Hi, got the following bug report on Gentoo: https://bugs.gentoo.org/show_bug.cgi?id=578076
Copying from https://bugs.gentoo.org/show_bug.cgi?id=578076#c2: > Seems like I am the lucky one, in the meantime I was able to track > down the problem to an inline matching issue. This box has an older > config migrated to Shorewall in the past. Following blacklist rule > (blrules file) caused the trouble for version greater 5.0.6.1: > > # Filter all packets that have RH0 headers DROP all > all ; -m rt --rt-type 0 > > this generated until 5.0.6.1 a rule > -A ~blacklist1 -m rt --rt-type 0 -j DROP > which is referenced correctly, everything works as expected > > version 5.0.6.2 and 5.0.7 generate new rules: a new chain fw-loc~ > appears which is polpulated with > fw-loc~ -m rt --rt-type 0 -j DROP > inline part present, so far, ok. > > BUT ~blacklist1 is now polulated with > -A ~blacklist1 -j DROP > which is missing the inline match, generating a blackhole rule, ipv6 > connectivity successfully terminated... > > After a fair amount of crossreading through the whole shorewall docs, > because not in every place its crystal clear how inline matches are > now have to be written down, I have updated the format of the > blacklisting entry to post 5.0.3 favored to eliminate backward > compatibility issues: > > INLINE(DROP):info all all ;; -m rt --rt-type 0 > > Same result... When you diff shorewall-5.0.6.1 against 5.0.6.2 you will notice > --- /tmp/shorewall-5.0.6.1/work/Shorewall/Perl/Shorewall/Rules.pm > 2016-03-09 20:18:18.000000000 +0100 > +++ /tmp/shorewall-5.0.6.2/work/Shorewall/Perl/Shorewall/Rules.pm > 2016-03-16 22:11:41.000000000 +0100 > @@ -3427,6 +3427,10 @@ > $wild ) ) { > $generated = 1; > } > + # > + # Clear inline matches > + # > + set_inline_matches( '' ); > } > } > } The user confirmed the problem with latest shorewall-5.0.7. -Thomas
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Transform Data into Opportunity. Accelerate data analysis in your applications with Intel Data Analytics Acceleration Library. Click to learn more. http://pubads.g.doubleclick.net/gampad/clk?id=278785471&iu=/4140
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
