diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/changelog.txt shorewall-lite-5.0.15/changelog.txt
--- shorewall-lite-5.0.14/changelog.txt 2016-11-03 15:07:35.974677931 -0700
+++ shorewall-lite-5.0.15/changelog.txt 2016-12-02 15:08:38.209679500 -0800
@@ -1,3 +1,31 @@
+Changes in 5.0.15 Final
+
+1) Update release documents.
+
+2) Correct 'restore' exit status
+
+3) Correct optimizer defect in merge_rules().
+
+Changes in 5.0.15 RC 2
+
+1) Update release documents.
+
+2) Correct syntax error in Providers.pm.
+
+Changes in 5.0.15 RC 1
+
+1) Update release documents.
+
+2) Use $PAGER in 'show macro'.
+
+3) Implement the -p option
+
+Changes in 5.0.15 Beta 1
+
+1) Update release documents.
+
+2) Preserve shell variables over 'update'.
+
Changes in 5.0.14 Final
1) Update release documents.
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/configure shorewall-lite-5.0.15/configure
--- shorewall-lite-5.0.14/configure 2016-11-03 15:07:35.974677931 -0700
+++ shorewall-lite-5.0.15/configure 2016-12-02 15:08:38.213679517 -0800
@@ -28,7 +28,7 @@
#
# Build updates this
#
-VERSION=5.0.14
+VERSION=5.0.15
case "$BASH_VERSION" in
[4-9].*)
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/configure.pl shorewall-lite-5.0.15/configure.pl
--- shorewall-lite-5.0.14/configure.pl 2016-11-03 15:07:35.974677931 -0700
+++ shorewall-lite-5.0.15/configure.pl 2016-12-02 15:08:38.213679517 -0800
@@ -31,7 +31,7 @@
# Build updates this
#
use constant {
- VERSION => '5.0.14'
+ VERSION => '5.0.15'
};
my %params;
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/install.sh shorewall-lite-5.0.15/install.sh
--- shorewall-lite-5.0.14/install.sh 2016-11-03 15:07:35.966677973 -0700
+++ shorewall-lite-5.0.15/install.sh 2016-12-02 15:08:38.197679452 -0800
@@ -22,7 +22,7 @@
# along with this program; if not, see .
#
-VERSION=5.0.14
+VERSION=5.0.15
usage() # $1 = exit status
{
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/manpages/shorewall-lite.8 shorewall-lite-5.0.15/manpages/shorewall-lite.8
--- shorewall-lite-5.0.14/manpages/shorewall-lite.8 2016-11-03 15:08:57.694245244 -0700
+++ shorewall-lite-5.0.15/manpages/shorewall-lite.8 2016-12-02 15:10:22.050086103 -0800
@@ -2,12 +2,12 @@
.\" Title: shorewall-lite
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.78.1
-.\" Date: 11/03/2016
+.\" Date: 12/02/2016
.\" Manual: Administrative Commands
.\" Source: Administrative Commands
.\" Language: English
.\"
-.TH "SHOREWALL\-LITE" "8" "11/03/2016" "Administrative Commands" "Administrative Commands"
+.TH "SHOREWALL\-LITE" "8" "12/02/2016" "Administrative Commands" "Administrative Commands"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/manpages/shorewall-lite.conf.5 shorewall-lite-5.0.15/manpages/shorewall-lite.conf.5
--- shorewall-lite-5.0.14/manpages/shorewall-lite.conf.5 2016-11-03 15:08:56.346252381 -0700
+++ shorewall-lite-5.0.15/manpages/shorewall-lite.conf.5 2016-12-02 15:10:20.466080204 -0800
@@ -2,12 +2,12 @@
.\" Title: shorewall-lite.conf
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.78.1
-.\" Date: 11/03/2016
+.\" Date: 12/02/2016
.\" Manual: Configuration Files
.\" Source: Configuration Files
.\" Language: English
.\"
-.TH "SHOREWALL\-LITE\&.CO" "5" "11/03/2016" "Configuration Files" "Configuration Files"
+.TH "SHOREWALL\-LITE\&.CO" "5" "12/02/2016" "Configuration Files" "Configuration Files"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/manpages/shorewall-lite-vardir.5 shorewall-lite-5.0.15/manpages/shorewall-lite-vardir.5
--- shorewall-lite-5.0.14/manpages/shorewall-lite-vardir.5 2016-11-03 15:08:56.886249523 -0700
+++ shorewall-lite-5.0.15/manpages/shorewall-lite-vardir.5 2016-12-02 15:10:21.110082604 -0800
@@ -2,12 +2,12 @@
.\" Title: shorewall-lite-vardir
.\" Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.78.1
-.\" Date: 11/03/2016
+.\" Date: 12/02/2016
.\" Manual: Configuration Files
.\" Source: Configuration Files
.\" Language: English
.\"
-.TH "SHOREWALL\-LITE\-VAR" "5" "11/03/2016" "Configuration Files" "Configuration Files"
+.TH "SHOREWALL\-LITE\-VAR" "5" "12/02/2016" "Configuration Files" "Configuration Files"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/releasenotes.txt shorewall-lite-5.0.15/releasenotes.txt
--- shorewall-lite-5.0.14/releasenotes.txt 2016-11-03 15:07:35.974677931 -0700
+++ shorewall-lite-5.0.15/releasenotes.txt 2016-12-02 15:08:38.209679500 -0800
@@ -1,7 +1,7 @@
----------------------------------------------------------------------------
- S H O R E W A L L 5 . 0 . 1 4 R C 3
+ S H O R E W A L L 5 . 0 . 1 5
------------------------------
- N o v e m b e r 0 1, 2 0 1 6
+ D e c e m b e r 0 5, 2 0 1 6
----------------------------------------------------------------------------
I. PROBLEMS CORRECTED IN THIS RELEASE
@@ -14,47 +14,42 @@
I. P R O B L E M S C O R R E C T E D I N T H I S R E L E A S E
----------------------------------------------------------------------------
-1) This release includes defect repair up through Shorewall 5.0.13.4.
+1) This release includes defect repair through Shorewall 5.0.14.1.
-2) When the address variable for an optional interface was used, and
- the interface did not have an IP address when the firewall was
- started, then enabling the interface did not previously
- create/alter the rules that use the address variable. Also, if the
- IP address of a disabled interface changed, enabling the interface
- did not update/add rules using the interface's gateway address
- variable.
+2) Previously, when the 'update' command transformed a superseded
+ file's contents into a newer file, with the exception of the
+ 'notrack' -> 'conntrack' conversion, the transformation was
+ incomplete:
- Now, if the IP address of a disabled optional interface
- changes from its value (if any) when the netfilter ruleset was
- instantiated, then after a successful 'enable', the ruleset is
- automatically reloaded if the interface's address variable was
- used.
+ a) All shell variables were expanded in the converted file.
- Similarly, if 'detect' is specified as the GATEWAY for an optional
- provider, then if the gateway at the time that the provider is
- successfully enabled is different from that (if any) when the
- netfilter ruleset was instantiated, then the ruleset is
- automatically reloaded if the provider interface's run-time gateway
- variable was used.
+ b) Any lines omitted by compiler directives ( ?if.... etc. ) were
+ also omitted from the converted file.
- As part of this change, if an IP address is specified as the
- GATEWAY for a provider, then the run-time gateway variable for the
- provider's interface is expanded at compile time rather than at
- runtime.
+ These deficiencies have been corrected. Now, shell variables are
+ preserved in the converted file and omitted lines are now
+ translated.
- Example:
+ EXCEPTIONS: Because the translations of the 'blacklist' and
+ 'routestopped' files are not 1:1, omitted lines and compiler
+ directives are not transferred to the converted files. If either
+ are present, the compiler issues a warning:
- #PROVIDER NUMBER MARK DUPLICATE INTRFACE GATEWAY OPTIONS COPY
- foo 1 1 - eth0 1.2.3.4 primary -
+ WARNING: "Omitted rules and compiler directives were not
+ translated
- Then %eth0 will be expanded at compile time to '1.2.3.4'.
+3) In earlier versions, when USE_DEFAULT_RT=No in shorewall6.conf,
+ the generated script would attempt to copy fe80:* routes from the
+ DUPLICATE routing table to provider tables, which could fail.
+ Now, the generated script ignores these routes.
-3) Previously, the ADDRESS column in /etc/shorewall[6]/masq was
- documented as allowing a list of addresses and/or address ranges.
- That feature depended on iptables support which is no longer
- present in current distributions. The code now disallows more than
- one address[-range] and the documentation has been changed
- accordingly.
+4) Previously, if the 'restore' command failed, the failure was not
+ corrected reflected in the exit status. The exit status now
+ correctly indicates the outcome of the command.
+
+5) A defect in OPTIMIZE level 4 processing, could previously result in
+ the incorrect omission of a -i, -o, -s or -d rule option in an
+ optimized rules. That defect has been corrected.
----------------------------------------------------------------------------
I I. K N O W N P R O B L E M S R E M A I N I N G
@@ -67,38 +62,22 @@
correctly in configurations with USE_DEFAULT_RT=No and optional
providers listed in the DUPLICATE column.
+3) While the 'ip' utility now accepts IPv6 routes with multiple
+ 'nexthop' destinations, these routes are not balanced. They are
+ rather instantiated as a sequence of single routes with different
+ metrics. Furthermore, the 'ip route replace' command fails on
+ such routes. Beginning with Shorewall6 5.0.15, the generated script
+ will use a "delete..add.." sequence on these routes rather than a
+ single "replace" command.
+
----------------------------------------------------------------------------
I I I. N E W F E A T U R E S I N T H I S R E L E A S E
----------------------------------------------------------------------------
-1) /etc/shorewall[6]/masq has been superseded by
- /etc/shorewall[6]/snat. The new 'snat' file is similar to most of
- the other configuration files in that the first column specifies
- the ACTION to be performed, the second contains the SOURCE and so
- on.
-
- The 'shorewall[6] update' command will convert an existing masq
- file into the equivalent 'snat' file and will rename masq to
- masq.bak.
-
- See shorewall[6]-snat(5) for details.
-
-2) Actions (both inline and regular) are now supported out of the new
- snat file. Like other actions, these 'SNAT actions' must be
- declared in the /etc/shorewall[6]/actions file where the new 'nat'
- option must be specified.
-
- Like other actions, the action rules are placed in a file named
- action.. Those rules have the same format as those in the
- snat file with two restrictions:
-
- 1. The '+' is not allowed in the ACTION column to specify that the
- rules should be applied before one-to-one NAT. It must rather be
- specified when the action is invoked.
+1) The 'show macro' command now uses the configured PAGER, if any.
- 2. Interface names are not permitted in the DEST column, so all of
- the rules apply to the interface(s) specified when the action was
- invoked.
+2) The PAGER may now be deactivated through use of the '-p' option
+ (e.g., "shorewall -p show" ).
----------------------------------------------------------------------------
I V. M I G R A T I O N I S S U E S
@@ -259,6 +238,85 @@
----------------------------------------------------------------------------
V. N O T E S F R O M O T H E R 5 . 0 R E L E A S E S
----------------------------------------------------------------------------
+ P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 4
+----------------------------------------------------------------------------
+
+1) This release includes defect repair up through Shorewall 5.0.13.4.
+
+2) When the address variable for an optional interface was used, and
+ the interface did not have an IP address when the firewall was
+ started, then enabling the interface did not previously
+ create/alter the rules that use the address variable. Also, if the
+ IP address of a disabled interface changed, enabling the interface
+ did not update/add rules using the interface's gateway address
+ variable.
+
+ Now, if the IP address of a disabled optional interface
+ changes from its value (if any) when the netfilter ruleset was
+ instantiated, then after a successful 'enable', the ruleset is
+ automatically reloaded if the interface's address variable was
+ used.
+
+ Similarly, if 'detect' is specified as the GATEWAY for an optional
+ provider, then if the gateway at the time that the provider is
+ successfully enabled is different from that (if any) when the
+ netfilter ruleset was instantiated, then the ruleset is
+ automatically reloaded if the provider interface's run-time gateway
+ variable was used.
+
+ As part of this change, if an IP address is specified as the
+ GATEWAY for a provider, then the run-time gateway variable for the
+ provider's interface is expanded at compile time rather than at
+ runtime.
+
+ Example:
+
+ #PROVIDER NUMBER MARK DUPLICATE INTRFACE GATEWAY OPTIONS COPY
+ foo 1 1 - eth0 1.2.3.4 primary -
+
+ Then %eth0 will be expanded at compile time to '1.2.3.4'.
+
+3) Previously, the ADDRESS column in /etc/shorewall[6]/masq was
+ documented as allowing a list of addresses and/or address ranges.
+ That feature depended on iptables support which is no longer
+ present in current distributions. The code now disallows more than
+ one address[-range] and the documentation has been changed
+ accordingly.
+
+----------------------------------------------------------------------------
+ N E W F E A T U R E S I N 5 . 0 . 1 4
+----------------------------------------------------------------------------
+
+1) /etc/shorewall[6]/masq has been superseded by
+ /etc/shorewall[6]/snat. The new 'snat' file is similar to most of
+ the other configuration files in that the first column specifies
+ the ACTION to be performed, the second contains the SOURCE and so
+ on.
+
+ The 'shorewall[6] update' command will convert an existing masq
+ file into the equivalent 'snat' file and will rename masq to
+ masq.bak.
+
+ See shorewall[6]-snat(5) for details.
+
+2) Actions (both inline and regular) are now supported out of the new
+ snat file. Like other actions, these 'SNAT actions' must be
+ declared in the /etc/shorewall[6]/actions file where the new 'nat'
+ option must be specified.
+
+ Like other actions, the action rules are placed in a file named
+ action.. Those rules have the same format as those in the
+ snat file with two restrictions:
+
+ 1. The '+' is not allowed in the ACTION column to specify that the
+ rules should be applied before one-to-one NAT. It must rather be
+ specified when the action is invoked.
+
+ 2. Interface names are not permitted in the DEST column, so all of
+ the rules apply to the interface(s) specified when the action was
+ invoked.
+
+----------------------------------------------------------------------------
P R O B L E M S C O R R E C T E D I N 5 . 0 . 1 3
----------------------------------------------------------------------------
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/shorewall-lite.spec shorewall-lite-5.0.15/shorewall-lite.spec
--- shorewall-lite-5.0.14/shorewall-lite.spec 2016-11-03 15:07:35.970677952 -0700
+++ shorewall-lite-5.0.15/shorewall-lite.spec 2016-12-02 15:08:38.205679484 -0800
@@ -1,6 +1,6 @@
%define name shorewall-lite
-%define version 5.0.14
-%define release 0RC3
+%define version 5.0.15
+%define release 0base
%define initdir /etc/init.d
Summary: Shoreline Firewall Lite is an iptables-based firewall for Linux systems.
@@ -117,6 +117,16 @@
%doc COPYING changelog.txt releasenotes.txt
%changelog
+* Fri Dec 02 2016 Tom Eastep tom@shorewall.net
+- Updated to 5.0.15-0base
+* Thu Dec 01 2016 Tom Eastep tom@shorewall.net
+- Updated to 5.0.15-0RC2
+* Sun Nov 27 2016 Tom Eastep tom@shorewall.net
+- Updated to 5.0.15-0RC1
+* Thu Nov 17 2016 Tom Eastep tom@shorewall.net
+- Updated to 5.0.15-0Beta2
+* Sun Nov 06 2016 Tom Eastep tom@shorewall.net
+- Updated to 5.0.15-0Beta1
* Mon Oct 31 2016 Tom Eastep tom@shorewall.net
- Updated to 5.0.14-0RC3
* Sat Oct 29 2016 Tom Eastep tom@shorewall.net
diff -Naurd -X /home/teastep/shorewall/tools/build/exclude.txt shorewall-lite-5.0.14/uninstall.sh shorewall-lite-5.0.15/uninstall.sh
--- shorewall-lite-5.0.14/uninstall.sh 2016-11-03 15:07:35.970677952 -0700
+++ shorewall-lite-5.0.15/uninstall.sh 2016-12-02 15:08:38.201679468 -0800
@@ -26,7 +26,7 @@
# You may only use this script to uninstall the version
# shown below. Simply run this script to remove Shorewall Firewall
-VERSION=5.0.14
+VERSION=5.0.15
PRODUCT=shorewall-lite
Product="Shorewall Lite"