Re: [Shorewall-devel] Possible installer script bug in 4.1.8?

[Tom Eastep <teastep@sh...>]

Ryan B. Lynch wrote:
> While trying to build RPMs for 4.1.8, I noticed that the 'install.sh' 
> script in the 'shorewall-common' package doesn't correctly handle an 
> installation directory prefix.  Based on the diff since 4.0.10.1, and 
> the fact that the indentation around that section is inconsistent, it 
> seems like it could be a typo.
> 
> In previous versions, the 'install -d ...' command that creates the 
> 'sbin' directory in the installation directory should create the parent, 
> as well.  In version 4.1.8, the 'install -d ...' command (line 204) is 
> moved inside an 'if' statement, so that it doesn't run and won't create 
> the 'sbin' directory and its parent unless run as a non-root user.
> 
> Is this a bug, or a feature intended to discourage building RPMs as root?
> 
> In case my description isn't clear, I attached a patch that fixes the 
> issue--or at least lets me build the RPM as root.

Thanks, Ryan

I've applied your patch then tweaked it a bit (we need not create /sbin or 
the destination directory if we're installing on Cygwin). Incremental (to 
your) patch attached.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

[Shorewall-devel] Possible installer script bug in 4.1.8?

[Ryan B. Lynch <ryan.b.lynch@gm...>]

While trying to build RPMs for 4.1.8, I noticed that the 'install.sh' 
script in the 'shorewall-common' package doesn't correctly handle an 
installation directory prefix.  Based on the diff since 4.0.10.1, and 
the fact that the indentation around that section is inconsistent, it 
seems like it could be a typo.

In previous versions, the 'install -d ...' command that creates the 
'sbin' directory in the installation directory should create the parent, 
as well.  In version 4.1.8, the 'install -d ...' command (line 204) is 
moved inside an 'if' statement, so that it doesn't run and won't create 
the 'sbin' directory and its parent unless run as a non-root user.

Is this a bug, or a feature intended to discourage building RPMs as root?

In case my description isn't clear, I attached a patch that fixes the 
issue--or at least lets me build the RPM as root.

-Ryan

Re: [Shorewall-devel] Checking the configuration before restarting

[Tom Eastep <teastep@sh...>]

Roberto C. Sánchez wrote:
> Greetings,
> 
> There is a very old bug report [0] still floating around asking for a
> configuration check before restarting on upgrade.  While this may not
> have been possible in the past, would it be possible now with
> Shorewall-perl?

Hi Roberto,

This is feasible, given that Shorewall-perl does a pretty thorough job of 
checking the configuration (and 4.2 will do even a better job).

Another idea would be to define an environmental variable that would cause 
the /etc/init.d/shorewall script to perform a safe-restart when asked to 
restart. That way, the firewall wouldn't go into the stopped state if 
'restart' failed.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

[Shorewall-devel] Checking the configuration before restarting

[Roberto C. Sánchez <roberto@co...>]

Greetings,

There is a very old bug report [0] still floating around asking for a
configuration check before restarting on upgrade.  While this may not
have been possible in the past, would it be possible now with
Shorewall-perl?

Regards,

-Roberto

[0] http://bugs.debian.org/200573

-- 
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com

Re: [Shorewall-devel] shorewall-perl 4.0.10

[Tom Eastep <teastep@sh...>]

Srinivasa Hebbar wrote:
> Hello,
> 
> Even when I add "optional" in interfaces file, the same error occurs
> and shorewall stops.
>
And I have asked you to send me a copy of your /etc/shorewall directory 
because I cannot reproduce the problem.

I can't solve your problem just by looking at your emails, no matter how 
many you send.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Re: [Shorewall-devel] shorewall-perl 4.0.10

[Tom Eastep <teastep@sh...>]

Tom Eastep wrote:
> Srinivasa Hebbar wrote:

>> interfaces
>> wan ppp1 detect tcpflags,nosmurfs,optional
>> wan ppp2 detect tcpflags,nosmurfs,optional
>> lan  eth3 detect tcpflags
>>
>> providers:
>> wan1 1 0x100 main ppp1 detect optional  eth3
>> wan2 2 0x200 main ppp2 detect optional  eth3
>>
>> zones:
>> fw      firewall
>> wan      ipv4
>> lan      ipv4
>>
>> Error:
>> Processing /etc/shorewall/params ...
>>    Shorewall is not running
>> Starting Shorewall....
>> Initializing...
>>    ERROR: Can't determine the IP address of ppp1
>> Terminated
>>
> 
> Then please send a tarball of your /etc/shorewall/ directory, including 
> a capabilities file -- I can't reproduce the problem here.
>

You can send the tarball to support@... if you are squeamish 
about sending it to the list.

My test case has:

[teastep@... user008]$ /sbin/shorewall version -a
4.0.10
Shorewall-perl 4.0.10
[teastep@... user008]$

zones:
fw      firewall
lan     ipv4
...

interfaces:
lan     eth0            -               nosmurfs,tcpflags,dhcp,optional
lan     eth5            -               nosmurfs,tcpflags,dhcp,optional
...

providers:
isp1    1       1       main       eth0       detect          optional
isp2    2       2       main       eth5       detect          optional

That configuration produces this shell code:

     ETH5_ADDRESS=$(find_first_interface_address_if_any eth5)
     ETH0_ADDRESS=$(find_first_interface_address_if_any eth0)

The find_first_interface_address_if_any() function does not fail with 
the error message that you are seeing.

-Tom


-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Re: [Shorewall-devel] shorewall-perl 4.0.10

[Tom Eastep <teastep@sh...>]

Srinivasa Hebbar wrote:
> Hello,
> 
> Even when I add "optional" in interfaces file, the same error occurs
> and shorewall stops.
> 
> Interfaces:
> wan ppp1 detect tcpflags,nosmurfs,optional
> wan ppp2 detect tcpflags,nosmurfs,optional
> lan  eth3 detect tcpflags
> 
> providers:
> wan1 1 0x100 main ppp1 detect optional  eth3
> wan2 2 0x200 main ppp2 detect optional  eth3
> 
> zones:
> fw      firewall
> wan      ipv4
> lan      ipv4
> 
> Error:
> Processing /etc/shorewall/params ...
>    Shorewall is not running
> Starting Shorewall....
> Initializing...
>    ERROR: Can't determine the IP address of ppp1
> Terminated
>

Then please send a tarball of your /etc/shorewall/ directory, including a 
capabilities file -- I can't reproduce the problem here.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Re: [Shorewall-devel] shorewall-perl 4.0.10

[Srinivasa Hebbar <sshebbar@gm...>]

Hello,

Even when I add "optional" in interfaces file, the same error occurs
and shorewall stops.

Interfaces:
wan ppp1 detect tcpflags,nosmurfs,optional
wan ppp2 detect tcpflags,nosmurfs,optional
lan  eth3 detect tcpflags

providers:
wan1 1 0x100 main ppp1 detect optional  eth3
wan2 2 0x200 main ppp2 detect optional  eth3

zones:
fw      firewall
wan      ipv4
lan      ipv4

Error:
Processing /etc/shorewall/params ...
   Shorewall is not running
Starting Shorewall....
Initializing...
   ERROR: Can't determine the IP address of ppp1
Terminated


Thanks,
Hebbar.

> Tom Eastep wrote:
> >> I have given ppp1 and ppp2 as optional interface in providers file as
> >> below.
> >> wan1 1 0x100 main ppp1 detect optional  eth3
> >> wan2 2 0x200 main ppp2 detect optional  eth3
> >>
> >> -------
> >> Shorewall start fails as follows:
> >> Starting Shorewall....
> >> Initializing...
> >>    ERROR: Can't determine the IP address of ppp1
> >> Terminated
> >
> > You also need to specify the 'optional' interface option in
> > /etc/shorewall/interfaces.
>
> I should add that 4.2 will make this simpler -- specifying 'optional' for
> an interface in /etc/shorewall/interfaces is all that is required to make
> providers through that interface optional as well.
>
> -Tom

Re: [Shorewall-devel] shorewall-perl 4.0.10

[Srinivasa Hebbar <hebbar@el...>]

Hello,

Even when I add "optional" in interfaces file, the same error occurs
and shorewall stops.

Interfaces:
wan ppp1 detect tcpflags,nosmurfs,optional
wan ppp2 detect tcpflags,nosmurfs,optional
lan  eth3 detect tcpflags

providers:
wan1 1 0x100 main ppp1 detect optional  eth3
wan2 2 0x200 main ppp2 detect optional  eth3

zones:
fw      firewall
wan      ipv4
lan      ipv4

Error:
Processing /etc/shorewall/params ...
   Shorewall is not running
Starting Shorewall....
Initializing...
   ERROR: Can't determine the IP address of ppp1
Terminated


Thanks,
Hebbar.

> Tom Eastep wrote:
> >> I have given ppp1 and ppp2 as optional interface in providers file as
> >> below.
> >> wan1 1 0x100 main ppp1 detect optional  eth3
> >> wan2 2 0x200 main ppp2 detect optional  eth3
> >>
> >> -------
> >> Shorewall start fails as follows:
> >> Starting Shorewall....
> >> Initializing...
> >>    ERROR: Can't determine the IP address of ppp1
> >> Terminated
> >
> > You also need to specify the 'optional' interface option in
> > /etc/shorewall/interfaces.
>
> I should add that 4.2 will make this simpler -- specifying 'optional' for
> an interface in /etc/shorewall/interfaces is all that is required to make
> providers through that interface optional as well.
>
> -Tom

Re: [Shorewall-devel] shorewall-perl 4.0.10

[Tom Eastep <teastep@sh...>]

Tom Eastep wrote:

>>
>> I have given ppp1 and ppp2 as optional interface in providers file as 
>> below.
>> wan1 1 0x100 main ppp1 detect optional  eth3
>> wan2 2 0x200 main ppp2 detect optional  eth3
>>
>> -------
>> Shorewall start fails as follows:
>> Starting Shorewall....
>> Initializing...
>>    ERROR: Can't determine the IP address of ppp1
>> Terminated
> 
> You also need to specify the 'optional' interface option in 
> /etc/shorewall/interfaces.
> 

I should add that 4.2 will make this simpler -- specifying 'optional' for an 
interface in /etc/shorewall/interfaces is all that is required to make 
providers through that interface optional as well.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

Re: [Shorewall-devel] shorewall-perl 4.0.10

[Tom Eastep <teastep@sh...>]

Srinivasa Hebbar wrote:
> Hello,
> 
> Shorewall perl 4.0.10 stops with errors when 
> the interface in providers file doesn't exist in the sytem.
> I have given "optional" keyword in the providers file.
> 
> Code generated looks like below.
> 
> define_firewall() {
> 
>     clear_routing_and_traffic_shaping
>     #
>     # Establish the values of shell variables used in the following function 
> calls
>     #
>     ppp1_ADDRESS=$(find_first_interface_address ppp1)
>     ppp2_ADDRESS=$(find_first_interface_address ppp2)
> 
> .....
> 
> The above lines are from /var/lib/shorewall/.restart
> 
> I have given ppp1 and ppp2 as optional interface in providers file as below.
> wan1 1 0x100 main ppp1 detect optional  eth3
> wan2 2 0x200 main ppp2 detect optional  eth3
> 
> -------
> Shorewall start fails as follows:
> Starting Shorewall....
> Initializing...
>    ERROR: Can't determine the IP address of ppp1
> Terminated

You also need to specify the 'optional' interface option in 
/etc/shorewall/interfaces.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key

[Shorewall-devel] shorewall-perl 4.0.10

[Srinivasa Hebbar <sshebbar@gm...>]

Hello,

Shorewall perl 4.0.10 stops with errors when 
the interface in providers file doesn't exist in the sytem.
I have given "optional" keyword in the providers file.

Code generated looks like below.

define_firewall() {

    clear_routing_and_traffic_shaping
    #
    # Establish the values of shell variables used in the following function 
calls
    #
    ppp1_ADDRESS=$(find_first_interface_address ppp1)
    ppp2_ADDRESS=$(find_first_interface_address ppp2)

.....

The above lines are from /var/lib/shorewall/.restart

I have given ppp1 and ppp2 as optional interface in providers file as below.
wan1 1 0x100 main ppp1 detect optional  eth3
wan2 2 0x200 main ppp2 detect optional  eth3

-------
Shorewall start fails as follows:
Starting Shorewall....
Initializing...
   ERROR: Can't determine the IP address of ppp1
Terminated


Thanks,
Hebbar

[Shorewall-devel] Shorewall 4.1.8

[Tom Eastep <teastep@sh...>]

Available for download at 
http://www.shorewall.net/pub/shorewall/development/4.1/shorewall-4.1.8/

Problems Corrected in Shorewall 4.1.8

1)  Changes to your configuration made by NULL_ROUTE_RFC1918=Yes are
     now reversed during 'shorewall stop' and 'shoreawll restart'.

2)  The init script on Debian now reads and utilizes the value of the
     OPTIONS variable from /etc/default/shorewall[-lite].  Previously,
     the value of that variable was not passed to the shorewall[-lite]
     command.

3)  With both Shorewall and Shorewall Lite, the 'start' and 'restart'
     commands now support a '-p' option. This option causes the
     Netfilter connection tracking table to be flushed (purged) as part
     of the operation. The 'conntrack' utility must be installed to use
     this option.

Other Changes in Shoreall 4.1.8.

1)  When using Shorewall-perl, the CEIL and RATE columns must now
     contain arithmetic expressions consisting of:

     a) Numeric digits (Hex numbers not allowed).
     b) Parentheses.
     c) The arithmetic operators +-* and /.
     d) The word 'full'.

2)  The installers (install.sh) now auto-detect a Cygwin environment
     and install under the current user's ID if OWNER and GROUP are not
     given.

3)  The 'start' and 'restart' commands now support a '-p' (purge)
     option which cause all entries to be removed from the Netfilter
     conntrack table. In order to use this option, the 'conntrack'
     utility must be installed on your system. Although it is generally
     not installed by default, Most distributions have this utility in
     their repositories.

-Tom
-- 
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@...
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key