No migration to manage nft will happen upstream.
Be prepared to package removal, and migrate to firewalld.
- Add shorewall-fix-install-manpages.patch fix boo#1203006
- Update spec copyright and macros
- Move /etc to /usr for Networkmanager and logrotate
- Update rpmlint check list
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=281
- Update to version 5.2.7
+ **Upgrade your configuration**
https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.7/releasenotes.txt
+ Previously, it was not possible to classify traffic by destination
IP address when using an Intermediate Functional Block (IFB) for
traffic shaping. This is because such classification takes place
before the traffic passes through the mangle PREROUTING chain.
Such filtering is now possible by setting the 'connmark' option in
the tcdevices file. This option causes the current connection mark
to be copied to the packet mark prior to filtering, thus allowing
the packet mark to be used for classification.
This change adds a new CONNMARK_ACTION capability which is
required to be able to specify the 'connmark' option.
+ The tcpri file now supports ?FORMAT 2 which inserts an SPORT
column directly to the right of the PORT column. As part of this
change, the PORT column is renamed to DPORT while allowing both
'port' and 'dport' to be used in the alternate input format. See
shorewall-tcpri(5) and
http://shorewall.org/simple_traffic_shaping.html for additional
information.
+ The Simple TC document is now linked to FAQs 97 and 97a.
OBS-URL: https://build.opensuse.org/request/show/828661
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=274
- Update to version 5.2.6
+ **Upgrade your configuration**
https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.6/releasenotes.txt
+ When compiling for export, the compiler generates a firewall.conf
file which is later installed on the remote firewall system as
${VARDIR}/firewall.conf. Previously, the CLI on that firewall was
not processing the file, resulting in some features not being
available:
- Default values for VERBOSITY, LOGFILE, LOGFORMAT, PATH,
SHOREWALL_SHELL, SUBSYSLOCK, RESTOREFILE, RESTART,
DYNAMIC_BLACKLIST and PAGER are not supplied.
- scfilter file supplied at compile time.
- dumpfilter file supplied at compile time.
That has been corrected.
+ A bug in iptables (see
https://git.netfilter.org/iptables/commit/?id=d1555a0906e35ba8d170613d5a43da64e527dbe1)
prevents the '--queue-cpu-fanout' option from being applied unless
that option is the last one specified. Unfortunately, Shorewall
places the '--queue-bypass' option last if that option is also
specified.
This release works around this issue by ensuring that the
'--queue-cpu-fanout' option appears last.
+ The -D 'compile', 'check', 'reload' and 'Restart' option was
previously omitted from the output of 'shorewall help'. It is now
included. As part of this change, an incorrect and conflicting
description of the -D option was removed from the 'remote-restart'
section of shorewall(8).
+ Previously, when EXPAND_POLICIES=No, chains that enforced ACCEPT
policies were not completely optimized by optimize level 2 (ACCEPT
rules preceding the final unconditional ACCEPT were not
OBS-URL: https://build.opensuse.org/request/show/819214
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=272
+ The description of the 'optional' option has been expanded in
shorewall-interfaces(5).
+ Previously, the AUTOMAKE option did not work properly when
/etc/shorewall[6] was a symbolic link. That has been corrected.
- Packaging
+ Remove broken %pretrans, move content to %pre
+ Remove use of %release in rpm scriptlet
+ This will avoid constant rebuild.
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=268
+ When DYNAMIC_BLACKLIST=ipset... or when SAVE_IPSETS=Yes in
shorewall[6].conf, 'shorewall[6] start' could hang. Fixed.
+ 'shorewall[6] start' would not automatically create dynamic
blacklisting ipsets. That has been corrected.
- This version will served also as maintenance upgrade for Leap
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=266
https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.4/releasenotes.txt
+ Fixes for debian
- Update to version 5.2.4.1
+ Fixes for openSUSE shorewall-init
will now ignore 'start' and 'stop' commands, for running firewalls
+ Spurious messages have been removed
- Packaging
+ Move /usr/sbin/shorewall to shorewall-core so -lite version
doesn't need main shorewall package
+ To make shorewall remote-* command working we patch lib.cli-std
to use /usr/sbin instead of /sbin + commented spec
+ Desactivate for the moment the upgrade warning. we need to
find a 100% working solution.
+ use %{var} form everywhere
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=264
- Add perl-base as buildrequirement to force choice of SHA-DIGEST
new problem in TW
- To fix boo#1166114 never restart shorewall-init.service
macro service_del_postun is replaced by simplier systemd_postun
- Remove conflict between main and lite package.
A managing station need main to build configuration and can use
-lite to execute it. Users are in charge of choosing which
service has to be started and used. ❤ Freedom
- Remove shorewall require from shorewall-init (was a forgoten
action)
- Update to version 5.2.4
https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.4/releasenotes.txt
+ Previously, when a Shorewall6 firewall was placed into the
'stopped' state, ICMP6 packets required by RFC 4890 were not
automatically accepted by the generated ruleset.
Beginning with this release, those packets are automatically
accepted.
+ Previously, the output of 'shorewall[6] help' displayed the
superseded 'load' command. That text has been deleted.
+ The QOSExample.html file in the documentation and on the web site
previously showed tcrules content for the /etc/shorewall/mangle
file (recall that 'mangle' superseded 'tcrules'). That page has
been corrected.
+ The 'Starting and Stopping' and 'Configuration file basics'
documents have been updated to align them with the current product
behavior.
+ The 'ipsets' document has been updated to clarify the use of
ipsets in the stoppedrules file.
- Packaging
+ shorewall-init package has a removed %service_del_postun
macro to close bug boo#1166114 Restarting this service can
lock down admin out of the system.
+ shorewall(6) and shorewall(6)-lite conflict has they shouldn't
be installed together on the same system.
+ conf_update flag is set to 1 to activate update reminder
+ Adjust and cleanup requires
- Add version to requires in -lite version
OBS-URL: https://build.opensuse.org/request/show/793944
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/shorewall?expand=0&rev=113
- Update to version 5.2.4
https://shorewall.org/pub/shorewall/5.2/shorewall-5.2.4/releasenotes.txt
+ Previously, when a Shorewall6 firewall was placed into the
'stopped' state, ICMP6 packets required by RFC 4890 were not
automatically accepted by the generated ruleset.
Beginning with this release, those packets are automatically
accepted.
+ Previously, the output of 'shorewall[6] help' displayed the
superseded 'load' command. That text has been deleted.
+ The QOSExample.html file in the documentation and on the web site
previously showed tcrules content for the /etc/shorewall/mangle
file (recall that 'mangle' superseded 'tcrules'). That page has
been corrected.
+ The 'Starting and Stopping' and 'Configuration file basics'
documents have been updated to align them with the current product
behavior.
+ The 'ipsets' document has been updated to clarify the use of
ipsets in the stoppedrules file.
- Packaging
+ shorewall-init package has a removed %service_del_postun
macro to close bug boo#1166114 Restarting this service can
lock down admin out of the system.
+ shorewall(6) and shorewall(6)-lite conflict has they shouldn't
be installed together on the same system.
+ conf_update flag is set to 1 to activate update reminder
+ Adjust and cleanup requires
OBS-URL: https://build.opensuse.org/request/show/790648
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=259
- Update to minor bugfix version 5.2.3.7
+ When DOCKER=Yes, if both the DOCKER-ISOLATE and
DOCKER-ISOLATE-STAGE-1 existed then the DOCKER-ISOLATE-STAGE-*
chains were not preserved through shorewall state changes.
That has been corrected so that both chains are preserved if
present.
+ Previously, the compiler always detected the OLD_CONNTRACK_MATCH
capability as being available in IPv6. When OLD_CONNTRACK_MATCH
was available, the compiler also mishandled inversion ('!') in the
ORIGDEST columns, leading to an assertion failure.
Both the incorrect capability detection and the mishandled
inversion have been corrected.
+ During 'enable' processing, if address variables associated with
the interface have values different than those when the firewall
was last started/restarted/reloaded, then a 'reload' is performed
rather than a simple 'enable'. The logic that checks for those
changes was incorrect in some configurations, leading to unneeded
reload operations. That has been corrected.
+ When MANGLE_ENABLED=No in shorewall[6].conf, some features
requiring use of the mangle table can be allowed, even though the
mangle table is not updated. That has been corrected such that use
of such features will raise an error.
+ When the IfEvent(...,reset) action was invoked, the compiler
previously emitted a spurious "Resetting..." message. That message
has been suppressed.
- Packaging
+ Do not provide anymore unsused notrack file
+ Introduce define conf_need_update to track when we activate the
+ Add version to requires in -lite version
OBS-URL: https://build.opensuse.org/request/show/785384
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=257
- Update to bugfix minor 5.2.3.5
+ A typo in the FTP documentation has been corrected.
+ The recommended mss setting when using IPSec with ipcomp
has been corrected.
+ A number of incorrect links in the manpages have been
corrected.
+ The 'bypass' option is now allowed when specifying an
NFQUEUE policy. Previously, specifying that option resulted
in an error.
+ Corrected IPv6 Address Range parsing.
+ Previously, such ranges were required to be of the form
[<addr1>-<addr2>] rather than the more standard form
[<addr1>]-[<addr2>]. In the snat file (and in nat actions),
the latter form was actually flagged as an error while in
other contexts, it resulted in a less obvious error being
raised.
+ The manpages have been updated to refer to
https://shorewall.org rather than http://www.shorewall.org.
- Refresh spec file
OBS-URL: https://build.opensuse.org/request/show/766493
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=251
- Update to bugfix minor 5.2.3.3
Previously, if an ipset was specified in an SPORT column, the
compiler would raise an error similar to:
ERROR: Invalid ipset name () /etc/shorewall/rules (line 44)
- Update to bugfix minor 5.2.3.2
Shorewall 5.2 automatically converts an existing 'masq' file to an
equivalent 'snat' file. Regrettably, Shorewall 5.2.3 broke that
automatic update, such that the following error message was issued:
Use of uninitialized value $Shorewall::Nat::raw::currentline in
pattern match (m//) at /usr/share/shorewall/Shorewall/Nat.pm
line 511, <$currentfile> line nnn. and the generated 'masq'
file contains only initial comments. That has been corrected.
OBS-URL: https://build.opensuse.org/request/show/694183
OBS-URL: https://build.opensuse.org/package/show/security:netfilter/shorewall?expand=0&rev=247
