Copyright © 2001-2005 Thomas M. Eastep
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, with no Front-Cover, and with no Back-Cover Texts. A copy of the license is included in the section entitled “GNU Free Documentation License”.
2005-07-17
Table of Contents
If you use a Windows system to download a corrected script, be sure to run the script through dos2unix after you have moved it to your Linux system.
If you are installing Shorewall for the first time and plan to use the .tgz and install.sh script, you can untar the archive, replace the “firewall” script in the untarred directory with the one you downloaded below, and then run install.sh.
When the instructions say to install a corrected firewall script in /usr/share/shorewall/firewall, you may rename the existing file before copying in the new file.
DO NOT INSTALL CORRECTED COMPONENTS ON A RELEASE EARLIER THAN THE ONE THAT THEY ARE LISTED UNDER BELOW. For example, do NOT install the 2.0.2 firewall script if you are running 2.0.0-RC2
Here
is the most up to date version of the rfc1918 file. This file only applies to Shorewall versions 1.4.* and 2.0.0
and its bugfix updates. In Shorewall 2.0.1 and later releases,
the bogons file lists IP ranges that are reserved by
the IANA and the rfc1918 file only lists those three
ranges that are reserved by RFC 1918.
Here is the most up to date version of the bogons file. This file only applies to Shorewall versions 2.0.1 and later.
Beginning with Shorewall version 2.2.0, errata will not be published on this page. Rather, the download directory for each version will contain:
A known_problems.txt file. This file will
list all known problems and will describe to any corrections or
workarounds available.
An errata sub-directory.
This directory will contain updated components that correct problems
listed in the known_problems.txt file.
Users specifying TCP_FLAGS_LOG_LEVEL=ULOG will find that "shorewall [re]start" fails with the following error:
iptables v1.3.2: Unknown arg `--log-ip-options' Try `iptables -h' or 'iptables --help' for more information. ERROR: Command "/usr/sbin/iptables -A logflags -j ULOG --log-ip-options --ulog-prefix "Shorewall:logflags:DROP:"" Failed
Install the 'firewall' script in the errata directory into /usr/share/shorewall/firewall replacing the file by that name.
Setting MACLIST_DISPOSITION=ACCEPT opens a serious security vulnerability. Install the 'firewall' script in the errata directoryinto /usr/share/shorewall/firewall replacing the file by that name.
If the "rejNotSyn" action is invoked, an error occurs at startup.
Corrected in this firewall script which may be installed in /usr/share/shorewall/firewall as described above.
The "shorewall add" command produces the error message:
/usr/share/shorewall/firewall: line 1: match_destination_hosts: command not found
You can correct the problem yourself by editing /usr/share/shorewall/firewall and on line 5805, replace match_destination_hosts with match_dest_hosts.
Corrected in this firewall script which may be installed in /usr/share/shorewall/firewall as described above.
The initial packages uploaded to the FTP and HTTP servers were incorrect. Here are the MD5 sums of the incorrect packages.
14e8f2bfa08cc5ca2715c8b1179d5eb2 shorewall-2.0.10-1.noarch.rpm 54bcbb2216ad3db9870507cd9716fd99 shorewall-2.0.10.tgz c2fe0acc7f056acb56d089cf8dafa39a shorwall-2.0.10.lrp
These incorrect packages have been replaced with correct ones having the following MD5 sums:
d5af452d38538b4b994c3c4abab8e012 shorewall-2.0.10-1.noarch.rpm 985ce9215ea9cc0299f0b5450fdbe05e shorewall-2.0.10.tgz 0ec7a65e4ed4ad1db0d2a4cb0c7bd5bf shorwall-2.0.10.lrp
If you have installed an incorrect package, please replace
/sbin/shorewall with this
file.
An empty PROTO column in /etc/shorewall/tcrules produced iptables errors during shorewall start. A value of all in that column produced a similar error.
Corrected in this firewall script which may be installed in /usr/share/shorewall/firewall as described above.
Entries in the USER/GROUP column of an action file (made from action.template) may be ignored or cause odd errors.
Corrected in this firewall script which may be installed in /usr/share/shorewall/firewall as described above.
Error messages regarding $RESTOREBASE occur during shorewall stop if DISABLE_IPV6=Yes in shorewall.conf.
Corrected in this firewall script which may be installed in /usr/share/shorewall/firewall as described above. Also fixed in Shorewall Version 2.0.5.
DNAT rules with fw as the source zone and that specify logging cause shorewall start to fail with an iptables error. The problem is corrected for Shorewall 2.0.3 users in this firewall script which may be installed in /usr/share/shorewall/firewall as described above.
Error messages regarding $RESTOREBASE occur during shorewall stop.
If CLEAR_TC=Yes in shorewall.conf,
shorewall stop fails without
removing the lock file.
The above problems are corrected in Shorewall version 2.0.3c.
Slackware users find that version 2.0.3a fails to start
because their mktemp utility does not support the
-d option. This may be corrected by installing this
corrected functions file in /var/lib/shorewall/functions.
Shorewall fails to start if there is no mktemp utility.
These problems are corrected in Shorewall version 2.0.3b.
A non-empty entry in the DEST column of /etc/shorewall/tcrules will result in an error message and Shorewall fails to start. This problem is fixed in Shorewall version 2.0.3a.
A potentially exploitable vulnerability in the way that Shorewall handles temporary files and directories has been found by Javier Fernández-Sanguino Peña. This vulnerability is corrected in Shorewall 2.0.3a. All Shorewall 2.0.x users are urged to upgrade to 2.0.3a.
Temporary restore files with names of the form
restore-nnnnn are left in
/var/lib/shorewall.
"shorewall restore" and "shorewall -f start" do not load kernel modules.
The above two problems are corrected in Shorewall 2.0.2a
Specifying a null common action in /etc/shorewall/actions (e.g., :REJECT) results in a startup error.
If /var/lib/shorewall does not exist,
shorewall start fails.
The above four problems are corrected in Shorewall 2.0.2b
DNAT rules work incorrectly with dynamic zones in that the source interface is not included in the nat table DNAT rule.
The above five problems are corrected in Shorewall 2.0.2c
During start and restart, Shorewall is detecting capabilities before loading kernel modules. Consequently, if kernel module autoloading is disabled, capabilities can be mis-detected during boot.
The newnotsyn option in
/etc/shorewall/hosts has no effect.
The above seven problems are corrected in Shorewall 2.0.2d
Use of the LOG target in an action results in two LOG or ULOG rules.
The above eight problems are corrected in Shorewall 2.0.2e
Kernel modules fail to load when MODULE_SUFFIX isn't set in shorewall.conf
All of the above problems are corrected in Shorewall 2.0.2f
These problems are all corrected by the
firewall and functions files
in this
directory. Both files must be installed in
/usr/share/shorewall/ as described above.
Confusing message mentioning IPV6 occur at startup.
Modules listed in /etc/shorewall/modules don't load or produce errors on Mandrake 10.0 Final.
The shorewall delete command does not remove all dynamic rules pertaining to the host(s) being deleted.
These problems are corrected in this
firewall script which may be installed in
/usr/share/shorewall/firewall as described
above.
When run on a SuSE system, the install.sh script fails to configure Shorewall to start at boot time. That problem is corrected in this version of the script.
On Debian systems, an install using the tarball results in an
inability to start Shorewall at system boot. If you already have
this problem, install this
file as /etc/init.d/shorewall (replacing the existing file
with that name). If you are just installing or upgrading to
Shorewall 2.0.0 or 2.0.1, then replace the
init.debian.sh file in the Shorewall
distribution directory (shorewall-2.0.x) with the updated file
before running install.sh from that
directory.
When using an Action in the ACTIONS column of a rule, you may receive a warning message about the rule being a policy. While this warning may be safely ignored, it can be eliminated by installing the script from the link below.
Thanks to Sean Mathews, a long-standing problem with Proxy ARP and IPSEC has been corrected.
The first problem has been corrected in Shorewall update 2.0.0a.
All of these problems may be corrected by installing this firewall script in /usr/share/shorewall as described above.
The upgrade issues have moved to a separate page.
If you want to use the new features in Shorewall 2.0.2 (Betas, RCs, Final) or later then you need to patch your iptables 1.2.9 with this patch or you need to use the CVS version of iptables.
Beginning with errata kernel 2.4.20-13.9, “REJECT --reject-with tcp-reset” is broken. The symptom most commonly seen is that REJECT rules act just like DROP rules when dealing with TCP. A kernel patch and precompiled modules to fix this problem are available at ftp://ftp1.shorewall.net/pub/shorewall/errata/kernel
RedHat have corrected this problem in their 2.4.20-27.x kernels.