Shorewall 5.0.7 is now available for download. Problems Corrected:
1) This release includes defect repair from Shorewall 5.0.6.2.
2) Previously, the compiler failed to catch invalid action/chain
combinations which caused iptables-restore failures when such
combinations were present in the configuration. That has been
corrected.
3) An issue involving nested inlined action and macro invocations has
been resolved.
4) The '&' (and) and '|' (or) symbols were previously ignored when
the action was CONNMARK (mangle file). These symbols now work as
documented.
5) When 'DOCKER=Yes', 'check -r' would previously fail. The command
now works correctly.
6) Previously, the specified linklayer, overhead, mtu, mpu and tsize
were not applied to ingress qdiscs that provide IN-BANDWIDTH
limiting. That has been corrected so that these options also apply
to inbound traffic.
IMPORTANT: If you have specified linklayer, overhead, etc., then
after this fix is installed, your inbound speed will be less than
it was before the fix. You are advised to re-test and possibly
adjust your IN-BANDWIDTH accordingly.
7) The syntax which Shorewall previously used to define ingress
filters is misinterpreted by the tc utility, with the result that
rather than dropping packets exceeding the IN-BANDWIDTH, the filter
instead reclassified them. That caused 'packet reclassify loop'
errors during periods of high inbound traffic. The compiler now
generates the options in the 'tc add filter' command in an order
that tc handles correctly.
8) If a log level was specified in one of the *_DEFAULT options,
the compiler would previously raise a fatal error when applying the
default action. That has been corrected.
New Features:
1) Actions may now be used in the mangle file. To be used in the
mangle file, an action must be declared in the actions file with
the 'mangle' option. Actions with this option may only be used in
the mangle file (or in other actions with the mangle option); they
may not be used in the rules file. Mangle actions may be inlined
using the 'inline' option in the actions file.
A new template file (/usr/share/shorewall/action.mangletemplate) is
included in the release for use in creating mangle actions.
2) The 'check -r' command now uses the PAGER program unless the -d
option is also specified. Additionally, when the compiler runs with
'trace', the PAGER program is used unless -d is set.
3) It is now possible to raise an error if a condition isn't met using
the ?ERROR directive.
?ERROR <message>
The text after ?ERROR is displayed in a standard Shorewall error
message.
4) Using the new ?ERROR directive, embedded Perl has been eliminated
from a number of standard actions.
Example from action.GlusterFS:
?if @1 !~ /^\d+/ || ! @1 || @1 > 1024
?error Invalid value for Bricks (@1)
?elsif @2 !~ /^[01]$/
?error Invalid value for IB (@2)
?endif
The above logic insures that the first action paramater is a
non-zero number <= 1024 and that the second parameter is either 0
or 1. If 2000 is passed for the first parameter, the following
error message is generated:
ERROR: Invalid value for Bricks (2000)
/usr/share/shorewall/action.GlusterFS (line 15)
from /etc/shorewall/rules (line 45)
5) Previously, inline matches were placed after column-generated
matches in the generated rule. This meant that "-p' could not be
used in inline matches. Beginning with this release, if the first
non-blank characters in an inline match is '+', then the remainder
of the inline matches are placed at the front of the generated
rule.
There are a couple of restrictions:
a. When -p is used in an inline match and the PROTO column is
supplied, then an error is generated unless the resolved
contents of the column matches the protocol specified in the
inline match. This means that only protocol numbers should
appear in the inline match.
b. Use of -i, -s, -o, or -d (or their long-form equivalents) in an
inline match will result in a compilation error if the contents
of the columns generates the same match.
6) The TCPFlags action has been modified to use '+' in inline matches
rather than embedded Perl with perl_action_tcp_handler() calls.
7) A new 'audit' action option has been added. Such actions are
expected to have at least two parameters; the first is a
target and the second is either omitted or is 'audit'.
Two existing standard actions (RST and NotSyn) have this
characteristic and they have been converted to use the 'audit'
option, eliminating embedded Perl within their bodies.
8) Within an action body, if a parameter is omitted in a DEFAULTS
statement, then the value of the corresponding action and Shorewall
variables is '-', while if the parameter is specified as '-' in
the parameter list, the value of the variables is '' if
expanded before the DEFAULTS statement.
Additionally, when an expression is evaluated, the value 0
evaluates as false; so '?IF @n' and 'IF $n' both fail if the nth
parameter is passed with value zero.
To make testing of the presense of parameters more efficient and
uniform, an new function has been added for use in ?IF and
?ELSEIF:
?IF [!] passed(<variable>)
where <variable> is an action or Shoreall variable.
'passed(@n)' and 'passed($n)' evaluate to true if the nth parameter
is not empty and its contents are other than '-'. If '!' is
present, the result is inverted.
In this simple form, the expression is evaluated by the compiler
without having to invoke the (expensive) Perl exec() function. The
'passed' function may also be used in more complex expressions, but
exec() will be invoked to evaluate those expressions.
9) The MARK and CONNMARK targets are now available in the rules file,
macros, and actions. Mark ranges are not currently supported with
these targets.
Thank you for using Shorewall,
-Tom
--
Tom Eastep \ When I die, I want to go like my Grandfather who
Shoreline, \ died peacefully in his sleep. Not screaming like
Washington, USA \ all of the passengers in his car
http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Transform Data into Opportunity. Accelerate data analysis in your applications with Intel Data Analytics Acceleration Library. Click to learn more. http://pubads.g.doubleclick.net/gampad/clk?id=278785351&iu=/4140
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
