On 03/28/2016 11:41 AM, Thomas D. wrote: > Hi, > > got the following bug report on Gentoo: > https://bugs.gentoo.org/show_bug.cgi?id=578076 > > > Copying from https://bugs.gentoo.org/show_bug.cgi?id=578076#c2: > >> Seems like I am the lucky one, in the meantime I was able to track >> down the problem to an inline matching issue. This box has an older >> config migrated to Shorewall in the past. Following blacklist rule >> (blrules file) caused the trouble for version greater 5.0.6.1: >> >> # Filter all packets that have RH0 headers DROP all >> all ; -m rt --rt-type 0 >> >> this generated until 5.0.6.1 a rule >> -A ~blacklist1 -m rt --rt-type 0 -j DROP >> which is referenced correctly, everything works as expected >> >> version 5.0.6.2 and 5.0.7 generate new rules: a new chain fw-loc~ >> appears which is polpulated with >> fw-loc~ -m rt --rt-type 0 -j DROP >> inline part present, so far, ok. >> >> BUT ~blacklist1 is now polulated with >> -A ~blacklist1 -j DROP >> which is missing the inline match, generating a blackhole rule, ipv6 >> connectivity successfully terminated... >> >> After a fair amount of crossreading through the whole shorewall docs, >> because not in every place its crystal clear how inline matches are >> now have to be written down, I have updated the format of the >> blacklisting entry to post 5.0.3 favored to eliminate backward >> compatibility issues: >> >> INLINE(DROP):info all all ;; -m rt --rt-type 0 >> >> Same result... > > When you diff shorewall-5.0.6.1 against 5.0.6.2 you will notice > >> --- /tmp/shorewall-5.0.6.1/work/Shorewall/Perl/Shorewall/Rules.pm >> 2016-03-09 20:18:18.000000000 +0100 >> +++ /tmp/shorewall-5.0.6.2/work/Shorewall/Perl/Shorewall/Rules.pm >> 2016-03-16 22:11:41.000000000 +0100 >> @@ -3427,6 +3427,10 @@ >> $wild ) ) { >> $generated = 1; >> } >> + # >> + # Clear inline matches >> + # >> + set_inline_matches( '' ); >> } >> } >> } > > The user confirmed the problem with latest shorewall-5.0.7.
Thomas, I just uploaded 5.0.7.1 which corrects this problem. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------ Transform Data into Opportunity. Accelerate data analysis in your applications with Intel Data Analytics Acceleration Library. Click to learn more. http://pubads.g.doubleclick.net/gampad/clk?id=278785471&iu=/4140
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
