=debian
elif [ -f /etc/gentoo-release ]; then
BUILD=gentoo
elif [ -f ${CONFDIR}/redhat-release ]; then
BUILD=redhat
elif [ -f ${CONFDIR}/SuSE-release ]; then
BUILD=suse
elif [ -f ${CONFDIR}/slackware-version ] ; then
BUILD=slackware
elif [ -f ${CONFDIR}/arch-release ] ; then
BUILD=archlinux
elif [ -f ${CONFDIR}/openwrt_release ]; then
BUILD=openwrt
else
BUILD=linux
fi
;;
esac
fi
case $BUILD in
cygwin*|CYGWIN*)
OWNER=$(id -un)
GROUP=$(id -gn)
;;
apple)
[ -z "$OWNER" ] && OWNER=root
[ -z "$GROUP" ] && GROUP=wheel
;;
*)
if [ $(id -u) -eq 0 ]; then
[ -z "$OWNER" ] && OWNER=root
[ -z "$GROUP" ] && GROUP=root
fi
;;
esac
[ -n "$OWNER" ] && OWNERSHIP="$OWNER:$GROUP"
[ -n "$HOST" ] || HOST=$BUILD
case "$HOST" in
cygwin)
echo "$PRODUCT is not supported on Cygwin" >&2
exit 1
;;
apple)
echo "$PRODUCT is not supported on OS X" >&2
exit 1
;;
debian)
echo "Installing Debian-specific configuration..."
;;
gentoo)
echo "Installing Gentoo-specific configuration..."
;;
redhat)
echo "Installing Redhat/Fedora-specific configuration..."
;;
slackware)
echo "Installing Slackware-specific configuration..."
;;
archlinux)
echo "Installing ArchLinux-specific configuration..."
;;
suse)
echo "Installing Suse-specific configuration..."
;;
openwrt)
echo "Installing OpenWRT-specific configuration..."
;;
linux)
;;
*)
echo "ERROR: Unknown HOST \"$HOST\"" >&2
exit 1;
;;
esac
[ -z "$INITDIR" ] && INITDIR="${CONFDIR}/init.d"
if [ -n "$DESTDIR" ]; then
if [ `id -u` != 0 ] ; then
echo "Not setting file owner/group permissions, not running as root."
OWNERSHIP=""
fi
make_directory ${DESTDIR}${SBINDIR} 755
make_directory ${DESTDIR}${INITDIR} 755
else
if [ ! -f ${SHAREDIR}/shorewall/coreversion ]; then
echo "$PRODUCT $VERSION requires Shorewall Core which does not appear to be installed" >&2
exit 1
fi
fi
echo "Installing $Product Version $VERSION"
#
# Check for ${CONFDIR}/$PRODUCT
#
if [ -z "$DESTDIR" -a -d ${CONFDIR}/$PRODUCT ]; then
if [ ! -f ${SHAREDIR}/shorewall/coreversion ]; then
echo "$PRODUCT $VERSION requires Shorewall Core which does not appear to be installed" >&2
exit 1
fi
[ -f ${CONFDIR}/$PRODUCT/shorewall.conf ] && \
mv -f ${CONFDIR}/$PRODUCT/shorewall.conf ${CONFDIR}/$PRODUCT/$PRODUCT.conf
else
rm -rf ${DESTDIR}${CONFDIR}/$PRODUCT
rm -rf ${DESTDIR}${SHAREDIR}/$PRODUCT
rm -rf ${DESTDIR}${VARDIR}
[ "$LIBEXECDIR" = /usr/share ] || rm -rf ${DESTDIR}/usr/share/$PRODUCT/wait4ifup ${DESTDIR}/usr/share/$PRODUCT/shorecap
fi
#
# Check for ${SBINDIR}/$PRODUCT
#
if [ -f ${DESTDIR}${SBINDIR}/$PRODUCT ]; then
first_install=""
else
first_install="Yes"
fi
delete_file ${DESTDIR}/usr/share/$PRODUCT/xmodules
install_file $PRODUCT ${DESTDIR}${SBINDIR}/$PRODUCT 0544
[ -n "${INITFILE}" ] && make_directory ${DESTDIR}${INITDIR} 755
echo "$Product control program installed in ${DESTDIR}${SBINDIR}/$PRODUCT"
#
# Create ${CONFDIR}/$PRODUCT, /usr/share/$PRODUCT and /var/lib/$PRODUCT if needed
#
mkdir -p ${DESTDIR}${CONFDIR}/$PRODUCT
mkdir -p ${DESTDIR}${SHAREDIR}/$PRODUCT
mkdir -p ${DESTDIR}${LIBEXECDIR}/$PRODUCT
mkdir -p ${DESTDIR}${VARDIR}
chmod 755 ${DESTDIR}${CONFDIR}/$PRODUCT
chmod 755 ${DESTDIR}${SHAREDIR}/$PRODUCT
if [ -n "$DESTDIR" ]; then
mkdir -p ${DESTDIR}${CONFDIR}/logrotate.d
chmod 755 ${DESTDIR}${CONFDIR}/logrotate.d
mkdir -p ${DESTDIR}${INITDIR}
chmod 755 ${DESTDIR}${INITDIR}
fi
if [ -n "$INITFILE" ]; then
if [ -f "${INITSOURCE}" ]; then
initfile="${DESTDIR}${INITDIR}/${INITFILE}"
install_file ${INITSOURCE} "$initfile" 0544
[ "${SHAREDIR}" = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' "$initfile"
echo "SysV init script $INITSOURCE installed in $initfile"
fi
fi
#
# Install the .service file
#
if [ -z "${SERVICEDIR}" ]; then
SERVICEDIR="$SYSTEMD"
fi
if [ -n "$SERVICEDIR" ]; then
mkdir -p ${DESTDIR}${SERVICEDIR}
[ -z "$SERVICEFILE" ] && SERVICEFILE=$PRODUCT.service
install_file $SERVICEFILE ${DESTDIR}${SERVICEDIR}/$PRODUCT.service 644
[ ${SBINDIR} != /sbin ] && eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${SERVICEDIR}/$PRODUCT.service
echo "Service file $SERVICEFILE installed as ${DESTDIR}${SERVICEDIR}/$PRODUCT.service"
fi
#
# Install the config file
#
if [ ! -f ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf ]; then
install_file $PRODUCT.conf ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf 0744
echo "Config file installed as ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf"
fi
if [ $HOST = archlinux ] ; then
sed -e 's!LOGFILE=/var/log/messages!LOGFILE=/var/log/messages.log!' -i ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf
elif [ $HOST = gentoo ]; then
# Adjust SUBSYSLOCK path (see https://bugs.gentoo.org/show_bug.cgi?id=459316)
perl -p -w -i -e "s|^SUBSYSLOCK=.*|SUBSYSLOCK=/run/lock/$PRODUCT|;" ${DESTDIR}${CONFDIR}/$PRODUCT/$PRODUCT.conf
fi
#
# Install the Makefile
#
install_file Makefile ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile 0600
[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile
[ $SBINDIR = /sbin ] || eval sed -i \'s\|/sbin/\|${SBINDIR}/\|\' ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile
echo "Makefile installed as ${DESTDIR}${CONFDIR}/$PRODUCT/Makefile"
#
# Install the default config path file
#
install_file configpath ${DESTDIR}${SHAREDIR}/$PRODUCT/configpath 0644
echo "Default config path file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/configpath"
#
# Install the libraries
#
for f in lib.* ; do
if [ -f $f ]; then
install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 0644
echo "Library ${f#*.} file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
fi
done
ln -sf lib.base ${DESTDIR}${SHAREDIR}/$PRODUCT/functions
echo "Common functions linked through ${DESTDIR}${SHAREDIR}/$PRODUCT/functions"
#
# Install Shorecap
#
install_file shorecap ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap 0755
[ $SHAREDIR = /usr/share ] || eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap
echo
echo "Capability file builder installed in ${DESTDIR}${LIBEXECDIR}/$PRODUCT/shorecap"
#
# Install the Modules files
#
if [ -f modules ]; then
install_file modules ${DESTDIR}${SHAREDIR}/$PRODUCT/modules 0600
echo "Modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/modules"
fi
if [ -f helpers ]; then
install_file helpers ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers 600
echo "Helper modules file installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/helpers"
fi
for f in modules.*; do
install_file $f ${DESTDIR}${SHAREDIR}/$PRODUCT/$f 644
echo "Module file $f installed as ${DESTDIR}${SHAREDIR}/$PRODUCT/$f"
done
#
# Install the Man Pages
#
if [ -d manpages -a -n "$MANDIR" ]; then
cd manpages
mkdir -p ${DESTDIR}${MANDIR}/man5/ ${DESTDIR}${MANDIR}/man8/
for f in *.5; do
gzip -c $f > $f.gz
install_file $f.gz ${DESTDIR}${MANDIR}/man5/$f.gz 644
echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man5/$f.gz"
done
for f in *.8; do
gzip -c $f > $f.gz
install_file $f.gz ${DESTDIR}${MANDIR}/man8/$f.gz 644
echo "Man page $f.gz installed to ${DESTDIR}${MANDIR}/man8/$f.gz"
done
cd ..
echo "Man Pages Installed"
fi
if [ -d ${DESTDIR}${CONFDIR}/logrotate.d ]; then
install_file logrotate ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT 644
echo "Logrotate file installed as ${DESTDIR}${CONFDIR}/logrotate.d/$PRODUCT"
fi
#
# Create the version file
#
echo "$VERSION" > ${DESTDIR}${SHAREDIR}/$PRODUCT/version
chmod 644 ${DESTDIR}${SHAREDIR}/$PRODUCT/version
#
# Remove and create the symbolic link to the init script
#
if [ -z "${DESTDIR}" -a -n "${INITFILE}" ]; then
rm -f ${SHAREDIR}/$PRODUCT/init
ln -s ${INITDIR}/${INITFILE} ${SHAREDIR}/$PRODUCT/init
fi
delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/lib.common
delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/lib.cli
delete_file ${DESTDIR}${SHAREDIR}/$PRODUCT/wait4ifup
#
# Note -- not all packages will have the SYSCONFFILE so we need to check for its existance here
#
if [ -n "$SYSCONFFILE" -a -f "$SYSCONFFILE" -a ! -f ${DESTDIR}${SYSCONFDIR}/${PRODUCT} ]; then
if [ ${DESTDIR} ]; then
mkdir -p ${DESTDIR}${SYSCONFDIR}
chmod 755 ${DESTDIR}${SYSCONFDIR}
fi
install_file ${SYSCONFFILE} ${DESTDIR}${SYSCONFDIR}/${PRODUCT} 0640
echo "$SYSCONFFILE file installed in ${DESTDIR}${SYSCONFDIR}/${PRODUCT}"
fi
if [ ${SHAREDIR} != /usr/share ]; then
eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SHAREDIR}/${PRODUCT}/lib.base
eval sed -i \'s\|/usr/share/\|${SHAREDIR}/\|\' ${DESTDIR}${SBINDIR}/$PRODUCT
fi
if [ $configure -eq 1 -a -z "$DESTDIR" -a -n "$first_install" -a -z "${cygwin}${mac}" ]; then
if [ -n "$SERVICEDIR" ]; then
if systemctl enable ${PRODUCT}.service; then
echo "$Product will start automatically at boot"
fi
elif mywhich insserv; then
if insserv ${INITDIR}/${INITFILE} ; then
echo "$PRODUCT will start automatically at boot"
if [ $HOST = debian ]; then
echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
touch /var/log/$PRODUCT-init.log
perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
else
echo "Set STARTUP_ENABLED=Yes in ${CONFDIR}/$PRODUCT/$PRODUCT.conf to enable"
fi
else
cant_autostart
fi
elif mywhich chkconfig; then
if chkconfig --add $PRODUCT ; then
echo "$PRODUCT will start automatically in run levels as follows:"
echo "Set STARTUP_ENABLED=Yes in ${CONFDIR}/$PRODUCT/${PRODUCT}.conf to enable"
chkconfig --list $PRODUCT
else
cant_autostart
fi
elif mywhich update-rc.d ; then
echo "$PRODUCT will start automatically at boot"
echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
touch /var/log/$PRODUCT-init.log
perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
update-rc.d $PRODUCT enable
elif mywhich rc-update ; then
if rc-update add $PRODUCT default; then
echo "$PRODUCT will start automatically at boot"
if [ $HOST = debian ]; then
echo "Set startup=1 in ${CONFDIR}/default/$PRODUCT to enable"
touch /var/log/$PRODUCT-init.log
perl -p -w -i -e 's/^STARTUP_ENABLED=No/STARTUP_ENABLED=Yes/;s/^IP_FORWARDING=On/IP_FORWARDING=Keep/;s/^SUBSYSLOCK=.*/SUBSYSLOCK=/;' ${CONFDIR}/$PRODUCT/$PRODUCT.conf
else
echo "Set STARTUP_ENABLED=Yes in ${CONFDIR}/$PRODUCT/$PRODUCT.conf to enable"
fi
else
cant_autostart
fi
elif [ $HOST = openwrt -a -f ${CONFDIR}/rc.common ]; then
/etc/init.d/$PRODUCT enable
if /etc/init.d/$PRODUCT enabled; then
echo "$PRODUCT will start automatically at boot"
else
cant_autostart
fi
elif [ "$INITFILE" != rc.${PRODUCT} ]; then #Slackware starts this automatically
cant_autostart
fi
fi
#
# Report Success
#
echo "$Product Version $VERSION Installed"
shorewall-lite-5.0.15.6/changelog.txt 0000644 0000000 0000000 00000040552 13062527166 016105 0 ustar root root Changes in 5.0.15.6
1) Update release documents.
2) Backport fix for two-interface snat-file.
Changes in 5.0.15.5
1) Update release documents.
2) Rebuild with corrected build50.
Changes in 5.0.15.4
1) Update release documents.
2) Merge fixes from 5.1.3.1 and earlier.
Changes in 5.0.15.3
1) Update release documents.
2) Merge three fixes from the 5.1.0 branch
Changes in 5.0.15.2
1) Update release documents.
2) Merge four fixes from the 5.1.0 branch
Changes in 5.0.15.1
1) Update release documents.
2) Make NFQUEUE non-terminating
3) IPv6 mDNS macro from Michele Baldessari.
Changes in 5.0.15 Final
1) Update release documents.
2) Correct 'restore' exit status
3) Correct optimizer defect in merge_rules().
Changes in 5.0.15 RC 2
1) Update release documents.
2) Correct syntax error in Providers.pm.
Changes in 5.0.15 RC 1
1) Update release documents.
2) Use $PAGER in 'show macro'.
3) Implement the -p option
Changes in 5.0.15 Beta 1
1) Update release documents.
2) Preserve shell variables over 'update'.
Changes in 5.0.14 Final
1) Update release documents.
2) Prevent multiple --to-source specifications in generated rules.
3) Fix installer re: snat file in $CONFDIR.
Changes in 5.0.14 RC 2
1) Update release documents.
2) Correct detection of use of address variables.
Changes in 5.0.14 RC 1
1) Update release documents.
2) Correctly translate +INLINE(...)
3) Deprecate INLINE_MATCHES=Yes
4) Correct an error message and move its generation.
5) Diosallow '+' in inline SNAT action bodies
6) Be sure NAT is enabled before process an snat file.
7) More documentation snat file updates.
Changes in 5.0.14 Beta 2
1) Update release documents.
2) Force a reload when an optional interface is enabled and its IP
address or gateway changed.
3) Correct MASQUERADE+ issue reported by Steven Springl.
Changes in 5.0.14 Beta 1
1) Update release documents.
2) Supersede the 'masq' file with the 'snat' file.
3) Add SNAT action support
4) Merge 5.0.13 fixes.
Changes in 5.0.13 Final
1) Update release documents.
2) Reverse ECN fix.
3) Restrict hypen in port ranges to numberic ports.
4) Correct typo in process_mangle_inline().
Changes in 5.0.13 RC 2
1) Update release documents.
2) Accept '-' as a port-range separator.
3) Correct shorewall6-masq examples.
4) Add -exists to ADD command with timeout
5) ECN fix.
Changes in 5.0.13 RC 1
1) Update release documents.
2) Merge fix from 5.0.12.
3) Make the output of 'blacklist' dependent on the verbosity and clean
up that output.
4) Detect bad characters in interface names.
Changes in 5.0.13 Beta 2
1) Update release documents.
2) Add 'timeout' DYNAMIC_BLACKLISTING option
3) Add FIREWALL option in shorewall[6].conf.
4) Remove restrictions on IPv6 'balance' and 'fallback'.
Changes in 5.0.13 Beta 1
1) Update release documents.
2) Roberto's typo fix in the mangle manpages.
3) Reorder the entries in the .conf files in ASCII collating sequence.
4) Correct DYNAMIC_BLACKLIST documentation.
4) Add 'disconnect' option to the DYNAMIC_BLACKLIST setting.
Changes in 5.0.12 Final
1) Update release documents.
2) Correct permissions of files created by the 'save' command.
Changes in 5.0.12 RC 3
1) Update release documents.
2) Correct disabled persistent' WRT start, restart and reload.
3) Don't assume that all probability-balanced interfaces are optional.
Changes in 5.0.12 RC 2
1) Update release documents.
2) Handle down or missing interfaces in the disable logic.
Changes in 5.0.12 RC 1
1) Update release documents.
2) Add DEFAULT_PAGER to shorewallrc.
3) Add support for the 'contiguous' time option.
4) Clear packet marks in PREROUTING and OUTPUT.
Changes in 5.0.12 Beta 2
1) Update release documents.
2) Restore 'use Shorewall::Config(shorewall)' in ?PERL handling.
3) Make POSTROUTING the default chain for CHECKSUM.
Changes in 5.0.12 Beta 1
1) Update release documents.
2) Minor cleanup in the Rules module
3) Allow zone lists in policy SOURCE and DEST columns.
Changes in 5.0.11 Final
1) Update release documents.
Changes in 5.0.11 RC 1
1) Update release documents.
2) Update module versions.
3) Allow provider interface to match wildcard interfaces entry.
Changes in 5.0.11 Beta 2
1) Update release documents
2) Default DSCP rules to the POSTROUTING chain.
3) Correct 'trace' handing of in-rule comments.
4) Correct handling of a provider interface that matches a wildcard.
5) Re-add a handle to flow classifiers.
Changes in 5.0.11 Beta 1
1) Update release documents
2) Allow 'comment' in alternate input.
Changes in 5.0.10.1
1) Update release documents
2) Update Debian SysV init scripts (Roberto Sánchez).
3) Implement LOGFILE=systemd (Scott Shumate).
Changes in 5.0.10
1) Update release documents
2) Avoid silly duplicate rules.
Changes in 5.0.10 RC 1
1) Update release documents
2) Convert the RPMs to use systemd
Changes in 5.0.10 Beta 2
1) Update release documents
2) Add 'dbl' interface option.
3) Transfer permissions during 'update'
4) Allow ':' in USER columns
5) Correct update/compatibility issues.
Changes in 5.0.10 Beta 1
1) Update release documents
2) Allow can now re-enable addresses disabled using the 'blacklist'
command.
Changes in 5.0.9 Final
1) Update release documents
2) Document DOCKER fix.
Changes in 5.0.9 RC 1
1) Update release documents
2) Cross-check core version during compilation.
3) Cross-check Shorewall6 version during IPv6 compilation.
4) Turn on AUTOMAKE in the sample configurations.
5) Date/time in 'date' format.
Changes in 5.0.9 Beta 2
1) Update release documents
2) Improve compile date/time implementation
3) Add VERBOSE_MESSAGES option.
4) Allow NFLOG in the mangle file
Changes in 5.0.9 Beta 1
1) Update release documents
2) Fix handling of optional provider with no IP address
3) Correct typos in the Events article
4) Implement standard error messages in the CLI
5) Include compile time and date in the output of 'status'
6) Apply Matt Darfeuille's patch set.
Changes in 5.0.8 Final
1) Update release documents
Changes in 5.0.8 RC 2
1) Update release documents.
2) Implement SW_LOGGERTAG
3) Correct logging of 'reloaded' message.
4) Enable compiler logging on reload and restart
5) Use uniform timestamp formatting on compiler messages
6) Flag 0 in the tcclasses MARK column
7) Correct tcclasses filter priority documentation.
8) Add an ESTABLISHED,RELATED rule for o => docker0
9) Add ?WARNING and ?INFO directives.
Changes in 5.0.8 RC 1
1) Update release documents.
2) Correct date format in messages produced by startup_error().
3) Correct many issues with save/restore of ipsets.
4) Update DHCP article (refresh -> reload)
5) Correct start command's handling of AUTOMAKE.
6) Place deprecated files with name collisions in a separate
directory.
7) Create an undo_routing file for the main table.
Changes in 5.0.8 Beta 4
1) Update release documents.
2) Use '-g' when the target is a terminating chain.
3) Catch case where a transformed rule jumps to its own chain.
4) Implement ipset-based blacklisting.
5) Add 'nodbl' interface option.
6) Correct handling of MINIUPNPD with DOCKER
7) Correct handling of interface options with multi-interface zones.
8) Merge Tuomo's new macros.
9) Reverse the order of Broadcast and ICMP checking in the default actions.
Changes in 5.0.8 Beta 3
1) Update release documents.
2) Make the physical interface name a true synonym of the logical
name.
3) Update IPv6 article.
4) Make IPv6 Drop Auth default consistent with IPv4.
5) Delete four IPv6 actions that duplicate their IPv4 counterparts
6) Allow reject method to be specified in REJECT and A_REJECT
Changes in 5.0.8 Beta 2
1) Update release documents.
2) Correct handling of physical interface names in the nat-related
INTERFACE columns.
3) Add MINIUPNPD option to shorewall.conf.
4) Document '+' in the MODULESDIR description.
Changes in 5.0.7 Final
1) Update release documents.
2) Correct 3-interface doc.
3) Updates to the configuration basics document.
4) Small efficiency change.
Changes in 5.0.7.2
1) Update release documents.
2) Fix warning when using older Perl versions.
3) Improve handling of inline matches
Changes in 5.0.7.1
1) Update release documents.
2) Fix inline matches in rule with wildcard zones
3) Allow ';R' with DIVERT.
Changes in 5.0.7 Final
1) Update release documents.
2) Correct 3-interface doc.
3) Updates to the configuration basics document.
4) Small efficiency change.
Changes in 5.0.7 RC 1
1) Update release documents.
2) Add stab to ingress qdiscs.
3) Fix action in policing filters.
4) Correct handling of second visit to the same mangle action.
5) Correct action handling in ingress filters.
6) Tighten up editing of .conf options.
Changes in 5.0.7 Beta 4
1) Update release documents.
2) Action and Inline options are now a bit map.
3) Implement 'audit' action option.
4) Make RST and NotSyn 'audit' actions.
5) Rename %actparms to %actparams.
6) Implement state action option
7) Update state actions to use the option.
8) Implement passed() in the compiler.
9) Update actions to use passed().
10) Update release notes for 5.0.6.2.
11) Another fix for 'check -r' - this time regarding Docker=Yes
12) Make '&' and '|' work with CONNMARK
13) Allow MARK and CONNMARK in the rules file.
Changes in 5.0.7 Beta 3
1) Update release documents.
2) Restore NotSyn parameter in action.Reject.
3) Add jump to DOCKER from OUTPUT.
4) More 'prerule' fixes in expand_rule()
Changes in 5.0.7 Beta 2
1) Update release documents.
2) Move convert_tos() back to the Tc module.
3) Allow inline mangle actions.
4) Always look in the main routing table for default gateway.
5) 'check -r' and 'trace' compiler commands use the pager.
6) Add ?ERROR directive.
7) Eliminate ?begin perl .... ?end perl in many actions.
8) Implement '+' in inline matches to force those matches before
column matches.
9) Use '+' to remove embedded Perl from the TCP-specific actions.
10) Fix nested inline action and macro invocations.
Changes in 5.0.7 Beta 1
1) Update release documents.
2) Implement mangle actions.
Changes in 5.0.6 Final
1) Update release documents.
2) Avoid duplicate routing rules with persistent providers.
Changes in 5.0.6 RC 1
1) Update release documents.
Changes in 5.0.6 Beta 5
1) Update release documents.
2) Generate docker0 rules when it is known to Shorewall
3) Avoid duplicated code out of save_dynamic_chains()
4) Remove dead code from define_firewall()
5) Save/Restore the DOCKER jump in the nat table OUTPUT chain.
6) Avoid a duplicated rule after restart when DOCKER=Yes
Changes in 5.0.6 Beta 4
1) Update release documents.
2) Add the PAGER option
Changes in 5.0.6 Beta 3
1) Update release documents.
2) Add sample ulogd.conf file to the logging article.
3) Added ECN action in shorewall-mangle(8).
4) Add DOCKER network support.
5) Save/restore docker0 FORWARD rules if that interface is not defined
to Shorewall.
Changes in 5.0.6 Beta 2
1) Update release documents.
2) Create SNMPtrap macro to supersede SNMPTrap
3) Fix two issues reported by Steven Springl.
4) Generate more compact conditional code when DOCKER=Yes
5) Correct stop/start handling when DOCKER=Yes
Changes in 5.0.6 Beta 1
1) Update release documents.
2) Allow providers with no gateway
3) Add Docker support.
Changes in 5.0.5 Final
1) Update release documents.
Changes in 5.0.5 RC 2
1) Update release documents.
2) Update to Macros - Tuomo Soini
3) Update to Documenttion for new column names - Tuomo Soini
Changes in 5.0.5 RC 1
1) Update release documents.
2) Correct indentation in the output of 'show macros'.
Changes in 5.0.5 Beta 2
1) Update release documents.
2) Enhance rule tracking.
Changes in 5.0.5 Beta 1
1) Update release documents.
2) Add origin comments to the .ip[6]tables-restore-input file
3) Correct test for interface assigned to two providers.
Changes in 5.0.4 Final
1) Update release documents.
Changes in 5.0.4 RC 2
1) Update release documents.
2) Handle @CALLER in policy actions
3) Sort red and codel options for reproducability.
4) Remove chain restrictions from -m geoip
5) Clean up sysconfig files.
Changes in 5.0.4 RC 1
1) Update release documents.
2) Create unique chains when @caller is used.
3) Correct hashlimit in logging rules
4) Avoid errors when 'status -i' finds no .status files.
5) Improve the maintainability of action-tuple code
Changes in 5.0.4 Beta 2
1) Update release documents.
2) Added HAProxy support.
Changes in 5.0.4 Beta 1
1) Update release documents.
2) Shorewall-init installer support for OpenWRT.
3) sysconfig files included for additional distributions.
4) Make IP[6]TABLES transparent.
5) Specify the '--wait' option when creating the mangle table
capability test chain.
6) Implement the WAIT_OPTION capability.
7) Assume 2.14 or later systemd (Tuomo Soini).
Changes in 5.0.3 Final
1) Update release documents.
Changes in 5.0.3 RC 2
1) Update release documents.
2) Allow a timeout to be specified in ADD rules.
3) Allow commas in log tags when LOGTAGONLY=Yes
Changes in 5.0.3 RC 1
1) Update release documents.
Changes in 5.0.3 Beta 2
1) Update release documents.
2) Merge 5.0.2.1 install/uninstall/configure changes from Matt.
3) Fix MAC handling in IPv6.
4) Another configure.pl fix from Matt.
Changes in 5.0.3 Beta 1
1) Update release documents.
2) Merge Matt Darfeuille's installer/uninstaller changes.
3) Merge Tuomo Soini's column-name change and update manpages.
4) Redefine MODULESDIR.
5) Set IP_FORWARDING=keep in all shorewall6.conf files.
Changes in 5.0.2.1
1) Update release documents.
2) Use 'netstat' if 'ss' isn't installed.
3) Install/Uninstall fixes from Matt Darfeuille.
Changes in 5.0.2 Final
1) Update release documents.
2) 'configure' detects OpenWRT
3) Corrected the Shorewall6-lite uninstaller
Changes in 5.0.2 RC 1
1) Update release documents.
2) Add OpenWRT support in the installers (Tom and Matt Darfeuille)
3) Correct mkdir command in mutex_on.
4) Add support for openWRT's 'lock' utility
5) Enable optional interface during 'start' and 'restart'
Changes in 5.0.2 Beta 2
1) Update release documents.
2) Support for lib.cli-user
3) Support for OpenWRT BB and later
4) Correct installer/uninstaller issues
5) Improve circular buffer check
6) Correct HOST=default behavior
7) Allow remote- commands to return correct exit status
Changes in 5.0.2 Beta 1
1) Update release documents.
2) Merge Tuomo's MSSQL fix.
3) Merge Tuomo's version removal fix.
4) Add 'persistent' options to providers, rtrules and routes
5) Add 'lib.cli-user' support.
Changes in 5.0.1.1
1) Update release documents.
2) More version removal (Tuomo Soini).
3) Delete default route from main when load= or fallback.
4) Add 'persistent' options to providers, rtrules and routes.
5) Correct L2TP documentation.
Changes in 5.0.1
1) Update release documents.
2) Replace LEGACY_RESTART with RESTART
3) Merge 'seconds' and 'minutes' change from 4.6.13.
Changes in 5.0.0
1) Update release documents.
2) Remove options from 'update' warning messages.
3) Update documentation for obsolete file removal.
4) Apply Erich Titl's 'date' fix.
Changes in 5.0.0 RC 1
1) Update release documents.
2) .service file fixes from Tuomo Soini
Changes in 5.0.0 Beta 2
1) Update release documents.
2) Correct the 'reset' command
3) Allow table names in the reset command.
4) Add Gluster FS action
Changes in 5.0.0 Beta 1
1) Update release documents.
2) Redefine 'reload' and 'restart'.
3) Eliminate service.214 files.
4) Add 'reload' to the service files.
5) Allow connlimit by destination.
6) Add the LEGACY_RESTART option.
7) Deimplement support for several old options
8) Merge from 4.6.12
9) Correct a warning message to refer to 'mangle' rather than
'tcrules'.
10) Drop support for the 'tos', 'tcrules', 'routestopped', 'notrack'
and 'blacklist' files.
11) Disallow bare SECTION, COMMENT and FORMAT lines.
12) The -t update option also converts the 'tos' file.
13) Merge from 4.6.13.
14) Remove all of the individual options from the 'update' command.
15) Delimit inline matches with ';;'.
16) Allow log-tags in shorewall.conf options
17) Allow non-expoerts access to the user bits in the fw mark.
18) Add a PROBABILITY column to the masq files
shorewall-lite-5.0.15.6/releasenotes.txt 0000644 0000000 0000000 00000216426 13062527166 016654 0 ustar root root ----------------------------------------------------------------------------
S H O R E W A L L 5 . 0 . 1 5 . 6
------------------------------
M a r c h 1 6 , 2 0 1 7
----------------------------------------------------------------------------
I. PROBLEMS CORRECTED IN THIS RELEASE
II. KNOWN PROBLEMS REMAINING
III. NEW FEATURES IN THIS RELEASE
IV. MIGRATION ISSUES
V. PROBLEMS CORRECTED AND NEW FEATURES IN PRIOR RELEASES
----------------------------------------------------------------------------
I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E
----------------------------------------------------------------------------
5.0.15.6
1) Previously, the two-interface sample snat file contained a typo;
192.16.0.0/16 was inadvertently entered as 92.16.0.0/16. That has
been corrected.
5.0.15.5
1) Shorewall 5.0.15.4 was built with a buggy toolset which resulted
is the IPv4 installers being installed in the IPv6 packages.
5.0.15.5 is built with a corrected toolset.
5.0.15.4
1) Expansion of options appearing in shorewall[6].conf (e.g.,
$TCP_FLAGS_LOG_LEVEL) has been corrected.
2) Previously, 'all+' was treated the same as 'all' in the policy
files.
3) Now, when systemd stops a Shorewall-generated firewall, the
firewall is cleared rather than placed in the safe state. This
is to maintain compatibility with the default SysVinit behavior and
to conform to Debian rules which require that 'stop' undoes
whatever 'start' did.
5.0.15.3
1) Previously, when SAVE_IPSETS=Yes or SAVE_IPSETS=ipv4, the restore
phase of a rejected safe-restart would fail. That has been
corrected.
2) It is now possible to include compact IPv6 addresses (those with
"::") in IP6TABLES() parameters. Previously, such addresses
resulted in an "INVALID ACTION..." error.
5.0.15.2
1) An optimizer defect that could result in start/reload/restart
failures has been corrected.
2) Previously, when a list of zones appeared in a policy file entry,
intra-zone traffic was affected even if neither the SOURCE nor DEST
list ended in '+'. That has been corrected so that intra-zone
traffic is included only when a '+' is present.
3) The 'ip xfrm' command is now used to dump the IPSEC SPD and SAD
during 'shorewall dump' processing. Previously, this information
was missing unless the ipsec-tools package was installed. As part
of this change, empty policies are no longer printed and IPv6 SAD
entries are now correctly listed.
5.0.15.1
1) Previously, rules in a chain that followed an unconditional NFQUEUE
rule were discarded with the warning:
WARNING: One or more unreachable rules in chain xxx have been
discarded
That problem has been corrected and such rules are now retained.
5.0.15
1) This release includes defect repair through Shorewall 5.0.14.1.
2) Previously, when the 'update' command transformed a superseded
file's contents into a newer file, with the exception of the
'notrack' -> 'conntrack' conversion, the transformation was
incomplete:
a) All shell variables were expanded in the converted file.
b) Any lines omitted by compiler directives ( ?if.... etc. ) were
also omitted from the converted file.
These deficiencies have been corrected. Now, shell variables are
preserved in the converted file and omitted lines are now
translated.
EXCEPTIONS: Because the translations of the 'blacklist' and
'routestopped' files are not 1:1, omitted lines and compiler
directives are not transferred to the converted files. If either
are present, the compiler issues a warning:
WARNING: "Omitted rules and compiler directives were not
translated
3) In earlier versions, when USE_DEFAULT_RT=No in shorewall6.conf,
the generated script would attempt to copy fe80:* routes from the
DUPLICATE routing table to provider tables, which could fail.
Now, the generated script ignores these routes.
4) Previously, if the 'restore' command failed, the failure was not
corrected reflected in the exit status. The exit status now
correctly indicates the outcome of the command.
5) A defect in OPTIMIZE level 4 processing, could previously result in
the incorrect omission of a -i, -o, -s or -d rule option in an
optimized rules. That defect has been corrected.
----------------------------------------------------------------------------
I I. K N O W N P R O B L E M S R E M A I N I N G
----------------------------------------------------------------------------
1) On systems running Upstart, shorewall-init cannot reliably secure
the firewall before interfaces are brought up.
2) The 'enable', 'reenable' and 'disable' commands do not work
correctly in configurations with USE_DEFAULT_RT=No and optional
providers listed in the DUPLICATE column.
3) While the 'ip' utility now accepts IPv6 routes with multiple
'nexthop' destinations, these routes are not balanced. They are
rather instantiated as a sequence of single routes with different
metrics. Furthermore, the 'ip route replace' command fails on
such routes. Beginning with Shorewall6 5.0.15, the generated script
will use a "delete..add.." sequence on these routes rather than a
single "replace" command.
----------------------------------------------------------------------------
I I I. N E W F E A T U R E S I N T H I S R E L E A S E
----------------------------------------------------------------------------
5.0.15.1
1) An IPv6 bi-directional mDNS macro has been contributed by Michele
Baldessari.
5.0.15
1) The 'show macro' command now uses the configured PAGER, if any.
2) The PAGER may now be deactivated through use of the '-p' option
(e.g., "shorewall -p show" ).
----------------------------------------------------------------------------
I V. M I G R A T I O N I S S U E S
----------------------------------------------------------------------------
1) If you are migrating from Shorewall 4.4.x or earlier, please see
http://www.shorewall.net/pub/shorewall/4.5/shorewall-4.5.21/releasenotes.txt
2) It is strongly recommended that you first upgrade your installation
to a 4.6 release >= 4.6.12 prior to upgrading to Shorewall 5.0.
Once you are on the Shorewall 4.6 release:
- shorewall update -A
If you also run Shorewall6:
- shorewall6 update -A
These steps are necessary because Shorewall 5.0:
- Does not contain support for the 'tcrules' and 'tos' files --
existing 'tcrules' and 'tos' files must be converted to an
equivalent set of 'mangle' file entries.
- Does not contain support for the 'blacklist' file -- it must
be converted to an equivalent 'blrules' file.
- Does not contain support for the 'notrack' file -- it must be
converted to an equivalent 'conntrack' file.
- Does not contain support for the 'routestopped' file -- it must
be converted to an equivalent 'stoppedrules' file.
Note that you can run the update command(s) after you upgrade to
Shorewall 5 but your firewall will not work correctly until
you do those update(s).
3) The following configuration options have been eliminated:
- EXPORTPARAMS
- IPSECFILE
- LEGACY_FASTSTART
- LOGRATE *
- LOGBURST *
- WIDE_TC_MARKS *
- HIGH_ROUTE_MARKS *
- BLACKLISTNEWONLY *
A fatal error results if those flagged with an asterisk ("*")
appear in the .conf file -- run the 'shorewall[6] update' command
to convert their settings to use supported options.
A warning is issued if any of the rest appear in the .conf file.
'shorewall[6] update' will drop them from the file.
4) To make the command names more accurately reflect what they do,
several changes have been included:
a) Beginning with this release, the 'restart' command now does a
true restart and is equivalent to a 'stop' followed by a
'start'.
b) The pre-5.0.0 'load' command has been renamed 'remote-start'.
c) The pre-5.0.0 'reload' command has been renamed 'remote-reload'.
c) The 'reload' command now performs the same function as the
pre-5.0.0 'restart' command.
d) A 'remote-restart' command has been added to Shorewall and
Shorewall6 to allow a remote 'restart' after updating the
remote firewall system's compiled script.
For those that can't get used to the idea of using 'reload' in
place of 'restart', a RESTART option has been added. The
option defaults to 'reload' for compatibility with earlier
releases. If set to 'restart', then the 'restart' command
does a true restart (stop followed by start)
5) While the WORKAROUNDS setting is still present in the
shorewall[6].conf file:
a) It's default setting has been changed to No.
b) All workarounds for old distributions have been eliminated.
6) Beginning with Shorewall 5.0.0, all macros and actions are assumed
to be FORMAT-2. FORMAT-1 macros and actions are no longer supported
and will be silently processed as if they were FORMAT-2. For most
macros and actions, this change will be of no concern, but may cause
compilation errors in rare cases.
To review, FORMAT-1 actions have the following columns:
TARGET
SOURCE
DEST
PROTO
DEST PORT(S)
SOURCE PORT(S)
RATE
USER/GROUP
MARK
FORMAT-1 macros have these columns:
TARGET
SOURCE
DEST
PROTO
DEST PORT(S)
SOURCE PORT(S)
RATE
USER/GROUP
FORMAT-2 actions and macros, on the other hand, have:
TARGET
SOURCE
DEST
PROTO
DEST PORT(S)
SOURCE PORT(S)
ORIGINAL DEST
RATE
USER/GROUP
MARK
CONNLIMIT
TIME
HEADERS (Only valid for IPv6)
SWITCH
HELPER
To summarize, if your action or macro only uses the first 6
columns (which most do), then it will process fine as
FORMAT-2. Otherwise, it must be modified to place specifications in
the proper columns.
7) COMMENT, FORMAT and SECTION lines must now begin with a question
mark ("?"). The 'update' command will change all bare COMMENT,
FORMAT and SECTION lines to include the question mark.
8) Beginning with Shorewall 5.0.8, the IPv6 default treatment of Auth
(TCP 113) is now consistent with IPv4; nothing special is done with
these requests, so they are simply logged and dropped.
IMPORTANT: If you want to continue to reject Auth requests, you
can do so by changing your DROP_DEFAULT setting to make the second
parameter REJECT. For example, if you currently have:
DROP_DEFAULT=Drop
you can change it to:
DROP_DEFAULT="Drop(-,REJECT)"
----------------------------------------------------------------------------
V. N O T E S F R O M O T H E R 5 . 0 R E L E A S E S
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 4
----------------------------------------------------------------------------
1) This release includes defect repair up through Shorewall 5.0.13.4.
2) When the address variable for an optional interface was used, and
the interface did not have an IP address when the firewall was
started, then enabling the interface did not previously
create/alter the rules that use the address variable. Also, if the
IP address of a disabled interface changed, enabling the interface
did not update/add rules using the interface's gateway address
variable.
Now, if the IP address of a disabled optional interface
changes from its value (if any) when the netfilter ruleset was
instantiated, then after a successful 'enable', the ruleset is
automatically reloaded if the interface's address variable was
used.
Similarly, if 'detect' is specified as the GATEWAY for an optional
provider, then if the gateway at the time that the provider is
successfully enabled is different from that (if any) when the
netfilter ruleset was instantiated, then the ruleset is
automatically reloaded if the provider interface's run-time gateway
variable was used.
As part of this change, if an IP address is specified as the
GATEWAY for a provider, then the run-time gateway variable for the
provider's interface is expanded at compile time rather than at
runtime.
Example:
#PROVIDER NUMBER MARK DUPLICATE INTRFACE GATEWAY OPTIONS COPY
foo 1 1 - eth0 1.2.3.4 primary -
Then %eth0 will be expanded at compile time to '1.2.3.4'.
3) Previously, the ADDRESS column in /etc/shorewall[6]/masq was
documented as allowing a list of addresses and/or address ranges.
That feature depended on iptables support which is no longer
present in current distributions. The code now disallows more than
one address[-range] and the documentation has been changed
accordingly.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 1 4
----------------------------------------------------------------------------
1) /etc/shorewall[6]/masq has been superseded by
/etc/shorewall[6]/snat. The new 'snat' file is similar to most of
the other configuration files in that the first column specifies
the ACTION to be performed, the second contains the SOURCE and so
on.
The 'shorewall[6] update' command will convert an existing masq
file into the equivalent 'snat' file and will rename masq to
masq.bak.
See shorewall[6]-snat(5) for details.
2) Actions (both inline and regular) are now supported out of the new
snat file. Like other actions, these 'SNAT actions' must be
declared in the /etc/shorewall[6]/actions file where the new 'nat'
option must be specified.
Like other actions, the action rules are placed in a file named
action.. Those rules have the same format as those in the
snat file with two restrictions:
1. The '+' is not allowed in the ACTION column to specify that the
rules should be applied before one-to-one NAT. It must rather be
specified when the action is invoked.
2. Interface names are not permitted in the DEST column, so all of
the rules apply to the interface(s) specified when the action was
invoked.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 3
----------------------------------------------------------------------------
5.0.13.4
1) DETECT_DNAT_IPADDRS=Yes in shorewall6.conf previously resulted in
an incorrect test in the generated script (0.0.0.0 was used
rather than ::). That has been corrected.
2) Use of an inline mangle action could cause the compiler to fail
with the following diagnostic:
Use of uninitialized value in bitwise and (&) at
/usr/share/shorewall/Shorewall/Rules.pm line 4826, <$currentfile>
line 6.
That has been corrected.
3) Handling of ipsets in the tcfilters file has been corrected
(Luigi).
4) Previously, ipsets used in the tcfilters file were not
auto-created. That has been corrected.
5) Previously, the compiler would issue a Perl runtime diagnostic if a
tcclasses entry with the 'occurs' option appeared before the entry
with the 'default' option. That has been corrected (Luigi).
5.0.13.3
1) When the effective verbosity was < 2 and the 'disconnect' option
was specified in DYNAMIC_BLACKLIST, a successful 'blacklist'
command would issue the following error message and would produce
no other output.
sed: -e expression #1, char 8: unknown command: `/'
5.0.13.2
1) Fix number 1 in 5.0.13.1 uncovered a latent defect that was not
discovered until after release. The defect caused the compiler to
crash when all of the following were true:
1) LOAD_HELPERS_ONLY=Yes and a capabilities file was not being
used.
2) SAVE_IPSETS=Yes or SAVE_IPSETS=ipv4 in shorewall.conf.
3) Ipset-based dynamic blacklisting was being used.
4) No other ipset-based rules appeared in the configuration.
This defect has been corrected.
5.0.13.1
1) Previously, Shorewall ipset creation could fail on older releases,
such as Centos 6, with a message similar to the following:
WARNING: ipset lvpn does not exist; creating it as an hash:net set
ipset v6.11: Unknown argument: `counters' Try `ipset help' for
more information.
That problem has been corrected so that the ipset is now created
successfully.
2) Another problem with the DEST column in inline mangle action bodies
has been corrected.
5.0.13
1) This release contains defect repair from 5.0.12.1.
2) The compiler now detects shell metacharacters in interface names
defined in /etc/shorewall[6]/interfaces. Previously, such
characters could cause runtime failures in the generated script.
3) Previously, the compiler ignored DEST column entries in inline
mangle action bodies. That value is now used unless it is '-', in
which case the DEST column value in the action invocation is used.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 1 3
----------------------------------------------------------------------------
1) A 'disconnect' option has been added to the DYNAMIC_BLACKLIST
setting. The option is only accepted for ipset-based dynamic
blacklisting and requires that the 'conntrack' utility be
installed. See shorewall[6].conf(5) for details.
With this option, when an address is blackliseted using the
'blacklist' command, the conntrack utility is used to break all
connections from that address. If the 'src-dst' option is also
specified in the BLACKLIST setting, then all connections to the
address are also broken. If the effective VERBOSITY is greater than
0, then a messages is displayed that indicated the number of flows
deleted by the command. If the effective VERBOSITY is 2, the
conntrack entries delected by the command are also displayed.
This option is more efficient for packet processing than including
the ESTABLISHED state in the BLACKLIST setting.
2) A 'timeout' option has been added to the DYNAMIC_BLACKLIST setting.
The option is only accepted for ipset-based dynamic blacklisting
and causes entries in the blacklist ipset to be automatically
deleted if they are not matched within a specified time. See
shorewall[6].conf(5) for details.
3) A new FIREWALL option has been added to shorewall[6].conf. This
option is intended to be used on an admisitrative system in
configurations of remote firewalls. It defines the DNS name or IP
address of the remote system so that the system name does not have
to be given in the remote-start, remote-reload and remote-restart
commmands. See shorewall[6](8) for details.
4) Shorewall6 now allows more that one provider to specify the
'balance' or 'fallback' options.
5) When using port numbers (as opposed to service names), the hyphen
("-") is now accepted as the separator in port ranges. When service
names are used, the colon (":") must still be used.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 2
----------------------------------------------------------------------------
1) Minor cleanup, mostly commentary, in the Rules.pm module.
2) In Shorewall 5.0.7, The assumed 'use Shorewall::Config(shorewall)'
statement in ?PERL and ?BEGIN PERL...?END PERL handling was
inadvertently removed. This results in Perl compilation errors if
the 'shorewall' function is invoked. The statement has now been
restored.
3) Previously, the firewall would fail to start if the configuration
contained a CHECKSUM rule without a chain designator and
MARK_IN_FORWARD_CHAIN=No. Now, the compiler defaults these rules to
the POSTROUTING chain and forbids them in the PREROUTING chain.
4) Recently, a case was observed where certain incoming packets had a
non-zero packet mark in the raw PREROUTING chain, causing them to
be misrouted. To guard against this issue, packet marks are now
cleared at the top of the PREROUTING and OUTPUT mangle chains when
the new ZERO_MARKS option is set to yes. Note that ZERO_MARKS=Yes
can break IPSEC in multi-ISP configurations.
5) Two distinct problems have been corrected in the 'disable'
command logic:
a) If a balanced or fallback interface was down or had been
deleted, then the 'disable' command could fail.
b) If a persistent optional interface was down, then the
generated script would fail when it attempted to add routes out
of the interface.
6) Previously, the generated script would attempt to reenable a
disabled persistent provider at each 'start', 'reload' or
'restart'. Now, disabled persistent providers are handled the same
as other providers and require the 'enable' or 'reenable' command
to enable them.
7) Previously, the generated script assumed that all
probability-balanced providers (those with the 'load' option
specified) were optional. That assumption has been removed.
8) Previously, the permissions of files created by the 'save' command
were more relaxed than necessary. This has been corrected.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 1 2
----------------------------------------------------------------------------
1) You may now place comma-separated zone lists in the SOURCE and DEST
columns in /etc/shorewall[6]/policy.
Example:
#SOURCE DEST POLICY ...
loc,dmz net REJECT
That line is equivalent to:
#SOURCE DEST POLICY ...
loc net REJECT
dmz net REJECT
If the same zone appears in both columns, the default ACCEPT
intrazone policy is not overridden unless the list is followed
immediately by '+'.
Example:
#SOURCE DEST POLICY ...
dmz,loc loc,dmz+ REJECT
That line is equivalent to:
#SOURCE DEST POLICY ...
dmz loc REJECT
dmz dmz REJECT
loc loc REJECT
loc dmz REJECT
Without the plus sine, it would be equivalent to
#SOURCE DEST POLICY ...
dmz loc REJECT
loc dmz REJECT
2) Distribution maintainers may now set a default pager via the
configure and configure.pl programs in Shorewall-core to set
DEFAULT_PAGER in the generated shorewallrc file. The
Shorewall-provided shorewallrc files for Debian currently specify
'less' for DEFAULT_PAGER. The other shorewallrc files do not
specify DEFAULT_PAGER.
If shorewall[6].conf does not specify PAGER then the DEFAULT_PAGER
setting is used.
3) The 'contiguous' option is now supported in TIME columns. When the
'timestop' value is smaller than the 'timestart' value, match this
as a single time period instead distinct intervals.
Example:
weekdays=Mo×tart=23:00×top=01:00
Will match Monday, for one hour from midnight to 1 a.m., and
then again for another hour from 23:00 onwards. If this is
unwanted, e.g. if you would like 'match for two hours from
Monday 23:00 onwards' you need to also specify the 'contiguous'
option in the example above.
See http://www.shorewall.org/configuration_file_basics.htm#TIME for
additional TIME column examples.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 1
----------------------------------------------------------------------------
1) This release contains defect repair through Shorewall 5.0.10.1.
2) In Shorewall 5.0, the default chain for DSCP rules was
inadvertently chained to PREROUTING (FORWARD, if
MARK_IN_FORWARD_CHAIN=Yes).
The default is now restored to POSTROUTING, its earlier value.
3) When 'trace' was specified, previously the output of ip[6]tables
rules containing a comment were displayed incorrectly. The "-m
comment --comment" specification was missing and the comment was
not enclosed in double quotes. This has been corrected.
4) Previously, if a provider interface matched only a wildcard entry
(one whose physical interface name ended in '+'), then the
generated script would always find the interface to be
unusable. That has been corrected.
5) A change released in 5.0.9.1 and that allowed simple traffic
shaping to support more than 9 interfaces prevented some users'
configurations from starting. That has been corrected.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 1 1
----------------------------------------------------------------------------
1) When using the alternate input form, it is now possible to specify
a comment to be attached to the generated ip[6]tables rule. Simply
use the 'comment' keyword. If the comment contains embedded white
space, then it must be enclosed in double quotes. Any double
quotes embedded in the comment must be escaped using a backslash.
Example:
ACCEPT net $FW { proto=tcp, dport=22, comment="Accept \"SSH\"" }
2) OPTIMIZE level 16 no longer deletes duplicate COUNT rules, allowing
multiple similar COUNT rules in a chain.
3) Beginning with this release, source RPMs are available on the
download sites.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 0
----------------------------------------------------------------------------
5.0.10.1
1) Several issues with the Debian SysV init scripts have been
corrected:
a) The scripts now issue progress messages for the 'stop' command
based on the setting of SAFESTOP in /etc/default/shorewall*.
b) The firewall is now stopped or cleared in runlevel 1 (minimal),
based on the setting of SAFESTOP.
c) A typo in the Shorewall init script prevented the force-stop
command from working correctly.
Roberto Sánchez.
5.0.10
1) This release includes defect repair through Shorewall 5.0.9.2.
2) Previously, the 'update' commmand could result in updated files
having the user's default permissions rather than the permissions
of the original file. That has been corrected.
3) A number of update and update-compatibility issues have been
corrected:
a) : (e.g., "fred:") is once again accepted in USER columns.
b) The USER column in the mangle file can once again be specified
when :T is the chain designator.
c) The 'notrack' file is now correctly appended to the 'mangle'
file during update.
d) IPMARK entries in 'tcrules' are now correctly converted into
the 'mangle' file.
4) When multiple zones are configured on an interface, the 'tcpflags',
'nosmurfs' and 'maclist' options could previously result in silly
duplicate rules. That problem has been corrected.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 1 0
----------------------------------------------------------------------------
5.0.10.1
1) You can now specify LOGFILE=systemd to cause 'journelctl -r' to be
used to read the system log (journel).
Scott Sumate.
5.0.10
1) The 'allow' command can now remove entries from the ipset-based
dynamic blacklists.
allow ...
2) A new 'dbl' (Dynamic Blacklist) option is now available in the
'interfaces' file. Possible settings are:
none - equivalent to specifying 'nodbl'.
src - packets entering the firewall on the interface have their
source IP address checked against the ipset-based
blacklist.
dst - packets entering the firewall on the interface have their
destination IP address checked against the ipset-based
blacklist.
src-dst - packets entering the firewall on the interface have their
source IP address checked against the ipset-based
blacklist. Packets originating on the fireawll and
leaving through the interface have their destination IP
address checked against the ipset-based blacklist.
The normal setting for an internet-facing interface will be either
'src' or 'src-dst'. The normal setting for an internal interface
will be either 'none' or 'dst'.
3) The RPMs from shorewall.net are now created to assume that systemd
is being used. They are targeted specifically at OpenSuSE and have
been verified on OpenSuSE 42.1.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 9
----------------------------------------------------------------------------
1) This release contains defect repair through Shorewall 5.0.8.2.
2) Previously, if:
- DOCKER=Yes
- docker0 was defined in /etc/shorewall/interfaces
- Docker was not running
then Shorewall would fail to start with an error similar to this
iptables-restore v1.4.21: Couldn't load target `DOCKER':
No such file or directory
Error occurred at line: 29
Try `iptables-restore -h' or
'iptables-restore --help' for more information.
ERROR: /sbin/iptables-restore Failed.
This has been corrected such that Shorewall starts correctly under
these conditions.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 9
----------------------------------------------------------------------------
1) The file 'lib.core' has been renamed 'lib.runtime' to more
accurately reflect the file's role.
2) The CLI now produces helpful error messages rather than simply
dumping out the complete usage syntax.
3) The 'status' and 'version -a" command outputs now include the time
and date when the current firewall script was compiled.
This feature implements a new 'info' command that is recognized by
the compiled script. That command produces output similar to the
following:
compiled Thu Apr 28 14:18:58 2016 by Shorewall version 5.0.9
Note 1: The time and date of compilation will only be displayed
after the firewall script has been compiled using this or a later
Shorewall release.
Note 2: Information about the current firewall script is only
displayed by the 'version -a' command when the command is executed
by root.
Caution: If you execute 'shorewall compile', a subsequent 'status'
command will display the compilation information for the newly
compiled script and not for the one that was used to instantiate
the running firewall configuration. Note that the compilation
date/time, in this case, will be later than the started date/time:
Example:
State:Started Sun Apr 24 12:22:18 PDT 2016 from /etc/shorewall/
(/var/lib/shorewall/firewall compiled Thu Apr 28 14:18:58 2016
by Shorewall version 5.0.9)
4) The ?INFO and ?WARNING directives added in Shorewall 5.0.8 include
the current filename and line number in the generated message. That
behavior can be suppressed by using ?INFO! AND ?WARNING!
instead. Additionally, the default behavior can be changed by
setting VERBOSE_MESSAGES=No in shorewall[6].conf. In that case,
including the exclaimation point causes the filename and line
number to be included.
5) NFLOG(...) is now supported in the mangle files.
6) The compiler now checks the version of the installed Shorewall-core
and issues a warning message if there is a mis-match.
Example (folded to fit within 72 columns):
WARNING: Version Mismatch: Shorewall-core is version 5.0.8.2,
while the Shorewall version is 5.0.9-Beta2
When compiling for IPv6, the Shorewall6 version is also verified
and a similar warning is issued in the case of a mismatch.
7) The sample configurations now have AUTOMAKE enabled.
8) Full date and time strings generated by the compiler are now in
'date' format rather than Perl's 'localtime' format.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 8
----------------------------------------------------------------------------
1) This release includes defect repair through Shorewall 5.0.7.2
2) If a physical interface name was used in the INTERFACE column of an
entry in /etc/shorewall/masq, then previously a Perl diagnostic was
issued as the masq rule was being processed and the iptables rule
and its containing chain were dropped by the optimizer. That has
been corrected so that physical interface names are handled
correctly.
Similar issues with physical names in the INTERFACE column of the
nat, netmap and ecn files have also been resolved.
3) The optional plus sign ('+') in the MODULESDIR setting, added in
Shorewall 5.0.3, is now documented in the shorewall[6].conf
manpages.
4) Address variables that specified the physical interface name
previously caused Perl diagnostics to be issued and wrong code
to be generated. That has been corrected.
5) The IPv6 default treatment of Auth (TCP 113) is now consistent with
IPv4; nothing special is done with these requests, so they are
simply logged and dropped or rejected.
IMPORTANT: If you want to continue to silengly reject Auth
requests, you can do so by changing your xxx_DEFAULT settings to
make the second parameter 'Reject'. For example, if you currently
have:
DROP_DEFAULT=Drop
REJECT_DEFAULT=Reject
you can change it to:
DROP_DEFAULT="Drop(-,REJECT)"
REJECT_DEFAULT="Reject(-,REJECT)"
6) Previously, if a zone had two or more interfaces, then the
interfaces' option rules (DHCP, dynamic blacklisting, etc.) could
be moved into the fw->zone chain without being restricted to their
respective interfaces. This could result in needless duplication of
rules. These rules are now kept in separate chains which, if they
are identical, will be combined by the optimizer if OPTIMIZE level 8
is enabled.
7) A number of issues have been resolved with saving/restoring ipsets
in Shorewall and Shorewall6.
- Even if Shorewall's SAVE_IPSETS was set to ipv4, restarting one
configuration would attempt to flush/destroy the ipsets for the
other address family.
- The same set could be saved multiple times, with the result
that ipset error messages were issued during 'shorewall[6]
start'.
- Needless repetition of code was generated due to the use of
compile-time loops rather than run-time loops.
8) Previously, when AUTOMAKE=Yes, the 'start' command would not
regenerate an out-of-date firewall script.
9) A couple of recent changes have resulted in file name collisions
on Cygwin with its underlying case-insensitive filesystem. To avoid
these collisions.
- /usr/share/shorewall/deprecated and
/usr/share/shorewall6/deprecated directories have been created.
- When a name collision occurs, the file with the older name is
moved to the deprecated directory
- The compiler automatically searches the deprecated directory
(both directories in the case of Shorewall6) for files.
In this release, macro.SNMPTraps and action.A_Reject were moved to
/usr/share/shorewall/deprecated/. Note that both are deprecated -
Reject accepts an 'audit' parameter, and macro.SNMPTraps has been
superseded by macro.SNMPtraps.
10) Previously, the 'reload' command did not produce a system log
message when it succeeded. That has been corrected.
11) Previously, when compilation was done as part of a reload or
restart operation, compiler logging to the STARTUP_LOG was
suppressed. Such logging is now enabled.
12) The compiler now uses a uniform format for timestamps in the
STARTUP_LOG and on standard output (when the -t option is
specified). Previously, some messages suppressed a leading zero in
the hour where others did not. Now, the leading zero is never
suppressed for compatibility with the timestamps produced by the
generated script.
13) Previously, the compiler would allow 0 to be specified in the MARK
column of the tcclasses file, resulting in a run-time failure:
Setting up Traffic Control...
RTNETLINK answers: Invalid argument
We have an error talking to the kernel
ERROR: Command "tc filter add dev eth0 protocol all parent 1:0
prio 276 handle 0 fw classid 1:10" Failed
Now, the following error is generated by the compiler:
ERROR: MARK value must be non-zero
As part of this change, the shorewall[6]-tcclasses(5) manpages have
been updated:
- Specifity a filter priority in the MARK column is now documented
(this feature has been in the code for several years)
- The default priorities of the filters for tos= and tcp-ack have
been correcgted.
14) For consistency with Docker, when bridge docker0 is listed in
/etc/shorewall/interfaces, the following rule is now generated:
-A FORWARD -o docker0 -m conntrack \
--ctstate RELATED,ESTABLISHED -j ACCEPT
15) Previously, the safe-* commands did not direct the compiler to
write to the STARTUP_LOG. That has been corrected. The commands
which direct the compiler to write to that log are now:
start
try
refresh
reload
restart
safe-*
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 8
----------------------------------------------------------------------------
1) Support for later versions of miniupnpd has been added in the form
of a MINIUPNPD option in shorewall.conf. If set to Yes, Shorewall
will create a chain in the nat table named MINIUPNPD-POSTROUTING
and will add jumps from POSTROUTING to that chain for each
interface with the upnpd option specified. Default is No.
The contents of the chain are preserved over 'shorewall reload' and
'shorewall restart' operations.
2) The REJECT and A_REJECT actions may now take an optional parameter
that specifies the way in which the packet is to be rejected. See
shorewall[6]-rules(5) for details.
3) The standard action files and shell libraries now have a uniform
format for their header comments (Tuomo Soini).
4) The compiler now uses the iptables goto (-g) parameter rather than
the jump (-j) parameter, when the target is a terminating chain
(does not have any rules with the RETURN target and the last rule
in the chain is an unconditional jump to a terminating target or
chain).
5) The compiler now raises an error if the target of a chain's rule is
the chain itself.
6) The compiler now raises an error if the action specified in
REJECT_ACTION contains a RETURN (CONTINUE) jump or if the last rule
in the action is not an unconditional jump to a terminating target.
7) The Drop and Reject default actions now accept a sixth parameter
that specifies the action to be taken on UPnP packets. Previously,
the same action was performed on UPnP as was performed on late DNS
replies. The default is DROP in both cases.
8) Heretofore, when DYNAMIC_BLACKLISTING=Yes, blacklists were checked
on packets arriving and leaving on all interfaces. Now, individual
interfaces may be exempted from dynamic blacklisting through use of
the "nodbl" interface option.
9) Prior to this release, dynamic blacklisting has been implemented
using rules in an ip[6]tables chain. This scales poorly when there
are a large number of blacklisted addresses.
Beginning with this release, dynamic blacklisting can be ipset-
based. See DYNAMIC_BLACKLIST in shorewall.conf(5) and
shorewall6.conf(5) and the 'blacklist' command in shorewall(8) and
shorewall6(8).
As part of this change, ipsets created by Shorewall are now of type
hash:net with the 'timeout 0 counters' options, rather than
hash:ip with no options. This allows both network and individual
host addresses to be added to these ipsets, a timeout to be
specified when addresses are added to the ipsets, and visibility
into matches on individual members of the ipset.
10) New new Redis macros have been added, one for Redis Cluster and the
other for Redis Sentinal (Tuomo Soini).
11) The system log messages created by Shorewall via the 'logger'
utility may now be augmented using logger's -t (--tag) option
through use of the SW_LOGGERTAG environmental variable. If this
variable is set to a non-empty value, then its contents will be
passed as the -t option (e.g. logger -t "$SW_LOGGERTAG" ...).
12) Similar to ?ERROR, which was introduced in Shorewall 5.0.7, this
release supports additional ?WARNING and ?INFO directives
?ERROR
?WARNING
?INFO
The is written to STDERR prefaced by the directive name
(WARNING or INFO) followed by a colon (':'). It is also written to the
STARTUP_LOG if:
- A STARTUP_LOG has been configured
- The command is start, try, restart, reload, refresh or one of the
safe-* commands
Unlike ?ERROR, ?WARNING and ?INFO do not cause compilation to be
aborted.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 7
----------------------------------------------------------------------------
5.0.7.2
1) When using older versions of Perl, the following warnings were
generated with 5.0.7 and 5.0.7.1.
Found = in conditional, should be == at
/usr/share/perl5/Shorewall/Chains.pm line 8630.
Found = in conditional, should be == at
/usr/share/perl5/Shorewall/Chains.pm line 8635.
That has been corrected.
(Tuomo Soini)
2) Several typos in the manpages have been corrected (Roberto
Sánchez).
3) Previously, if an inline match was used in the last line of an
action, then the inline match could also be applied to the jump to
the action's chain. That has been corrected so that the jump to the
chain contains the correct set of matches.
5.0.7.1
1) In 5.0.6.2 and 5.0.7, use of an inline match in a rule that
generated multiple ip[6]tables rules caused only the first
generated rule to contain the inline match. That has been
corrected.
2) In 5.0.7, if ':R' was specified with the DIVERT action, an error
message was erroneously generated. That has been corrected.
5.0.7
1) This release includes defect repair from Shorewall 5.0.6.2.
2) Previously, the compiler failed to catch invalid action/chain
combinations which caused iptables-restore failures when such
combinations were present in the configuration. That has been
corrected.
3) An issue involving nested inlined action and macro invocations has
been resolved.
4) The '&' (and) and '|' (or) symbols were previously ignored when
the action was CONNMARK (mangle file). These symbols now work as
documented.
5) When 'DOCKER=Yes', 'check -r' would previously fail. The command
now works correctly.
6) Previously, the specified linklayer, overhead, mtu, mpu and tsize
were not applied to ingress qdiscs that provide IN-BANDWIDTH
limiting. That has been corrected so that these options also apply
to inbound traffic.
IMPORTANT: If you have specified linklayer, overhead, etc., then
after this fix is installed, your inbound speed will be less than
it was before the fix. You are advised to re-test and possibly
adjust your IN-BANDWIDTH accordingly.
7) The syntax which Shorewall previously used to define ingress
filters is misinterpreted by the tc utility, with the result that
rather than dropping packets exceeding the IN-BANDWIDTH, the filter
instead reclassified them. That caused 'packet reclassify loop'
errors during periods of high inbound traffic. The compiler now
generates the options in the 'tc add filter' command in an order
that tc handles correctly.
8) If a log level was specified in one of the *_DEFAULT options,
the compiler would previously raise a fatal error when applying the
default action. That has been corrected.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 7
----------------------------------------------------------------------------
1) Actions may now be used in the mangle file. To be used in the
mangle file, an action must be declared in the actions file with
the 'mangle' option. Actions with this option may only be used in
the mangle file (or in other actions with the mangle option); they
may not be used in the rules file. Mangle actions may be inlined
using the 'inline' option in the actions file.
A new template file (/usr/share/shorewall/action.mangletemplate) is
included in the release for use in creating mangle actions.
2) The 'check -r' command now uses the PAGER program unless the -d
option is also specified. Additionally, when the compiler runs with
'trace', the PAGER program is used unless -d is set.
3) It is now possible to raise an error if a condition isn't met using
the ?ERROR directive.
?ERROR
The text after ?ERROR is displayed in a standard Shorewall error
message.
4) Using the new ?ERROR directive, embedded Perl has been eliminated
from a number of standard actions.
Example from action.GlusterFS:
?if @1 !~ /^\d+/ || ! @1 || @1 > 1024
?error Invalid value for Bricks (@1)
?elsif @2 !~ /^[01]$/
?error Invalid value for IB (@2)
?endif
The above logic insures that the first action paramater is a
non-zero number <= 1024 and that the second parameter is either 0
or 1. If 2000 is passed for the first parameter, the following
error message is generated:
ERROR: Invalid value for Bricks (2000)
/usr/share/shorewall/action.GlusterFS (line 15)
from /etc/shorewall/rules (line 45)
5) Previously, inline matches were placed after column-generated
matches in the generated rule. This meant that "-p' could not be
used in inline matches. Beginning with this release, if the first
non-blank characters in an inline match is '+', then the remainder
of the inline matches are placed at the front of the generated
rule.
There are a couple of restrictions:
a. When -p is used in an inline match and the PROTO column is
supplied, then an error is generated unless the resolved
contents of the column matches the protocol specified in the
inline match. This means that only protocol numbers should
appear in the inline match.
b. Use of -i, -s, -o, or -d (or their long-form equivalents) in an
inline match will result in a compilation error if the contents
of the columns generates the same match.
6) The TCPFlags action has been modified to use '+' in inline matches
rather than embedded Perl with perl_action_tcp_handler() calls.
7) A new 'audit' action option has been added. Such actions are
expected to have at least two parameters; the first is a
target and the second is either omitted or is 'audit'.
Two existing standard actions (RST and NotSyn) have this
characteristic and they have been converted to use the 'audit'
option, eliminating embedded Perl within their bodies.
8) Within an action body, if a parameter is omitted in a DEFAULTS
statement, then the value of the corresponding action and Shorewall
variables is '-', while if the parameter is specified as '-' in
the parameter list, the value of the variables is '' if
expanded before the DEFAULTS statement.
Additionally, when an expression is evaluated, the value 0
evaluates as false; so '?IF @n' and 'IF $n' both fail if the nth
parameter is passed with value zero.
To make testing of the presense of parameters more efficient and
uniform, an new function has been added for use in ?IF and
?ELSEIF:
?IF [!] passed()
where is an action or Shoreall variable.
'passed(@n)' and 'passed($n)' evaluate to true if the nth parameter
is not empty and its contents are other than '-'. If '!' is
present, the result is inverted.
In this simple form, the expression is evaluated by the compiler
without having to invoke the (expensive) Perl exec() function. The
'passed' function may also be used in more complex expressions, but
exec() will be invoked to evaluate those expressions.
9) The MARK and CONNMARK targets are now available in the rules file,
macros, and actions. Mark ranges are not currently supported with
these targets.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 6
----------------------------------------------------------------------------
1) This release includes defect repair through Shorewall 5.0.5.1.
2) Previously, the generated function define_firewall() contained
logic for handling the 'stop' and 'clear' commands. Beginning with
this release, the function will no longer include that logic, since
the function is not called when processing those commands.
3) The 'persistent' option on a provider previously resulted in
a duplicate routing rule was created each time that the provider
was disabled. This has been corrected so that duplicate rules are
not created.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 6
----------------------------------------------------------------------------
1) The GATEWAY column in /etc/shorewall[6]/providers may now contain
the keyword 'none'. This will create a routing table with no
default route, to allow handling policy-routing senarios where a
default route is not required.
2) Previously, when both Shorewall and Docker were used on the same
system, one of two approaches had to be followed:
a) Run docker with --iptables=false and use Shorewall to
configure Netfilter.
b) Run docker with ---iptables=true and use extension scripts to
save/restore the Docker-generated rules.
The first is complex and the second is difficult to do in a way
that insures that changes to the Shorewall configuration aren't
lost during restart/reload.
In this release, a new DOCKER option is available in
shorewall.conf. When DOCKER=Yes, the generated script takes
responsibility for saving and restoring the Docker-generated rules.
The Shorewall implementation assumes that the default 'docker0'
bridge is being used.
It is recommended that docker0 be assigned to a zone in
/etc/shorewall/interfaces. When you do that, the setting
of 'routeback' for that interface determines whether
inter-container communication is allowed. If docker0 is not listed
in the interfaces file, then the generated script will save/restore
the FORWARD chain rules for that interface.
If you are using Docker's network features where bridges with names
of the form br-xxxxxxxxxxxx are created, those bridges should not
be defined to Shorewall.
Note that DOCKER=Yes is currently supported only in Shorewall and
not in Shorewall6.
3) A new SNMPtrap macro has been added and is intended to supersede
SNMPTrap. The latter is now deprecated, but is still available for
use.
4) As an alternative to entries in the ecn file, the IPv4 mangle file
now supports an ECN target for clearing the ECN flags in the TCP
header. See shorewall-mangle(8) for details.
5) The remainder of the documentation has been updated to use the new
column headings.
6) Beginning with this release, voluminous CLI output to terminals from 'show'
and 'dump' commands may be automatically paged using a program like
'less' or 'more'. The pager program to be used, if any, is
specified using the PAGER option in shorewall[6].conf.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 5
----------------------------------------------------------------------------
1) Previously, an interface could be erroneously assigned to two
different providers and the compiler did not flag that as an error.
The compiler now correctly catches this violation.
2) The alignment of the output of the 'shorewall[6] show macros'
command has been corrected.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 5
----------------------------------------------------------------------------
1) The .ip[6]tables-restore-input file may now include comments which
indicate the origin of the rules, similar to the ip[6]tables
comments that are generated when TRACK_RULES=Yes in
shorewall[6].conf. This additional information is added when
TRACK_RULES=File.
Note: This change also enhances TRACK_RULES=Yes by adding tracking
comments to additional generated ip[6]tables rules.
2) The output of 'shorewall[6] show actions' is now sorted.
3) The macro file headers have been updated to use the new
column names. Also, some macros now invoke other macros rather than
duplicating their rules. This is intended to ease future
maintenance (Tuomo Soini).
4) Additional documentation articles have been updated to use the new
column names (Tuomo Soini).
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 4
----------------------------------------------------------------------------
1) There previously existed a slight possibility that starting both
Shorewall and Shorewall6 simultaneously could lead to a failure
such as this one:
Dec 18 13:18:35 elmo.example.com shorewall6[1889]: Loading Modules...
Dec 18 13:18:38 elmo.example.com shorewall6[1889]: Another app is
currently holding the xtables lock. Perhaps you want to use
the -w option?
Dec 18 13:18:40 elmo.example.com shorewall6[1889]:
ERROR: Cannot Create Mangle chain fooX2349
Dec 18 13:18:40 elmo.example.com systemd[1]: shorewall6.service:
main process exited, code=exited, status=255/n/a
That problem can no longer occur.
2) Previously, when a source- or destination-specific RATE was
specified on a logging rule (LOG, ULOG or NFLOG), the compiler
incorrectly applied both the specified RATE as well as the global
LOGLIMIT. That has been corrected so that only the specified RATE
is applied.
3) Previously, when @caller was used within an action body, the
compiler would not create unique ip[6]tables chains for each
invocation of the action, even though the invocations had different
values of @caller. Now, each invocation of such an action creates a
separate ip[6]tables chain for each unique caller.
4) Previously, the 'status -i' command produced error output when
there were no optional interfaces. That erroneous output is no
longer produced.
5) Traffic shaping configurations that use red or codel will now
produce consistent compiled scripts. Previously, these
configurations could produce equivalent but different scripts on
consecutive compilations.
6) Previously, the Shoreall compiler enforced old rules about where
country codes could appear. As those restrictions have now been
removed, the compiler no longer issues messages such as these:
ERROR: A countrycode list may not be used in this context
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 4
----------------------------------------------------------------------------
1) Shorewall Init is now supported on OpenWRT.
2) The IPTABLES and IP6TABLES actions in the rules and mangle files
can now correctly handle logging targets (LOG, ULOG and
NFLOG). Previously, an attempt to use these targets would result in
an error similar to:
ERROR: LOG requires a level
3) To further reduce the possibility of failures caused by Shorewall
and Shorewall6 starting concurrently, a new WAIT_OPTION capability
has been implemented. On systems with that capability, all
'iptables' and 'ip6tables' commands will use the --wait option.
4) The .214.service files have been removed and the .service files
(with the exception of Debian) have been updated to use the
network-pre.target (Tuomo Soini).
5) Shorewall, Shorewall6, Shorewall-lite and Shorewall6-lite now
install /etc/sysconfig/ files for specifying
start/restart/reload options on those distributions that use
/etc/sysconfig.
6) The mangle file now supports an DIVERTHA action that provides
support for HAProxy.
To setup the HAProxy configuration described at
http://www.loadbalancer.org/blog/setting-up-haproxy-with-transparent-mode-on-centos-6-x,
place this entry in shorewall-providers(5):
#NAME NUMBER MARK DUPLICATE INTERFACE GATEWAY OPTIONS
TProxy 1 - - lo - tproxy
and use this DIVERTHA entry:
#ACTION SOURCE DEST PROTO ...
DIVERTHA - - tcp
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 3
----------------------------------------------------------------------------
1) This release includes defect repair through Shorewall 5.0.2.1.
2) To avoid interference with other subsystem settings, all released
shorewall6.conf files now specify IP_FORWARDING=keep. Previously,
the settings were inconsistent among the various sample files.
3) This release includes more fixes to the configure, install and
uninstall scripts (Matt Darfeuille).
4) Previously, Shorewall6 rejected rules in which the SOURCE contained
both an interface name and a MAC address (in Shorewall
format). That defect has been corrected so that such rules are now
accepted.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 3
----------------------------------------------------------------------------
1) The MODULESDIR option in shorewall[6].conf has been extended to
allow specification of additional directories to be added to those
defaulted by Shorewall. If the specified value begins with "+",
then the remainder of the value is assumed to be a colon-separated
list of directory names that are relative to /lib/modules/`uname
-r`.
For example, to load the xt_RTPENGINE module, you would create
/etc/shorewall/modules as follows:
INCLUDE /usr/share/shorewall/modules
loadmodule xt_RTPENGINE
You would then set MODULESDIR as:
MODULESDIR="+extra/rtpengine"
2) Previously, some of the column headings in the configuration files
required two lines to display. For example, in the rules file:
#ACTION SOURCE DESTINATION PROTOCOL DEST SOURCE
# PORT(S) PORT(S)
To use the alternative input format for such two-word columns, a
one-word abbreviation was required. For example, DEST PORTS(S) is
abbreviated as 'dport' and SOURCE PORT(S) is abbreviated as
'sport'.
The two-line column headings are also a nuisance for Emacs users
because when the key is struck, Emacs positions the cursor
based on the white space in the preceding line. So if an ACTION is
typed and the key is then depressed, rather than position the
cursor in the SOURCE column, Emacs positions it in the DEST PORT(S)
column.
To eliminate these issues, the multi-word columns have been
relabled to use their abbreviated names. Note that this relabelling
does not require modification of existing configurations. It simply
means that the sample files released with Shorewall and the
manpages that describe column-oriented files now use the
abbreviated names rather than the previous names (Tuomo Soini and
Tom Eastep).
3) ADD rules may now include a timeout value which will override
any timeout that was specified when the related ipset was created.
4) Commas are now allowed in log tags when LOGTAGONLY=Yes. Previously,
characters after the first comma in a log tag were discarded when
LOGTAGONLY=Yes.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 2
----------------------------------------------------------------------------
5.0.2.1
1) When processing the 'dump' command, the CLI now uses 'netstat' to
print socket information when the 'ss' utility is not installed.
2) Several defects in the installers/uninstallers have been corrected
(Matt Darfeuille).
5.0.2
1) This release includes defect repair up through Shoreall 5.0.1.1.
2) The MSSQL macro now allows UDP port 1434 (Tuomo Soini).
3) A number of issues with param file processing on Cygwin have been
corrected. The most serious of these issues was introduction of
syntax errors into the generated firewall script.
4) More version numbers have been removed from configuration files
and Macros (Tuomo Soini).
5) The check for use of a circular kernel log buffer (as opposed to a
log file) has been improved.
6) Previously, HOST=default was accepted by configure[.pl], but the
generated shorewallrc file was unusable. Now, HOST=default is
equivalent to HOST=linux.
7) Previously, if a circular log buffer was being used, the output of
various commands still displayed '/var/log/messages' as the log
file. Now, it is displayed as 'logread'.
8) The 'remote-*' commands now return correct exit status.
9) Previously, if LOCKFILE specified a file in a directory other than
$VARDIR, and that directory did not exist, it was not created
automatically.
10) Previously, optional interfaces were not enabled during 'start' and
'restart' unless there was at least one entry in the 'providers'
file. This resulted in these interfaces not appearing in the
output of 'shorewall[6] status -i'.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 2
----------------------------------------------------------------------------
1) The providers file now supports a 'persistent' option. When
specified, this option removes the need to configure host routes to
systems used as the 'checkip' in LSM.
As part of this change, two other configuration files have changed:
a) The 'rtrules' file now allows the rule priority to be followed
by an exclaimation mark ("!").
b) An OPTION column has been added to the 'routes' file. The only
option currently supported is 'persistent'.
The option affects the routing configuration when the provider is
disabled:
- The provider's routing table still exists and contains the
provider's default route.
- Unless 'noautosrc' is specified, connections originating from the
interfaces IP address(es) are routed via the provider's default
gateway.
- Routing rules for the provider that specify '!' after the
priority are left in place.
- 'persistent' routes for the provider are left in place, allowing
communication with local networks that are still accessible.
2) It is now possible to replace any function in the CLI libraries
except for get_config(). This is accomplished by placing the
replacement function(s) in a shell library named 'lib.cli-user' in
a directory on the CONFIG_PATH. This allows for customization of
commands as well as working around distribution-specific issues.
3) Support for OpenWRT versions BB and later has been added. Included
in this support are:
- The log display commands (show log, logwatch, etc.) no longer
depend on the 'tac' utility (although it will be used if it is
installed).
- Shorewall-core's 'configure' script detects OpenWRT and accepts
HOST=openwrt as an argument.
- Shorewall-core, Shorewall-lite and Shoreawll6-lite installers
support openwrt. Additionally, those installers no longer depend
on the 'install' utility.
- Shorewall[6]-lite will use OpenWRT's 'lock' utility to create the
LOCKFILE.
A special thanks to Matt Darfeuille for his help in making this
support possible.
4) Configuration files and extension scripts now have uniform
introductory comments (Tuomo Soini).
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1
----------------------------------------------------------------------------
1) Previously, if statistical load balancing was used in the providers
file, the default route in the main table was not deleted during
firewall start/restart. That route is now correctly deleted.
2) Certain files in /etc/shorewall[6] previously had permissions 644.
Those have been changed to 600 to match the other files in the
directories.
3) Previously, the CLI programs did not deal properly with the absense
of the 'hostname' utility. Now, if that utility is not present, the
programs look for 'uname' and if it is present, they use the 'uname
-n' command. If neither 'hostname' nor 'uname' are installed, the
programs display 'localhost' as the system name.
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 1
----------------------------------------------------------------------------
1) 'second' and 'minute' are now allowed in the LOGLIMIT
specification in place of 'sec' and 'min' respectively. This
enhancement was present in Shorewall 4.6.13 but was not available
in Shoreall 5.0.0.
2) The LEGACY_RESTART option has been superseded by the RESTART
option. RESTART may be set as follows:
RESTART=reload
Causes the 'restart' command to perform the same action as the
'reload' command. This is the default if RESTART is not set.
RESTART=restart
Causes the 'restart' command to perform a true restart (stop
followed by start).
If LEGACY_RESTART is present in shorewall[6].conf and RESTART is
not, then its setting will govern the behavior of 'restart'. The
'update' command will convert the LEGACY_RESTART setting to the
equivalent RESTART setting.
----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 0
----------------------------------------------------------------------------
1) This release includes defect repair up through Shorewall 4.6.13.1.
2) The compiled script now uses the %e date format rather than %_d,
for Busybox compatibilty. (Erich Titl)
----------------------------------------------------------------------------
N E W F E A T U R E S I N 5 . 0 . 0
----------------------------------------------------------------------------
1) To make the command names more accurately reflect what they do,
several changes have been included:
a) Beginning with this release, the 'restart' command now does a
true restart and is equivalent to a 'stop' followed by a
'start'.
b) The pre-5.0.0 'load' command has been renamed 'remote_start'.
c) The pre-5.0.0 'reload' command has been renamed 'remote_reload'.
c) The 'reload' command now performs the same function as the
pre-5.0.0 'restart' command.
d) A 'remote_restart' command has been added to Shorewall and
Shorewall6 to allow a remote 'restart' after updating the
remote firewall system's compiled script.
2) For those that can't get used to the idea of using 'reload' in
place of 'restart', a LEGACY_RESTART option has been added. The
option defaults to No but if set to Yes, then the 'restart' command
does what it has always done.
3) It is now possible to limit connections by destination address in
the rules file by prefixing the CONNLIMIT setting with 'd:'.
4) While the WORKAROUNDS setting is still present in the
shorewall[6].conf files:
a) Its default setting has been changed to No.
b) All workarounds for old distributions have been eliminated. See
the Migration Issues for additional information.
5) A number of configuration options have been eliminated:
- EXPORTPARAMS
- IPSECFILE
- LEGACY_FASTSTART
- LOGRATE *
- LOGBURST *
- WIDE_TC_MARKS *
- HIGH_ROUTE_MARKS *
- BLACKLISTNEWONLY *
A fatal error results if those flagged with an asterisk ("*")
appear in the .conf file -- run the 'shorewall[6] update' command
to convert their settings to use supported options.
A warning is issued if any of the rest appear in the .conf file.
'shorewall[6] update' will drop them from the file.
7) The -b, -D, -r, -s, -t and -n options have been removed from the
'update' command. The command now behaves as if all of those
options had been specified.
6) Support has been removed for the 'blacklist', 'tcrules',
'routestopped', 'notrack' and 'tos' files.
The 'update' command will:
- convert the 'tcrules' and 'tos' files to the equivalent 'mangle'
file.
- convert the 'blacklist' file into an equivalent 'blrules' file.
- convert the routestopped' file into the equivalent 'stoppedrules'
file.
- convert a 'notrack' file to the equivalent 'conntrack' file.
7) Beginning with this release, all macros and actions are assumed
to be FORMAT-2. FORMAT-1 macros and actions are no longer supported
and will be silently processed as if they were FORMAT-2. For most
macros and actions, this change will be of no concern, but may cause
compilation errors in rare cases.
8) Beginning with this release, COMMENT, FORMAT and SECTION lines must
begin with a question mark ("?"). The 'update' command makes these
changes for you.
9) As an alternative to INLINE_MATCHES=Yes, you may now specify inline
matches (raw ip[6]tables text) after a double semicolon (';;').
Example from the 'masq' file to split SNAT between two public
addresses on eth1:
#INTERFACE SOURCE ADDRESS
eth1 - 1.2.3.1 ;; -m statistic --mode random --probability 0.50
eth1 - 1.2.3.2
10) Options in shorewall[6].conf that accept a log level now also allow
specification of a log tag.
Example:
TCP_FLAGS_LOG_LEVEL=info:,tcpflags
11) A PROBABILITY column has been added to the masq file. One usage
scenario is to balance SNAT between two or more IP addresses on a
WAN interface:
#INTERFACE SOURCE ADDRESS
eth1 - 1.2.3.4 { probability=0.50 }
eth2 - 1.2.3.5
12) Previously, when chain names were included in a 'reset' command,
they were assumed to be filter table chains. Now, both a table name
and a chain name can be given (e.g., mangle:PREROUTING). The
specified table remains the default for the remainder of the
command unless a following entry also includes a table name.
13) An action for Gluster FS (action.GlusterFS) has been added. See the
action file for a description of the parameters.
shorewall-lite-5.0.15.6/shorewall-lite.spec 0000644 0000000 0000000 00000023407 13062527166 017224 0 ustar root root %define name shorewall-lite
%define version 5.0.15
%define release 6
%define initdir /etc/init.d
Summary: Shoreline Firewall Lite is an iptables-based firewall for Linux systems.
Name: %{name}
Version: %{version}
Release: %{release}
License: GPLv2
Packager: Tom Eastep
Group: Networking/Utilities
Source: %{name}-%{version}.tgz
URL: http://www.shorewall.net/
BuildArch: noarch
BuildRoot: %{_tmppath}/%{name}-%{version}-root
Requires: iptables iproute shorewall-core
Provides: shoreline_firewall = %{version}-%{release}
%description
The Shoreline Firewall, more commonly known as "Shorewall", is a Netfilter
(iptables) based firewall that can be used on a dedicated firewall system,
a multi-function gateway/ router/server or on a standalone GNU/Linux system.
Shorewall Lite is a companion product to Shorewall that allows network
administrators to centralize the configuration of Shorewall-based firewalls.
%prep
%setup
%build
%install
./configure.pl --host=%{_vendor} \
--prefix=%{_prefix} \
--tmpdir=%{_tmpdir} \
--perllibdir=%{perl_vendorlib} \
--libexecdir=%{_libexecdir} \
--sbindir=%{_sbindir}
DESTDIR=%{buildroot} ./install.sh
%clean
rm -rf $RPM_BUILD_ROOT
%pre
if [ -f /etc/shorewall-lite/shorewall.conf ]; then
cp -fa /etc/shorewall-lite/shorewall.conf /etc/shorewall-lite/shorewall.conf.rpmsave
fi
%post
if [ $1 -eq 1 ]; then
if [ -x %{_sbindir}/systemctl ]; then
%{_sbindir}/systemctl enable shorewall-lite
elif [ -x /usr/bin/systemctl ]; then
/usr/bin/systemctl enable shorewall-lite
elif [ -x %{_sbindir}/insserv ]; then
%{_sbindir}/insserv %{_initddir}/shorewall-lite
elif [ -x %{_sbindir}/chkconfig ]; then
%{_sbindir}/chkconfig --add shorewall-lite;
fi
elif [ -f /etc/shorewall-lite/shorewall.conf.rpmsave ]; then
mv -f /etc/shorewall-lite/shorewall-lite.conf /etc/shorewall-lite/shorewall-lite.conf.rpmnew
mv -f /etc/shorewall-lite/shorewall.conf.rpmsave /etc/shorewall-lite/shorewall-lite.conf
echo "/etc/shorewall-lite/shorewall.conf retained as /etc/shorewall-lite/shorewall-lite.conf"
echo "/etc/shorewall-lite/shorewall-lite.conf installed as /etc/shorewall-lite/shorewall-lite.conf.rpmnew"
fi
%preun
if [ $1 -eq 0 ]; then
if [ -x %{_sbindir}/systemctl ]; then
%{_sbindir}/systemctl disable shorewall-lite
elif [ -x /usr/bin/systemctl ]; then
/usr/bin/systemctl disable shorewall-lite
elif [ -x %{_sbindir}/insserv ]; then
%{_sbindir}/insserv -r %{_initddir}/shorewall-lite
elif [ -x %{_sbindir}/chkconfig ]; then
%{_sbindir}/chkconfig --del shorewall-lite
fi
fi
%files
%defattr(0644,root,root,0755)
%attr(0755,root,root) %dir /etc/shorewall-lite
%attr(0644,root,root) %config(noreplace) /etc/shorewall-lite/shorewall-lite.conf
%attr(0644,root,root) /etc/shorewall-lite/Makefile
%attr(0644,root,root) /usr/lib/systemd/system/shorewall-lite.service
%attr(0755,root,root) %dir /usr/share/shorewall-lite
%attr(0700,root,root) %dir /var/lib/shorewall-lite
%attr(0755,root,root) %dir /etc/sysconfig/
%attr(0600,root,root) %config(noreplace) /etc/sysconfig/shorewall-lite
%attr(0644,root,root) /etc/logrotate.d/shorewall-lite
%attr(0755,root,root) %{_sbindir}/shorewall-lite
%attr(0644,root,root) /usr/share/shorewall-lite/version
%attr(0644,root,root) /usr/share/shorewall-lite/configpath
%attr(- ,root,root) /usr/share/shorewall-lite/functions
%attr(0644,root,root) /usr/share/shorewall-lite/lib.base
%attr(0644,root,root) /usr/share/shorewall-lite/modules*
%attr(0644,root,root) /usr/share/shorewall-lite/helpers
%attr(0544,root,root) %{_libexecdir}/shorewall-lite/shorecap
%attr(0644,root,root) %{_mandir}/man5/shorewall-lite.conf.5.gz
%attr(0644,root,root) %{_mandir}/man5/shorewall-lite-vardir.5.gz
%attr(0644,root,root) %{_mandir}/man8/shorewall-lite.8.gz
%doc COPYING changelog.txt releasenotes.txt
%changelog
* Thu Mar 16 2017 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-6
* Wed Mar 15 2017 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-5
* Wed Mar 15 2017 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-4
* Sat Jan 07 2017 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-3
* Tue Dec 20 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-2
* Fri Dec 09 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-1
* Fri Dec 02 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-0base
* Thu Dec 01 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-0RC2
* Sun Nov 27 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-0RC1
* Thu Nov 17 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-0Beta2
* Sun Nov 06 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.15-0Beta1
* Mon Oct 31 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.14-0RC3
* Sat Oct 29 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.14-0RC2
* Thu Oct 27 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.14-0RC1
* Tue Oct 25 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.14-0Beta2
* Sun Oct 16 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.14-0Beta1
* Sun Oct 16 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.13-0base
* Sun Oct 16 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.13-0RC2
* Sun Oct 09 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.13-0RC1
* Tue Oct 04 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.13-0Beta2
* Sun Oct 02 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.13-0Beta1
* Sat Oct 01 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.12-0base
* Sat Oct 01 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.12-0RC3
* Tue Sep 27 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.12-0RC2
* Tue Sep 20 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.12-0RC1
* Tue Sep 13 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.12-0Beta2
* Sat Aug 13 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.12-0Beta1
* Sat Aug 06 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.11-0base
* Sat Jul 30 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.11-0RC1
* Wed Jul 27 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.11-0Beta2
* Tue Jul 19 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.11-0Beta1
* Fri Jul 08 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.10-1
* Sat Jun 25 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.10-0base
* Tue Jun 21 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.10-0RC1
* Tue Jun 14 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.10-0Beta2
* Mon Jun 06 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.10-0Beta1
* Thu May 12 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.9-0base
* Thu May 05 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.9-0RC1
* Thu Apr 28 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.9-0Beta2
* Mon Apr 18 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.9-0Beta1
* Fri Apr 15 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.8-0RC2
* Mon Apr 11 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.8-0RC1
* Thu Apr 07 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.8-0Beta4
* Sat Apr 02 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.8-0Beta3
* Fri Apr 01 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.8-0Beta2
* Sun Mar 27 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.8-0Beta1
* Thu Mar 24 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.7-0base
* Fri Mar 18 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.7-0RC1
* Sun Mar 13 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.7-0Beta4
* Sun Mar 13 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.7-0Beta3
* Tue Mar 08 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.7-0Beta2
* Sat Mar 05 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.7-0Beta1
* Fri Mar 04 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.6-0Beta6
* Fri Mar 04 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.6-0Beta5
* Thu Mar 03 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.6-0Beta4
* Sat Feb 27 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.6-0Beta3
* Sun Feb 21 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.6-0Beta2
* Fri Feb 19 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.6-0Beta1
* Wed Feb 17 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.5-0base
* Mon Feb 15 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.5-0RC2
* Wed Feb 03 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.5-0RC1
* Fri Jan 29 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.5-0Beta2
* Wed Jan 20 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.5-0Beta1
* Wed Jan 20 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0base
* Tue Jan 19 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0RC2
* Mon Jan 11 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0RC1
* Tue Jan 05 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0Beta2
* Sat Jan 02 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.4-0Beta1
* Sun Dec 27 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0base
* Thu Dec 24 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0RC2
* Sun Dec 13 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0RC1
* Sat Dec 05 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0Beta2
* Sat Nov 28 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.3-0Beta1
* Sat Nov 21 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-1
* Sat Nov 07 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0base
* Sun Nov 01 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0RC1
* Mon Oct 26 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0Beta2
* Mon Oct 26 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.2-0Beta1
* Tue Oct 13 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.1-1
* Mon Oct 12 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.1-0base
* Sat Oct 03 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0base
* Mon Sep 21 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0RC1
* Thu Sep 10 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0Beta2
* Mon Jul 27 2015 Tom Eastep tom@shorewall.net
- Updated to 5.0.0-0Beta1
shorewall-lite-5.0.15.6/init.suse.sh 0000755 0000000 0000000 00000005542 13062525714 015672 0 ustar root root #!/bin/sh
#
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall - V4.5
#
# This program is under GPL [http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt]
#
# (c) 1999,2000,2001,2002,2003,2004,2005,2006,2007,2012 - Tom Eastep (teastep@shorewall.net)
#
# On most distributions, this file should be called /etc/init.d/shorewall.
#
# Complete documentation is available at http://shorewall.net
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of Version 2 of the GNU General Public License
# as published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
#
# If an error occurs while starting or restarting the firewall, the
# firewall is automatically stopped.
#
# Commands are:
#
# shorewall start Starts the firewall
# shorewall restart Restarts the firewall
# shorewall reload Reload the firewall
# (same as restart)
# shorewall stop Stops the firewall
# shorewall status Displays firewall status
#
### BEGIN INIT INFO
# Provides: shorewall-lite
# Required-Start: $network $remote_fs
# Required-Stop:
# Default-Start: 2 3 5
# Default-Stop: 0 1 6
# Description: starts and stops the shorewall firewall
# Short-Description: Packet filtering firewall
### END INIT INFO
################################################################################
# Give Usage Information #
################################################################################
usage() {
echo "Usage: $0 start|stop|reload|restart|status"
exit 1
}
################################################################################
# Get startup options (override default)
################################################################################
OPTIONS=
#
# The installer may alter this
#
. /usr/share/shorewall/shorewallrc
if [ -f ${SYSCONFDIR}/shorewall-lite ]; then
. ${SYSCONFDIR}/shorewall-lite
fi
SHOREWALL_INIT_SCRIPT=1
################################################################################
# E X E C U T I O N B E G I N S H E R E #
################################################################################
command="$1"
case "$command" in
start)
exec ${SBINDIR}/shorewall-lite $OPTIONS start $STARTOPTIONS
;;
restart|reload)
exec ${SBINDIR}/shorewall-lite $OPTIONS restart $RESTARTOPTIONS
;;
status|stop)
exec ${SBINDIR}/shorewall-lite $OPTIONS $command $@
;;
*)
usage
;;
esac
shorewall-lite-5.0.15.6/shorewallrc.cygwin 0000644 0000000 0000000 00000002374 13062527166 017164 0 ustar root root #
# Cygwin Shorewall 5.0 rc file
#
BUILD=cygwin
HOST=cygwin
PREFIX=/usr #Top-level directory for shared files, libraries, etc.
SHAREDIR=${PREFIX}/share #Directory for arch-neutral files.
LIBEXECDIR=${PREFIX}/share #Directory for executable scripts.
PERLLIBDIR=${PREFIX}/share/shorewall #Directory to install Shorewall Perl module directory
CONFDIR=/etc #Directory where subsystem configurations are installed
SBINDIR=/bin #Directory where system administration programs are installed
MANDIR=${SHAREDIR}/man #Directory where manpages are installed.
INITDIR=/etc/init.d #Unused on Cygwin
INITFILE= #Unused on Cygwin
INITSOURCE= #Unused on Cygwin
ANNOTATED= #Unused on Cygwin
SERVICEDIR= #Unused on Cygwin
SERVICEFILE= #Unused on Cygwin
SYSCONFDIR= #Unused on Cygwin
SPARSE=Yes #Only install $PRODUCT/$PRODUCT.conf in $CONFDIR.
VARLIB=/var/lib #Unused on Cygwin
DEFAULT_PAGER= #Pager to use if none specified in shorewall[6].conf
shorewall-lite-5.0.15.6/default.debian 0000644 0000000 0000000 00000001654 13062525714 016202 0 ustar root root # prevent startup with default configuration
# set the following varible to 1 in order to allow Shorewall-lite to start
startup=0
# If your Shorewall-lite configuration requires detection of the ip address of
# a ppp interface, you must list such interfaces in "wait_interface" to get
# Shorewall-lite to wait until the interface is configured. Otherwise the
# script will fail because it won't be able to detect the IP address.
#
# Example:
# wait_interface="ppp0"
# or
# wait_interface="ppp0 ppp1"
# or, if you have defined in /etc/shorewall-lite/params
# wait_interface=
#
# Startup options
#
OPTIONS=""
#
# Start options
#
STARTOPTIONS=""
#
# Restart options
#
RESTARTOPTIONS=""
#
# Init Log -- if /dev/null, use the STARTUP_LOG defined in shorewall.conf
#
INITLOG=/dev/null
#
# Set this to 1 to cause '/etc/init.d/shorewall-lite stop' to place the firewall in
# a safe state rather than to open it
#
SAFESTOP=0
# EOF
shorewall-lite-5.0.15.6/modules.extensions 0000644 0000000 0000000 00000002632 13062527166 017203 0 ustar root root #
# Shorewall -- /usr/share/shorewall/modules.extensions
#
# Extensions Modules File
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
loadmodule ipt_addrtype
loadmodule ipt_ah
loadmodule ipt_CLASSIFY
loadmodule ipt_CLUSTERIP
loadmodule ipt_comment
loadmodule ipt_connmark
loadmodule ipt_CONNMARK
loadmodule ipt_conntrack
loadmodule ipt_dscp
loadmodule ipt_DSCP
loadmodule ipt_ecn
loadmodule ipt_ECN
loadmodule ipt_esp
loadmodule ipt_hashlimit
loadmodule ipt_helper
loadmodule ipt_ipp2p
loadmodule ipt_iprange
loadmodule ipt_length
loadmodule ipt_limit
loadmodule ipt_mac
loadmodule ipt_mark
loadmodule ipt_MARK
loadmodule ipt_MASQUERADE
loadmodule ipt_multiport
loadmodule ipt_NETMAP
loadmodule ipt_NOTRACK
loadmodule ipt_owner
loadmodule ipt_physdev
loadmodule ipt_pkttype
loadmodule ipt_policy
loadmodule ipt_realm
loadmodule ipt_recent
loadmodule ipt_REDIRECT
loadmodule ipt_REJECT
loadmodule ipt_SAME
loadmodule ipt_sctp
loadmodule ipt_set
loadmodule ipt_state
loadmodule ipt_tcpmss
loadmodule ipt_TCPMSS
loadmodule ipt_tos
loadmodule ipt_TOS
loadmodule ipt_ttl
loadmodule ipt_TTL
shorewall-lite-5.0.15.6/init.debian.sh 0000755 0000000 0000000 00000006214 13062525714 016132 0 ustar root root #!/bin/sh
### BEGIN INIT INFO
# Provides: shorewall-lite
# Required-Start: $network $remote_fs
# Required-Stop: $network $remote_fs
# Default-Start: S
# Default-Stop: 0 1 6
# Short-Description: Configure the firewall at boot time
# Description: Configure the firewall according to the rules specified in
# /etc/shorewall-lite
### END INIT INFO
. /lib/lsb/init-functions
SRWL=/sbin/shorewall-lite
SRWL_OPTS="-tvv"
test -n ${INITLOG:=/var/log/shorewall-lite-init.log}
[ "$INITLOG" = "/dev/null" ] && SHOREWALL_INIT_SCRIPT=1 || SHOREWALL_INIT_SCRIPT=0
export SHOREWALL_INIT_SCRIPT
test -x $SRWL || exit 0
test -x $WAIT_FOR_IFUP || exit 0
test -n "$INITLOG" || {
echo "INITLOG cannot be empty, please configure $0" ;
exit 1;
}
if [ "$(id -u)" != "0" ]
then
echo "You must be root to start, stop or restart \"Shorewall firewall\"."
exit 1
fi
echo_notdone () {
if [ "$INITLOG" = "/dev/null" ] ; then
echo "not done."
else
echo "not done (check $INITLOG)."
fi
exit 1
}
not_configured () {
echo "#### WARNING ####"
echo "the firewall won't be started/stopped unless it is configured"
if [ "$1" != "stop" ]
then
echo ""
echo "Please read about Debian specific customization in"
echo "/usr/share/doc/shorewall/README.Debian.gz."
fi
echo "#################"
exit 0
}
#
# The installer may alter this
#
. /usr/share/shorewall/shorewallrc
# parse the shorewall params file in order to use params in
# /etc/default/shorewall
if [ -f "$CONFDIR/shorewall-lite/params" ]
then
. $CONFDIR/shorewall-lite/params
fi
# check if shorewall is configured or not
if [ -f "$SYSCONFDIR/shorewall-lite" ]
then
. $SYSCONFDIR/shorewall-lite
SRWL_OPTS="$SRWL_OPTS $OPTIONS"
if [ "$startup" != "1" ]
then
not_configured
fi
else
not_configured
fi
# start the firewall
shorewall_start () {
echo -n "Starting \"Shorewall firewall\": "
$SRWL $SRWL_OPTS start $STARTOPTIONS >> $INITLOG 2>&1 && echo "done." || echo_notdone
return 0
}
# stop the firewall
shorewall_stop () {
if [ "$SAFESTOP" = 1 ]; then
echo -n "Stopping \"Shorewall Lite firewall\": "
$SRWL $SRWL_OPTS stop >> $INITLOG 2>&1 && echo "done." || echo_notdone
else
echo -n "Clearing all \"Shorewall Lite firewall\" rules: "
$SRWL $SRWL_OPTS clear >> $INITLOG 2>&1 && echo "done." || echo_notdone
fi
return 0
}
# restart the firewall
shorewall_restart () {
echo -n "Restarting \"Shorewall firewall\": "
$SRWL $SRWL_OPTS restart $RESTARTOPTIONS >> $INITLOG 2>&1 && echo "done." || echo_notdone
return 0
}
# refresh the firewall
shorewall_refresh () {
echo -n "Refreshing \"Shorewall firewall\": "
$SRWL $SRWL_OPTS refresh >> $INITLOG 2>&1 && echo "done." || echo_notdone
return 0
}
# status of the firewall
shorewall_status () {
$SRWL $SRWL_OPTS status && exit 0 || exit $?
}
case "$1" in
start)
shorewall_start
;;
stop)
shorewall_stop
;;
refresh)
shorewall_refresh
;;
force-reload|restart)
shorewall_restart
;;
status)
shorewall_status
;;
*)
echo "Usage: /etc/init.d/shorewall-lite {start|stop|refresh|restart|force-reload|status}"
exit 1
esac
exit 0
shorewall-lite-5.0.15.6/modules.essential 0000644 0000000 0000000 00000001417 13062527166 016773 0 ustar root root #
# Shorewall -- /usr/share/shorewall/modules.essential
#
# Essential Modules File
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
#
# Essential Modules
#
loadmodule nfnetlink
loadmodule x_tables
loadmodule ip_tables
loadmodule iptable_filter
loadmodule iptable_mangle
loadmodule ip_conntrack
loadmodule nf_conntrack
loadmodule nf_conntrack_ipv4
loadmodule iptable_nat
loadmodule iptable_raw
loadmodule xt_state
loadmodule xt_tcpudp
shorewall-lite-5.0.15.6/shorewall-lite.service 0000644 0000000 0000000 00000001041 13062525714 017715 0 ustar root root #
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall
#
# Copyright 2011 Jonathan Underwood
#
[Unit]
Description=Shorewall IPv4 firewall (lite)
Wants=network-online.target
After=network-online.target
Conflicts=iptables.service firewalld.service
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=-/etc/sysconfig/shorewall-lite
StandardOutput=syslog
ExecStart=/sbin/shorewall-lite $OPTIONS start $STARTOPTIONS
ExecStop=/sbin/shorewall-lite $OPTIONS stop
[Install]
WantedBy=basic.target
shorewall-lite-5.0.15.6/configure 0000755 0000000 0000000 00000012233 13062527166 015317 0 ustar root root #!/bin/bash
#
# Shorewall Packet Filtering Firewall RPM configuration program - V4.6
#
# (c) 2012,2014 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://www.shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see = ] ...
#
#
################################################################################################
#
# Build updates this
#
VERSION=5.0.15.6
case "$BASH_VERSION" in
[4-9].*)
;;
*)
echo "ERROR: This program requires Bash 4.0 or later" >&2
exit 1
;;
esac
declare -A params
declare -A options
getfileparams() {
while read option; do
case $option in
\#*)
;;
*)
on=${option%=*}
ov=${option#*=}
ov=${ov%#*}
[ -n "$on" ] && options[${on}]="${ov}"
;;
esac
done
return 0
}
for p in $@; do
if [ -n "${p}" ]; then
declare -u pn
pn=${p%=*}
pn=${pn#--}
pv=${p#*=}
if [ -n "${pn}" ]; then
case ${pn} in
VENDOR)
pn=HOST
;;
SHAREDSTATEDIR)
pn=VARLIB
;;
DATADIR)
pn=SHAREDIR
;;
esac
params[${pn}]="${pv}"
else
echo "ERROR: Invalid option ($p)" >&2
exit 1
fi
fi
done
cd $(dirname $0)
vendor=${params[HOST]}
if [ -z "$vendor" ]; then
if [ -f /etc/os-release ]; then
eval $(cat /etc/os-release | grep ^ID=)
case $ID in
fedora|rhel)
vendor=redhat
;;
debian|ubuntu)
vendor=debian
;;
opensuse)
vendor=suse
;;
*)
vendor="$ID"
;;
esac
params[HOST]="$vendor"
fi
fi
if [ -z "$vendor" ]; then
case `uname` in
Darwin)
params[HOST]=apple
rcfile=shorewallrc.apple
;;
cygwin*|CYGWIN*)
params[HOST]=cygwin
rcfile=shorewallrc.cygwin
;;
*)
if [ -f /etc/debian_version ]; then
params[HOST]=debian
ls -l /sbin/init | fgrep -q systemd && rcfile=shorewallrc.debian.systemd || rcfile=shorewallrc.debian.sysvinit
elif [ -f /etc/redhat-release ]; then
params[HOST]=redhat
rcfile=shorewallrc.redhat
elif [ -f /etc/slackware-version ] ; then
params[HOST]=slackware
rcfile=shorewallrc.slackware
elif [ -f /etc/SuSE-release ]; then
params[HOST]=suse
rcfile=shorewallrc.suse
elif [ -f /etc/arch-release ] ; then
params[HOST]=archlinux
rcfile=shorewallrc.archlinux
elif [ -f /etc/openwrt_release ]; then
params[HOST]=openwrt
rcfile=shorewallrc.openwrt
else
params[HOST]=linux
rcfile=shorewallrc.default
fi
;;
esac
vendor=${params[HOST]}
else
if [ $vendor = linux ]; then
rcfile=shorewallrc.default;
elif [ $vendor = debian -a -f /etc/debian_version ]; then
ls -l /sbin/init | fgrep -q systemd && rcfile=shorewallrc.debian.systemd || rcfile=shorewallrc.debian.sysvinit
else
rcfile=shorewallrc.$vendor
fi
if [ ! -f $rcfile ]; then
echo "ERROR: $vendor is not a recognized host type" >&2
exit 1
elif [ $vendor = default ]; then
params[HOST]=linux
vendor=linux
elif [[ $vendor == debian.* ]]; then
params[HOST]=debian
vendor=debian
fi
fi
if [ $vendor = linux ]; then
echo "INFO: Creating a generic Linux installation - " `date`;
else
echo "INFO: Creating a ${params[HOST]}-specific installation - " `date`;
fi
echo
getfileparams < $rcfile || exit 1
for p in ${!params[@]}; do
options[${p}]="${params[${p}]}"
done
echo '#' > shorewallrc
echo "# Created by Shorewall Core version $VERSION configure - " `date` >> shorewallrc
echo "# rc file: $rcfile" >> shorewallrc
echo '#' >> shorewallrc
if [ $# -gt 0 ]; then
echo "# Input: $@" >> shorewallrc
echo '#' >> shorewallrc
fi
if [ -n "${options[VARLIB]}" ]; then
if [ -z "${options[VARDIR]}" ]; then
options[VARDIR]='${VARLIB}/${PRODUCT}'
fi
elif [ -n "${options[VARDIR]}" ]; then
if [ -z "{$options[VARLIB]}" ]; then
options[VARLIB]=${options[VARDIR]}
options[VARDIR]='${VARLIB}/${PRODUCT}'
fi
fi
if [ -z "${options[SERVICEDIR]}" ]; then
options[SERVICEDIR]="${options[SYSTEMD]}"
fi
for on in \
HOST \
PREFIX \
SHAREDIR \
LIBEXECDIR \
PERLLIBDIR \
CONFDIR \
SBINDIR \
MANDIR \
INITDIR \
INITSOURCE \
INITFILE \
AUXINITSOURCE \
AUXINITFILE \
SERVICEDIR \
SERVICEFILE \
SYSCONFFILE \
SYSCONFDIR \
SPARSE \
ANNOTATED \
VARLIB \
VARDIR \
DEFAULT_PAGER
do
echo "$on=${options[${on}]}"
echo "$on=${options[${on}]}" >> shorewallrc
done
shorewall-lite-5.0.15.6/configure.pl 0000755 0000000 0000000 00000013262 13062527166 015734 0 ustar root root #! /usr/bin/perl -w
#
# Shorewall Packet Filtering Firewall RPM configuration program - V4.5
#
# (c) 2012, 2014 - Tom Eastep (teastep@shorewall.net)
#
# Shorewall documentation is available at http://www.shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see = ...
#
#
################################################################################################
use strict;
#
# Build updates this
#
use constant {
VERSION => '5.0.15.6'
};
my %params;
my %options;
my %aliases = ( VENDOR => 'HOST',
SHAREDSTATEDIR => 'VARLIB',
DATADIR => 'SHAREDIR' );
for ( @ARGV ) {
die "ERROR: Invalid option specification ( $_ )" unless /^(?:--)?(\w+)=(.*)$/;
my $pn = uc $1;
my $pv = $2 || '';
$pn = $aliases{$pn} if exists $aliases{$pn};
$params{$pn} = $pv;
}
use File::Basename;
chdir dirname($0);
my $vendor = $params{HOST};
my $rcfile;
my $rcfilename;
unless ( defined $vendor ) {
if ( -f '/etc/os-release' ) {
my $id = `cat /etc/os-release | grep ^ID=`;
chomp $id;
$id =~ s/ID=//;
if ( $id eq 'fedora' || $id eq 'rhel' ) {
$vendor = 'redhat';
} elsif ( $id eq 'opensuse' ) {
$vendor = 'suse';
} elsif ( $id eq 'ubuntu' || $id eq 'debian' ) {
my $init = `ls -l /sbin/init`;
$vendor = $init =~ /systemd/ ? 'debian.systemd' : 'debian.sysvinit';
} else {
$vendor = $id;
}
}
$params{HOST} = $vendor;
$params{HOST} =~ s/\..*//;
}
if ( defined $vendor ) {
if ( $vendor eq 'debian' && -f '/etc/debian_version' ) {
if ( -l '/sbin/init' ) {
if ( readlink('/sbin/init') =~ /systemd/ ) {
$rcfilename = 'shorewallrc.debian.systemd';
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} else {
$rcfilename = $vendor eq 'linux' ? 'shorewallrc.default' : 'shorewallrc.' . $vendor;
}
unless ( -f $rcfilename ) {
die qq("ERROR: $vendor" is not a recognized host type);
} elsif ( $vendor eq 'default' ) {
$params{HOST} = $vendor = 'linux';
} elsif ( $vendor =~ /^debian\./ ) {
$params{HOST} = $vendor = 'debian';
}
} else {
if ( -f '/etc/debian_version' ) {
$vendor = 'debian';
if ( -l '/sbin/init' ) {
if ( readlink( '/sbin/init' ) =~ /systemd/ ) {
$rcfilename = 'shorewallrc.debian.systemd';
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} else {
$rcfilename = 'shorewallrc.debian.sysvinit';
}
} elsif ( -f '/etc/redhat-release' ){
$vendor = 'redhat';
$rcfilename = 'shorewallrc.redhat';
} elsif ( -f '/etc/slackware-version' ) {
$vendor = 'slackware';
$rcfilename = 'shorewallrc.slackware';
} elsif ( -f '/etc/SuSE-release' ) {
$vendor = 'suse';
$rcfilename = 'shorewallrc.suse';
} elsif ( -f '/etc/arch-release' ) {
$vendor = 'archlinux';
$rcfilename = 'shorewallrc.archlinux';
} elsif ( `uname` =~ '^Darwin' ) {
$vendor = 'apple';
$rcfilename = 'shorewallrc.apple';
} elsif ( `uname` =~ /^Cygwin/i ) {
$vendor = 'cygwin';
$rcfilename = 'shorewallrc.cygwin';
} else {
$vendor = 'linux';
$rcfilename = 'shorewallrc.default';
}
$params{HOST} = $vendor;
}
my @localtime = localtime;
my @abbr = qw( Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec );
if ( $vendor eq 'linux' ) {
printf "INFO: Creating a generic Linux installation - %s %2d %04d %02d:%02d:%02d\n\n", $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];;
} else {
printf "INFO: Creating a %s-specific installation - %s %2d %04d %02d:%02d:%02d\n\n", $params{HOST}, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];;
}
open $rcfile, '<', $rcfilename or die "Unable to open $rcfilename for input: $!";
while ( <$rcfile> ) {
s/\s*#.*//;
unless ( /^\s*$/ ) {
chomp;
die "ERROR: Invalid entry ($_) in $rcfilename, line $." unless /\s*(\w+)=(.*)/;
$options{$1} = $2;
}
}
close $rcfile;
while ( my ( $p, $v ) = each %params ) {
$options{$p} = ${v};
}
my $outfile;
open $outfile, '>', 'shorewallrc' or die "Can't open 'shorewallrc' for output: $!";
printf $outfile "#\n# Created by Shorewall Core version %s configure.pl - %s %2d %04d %02d:%02d:%02d\n", VERSION, $abbr[$localtime[4]], $localtime[3], 1900 + $localtime[5] , @localtime[2,1,0];
print $outfile "# rc file: $rcfilename\n#\n";
print $outfile "# Input: @ARGV\n#\n" if @ARGV;
if ( $options{VARLIB} ) {
unless ( $options{VARDIR} ) {
$options{VARDIR} = '${VARLIB}/${PRODUCT}';
}
} elsif ( $options{VARDIR} ) {
$options{VARLIB} = $options{VARDIR};
$options{VARDIR} = '${VARLIB}/${PRODUCT}';
}
$options{SERVICEDIR}=$options{SYSTEMD} unless $options{SERVICEDIR};
for ( qw/ HOST
PREFIX
SHAREDIR
LIBEXECDIR
PERLLIBDIR
CONFDIR
SBINDIR
MANDIR
INITDIR
INITSOURCE
INITFILE
AUXINITSOURCE
AUXINITFILE
SERVICEDIR
SERVICEFILE
SYSCONFFILE
SYSCONFDIR
SPARSE
ANNOTATED
VARLIB
VARDIR
DEFAULT_PAGER / ) {
my $val = $options{$_} || '';
print "$_=$val\n";
print $outfile "$_=$val\n";
}
close $outfile;
1;
shorewall-lite-5.0.15.6/modules.xtables 0000644 0000000 0000000 00000002301 13062527166 016437 0 ustar root root #
# Shorewall -- /usr/share/shorewall/modules.xtables
#
# Xtables Modules File
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
loadmodule xt_AUDIT
loadmodule xt_CLASSIFY
loadmodule xt_connmark
loadmodule xt_CONNMARK
loadmodule xt_conntrack
loadmodule xt_dccp
loadmodule xt_dscp
loadmodule xt_DSCP
loadmodule xt_hashlimit
loadmodule xt_helper
loadmodule xt_ipp2p
loadmodule xt_iprange
loadmodule xt_length
loadmodule xt_limit
loadmodule xt_mac
loadmodule xt_mark
loadmodule xt_MARK
loadmodule xt_multiport
loadmodule xt_NFQUEUE
loadmodule xt_owner
loadmodule xt_physdev
loadmodule xt_pkttype
loadmodule xt_policy
loadmodule xt_sctp
loadmodule xt_tcpmss
loadmodule xt_TCPMSS
loadmodule xt_time
loadmodule xt_IPMARK
loadmodule xt_TPROXY
#
# From xtables-addons
#
loadmodule xt_condition
loadmodule xt_geoip
loadmodule xt_ipp2p
loadmodule xt_LOGMARK
loadmodule xt_RAWNAT
shorewall-lite-5.0.15.6/logrotate 0000644 0000000 0000000 00000000126 13062525714 015326 0 ustar root root /var/log/shorewall-lite-init.log {
missingok
notifempty
create 0600 root root
}
shorewall-lite-5.0.15.6/Makefile 0000644 0000000 0000000 00000001000 13062525714 015033 0 ustar root root # Shorewall Lite Makefile to restart if firewall script is newer than last restart
VARDIR=$(shell /sbin/shorewall-lite show vardir)
SHAREDIR=/usr/share/shorewall-lite
RESTOREFILE?=.restore
all: $(VARDIR)/$(RESTOREFILE)
$(VARDIR)/$(RESTOREFILE): $(VARDIR)/firewall
@/sbin/shorewall-lite -q save >/dev/null; \
if \
/sbin/shorewall-lite -q restart >/dev/null 2>&1; \
then \
/sbin/shorewall-lite -q save >/dev/null; \
else \
/sbin/shorewall-lite -q restart 2>&1 | tail >&2; exit 1; \
fi
# EOF
shorewall-lite-5.0.15.6/shorewall-lite.service.debian 0000644 0000000 0000000 00000001227 13062525714 021144 0 ustar root root #
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall
#
# Copyright 2011 Jonathan Underwood
# Copyright 2015 Tom Eastep
#
[Unit]
Description=Shorewall IPv4 firewall (lite)
Wants=network-online.target
After=network-online.target
Conflicts=iptables.service firewalld.service
[Service]
Type=oneshot
RemainAfterExit=yes
EnvironmentFile=-/etc/default/shorewall-lite
StandardOutput=syslog
ExecStart=/sbin/shorewall-lite $OPTIONS start $STARTOPTIONS
ExecStop=/sbin/shorewall-lite $OPTIONS clear
ExecReload=/sbin/shorewall-lite $OPTIONS reload $RELOADOPTIONS
[Install]
WantedBy=basic.target
shorewall-lite-5.0.15.6/modules 0000644 0000000 0000000 00000001323 13062527166 015001 0 ustar root root #
# Shorewall version 5 - Modules File
#
# /usr/share/shorewall/modules
#
# This file loads the modules that may be needed by the firewall.
#
# THE ORDER OF THE COMMANDS BELOW IS IMPORTANT!!!!!! You MUST load in
# dependency order. i.e., if M2 depends on M1 then you must load M1
# before you load M2.
#
# If you need to modify this file, copy it to /etc/shorewall and modify the
# copy.
#
###############################################################################
#
# Essential Modules
#
INCLUDE modules.essential
#
# Other xtables modules
#
INCLUDE modules.xtables
#
# Helpers
#
INCLUDE helpers
#
# Ipset
#
INCLUDE modules.ipset
#
# Traffic Shaping
#
INCLUDE modules.tc
#
# Extensions
#
INCLUDE modules.extensions
shorewall-lite-5.0.15.6/shorewall-lite.conf 0000644 0000000 0000000 00000003365 13062525714 017215 0 ustar root root ###############################################################################
# /etc/shorewall-lite/shorewall-lite.conf Version 5 - Change the following
# variables to override the values in the shorewall.conf file used to
# compile /var/lib/shorewall-lite/firewall. Those values may be found in
# /var/lib/shorewall-lite/firewall.conf.
#
# For information about the settings in this file, type
# "man shorewall-lite.conf"
#
# Manpage also online at
# http://www.shorewall.net/manpages/shorewall-lite.conf.html
###############################################################################
# N 0 T E
###############################################################################
# Entries in this file override entries in the shorewall.conf file in the
# export directory when the firewall script was compiled. Any variable
# not set here assumes the value defined at firewall compilation time.
#
# PROVIDED THAT shorewall.conf IN THE EXPORT DIRECTORY IS CORRECT, YOU DO NOT
# NEED TO MODIFY THIS FILE IN ANY WAY
###############################################################################
# V E R B O S I T Y
###############################################################################
VERBOSITY=
###############################################################################
# L O G G I N G
###############################################################################
LOGFILE=
###############################################################################
# L O C A T I O N O F F I L E S A N D D I R E C T O R I E S
###############################################################################
IPTABLES=
PATH=
SHOREWALL_SHELL=
SUBSYSLOCK=
RESTOREFILE=
#LAST LINE -- DO NOT REMOVE
shorewall-lite-5.0.15.6/manpages/ 0000755 0000000 0000000 00000000000 13062527312 015173 5 ustar root root shorewall-lite-5.0.15.6/manpages/shorewall-lite.8 0000644 0000000 0000000 00000101542 13062527312 020222 0 ustar root root '\" t
.\" Title: shorewall-lite
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.78.1
shorewall-lite.conf
5
Configuration Files
shorewall-lite.conf
Shorewall Lite global configuration file
/etc/shorewall-lite/shorewall-lite.conf
Description
This file sets options that apply to Shorewall Lite as a
whole.
The file consists of Shell comments (lines beginning with '#'),
blank lines and assignment statements
(variable =value ). Each
variable's setting is preceded by comments that describe the variable and
it's effect.
Any option not specified in this file gets its value from the
shorewall.conf file used during compilation of
/var/lib/shorewall-lite/firewall. Those settings may be found in the file
/var/lib/shorewall-lite/firewall.conf.
OPTIONS
The following options may be set in shorewall.conf.
IPTABLES= [pathname ]
This parameter names the iptables executable to be used by
Shorewall. If not specified or if specified as a null value, then
the iptables executable located using the PATH option is
used.
LOGFILE= [pathname ]
This parameter tells the /sbin/shorewall program where to look
for Shorewall messages when processing the dump , logwatch , show
log , and hits commands.
If not assigned or if assigned an empty value, /var/log/messages is
assumed.
LOGFORMAT= [" formattemplate " ]
The value of this variable generate the --log-prefix setting
for Shorewall logging rules. It contains a “printf” formatting
template which accepts three arguments (the chain name, logging rule
number (optional) and the disposition). To use LOGFORMAT with
fireparse, set it as:
LOGFORMAT="fp=%s:%d a=%s "
If the LOGFORMAT value contains the substring “%d” then the
logging rule number is calculated and formatted in that position; if
that substring is not included then the rule number is not included.
If not supplied or supplied as empty (LOGFORMAT="") then
“Shorewall:%s:%s:” is assumed.
PATH= pathname [: pathname ]...
Determines the order in which Shorewall searches directories
for executable files.
RESTOREFILE= [filename ]
Specifies the simple name of a file in /var/lib/shorewall to
be used as the default restore script in the shorewall save , shorewall restore , shorewall forget and shorewall -f start commands.
SHOREWALL_SHELL= [pathname ]
This option is used to specify the shell program to be used to
run the Shorewall compiler and to interpret the compiled script. If
not specified or specified as a null value, /bin/sh is assumed.
Using a light-weight shell such as ash or dash can significantly
improve performance.
SUBSYSLOCK= [pathname ]
This parameter should be set to the name of a file that the
firewall should create if it starts successfully and remove when it
stops. Creating and removing this file allows Shorewall to work with
your distribution's initscripts. For RedHat, this should be set to
/var/lock/subsys/shorewall. For Debian, the value is
/var/state/shorewall and in LEAF it is /var/run/shorewall.
VERBOSITY=[number ]
Shorewall has traditionally been very noisy (produced lots of
output). You may set the default level of verbosity using the
VERBOSITY OPTION.
Values are:
0 - Silent. You may make it more verbose using the -v
option
1 - Major progress messages displayed
2 - All progress messages displayed (old default
behavior)
If not specified, then 2 is assumed.
FILES
/etc/shorewall-lite/shorewall.conf
See ALSO
http://www.shorewall.net/Documentation_Index.html shorewall-lite(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall-tcclasses(5), shorewall-tcdevices(5), shorewall-tcrules(5),
shorewall-tos(5), shorewall-tunnels(5), shorewall-zones(5)
shorewall-lite-5.0.15.6/manpages/shorewall-lite.conf.5 0000644 0000000 0000000 00000013264 13062527311 021145 0 ustar root root '\" t
.\" Title: shorewall-lite.conf
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.78.1
shorewall-lite-vardir
5
Configuration Files
vardir
Shorewall Lite file
/etc/shorewall-lite/vardir
Description
This file does not exist by default. You may create the file if you
want to change the directory used by Shorewall Lite to store state
information, including compiled firewall scripts. By default, the
directory used is /var/lib/shorewall-lite/ .
The file contains a single variable assignment:
VARDIR= directory where directory is the name of a
directory. If you add this file, you should copy the files from
/var/lib/shorewall-lite to the new directory before
performing a shorewall-lite restart .
Beginning with Shorewall 4.5.2, use of this file is deprecated in
favor of specifying VARDIR in the shorewallrc file
used during installation of Shorewall Core. While the name of the
variable remains VARDIR, the meaning is slightly different. When set in
shorewallrc, Shorewall Lite, will create a directory under the specified
path name to hold state information.
Example:
VARDIR=/opt/var/lib/
The state directory for Shorewall Lite will be
/opt/var/lib/shorewall-lite/.
When VARDIR is set in /etc/shorewall-lite/vardir, Shorewall Lite
will save its state in the directory
specified.
Example
VARDIR=/root/shorewall
FILES
/etc/shorewall-lite/vardir
See ALSO
shorewall(8), shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall-interfaces(5),
shorewall-ipsec(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-route_rules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-tcclasses(5), shorewall-tcdevices(5),
shorewall-tcrules(5), shorewall-tos(5), shorewall-tunnels(5),
shorewall-zones(5)
shorewall-lite-5.0.15.6/manpages/shorewall-lite-vardir.5 0000644 0000000 0000000 00000006524 13062527312 021510 0 ustar root root '\" t
.\" Title: shorewall-lite-vardir
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.78.1
shorewall-lite
8
Administrative Commands
shorewall-lite
Administration tool for Shoreline Firewall Lite (Shorewall
Lite)
shorewall-lite
trace |debug nolock -options
add interface [:host-list ]zone
shorewall-lite
trace |debug nolock -options
allow address
shorewall-lite
trace |debug nolock -options
blacklist address
shorewall-lite
trace |debug nolock -options
allow address
shorewall-lite
trace |debug nolock -options
clear -f
shorewall-lite
trace |debug nolock -options
close
open-number |
source dest protocol
port
shorewall-lite
trace |debug nolock -options
delete interface [:host-list ]zone
shorewall-lite
trace |debug nolock -options
disable { interface |
provider }
shorewall-lite
trace |debug nolock -options
drop address
shorewall-lite
trace |debug -options
dump -x -l -m -c
shorewall-lite
trace |debug nolock -options
enable { interface |
provider }
shorewall-lite
trace |debug nolock -options
forget filename
shorewall-lite
trace |debug -options
help
shorewall-lite
trace |debug -options
hits -t
shorewall-lite
trace |debug -options
ipcalc
address
mask address /vlsm
shorewall-lite
trace |debug -options
iprange address1 - address2
shorewall-lite
trace |debug -options
iptrace iptables match
expression
shorewall-lite
trace |debug nolock -options
logdrop address
shorewall-lite
trace |debug -options
logwatch -m refresh-interval
shorewall-lite
trace |debug nolock -options
logreject address
shorewall-lite
trace |debug -options
noiptrace iptables match
expression
shorewall-lite
open
source dest
protocol port
shorewall-lite
trace |debug nolock -options
reenable { interface |
provider }
shorewall-lite
trace |debug nolock -options
reject address
shorewall-lite
trace |debug nolock -options
reload -n -p -C
shorewall-lite
trace |debug nolock -options
reset
shorewall-lite
trace |debug nolock -options
restart -n -p -C
shorewall-lite
trace |debug nolock -options
restore -C filename
shorewall-lite
trace |debug nolock -options
run function
parameter ...
shorewall-lite
trace |debug nolock -options
save -C filename
shorewall-lite
trace |debug nolock -options
savesets
shorewall-lite
trace |debug -options
show | list | ls -b -x -l -t
{filter |mangle |nat |raw|rawpost }chain chain
shorewall-lite
trace |debug -options
show | list | ls -x {bl|blacklists}
shorewall-lite
trace |debug -options
show | list | ls -f capabilities
shorewall-lite
trace |debug -options
show | list | ls classifiers|connections|config|events|filters|ip|ipa|zones|policies|marks
shorewall-lite
trace |debug -options
show | list | ls event event
shorewall-lite
trace |debug -options
show | list | ls -c routing
shorewall-lite
trace |debug -options
show | list | ls -x mangle|nat|raw|rawpost
shorewall-lite
trace |debug -options
show | list | ls tc
shorewall-lite
trace |debug -options
show | list | ls -m log
shorewall-lite
trace |debug nolock -options
start -n -p -f -C
shorewall-lite
trace |debug nolock -options
stop
shorewall-lite
trace |debug -options
status -i
shorewall-lite
trace |debug -options
version -a
Description
The shorewall-lite utility is used to control the Shoreline Firewall
Lite (Shorewall Lite).
Options
The trace and debug options are
used for debugging. See http://www.shorewall.net/starting_and_stopping_shorewall.htm#Trace .
The nolock option prevents the command from
attempting to acquire the Shorewall-lite lockfile. It is useful if you
need to include shorewall commands in the
started extension script .
The options control the amount of output that
the command produces. They consist of a sequence of the letters v and q . If the
options are omitted, the amount of output is determined by the setting of
the VERBOSITY parameter in shorewall.conf (5). Each v adds one to the effective verbosity and each
q subtracts one from the effective
VERBOSITY. Alternately, v may be followed
immediately with one of -1,0,1,2 to specify VERBOSITY. There may be no
white-space between v and the
VERBOSITY.
The options may also include the letter
t which causes all progress messages to be
timestamped.
Commands
The available commands are listed below.
add {
interface [:host-list ]...
zone | zone
host-list }
Adds a list of hosts or subnets to a dynamic zone usually used
with VPN's.
The interface argument names an interface
defined in the shorewall-interfaces (5)
file. A host-list is comma-separated list whose
elements are host or network addresses.
The add command is not very robust. If
there are errors in the host-list , you
may see a large number of error messages yet a subsequent
shorewall-lite show zones command will indicate
that all hosts were added. If this happens, replace
add by delete and run the
same command again. Then enter the correct command.
allow
address
Re-enables receipt of packets from hosts previously
blacklisted by a drop , logdrop , reject , or logreject command. Beginning with Shorewall
5.0.10, this command can also re-enable addresses blacklisted using
the blacklist command.
blacklist
address [ option
... ]
Added in Shorewall 5.0.8 and requires
DYNAMIC_BLACKLIST=ipset.. in shorewall.conf (5).
Causes packets from the given host or network
address to be dropped, based on the
setting of BLACKLIST in shorewall.conf (5). The
address along with any
option s are passed to the ipset
add command.
If the disconnect option is specified in the
DYNAMIC_BLACKLISTING setting, then the effective VERBOSITY
determines the amount of information displayed:
If the effective verbosity is > 0, then a message
giving the number of conntrack flows deleted by the command is
displayed.
If the effective verbosity is > 1, then the conntrack
table entries deleted by the command are also displayed.
call function [
parameter ... ]
Added in Shorewall 4.6.10. Allows you to call a function in
one of the Shorewall libraries or in your compiled script. function
must name the shell function to be called. The listed parameters are
passed to the function.
The function is first searched for in
lib.base , lib.common and
lib.cli . If it is not found, the call command
is passed to the generated script to be executed.
clear
[-f ]
Clear will remove all rules and chains installed by
Shorewall-lite. The firewall is then wide open and unprotected.
Existing connections are untouched. Clear is often used to see if
the firewall is causing connection problems.
If -f is given, the command will be processed
by the compiled script that executed the last successful start , reload , restart or refresh command if that script exists.
close {
open-number |
source dest [
protocol [ port
] ] }
Added in Shorewall 4.5.8. This command closes a temporary open
created by the open command. In the first form,
an open-number specifies the open to be
closed. Open numbers are displayed in the num column of the output of the
shorewall-lite show opens command.
When the second form of the command is used, the parameters
must match those given in the earlier open
command.
delete {
interface [:host-list ]...
zone | zone
host-list }
The delete command reverses the effect of an earlier add command.
The interface argument names an interface
defined in the shorewall-interfaces (5)
file. A host-list is comma-separated list whose
elements are a host or network address.
disable {
interface |
provider }
Added in Shorewall 4.4.26. Disables the optional provider
associated with the specified interface
or provider . Where more than one provider
share a single network interface, a
provider name must be given.
drop
address
Causes traffic from the listed address es
to be silently dropped.
dump [-x ]
[-l ] [-m ]
[-c ]
Produces a verbose report about the firewall configuration for
the purpose of problem analysis.
The -x option causes actual
packet and byte counts to be displayed. Without that option, these
counts are abbreviated. The -m
option causes any MAC addresses included in Shorewall-lite log
messages to be displayed.
The -l option causes the rule
number for each Netfilter rule to be displayed.
The -c option causes the route cache to be
dumped in addition to the other routing information.
enable {
interface |
provider }
Added in Shorewall 4.4.26. Enables the optional provider
associated with the specified interface
or provider . Where more than one provider
share a single network interface, a
provider name must be given.
forget [
filename ]
Deletes /var/lib/shorewall-lite/filename
and /var/lib/shorewall-lite/save. If no
filename is given then the file specified by
RESTOREFILE in shorewall.conf (5) is
assumed.
help
Displays a syntax summary.
hits
[-t ]
Generates several reports from Shorewall-lite log messages in
the current log file. If the -t option is included,
the reports are restricted to log messages generated today.
ipcalc { address mask |
address/vlsm }
Ipcalc displays the network address, broadcast address,
network in CIDR notation and netmask corresponding to the
input[s].
iprange
address1 -address2
Iprange decomposes the specified range of IP addresses into
the equivalent list of network/host addresses.
iptrace iptables
match expression
This is a low-level debugging command that causes iptables
TRACE log records to be created. See iptables(8) for details.
The iptables match expression must
be one or more matches that may appear in both the raw table OUTPUT
and raw table PREROUTING chains.
The trace records are written to the kernel's log buffer with
facility = kernel and priority = warning, and they are routed from
there by your logging daemon (syslogd, rsyslog, syslog-ng, ...) --
Shorewall-lite has no control over where the messages go; consult
your logging daemon's documentation.
list
list is a synonym for
show -- please see below.
logdrop
address
Causes traffic from the listed address es
to be logged then discarded. Logging occurs at the log level
specified by the BLACKLIST_LOGLEVEL setting in shorewall.conf (5).
logwatch [-m ]
[refresh-interval ]
Monitors the log file specified by the LOGFILE option in
shorewall.conf (5) and
produces an audible alarm when new Shorewall-lite messages are
logged. The -m option causes the
MAC address of each packet source to be displayed if that
information is available. The
refresh-interval specifies the time in
seconds between screen refreshes. You can enter a negative number by
preceding the number with "--" (e.g., shorewall-lite
logwatch -- -30 ). In this case, when a packet count
changes, you will be prompted to hit any key to resume screen
refreshes.
logreject
address
Causes traffic from the listed address es
to be logged then rejected. Logging occurs at the log level
specified by the BLACKLIST_LOGLEVEL setting in shorewall.conf (5).
ls
ls is a synonym for show
-- please see below.
noiptrace iptables
match expression
This is a low-level debugging command that cancels a trace
started by a preceding iptrace command.
The iptables match expression must
be one given in the iptrace command being
canceled.
open
source dest [
protocol [ port
] ]
Added in Shorewall 4.6.8. This command requires that the
firewall be in the started state and that DYNAMIC_BLACKLIST=Yes in
shorewall.conf
(5) . The effect of the command is to temporarily open the
firewall for connections matching the parameters.
The source and
dest parameters may each be specified as
all if you don't wish to restrict
the connection source or destination respectively. Otherwise, each
must contain a host or network address or a valid DNS name.
The protocol may be specified
either as a number or as a name listed in /etc/protocols. The
port may be specified numerically or as a
name listed in /etc/services.
To reverse the effect of a successful open
command, use the close command with the same
parameters or simply restart the firewall.
Example: To open the firewall for SSH connections to address
192.168.1.1, the command would be:
shorewall-lite open all 192.168.1.1 tcp 22
To reverse that command, use:
shorewall-lite close all 192.168.1.1 tcp 22
reenable {
interface |
provider }
Added in Shorewall 4.6.9. This is equivalent to a
disable command followed by an
enable command on the specified
interface or
provider .
reject
address
Causes traffic from the listed address es
to be silently rejected.
reload [-n] [-p]
[-C ]
Added in Shorewall 5.0.0, reload is similar to shorewall-lite start except that it assumes
that the firewall is already started. Existing connections are
maintained.
The -n option causes Shorewall-lite to avoid
updating the routing table(s).
The -p option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.
The -C option was added in Shorewall 4.6.5.
If the specified (or implicit) firewall script is the one that
generated the current running configuration, then the running
netfilter configuration will be reloaded as is so as to preserve the
iptables packet and byte counters.
reset [chain ,
...]
Resets the packet and byte counters in the specified
chain (s). If no
chain is specified, all the packet and
byte counters in the firewall are reset.
restart [-n] [-p]
[-C ]
Beginning with Shorewall 5.0.0, this command performs a true
restart. The firewall is completely stopped as if a
stop command had been issued then it is started
again.
The -n option causes Shorewall-lite to avoid
updating the routing table(s).
The -p option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.
The -C option was added in Shorewall 4.6.5.
If the specified (or implicit) firewall script is the one that
generated the current running configuration, then the running
netfilter configuration will be reloaded as is so as to preserve the
iptables packet and byte counters.
restore [-n ]
[-p ] [-C ] [
filename ]
Restore Shorewall-lite to a state saved using the shorewall-lite save command. Existing
connections are maintained. The filename names
a restore file in /var/lib/shorewall-lite created using shorewall-lite save ; if no
filename is given then Shorewall-lite will be
restored from the file specified by the RESTOREFILE option in shorewall.conf (5).
If your iptables ruleset depends on variables that are
detected at run-time, either in your params file or by
Shorewall-generated code, restore will use the
values that were current when the ruleset was saved, which may be
different from the current values.
The -n option causes Shorewall to avoid
updating the routing table(s).
The -p option, added in Shorewall 4.6.5,
causes the connection tracking table to be flushed; the
conntrack utility must be installed to use this
option.
The -C option was added in Shorewall 4.6.5.
If the -C option was specified during shorewall save , then the counters saved by
that operation will be restored.
run
command [
parameter ... ]
Added in Shorewall 4.6.3. Executes
command in the context of the generated
script passing the supplied parameter s.
Normally, the command will be a function
declared in lib.private .
Before executing the command , the
script will detect the configuration, setting all SW_* variables and
will run your init extension script with
$COMMAND = 'run'.
save [-C ] [
filename ]
The dynamic blacklist is stored in
/var/lib/shorewall-lite/save. The state of the firewall is stored in
/var/lib/shorewall-lite/filename for use by the
shorewall-lite restore . If
filename is not given then the state is saved
in the file specified by the RESTOREFILE option in shorewall.conf (5).
The -C option, added in Shorewall 4.6.5,
causes the iptables packet and byte counters to be saved along with
the chains and rules.
savesets
Added in shorewall 4.6.8. Performs the same action as the
stop command with respect to saving ipsets (see
the SAVE_IPSETS option in shorewall.conf (5)).
This command may be used to proactively save your ipset contents in
the event that a system failure occurs prior to issuing a
stop command.
show
The show command can have a number of different
arguments:
bl|blacklists
[-x ]
Added in Shorewall 4.6.2. Displays the dynamic chain
along with any chains produced by entries in
shorewall-blrules(5).The -x
option is passed directly through to iptables and causes
actual packet and byte counts to be displayed. Without this
option, those counts are abbreviated.
[-f ] capabilities
Displays your kernel/iptables capabilities. The
-f option causes the display
to be formatted as a capabilities file for use with compile -e .
[-b ] [-x ]
[-l ] [-t
{filter |mangle |nat |raw |rawpost }]
[ chain ... ]
The rules in each chain are
displayed using the iptables
-L chain -n -v command. If no
chain is given, all of the chains in the
filter table are displayed. The -x option is passed directly through to
iptables and causes actual packet and byte counts to be
displayed. Without this option, those counts are abbreviated.
The -t option specifies the
Netfilter table to display. The default is filter .
The -b ('brief') option
causes rules which have not been used (i.e. which have zero
packet and byte counts) to be omitted from the output. Chains
with no rules displayed are also omitted from the
output.
The -l option causes
the rule number for each Netfilter rule to be
displayed.
If the t option and the
chain keyword are both omitted and any of the
listed chain s do not exist, a usage
message is displayed.
classifiers|filters
Displays information about the packet classifiers
defined on the system as a result of traffic shaping
configuration.
config
Displays distribution-specific defaults.
connections
[filter_parameter
...]
Displays the IP connections currently being tracked by
the firewall.
If the conntrack utility is
installed, beginning with Shorewall 4.6.11 the set of
connections displayed can be limited by including conntrack
filter parameters (-p , -s, --dport, etc). See conntrack(8)
for details.
event
event
Added in Shorewall 4.5.19. Displays the named
event.
events
Added in Shorewall 4.5.19. Displays all events.
ip
Displays the system's IPv4 configuration.
ipa
Added in Shorewall 4.4.17. Displays the per-IP
accounting counters (shorewall-accounting
(5)).
[-m ] log
Displays the last 20 Shorewall-lite messages from the
log file specified by the LOGFILE option in shorewall.conf (5). The
-m option causes the MAC
address of each packet source to be displayed if that
information is available.
[-x ] mangle
Displays the Netfilter mangle table using the command
iptables -t mangle -L -n -v .
The -x option is passed
directly through to iptables and causes actual packet and byte
counts to be displayed. Without this option, those counts are
abbreviated.
marks
Added in Shorewall 4.4.26. Displays the various fields
in packet marks giving the min and max value (in both decimal
and hex) and the applicable mask (in hex).
nat
Displays the Netfilter nat table using the command
iptables -t nat -L -n -v .The
-x option is passed directly
through to iptables and causes actual packet and byte counts
to be displayed. Without this option, those counts are
abbreviated.
opens
Added in Shorewall 4.5.8. Displays the iptables rules in
the 'dynamic' chain created through use of the open
command..
policies
Added in Shorewall 4.4.4. Displays the applicable policy
between each pair of zones. Note that implicit intrazone
ACCEPT policies are not displayed for zones associated with a
single network where that network doesn't specify
routeback .
routing
Displays the system's IPv4 routing configuration. The -c
option causes the route cache to be displayed in addition to
the other routing information.
raw
Displays the Netfilter raw table using the command
iptables -t raw -L -n -v .The
-x option is passed directly
through to iptables and causes actual packet and byte counts
to be displayed. Without this option, those counts are
abbreviated.
tc
Displays information about queuing disciplines, classes
and filters.
zones
Displays the current composition of the Shorewall zones
on the system.
start [-p ]
[-n ] [-f ]
[-C ]
Start Shorewall Lite. Existing connections through
shorewall-lite managed interfaces are untouched. New connections
will be allowed only if they are allowed by the firewall rules or
policies.
The -p option causes the connection tracking
table to be flushed; the conntrack utility must
be installed to use this option.
The -n option prevents the firewall script
from modifying the current routing configuration.
The -f option was added in Shorewall 4.6.5.
If the RESTOREFILE named in shorewall.conf (5) exists, is
executable and is not older than the current filewall script, then
that saved configuration is restored.
The -C option was added in Shorewall 4.6.5
and is only meaningful when the -f option is also
specified. If the previously-saved configuration is restored, and if
the -C option was also specified in the save command, then the packet and byte
counters will be restored.
stop
Stops the firewall. All existing connections, except those
listed in shorewall-routestopped (5)
or permitted by the ADMINISABSENTMINDED option in shorewall.conf (5), are taken down.
The only new traffic permitted through the firewall is from systems
listed in shorewall-routestopped (5)
or by ADMINISABSENTMINDED.
If -f is given, the command will be processed
by the compiled script that executed the last successful start , restart or refresh command if that script exists.
status
Produces a short report about the state of the
Shorewall-configured firewall.
The -i option was added in Shorewall 4.6.2
and causes the status of each optional or provider interface to be
displayed.
version
Displays Shorewall's version. The -a option
is included for compatibility with earlier Shorewall releases and is
ignored.
EXIT STATUS
In general, when a command succeeds, status 0 is returned; when the
command fails, a non-zero status is returned.
The status command returns exit status as
follows:
0 - Firewall is started.
3 - Firewall is stopped or cleared
4 - Unknown state; usually means that the firewall has never been
started.
ENVIRONMENT
Two environmental variables are recognized by Shorewall-lite:
SHOREWALL_INIT_SCRIPT
When set to 1, causes Std out to be redirected to the file
specified in the STARTUP_LOG option in shorewall.conf(5) .
SW_LOGGERTAG
Added in Shorewall 5.0.8. When set to a non-empty value, that
value is passed to the logger utility in its -t (--tag)
option.
FILES
/etc/shorewall-lite/
See ALSO
http://www.shorewall.net/starting_and_stopping_shorewall.htm shorewall-accounting(5), shorewall-actions(5),
shorewall-blacklist(5), shorewall-hosts(5), shorewall_interfaces(5),
shorewall-ipsets(5), shorewall-maclist(5), shorewall-masq(5),
shorewall-nat(5), shorewall-netmap(5), shorewall-params(5),
shorewall-policy(5), shorewall-providers(5), shorewall-proxyarp(5),
shorewall-rtrules(5), shorewall-routestopped(5), shorewall-rules(5),
shorewall.conf(5), shorewall-secmarks(5), shorewall-tcclasses(5),
shorewall-tcdevices(5), shorewall-tcrules(5), shorewall-tos(5),
shorewall-tunnels(5), shorewall-zones(5)
shorewall-lite-5.0.15.6/lib.base 0000644 0000000 0000000 00000002065 13062525714 015011 0 ustar root root #
# Shorewall 4.4 -- /usr/share/shorewall-lite/lib.base
#
# (c) 2011,2014 - Tom Eastep (teastep@shorewall.net)
#
# Complete documentation is available at http://shorewall.net
#
# This program is part of Shorewall.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by the
# Free Software Foundation, either version 2 of the license or, at your
# option, any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, see