/[smeserver]/rpms/e-smith-packetfilter/sme10/e-smith-packetfilter.spec
ViewVC logotype

Annotation of /rpms/e-smith-packetfilter/sme10/e-smith-packetfilter.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.15 - (hide annotations) (download)
Tue Nov 16 03:18:06 2021 UTC (2 years, 7 months ago) by jpp
Branch: MAIN
CVS Tags: e-smith-packetfilter-2_6_0-8_el7_sme, HEAD
Changes since 1.14: +8 -2 lines
* Mon Nov 15 2021 Jean-Philippe Pialasse <tests@pialasse.com> 2.6.0-8.sme
- restrict VPN networks to their interface [SME: 11640]
  remove remoteVPNSubnet property added VPNif property

1 jpp 1.15 # $Id: e-smith-packetfilter.spec,v 1.14 2021/04/07 20:07:51 jpp Exp $
2 stephdl 1.1
3     Summary: e-smith server and gateway - packetfilter add-on
4     %define name e-smith-packetfilter
5     Name: %{name}
6     %define version 2.6.0
7 jpp 1.15 %define release 8
8 stephdl 1.1 Version: %{version}
9     Release: %{release}%{?dist}
10     License: GPL
11     Group: Networking/Daemons
12     Source: %{name}-%{version}.tar.xz
13 jpp 1.2 Patch0: e-smith-packetfilter-2.6.0-bz11122-bz11089-systemd-event.patch
14 jpp 1.4 Patch1: e-smith-packetfilter-2.6.0-bz11251-drop-pptpd.patch
15 jpp 1.6 Patch2: e-smith-packetfilter-2.6.0-bz11420.patch
16 jpp 1.7 Patch3: e-smith-packetfilter-2.6.0bz11426-ulogd.patch
17 jpp 1.14 Patch4: e-smith-packetfilter-2.6.0-bz11528-bz11451.patch
18 jpp 1.15 Patch5: e-smith-packetfilter-2.6.0-bz11640-VPNif.patch
19 jpp 1.2
20 stephdl 1.1 BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
21     BuildArchitectures: noarch
22 jpp 1.3 Requires: e-smith-base >= 5.8.0-49
23 jpp 1.11 Requires: ulogd >= 2
24 jpp 1.10 Requires: daemontools
25 stephdl 1.1 Requires: iptables
26     BuildRequires: e-smith-devtools
27     Obsoletes: e-smith-ipmasq
28     AutoReqProv: no
29 jpp 1.8 Requires(pre): /usr/sbin/useradd
30 stephdl 1.1
31     %description
32     e-smith server and gateway software - packetfilter add-on
33    
34     %changelog
35 jpp 1.15 * Mon Nov 15 2021 Jean-Philippe Pialasse <tests@pialasse.com> 2.6.0-8.sme
36     - restrict VPN networks to their interface [SME: 11640]
37     remove remoteVPNSubnet property added VPNif property
38    
39 jpp 1.14 * Wed Apr 07 2021 Jean-Philippe Pialasse <tests@pialasse.com> 2.6.0-7.sme
40     - fix dropin file not expanded on initial installation [SME: 11528]
41     - fix noise on logrotate, doing a restart instead of reload [SME: 11451]
42    
43 jpp 1.7 * Thu Mar 04 2021 Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-6.sme
44     - move ulogd to systemd [SME: 11426]
45     - require ulogd 2 [SME: 11426]
46    
47 jpp 1.6 * Wed Mar 03 2021 Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-5.sme
48     - remove pptpd last references [SME: 11420]
49    
50 jpp 1.5 * Fri Feb 12 2021 Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-4.sme
51     - remove /usr/lib/systemd/system-preset/80-koozali-packetfilter.preset [SME: 10958]
52    
53 jpp 1.4 * Fri Dec 11 2020 Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-3.sme
54     - drop pptpd support [SME: 11251]
55    
56 jpp 1.2 * Tue Nov 10 2020 Jean-Philipe Pialasse <tests@pialasse.com> 2.6.0-2.sme
57     - launch masq using systemd unit [SME: 11089]
58     - create event to avoid reboot on update [SME: 11122]
59    
60 stephdl 1.1 * Fri Feb 05 2016 stephane de Labrusse <stephdl@de-labrusse.fr> 2.6.0-1.sme
61     - Initial release to sme10
62    
63     * Thu Feb 28 2013 Ian Wells <esmith@wellsi.com> 2.4.0-3.sme
64     - Prevent multiple instances of the masq script running,
65     patch by Charlie Brady [SME: 7415]
66    
67     * Tue Feb 19 2013 Daniel Berteaud <daniel@firewall-services.com> 2.4.0-2.sme
68     - Use extrapositioned negation (Credits to John Crisp) [SME: 7262]
69    
70     * Wed Feb 6 2013 Shad L. Lords <slords@mail.com> 2.4.0-1.sme
71     - Roll new stream for sme9
72    
73     * Tue Oct 7 2008 Shad L. Lords <slords@mail.com> 2.2.0-1.sme
74     - Roll new stream to separate sme7/sme8 trees [SME: 4633]
75    
76     * Fri May 18 2007 Shad L. Lords <slords@mail.com> 1.18.0-6
77     - Use correct lib for modules
78    
79     * Sun Apr 29 2007 Shad L. Lords <slords@mail.com>
80     - Clean up spec so package can be built by koji/plague
81    
82     * Fri Apr 09 2007 Stephen Noble <support@dungog.net> 1.18.0-5
83     - Fix masq error in server only mode (cannot open UDPPort) [SME: 2812]
84    
85     * Fri Apr 06 2007 Shad L. Lords <slords@mail.com> 1.18.0-4
86     - Fix perms for ulogd.conf file [SME: 2722]
87    
88     * Mon Mar 19 2007 Shad L. Lords <slords@mail.com> 1.18.0-3
89     - Update ulogd.conf to new format [SME: 2744]
90    
91     * Fri Feb 09 2007 Shad L. Lords <slords@mail.com> 1.18.0-2
92     - Fix sorting for Ports properties [SME: 56]
93    
94     * Fri Jan 26 2007 Shad L. Lords <slords@mail.com> 1.18.0-1
95     - Roll stable stream. [SME: 2328]
96    
97     * Thu Jan 18 2007 Shad L. Lords <slords@mail.com> 1.17.0-7
98     - Move last masq fragments from e-smith-base.
99    
100     * Wed Jan 17 2007 Shad L. Lords <slords@mail.com> 1.17.0-6
101     - Use both {TCP,UDP}Port and {TCP,UDP}Ports for masq template [SME: 56]
102    
103     * Thu Dec 07 2006 Shad L. Lords <slords@mail.com>
104     - Update to new release naming. No functional changes.
105     - Make Packager generic
106    
107     * Fri Nov 23 2006 Gordon Rowell <gordonr@gormand.com.au> 1.17.0-04
108     - Remove TCPMinimizeDelay default for ssh [SME: 2083]
109    
110     * Mon Aug 28 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-03
111     - Ensure that $OUTERNET is an IP address. [SME: 1815]
112    
113     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-02
114     - Merge in masq fragments from e-smith-base.
115    
116     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-01
117     - Roll new development stream.
118    
119     * Wed Jul 26 2006 Gordon Rowell <gordonr@gormand.com.au> 1.16.0-05
120     - Remove redundant auto-generated service-specific denylog rules from
121     90InboundTCP10filter_{tcp,udp} [SME: 1776]
122    
123     * Tue Jul 18 2006 Charlie Brady <charlie_brady@mitel.com> 1.16.0-04
124     - Bundle fragments from e-smith-ipmasq and obsolete that RPM. [SME: 1002]
125    
126     * Tue Jun 20 2006 Filippo Carletti <carletti@mobilia.it> 1.16.0-03
127     - No longer drop UDP packets in serveronly mode [SME: 1002]
128    
129     * Thu Apr 6 2006 Gavin Weight <gweight@gmail.com> 1.2.0-02
130     - Make ident TCP reject configurable, based on oidentd status.
131     If oidentd{status} is enabled, allow ident, otherwise REJECT it [SME: 85]
132    
133     * Wed Mar 15 2006 Charlie Brady <charlie_brady@mitel.com> 1.2.0-01
134     - Roll stable stream version. [SME: 1016]
135    
136     * Wed Nov 30 2005 Gordon Rowell <gordonr@gormand.com.au> 1.15.1-12
137     - Bump release number only
138    
139     * Wed Sep 21 2005 Charlie Brady <charlieb@e-smith.com>
140     - [1.15.1-11]
141     - Remove force/masq/status fragment, and fix "masq adjust" so
142     that it is harmless if firewall is disabled. This leaves unsolved
143     the problem of whether to toggle disabled->enabled during upgrades.
144     [SF: 1261356]
145    
146     * Wed Sep 7 2005 Charlie Brady <charlieb@e-smith.com>
147     - [1.15.1-10]
148     - Fix location of force/status fragment for masq service. [SF: 1261356]
149    
150     * Tue Aug 30 2005 Charlie Brady <charlieb@e-smith.com>
151     - [1.15.1-09]
152     - Add force/status fragment for masq service, to force enabled.
153     This ensures that firewall is running after a system upgrade,
154     to avoid various panel failure modes. Solution to be reviewed
155     for alternatives later. [SF: 1261356]
156    
157     * Fri Aug 26 2005 Charlie Brady <charlieb@e-smith.com>
158     - [1.15.1-08]
159     - Remove filtering of outbound ICMP - it's blocking legitimate ICMP
160     redirects. [MN00093544]
161    
162     * Tue Aug 2 2005 Shad Lords <slords@email.com>
163     - [1.15.1-07]
164     - Add default $masq{Stealth} db entry
165    
166     * Tue Aug 2 2005 Gordon Rowell <gordonr@gormand.com.au>
167     - [1.15.1-06]
168     - Rejct IDENT with a TCP reset [SF: 1240659]
169     - Add support for UDPPort (c.f. TCPPort) property to allow
170     filtered UDP [SF: 1241398]
171     - Add support for DenyHosts property (see 1.15.0-02 for AllowHosts)
172     [SF: 1241398]
173    
174     * Mon Jul 18 2005 Charlie Brady <charlieb@e-smith.com>
175     - [1.15.1-05]
176     - Tidy up path reference to networks db. [SF: 1216546]
177    
178     * Tue Jun 7 2005 Charlie Brady <charlieb@e-smith.com>
179     - [1.15.1-04]
180     - Fix ulogd logging to stdout not being captured by multilog.
181    
182     * Mon May 2 2005 Charlie Brady <charlieb@e-smith.com>
183     - [1.15.1-03]
184     - Add requires headers for ulogd and daemontools.
185    
186     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
187     - [1.15.1-02]
188     - Switch to logging via ulogd and multilog.
189    
190     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
191     - [1.15.1-01]
192     - Roll new development stream - 1.15.1
193    
194     * Wed Mar 30 2005 Charlie Brady <charlieb@e-smith.com>
195     - [1.15.0-15]
196     - Set $OUTERNET to equal $LocalIP in masq script in serveronly mode,
197     so that masq script (if enabled) does not block allowed public access.
198     - Remove various 45Allow* fragments as TCPPort properties of services
199     will allow access if public access is enabled.
200    
201     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
202     - [1.15.0-14]
203     - More cleanup for iptables-trace [tonyc]
204    
205     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
206     - [1.15.0-13]
207     - update to latest iptables-trace [tonyc] :
208     - add logging for default chain policy fallback
209     - fix stop() bug causing _any_ rules with --log-prefix to be removed
210    
211     * Fri Apr 30 2004 Michael Soulier <msoulier@e-smith.com>
212     - [1.15.0-12]
213     - Made TOS settings configurable, with just ssh set by default.
214     [msoulier dpar-28993]
215    
216     * Wed Feb 25 2004 Michael Soulier <msoulier@e-smith.com>
217     - [1.15.0-11]
218     - Tightened rules for remote vpn subnets. [msoulier dpar-21836]
219    
220     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
221     - [1.15.0-10]
222     - Fixed iptables-trace "stop" removing rules from the denylog chain.
223     [msoulier 10955]
224    
225     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
226     - [1.15.0-09]
227     - Added a toggle of the trace option during adjust, so adjusts work with trace
228     enabled. [msoulier 8117]
229    
230     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
231     - [1.15.0-08]
232     - Changed multicast DROP target to denylog, so it toggles. [msoulier 9450]
233    
234     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
235     - [1.15.0-07]
236     - Changed the toggle property name to DenylogTarget. [msoulier 9450]
237    
238     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
239     - [1.15.0-06]
240     - Added firewall-wide toggle for denylog DROP/REJECT. [msoulier 9450]
241    
242     * Sat Nov 29 2003 Charlie Brady <charlieb@e-smith.com>
243     - [1.15.0-05]
244     - Ensure that masq script expands without error in serveronly mode.
245     [charlieb 10162]
246    
247     * Sat Oct 4 2003 Michael Soulier <msoulier@e-smith.com>
248     - [1.15.0-04]
249     - Fixed error in masq fragment with stealth enabled. [msoulier 10165]
250    
251     * Thu Sep 25 2003 Gordon Rowell <gordonr@e-smith.com>
252     - [1.15.0-03]
253     - Add masq to 0.0.0.0/0 for public, unrestricted [gordonr 10050]
254    
255     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
256     - [1.15.0-02]
257     - New fragment 90InboundTCP10filter_tcp, a further step towards
258     auto-generation of rules, removing the 45Allow* fragments:
259    
260     For all services which have a TCPPort property defined:
261     If the service is 'enabled' and the service is 'public',
262     generate iptables rules as follows:
263     If an AllowHosts property is defined, allow only those hosts
264     Otherwise allow all hosts
265    
266     AllowHosts is comma separated, and can contain IPs, IP/mask and CIDR
267    
268     This will generate duplicate rules until the 45Allow* fragments
269     are removed, which can happen once the TCPPort property is defined
270     for a service.
271    
272     QUERY: Should this be TCPPort (singular) or TCPPorts (plural)?
273     TODO: Create db defaults fragments to deprecate the 45Allow* fragments
274     TODO: Possibly add DenyHosts processing [gordonr 10050]
275    
276     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
277     - [1.15.0-01]
278     - Changing version to development stream number - 1.15.0
279     - Dev stream [gordonr 10050]
280    
281     * Thu Jun 26 2003 Charlie Brady <charlieb@e-smith.com>
282     - [1.14.0-01]
283     - Changing version to stable stream number - 1.14.0
284    
285     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
286     - [1.13.0-27]
287     - Again [tonyc 8578]
288    
289     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
290     - [1.13.0-26]
291     - Add lo->lo ACCEPT rule back to 90local_chk00Start fragment [tonyc 8578]
292    
293     * Mon Jun 16 2003 Tony Clayton <apc@e-smith.com>
294     - [1.13.0-25]
295     - Split 90AllowLocal masq fragment into 90local_chk* [tonyc 8578]
296    
297     * Mon Jun 2 2003 Michael Soulier <msoulier@e-smith.com>
298     - [1.13.0-24]
299     - Explicitely blocking multicast not from a local network.
300     [msoulier 6031]
301    
302     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
303     - [1.13.0-23]
304     - Added chain creation during adjust. What a thought. [msoulier 7695]
305    
306     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
307     - [1.13.0-22]
308     - Added support for a PPPconn chain to track rules to permit PPTP connections.
309     [msoulier 7695]
310    
311     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
312     - [1.13.0-21]
313     - Refactored the 90adjustUDP template into multiple fragments. [msoulier 8505]
314    
315     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
316     - [1.13.0-20]
317     - Refactored the 90adjustTCP template into multiple fragments. [msoulier 8505]
318    
319     * Tue Apr 22 2003 Michael Soulier <msoulier@e-smith.com>
320     - [1.13.0-19]
321     - Accepting all traffic from the loopback interface. [msoulier 8299]
322    
323     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
324     - [1.13.0-18]
325     - Removed acceptance of anything not from the external interface. The local
326     networks list should be sufficient. [msoulier 8299]
327    
328     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
329     - [1.13.0-17]
330     - Added handling of local_chk chain in adjustment. [msoulier 8299]
331    
332     * Mon Apr 14 2003 Gordon Rowell <gordonr@e-smith.com>
333     - [1.13.0-16]
334     - Flag pptp masq as on by default [gordonr 6694]
335    
336     * Tue Apr 8 2003 Michael Soulier <msoulier@e-smith.com>
337     - [1.13.0-15]
338     - Added iptables-trace in /etc/rc.d/init.d. [msoulier 7613]
339    
340     * Tue Apr 1 2003 Gordon Rowell <gordonr@e-smith.com>
341     - [1.13.0-14]
342     - Added denylog: prefix to denied packet logs [gordonr 6852]
343    
344     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
345     - [1.13.0-13]
346     - Portforwarding still had problems, fixed here. [msoulier 7284]
347    
348     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
349     - [1.13.0-12]
350     - Added ForwardedTCP and ForwardedUDP, as well as supporting code to
351     permit certain ports to be opened for forwarded traffic inbound. Required
352     for portforwarding. [msoulier 7284]
353    
354     * Fri Mar 7 2003 Charlie Brady <charlieb@e-smith.com>
355     - [1.13.0-11]
356     - Add "use esmith::util" to 01localNetworks fragment. Needed if
357     esmith::templates form of processTemplate is used. [charlieb 5650]
358    
359     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
360     - [1.13.0-10]
361     - Remove quotes around 'Name' - not required [gordonr 7343]
362    
363     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
364     - [1.13.0-09]
365     - Make use of ExternalInterface definition in 00Definitions [gordonr 7343]
366     - Update dependency on e-smithbase [gordonr 7343]
367    
368     * Mon Feb 3 2003 Mark Knox <markk@e-smith.com>
369     - [1.13.0-08]
370     - Open port 443 when either web server is enabled [markk 6428]
371    
372     * Fri Jan 24 2003 Charlie Brady <charlieb@e-smith.com>
373     - [1.13.0-07]
374     - Fix one last broken here document. [charlieb 6651]
375    
376     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
377     - [1.13.0-06]
378     - Fix a few typos in previous round of masq fragment changes. [charlieb]
379    
380     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
381     - [1.13.0-05]
382     - formatting changes in masq/00Functions template fragment [charlieb]
383     - Use connection tracking on both INPUT and FORWARD tables [charlieb 6651]
384     - Allow any local traffic on INPUT and FORWARD chains. Local traffic
385     is currently defined as all traffic which didn't come in via the
386     external interface. That definition can easily change, as there is
387     a special chain for accepting local traffic. [charlieb 6709]
388     - Remove explicit allow of multicast traffic, as it is a subset of "local"
389     traffic [charlieb 6031, 6709]
390     - Move ICMP type checking into "adjust" part of masq script [charlieb 6709]
391    
392     * Sat Jan 18 2003 Michael Soulier <msoulier@e-smith.com>
393     - [1.13.0-04]
394     - Permitting multicast traffic to and from the internal interface.
395     [msoulier 6031]
396    
397     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
398     - [1.13.0-03]
399     - Put back non-redundant DROP lines, but add a comment as to why
400     they are there [gordonr 6580]
401    
402     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
403     - [1.13.0-02]
404     - Remove redundant DROP lines from denylog chain [gordonr 6580]
405    
406     * Thu Jan 9 2003 Mark Knox <markk@e-smith.com>
407     - [1.13.0-01]
408     - Forced version update by co2rpm to 1.13.0
409    
410     * Mon Dec 16 2002 Charlie Brady <charlieb@e-smith.com>
411     - [1.12.0-01]
412     - Roll to stable version to 1.12.0
413    
414     * Fri Nov 29 2002 Michael Soulier <msoulier@e-smith.com>
415     - [1.11.0-07]
416     - Added a get_safe_id function, to factor out firewall rule scanning code, and
417     prevent chain name clashes in the extreme case. [msoulier 5696]
418    
419     * Thu Nov 28 2002 Michael Soulier <msoulier@e-smith.com>
420     - [1.11.0-06]
421     - Removed specific tcp_in and udp_in chains in favour of the InboundTCP_$$ and
422     InboundUDP__$$ chains. They are far, far easier to manage, especially for
423     the portforwarding blade. [msoulier 5696]
424    
425     * Wed Nov 20 2002 Charlie Brady <charlieb@e-smith.com>
426     - [1.11.0-05]
427     - Make sure that --numeric is used with any --list command, to avoid
428     reverse lookup delays. [charlieb 5644]
429    
430     * Wed Nov 13 2002 Charlie Brady <charlieb@e-smith.com>
431     - [1.11.0-04]
432     - Peel off ICMP for checking after packets for ESTABLISHED and RELATED
433     connections are allowed. This allows outbound ping to work. [charlieb 5423]
434    
435     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
436     - [1.11.0-03]
437     - Apply UDP filtering only on traffic entering via external
438     interface. [charlieb 5644]
439    
440     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
441     - [1.11.0-02]
442     - Add UDP input filter setup and adjust rules.
443     Re-arrange 00Functions a bit so that perl block is
444     shorter and the rest is in-line [charlieb 5644]
445     - Move adjustEnd to 92, to allow 91 hole for any adjustments
446     needing to be done after input filter rules are adjusted
447     (e.g. port forwarding).
448    
449     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
450     - [1.11.0-01]
451     - rolling development stream to 1.11.0
452    
453     * Sat Oct 19 2002 Charlie Brady <charlieb@e-smith.com>
454     - [1.10.0-08]
455     - Send default packets on the FORWARD filter to denylog, rather than
456     DROP. [charlieb 5246]
457     - Revert 2) from 1.10.0-05 checkin. 5.5 ipchains forwarding rules do not allow
458     IP masqueraded packets. [charlieb 5246]
459    
460     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
461     - [1.10.0-07]
462     - Commit new file 42CheckTCPInput which was missed in last checkin.
463     [charlieb 5246]
464    
465     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
466     - [1.10.0-06]
467     - Create a new intermediate TCP input chain, and create a new temporary
468     TCP input chain whenever we run "masq adjust". This ensures that
469     new TCP input checking rules occur at the same place during input
470     checking as existing rules, and also means that rules previously created
471     by now-removed packages disappear. [charlieb 4501, 5246]
472    
473     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
474     - [1.10.0-05]
475     - Fix to the previous change 1) to restore some commented out rules,
476     and 2) to fix those rules so that they match the 5.5 ipchains
477     version. [charlieb 5246]
478    
479     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
480     - [1.10.0-04]
481     - Changes so that local networks can be added/deleted and "masq adjust"
482     will correctly re-adjust the filters. [charlieb 5246]
483    
484     * Tue Oct 15 2002 Charlie Brady <charlieb@e-smith.com>
485     - [1.10.0-03]
486     - Change 00Functions so that "tcp_in" function can create chains as required
487     during "masq adjust", so that new modules can add rules and still avoid
488     "masq restart". [charlieb 4501]
489    
490     * Tue Oct 15 2002 Mark Knox <markk@e-smith.com>
491     - [1.10.0-02]
492     - Re-add echo-reply support (doesn't work with conntrack) [markk 5213]
493    
494     * Sat Oct 12 2002 Charlie Brady <charlieb@e-smith.com>
495     - [1.10.0-01]
496     - Roll to maintained version number to 1.10.0
497     - Remove "perl createlinks" from %build section, since we no longer
498     have a createlinks file.
499    
500     * Fri Oct 11 2002 Gordon Rowell <gordonr@e-smith.com>
501     - [1.9.15-07]
502     - Check the correct configDB entry for public POP [gordonr 5181]
503    
504     * Tue Oct 8 2002 Mark Knox <markk@e-smith.com>
505     - [1.9.15-06]
506     - Use denylog target for dropped ICMP packets [markk 5095]
507     - Remove explicit echo-reply support (we use conntrack now) [markk 5095]
508    
509     * Mon Oct 7 2002 Mark Knox <markk@e-smith.com>
510     - [1.9.15-05]
511     - Drop ICMP echo-requests on ext i/f when in private s/g mode or if Stealth
512     property is set. General cleanup of ICMP rules. [markk 5095]
513    
514     * Wed Sep 11 2002 Gordon Rowell <gordonr@e-smith.com>
515     - [1.9.15-04]
516     - Added extra slosh in tcp_in as one gets gobbled by template evaluation
517     and we need one in the final output. Reformatted the lines and moved
518     proto/port together on first line of pair for readability [gordonr 4792]
519    
520     * Thu Sep 5 2002 Charlie Brady <charlieb@e-smith.com>
521     - [1.9.15-03]
522     - Fix tcp_in function - it doesn't work too well without the jump to the
523     newly defined rule. Change DROP to denylog in the placeholder rule,
524     even though it is short-lived. [charlieb 4792]
525    
526     * Mon Sep 2 2002 Charlie Brady <charlieb@e-smith.com>
527     - [1.9.15-02]
528     - Remove createlinks script and network-{create,delete} event directories -
529     the required change was made in e-smith-base, and this shouldn't have
530     been checked in. [charlieb 4501]
531    
532     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
533     - [1.9.15-01]
534     - Rolling minor version number to work around wrinkle in co2rpm [charlieb 3700]
535    
536     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
537     - [1.9.14-04]
538     - Remove 45AllowAUTH masq fragment - moved to e-smith-oidentd package.
539     [charlieb 4435]
540    
541     * Tue Aug 27 2002 Charlie Brady <charlieb@e-smith.com>
542     - [1.9.14-03]
543     - Fix iptables syntax in AdjustTOS fragment [charlieb 1268]
544    
545     * Mon Aug 26 2002 Charlie Brady <charlieb@e-smith.com>
546     - [1.9.14-02]
547     - Fix AllowICMPfromLAN template error [charlieb 1268]
548    
549     * Thu Aug 22 2002 Charlie Brady <charlieb@e-smith.com>
550     - [1.9.14-01]
551     - Use full iptables path in status fragment - allows "service masq status" to
552     work. [charlieb 1268]
553     - Fix local networks list [charlieb 1268]
554    
555     * Tue Aug 20 2002 Charlie Brady <charlieb@e-smith.com>
556     - [1.9.13-01]
557     - Fix syntax in 30adjustTOS fragment. Move definitions to start of masq
558     script where they can be used in functions. [charlieb 4501]
559    
560     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
561     - [1.9.12-01]
562     - Add 90adjustDenyLog fragment missed in last commit. [charlieb 4501]
563    
564     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
565     - [1.9.11-01]
566     - Further re-arrangement to facilitate non-disruptive update of filtering
567     rules. [charlieb 4501]
568    
569     * Fri Aug 16 2002 Charlie Brady <charlieb@e-smith.com>
570     - [1.9.10-01]
571     - Remove 98adjust, and split it into 49adjustStart, 50adjustTCP and 51adjustEnd
572     fragments. Migrate network stack tuning stuff to sysctl.conf templates.
573     Add TOS adjustment stuff. [charlieb 4501]
574    
575     * Thu Aug 15 2002 Charlie Brady <charlieb@e-smith.com>
576     - [1.9.9-01]
577     - Change masq template fragments to allow non-disruptive modification.
578     Add "masq adjust" verb. [charlieb 4501]
579    
580     * Thu Aug 8 2002 Charlie Brady <charlieb@e-smith.com>
581     - [1.9.8-01]
582     - Remove deprecated split in masq template fragment, and add FIXME comment
583     to code which looks to be wrong. [charlieb 1268]
584    
585     * Wed Jul 31 2002 Charlie Brady <charlieb@e-smith.com>
586     - [1.9.7-01]
587     - Use iptables state tracking to allow return traffic. Remove special
588     rules set up to allow the return traffic. [charlieb 4499]
589    
590     * Tue Jul 23 2002 Charlie Brady <charlieb@e-smith.com>
591     - [1.9.6-01]
592     - Allow local and masqueraded traffic on forward chain. Fix syntax for denylog
593     chain. [charlieb 1268]
594    
595     * Thu Jul 18 2002 Charlie Brady <charlieb@e-smith.com>
596     - [1.9.5-01]
597     - Avoid a perl warning from use of ${httpd-e-smith}{status} -
598     change to ${'httpd-e-smith'}{status}. [charlieb 1268]
599    
600     * Wed Jul 17 2002 Charlie Brady <charlieb@e-smith.com>
601     - [1.9.4-01]
602     - Change syntax from ipchains (2.2 kernel) to iptables (2.4 kernel).
603     [charlieb 1268]
604     - Add "status" option to list tables.
605     - Miscellaneous syntax cleanups.
606    
607     * Tue Jul 2 2002 Charlie Brady <charlieb@e-smith.com>
608     - [1.9.3-01]
609     - Add "modprobe ipchains" to allow firewall to work with 2.4 kernel
610     [charlieb 4223]
611    
612     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
613     - [1.9.2-01]
614     - Allow ICMP from all "local" networks, not just physical LAN [markk 3698]
615    
616     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
617     - [1.9.1-01]
618     - Allow ICMP on internal interface [markk 3698]
619    
620     * Wed Jun 5 2002 Charlie Brady <charlieb@e-smith.com>
621     - [1.9.0-01]
622     - Changing version to maintained stream number to 1.9.0
623    
624     * Fri May 31 2002 Charlie Brady <charlieb@e-smith.com>
625     - [1.8.0-01]
626     - Changing version to maintained stream number to 1.8.0
627    
628     * Thu May 23 2002 Gordon Rowell <gordonr@e-smith.com>
629     - [1.7.3-01]
630     - RPM rebuild forced by cvsroot2rpm
631    
632     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
633     - [1.7.2-01]
634     - Remove 45AllowSMTP - moved to e-smith-mailfront. [charlieb 3419]
635    
636     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
637     - [1.7.1-01]
638     - No change. Test build of CVS conversion.
639    
640     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
641     - [1.7.0-01]
642     - rollRPM: Rolled version number to 1.7.0-01. Includes patches up to 1.6.0-02.
643    
644     * Wed Dec 19 2001 Charlie Brady <charlieb@e-smith.com>
645     - [1.6.0-02]
646     - Restore run time lookup of ExternalIP by /etc/rc.d/init.d/masq.
647     - Make sure that OUTERNET is set to a valid IP address, even if
648     ExternalIP is not set in config db, to avoid syntax errors in
649     ipchains command in masq script.
650    
651     * Tue Dec 11 2001 Jason Miller <jay@e-smith.com>
652     - [1.6.0-01]
653     - rollRPM: Rolled version number to 1.6.0-01. Includes patches up to 1.5.0-05.
654    
655     * Thu Dec 06 2001 Charlie Brady <charlieb@e-smith.com>
656     - [1.5.0-05]
657     - Add support for ippp0 as the external interface - if sync ISDN is used.
658    
659     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
660     - [1.5.0-04]
661     - Add $OUT = "" to 01localNetworks so that '1' isn't output
662     into template when 01localNetworks generates no output.
663    
664     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
665     - [1.5.0-03]
666     - Splitting @locals and $primaryLocalNet generation out of
667     40AllowLocals into 01localNetworks.
668     - transproxy fragment from e-smith-proxy needs these variables in
669     35transproxy.
670    
671     * Tue Nov 06 2001 Charlie Brady <charlieb@e-smith.com>
672     - [1.5.0-02]
673     - Fix variable naming error in setting up @locals array.
674     - Remove forwarding rules from stopmasq section - and remove the 'stop'
675     alias for this case - there is a separate stop section of the script.
676     - Add bidirectional forwarding rules for each local network to our network.
677     This both enables the forwarded traffic, and also prevents masquerading
678     of the local traffic.
679    
680     * Mon Nov 5 2001 Charlie Brady <charlieb@e-smith.com>
681     - [1.5.0-01]
682     - Rolled version number to 1.5.0-01. Includes patches upto 1.4.0-02.
683    
684     * Mon Oct 29 2001 Charlie Brady <charlieb@e-smith.com>
685     - [1.4.0-02]
686     - Allow packet forwarding from localnet to localnet in serveronly mode -
687     this is necessary for PPTP VPN termination.
688    
689     * Thu Aug 23 2001 Gordon Rowell <gordonr@e-smith.com>
690     - [1.4.0-01]
691     - Rolled version number to 1.4.0-01. Includes patches upto 1.3.0-08.
692    
693     * Fri Aug 17 2001 gordonr
694     - [1.3.0-08]
695     - Autorebuild by rebuildRPM
696    
697     * Mon Aug 13 2001 Adrian Chung <adrianc@e-smith.com>
698     - [1.3.0-07]
699     - Apply the patch. :)
700    
701     * Fri Aug 10 2001 Adrian Chung <adrianc@e-smith.com>
702     - [1.3.0-06]
703     - Multicast range is 224.0.0.0 to 239.255.255.255 which
704     is 224.0.0.0/4 not 224.0.0.0/3.
705     224.0.0.0/3 covers 255.255.255.255 which denies DHCP traffic
706    
707     * Mon Apr 21 2001 Gordon Rowell <gordonr@e-smith.com>
708     - [1.3.0-05]
709     - Putback Charlie's change to add Stealth property to masq service, defaulting
710     to "no". If set to "yes", external ICMP echo packets are ignored.
711    
712     * Sat Apr 07 2001 Gordon Rowell <gordonr@e-smith.com>
713     - [1.3.0-04]
714     - Forward port patches from 1.2.0-01 to 1.2.0-06
715    
716     * Sun Mar 25 2001 Gordon Rowell <gordonr@e-smith.com>
717     - [1.2.0-06]
718     - Two new properties of masq service - PermitHighUDP and PermitHighTCP.
719     Both default to "yes", but provide an easy way to block unprivileged
720     TCP/UDP or both.
721    
722     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
723     - [1.2.0-05]
724     - Default auth/smtp/http[s] to public for backwards compatability
725    
726     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
727     - [1.2.0-04]
728     - masq service now has an optional property Logging, defaulting to "none"
729     - Only log denied packets if Logging is other than "none" - this stops
730     logging of the SMB chatter on cable and other shared networks
731     - Ignore SMB and RIP packets unless Logging is "all"
732    
733     * Thu Mar 22 2001 Gordon Rowell <gordonr@e-smith.com>
734     - [1.2.0-03]
735     - Check access property for httpd-e-smith/smtpd/identd
736    
737     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
738     - [1.3.0-03]
739     - set rp_filter to 0 for 'all' interface as well.
740    
741     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
742     - [1.3.0-02]
743     - set rp_filter to 0 for 'default' interface, explicitly set
744     it to 1 for eth0, eth1.
745     - ipsec-restart will set eth1 to '0'.
746    
747     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
748     - [1.3.0-01]
749     - branching to development stream.
750    
751     * Thu Feb 8 2001 Adrian Chung <adrianc@e-smith.com>
752     - [1.2.0-02]
753     - Rolling release number for GPG signing.
754    
755     * Thu Jan 25 2001 Peter Samuel <peters@e-smith.com>
756     - [1.2.0-01]
757     - Rolled version number to 1.2.0-01. Includes patches upto 1.1.0-16.
758    
759     * Thu Jan 25 2001 Adrian Chung <adrianc@e-smith.com>
760     - [1.1.0-16]
761     - removed 35DenyUnrouteable fragment, since it affects
762     us, and anyone else using a provider who masquerades
763     connections.
764    
765     * Wed Jan 24 2001 Charlie Brady <charlieb@e-smith.com>
766     - [1.1.0-15]
767     - Remove AllowFTP fragment - moved to e-smith-proftpd.
768    
769     * Thu Jan 18 2001 Adrian Chung <adrianc@e-smith.com>
770     - [1.1.0-14]
771     - adjusted 45AllowFTP to follow value of FTP accessLimits instead
772     of service status.
773    
774     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
775     - [1.1.0-13]
776     - Added use esmith::db
777    
778     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
779     - [1.1.0-12]
780     - Backed out -11 patch - not required
781     - Reordered fragments
782    
783     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
784     - [1.1.0-11]
785     - Added source/destination to icmp rules
786    
787     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
788     - [1.1.0-10]
789     - Added protocol option to icmp fragments
790     - Removed masqstart/masqstop
791     - Allowed icmp echo-request and echo-reply
792    
793     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
794     - [1.1.0-9]
795     - Rearranged fragments
796     - Split some rules into new chains
797     - Added extra ICMP rules
798    
799     * Fri Dec 15 2000 Charlie Brady <charlieb@e-smith.com>
800     - [1.1.0-8]
801     - Move AllowSSH template fragment to e-smith-openssh.
802     - Fix uninitialised value problem in 15Definitions.
803    
804     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
805     - [1.1.0-7]
806     - Normalised AUTH template and fixed HTTP[S] templates
807    
808     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
809     - [1.1.0-6]
810     - Used hard-quote form of HERE documents to avoid $ expansions
811    
812     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
813     - [1.1.0-5]
814     - Normalised structure of 45Allow* fragments
815     - Moved 45AllowIONonPriv to 46AllowIONonPriv
816    
817     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
818     - [1.1.0-4]
819     - Fixed service name in templates - imapd -> imap
820     - Changed mode -> access
821    
822     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
823     - [1.1.0-3]
824     - Rewrote 15definitions and 45* fragments which checked services entries
825    
826     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
827     - [1.1.0-2]
828     - Determine ExternalIP at run time
829     - Modified templates to check services entries
830     - Added COPYING file and GPL Copyright
831    
832     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
833     - [1.1.0-1]
834     - Rolled version and tarball including patches to 0.1-4
835     - Used e-smith-devtools
836    
837     * Thu Nov 30 2000 Gordon Rowell <gordonr@e-smith.com>
838     - [0.1-4]
839     - Changes to match change to pppoe service
840    
841     * Wed Nov 29 2000 Gordon Rowell <gordonr@e-smith.com>
842     - Handle ppp0 as external interface for PPPoE setups
843    
844     * Tue Nov 21 2000 Charlie Brady <charlieb@e-smith.com>
845     - Remove extraneous } in 15definitions
846    
847     * Sun Nov 19 2000 Charlie Brady <charlieb@e-smith.com>
848     - initial release
849    
850     %prep
851     %setup
852 jpp 1.2 %patch0 -p1
853 jpp 1.4 %patch1 -p1
854 jpp 1.6 %patch2 -p1
855 jpp 1.7 %patch3 -p1
856     rm -rf root/var/service/ulogd
857 jpp 1.13 mkdir -p root/run/ulog
858 jpp 1.14 %patch4 -p1
859 jpp 1.15 %patch5 -p1
860 jpp 1.14
861 stephdl 1.1
862     %build
863     perl createlinks
864    
865     %install
866     rm -rf $RPM_BUILD_ROOT
867    
868     for file in masq
869     do
870     mkdir -p root/etc/e-smith/templates/etc/rc.d/init.d/$file
871     ln -s /etc/e-smith/templates-default/template-begin-shell \
872     root/etc/e-smith/templates/etc/rc.d/init.d/$file/template-begin
873     done
874    
875     (cd root ; find . -depth -print | cpio -dump $RPM_BUILD_ROOT)
876     mkdir -p $RPM_BUILD_ROOT/var/log/iptables
877     mkdir -p $RPM_BUILD_ROOT/service
878 jpp 1.7 #ln -s /var/service/ulogd $RPM_BUILD_ROOT/service/ulogd
879 stephdl 1.1 /sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
880 jpp 1.8 --dir /var/log/iptables 'attr(0755,ulog,ulog)' \
881 jpp 1.13 --dir /run/ulog 'attr(2755,ulog,ulog)' \
882 stephdl 1.1 > e-smith-%{version}-filelist
883     echo "%doc COPYING" >> e-smith-%{version}-filelist
884 jpp 1.7 # --dir /var/service/ulogd 'attr(1755,root,root)' \
885     # --file /var/service/ulogd/run 'attr(0755,root,root)' \
886     # --dir /var/service/ulogd/log 'attr(0755,root,root)' \
887     # --file /var/service/ulogd/log/run 'attr(0755,root,root)' \
888 stephdl 1.1
889     %clean
890     rm -rf $RPM_BUILD_ROOT
891    
892 jpp 1.7 %pre
893     if [ $1 -gt 1 ] ; then
894     if [ -e /var/service/ulogd/run ] ; then
895     /usr/bin/sv d ulogd
896     /usr/bin/sv d ulogd/log
897     fi
898     fi
899    
900 jpp 1.8 /usr/sbin/groupadd \
901     -g 1010 -o ulog 2>/dev/null || :
902    
903     /usr/sbin/useradd \
904     -u 1010 -g 1010 -c 'ulogd user' -d /var/log/ulogd \
905     -M -s /bin/false ulog || :
906 jpp 1.7
907 stephdl 1.1 %files -f e-smith-%{version}-filelist
908     %defattr(-,root,root)

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed