/[smeserver]/rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec
ViewVC logotype

Annotation of /rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (hide annotations) (download)
Thu Feb 7 21:35:28 2013 UTC (11 years, 4 months ago) by slords
Branch: MAIN
CVS Tags: e-smith-packetfilter-2_4_0-1_el6_sme
* Wed Feb  6 2013 Shad L. Lords <slords@mail.com> 2.4.0-1.sme
- Roll new stream for sme9

1 slords 1.1 # $Id: e-smith-packetfilter.spec,v 1.2 2008/10/07 18:50:26 slords Exp $
2    
3     Summary: e-smith server and gateway - packetfilter add-on
4     %define name e-smith-packetfilter
5     Name: %{name}
6     %define version 2.4.0
7     %define release 1
8     Version: %{version}
9     Release: %{release}%{?dist}
10     License: GPL
11     Group: Networking/Daemons
12     Source: %{name}-%{version}.tar.xz
13     BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
14     BuildArchitectures: noarch
15     Requires: e-smith-base >= 4.18.0
16     Requires: ulogd >= 1.24
17     Requires: daemontools
18     Requires: iptables
19     BuildRequires: e-smith-devtools
20     Obsoletes: e-smith-ipmasq
21     AutoReqProv: no
22    
23     %description
24     e-smith server and gateway software - packetfilter add-on
25    
26     %changelog
27     * Wed Feb 6 2013 Shad L. Lords <slords@mail.com> 2.4.0-1.sme
28     - Roll new stream for sme9
29    
30     * Tue Oct 7 2008 Shad L. Lords <slords@mail.com> 2.2.0-1.sme
31     - Roll new stream to separate sme7/sme8 trees [SME: 4633]
32    
33     * Fri May 18 2007 Shad L. Lords <slords@mail.com> 1.18.0-6
34     - Use correct lib for modules
35    
36     * Sun Apr 29 2007 Shad L. Lords <slords@mail.com>
37     - Clean up spec so package can be built by koji/plague
38    
39     * Fri Apr 09 2007 Stephen Noble <support@dungog.net> 1.18.0-5
40     - Fix masq error in server only mode (cannot open UDPPort) [SME: 2812]
41    
42     * Fri Apr 06 2007 Shad L. Lords <slords@mail.com> 1.18.0-4
43     - Fix perms for ulogd.conf file [SME: 2722]
44    
45     * Mon Mar 19 2007 Shad L. Lords <slords@mail.com> 1.18.0-3
46     - Update ulogd.conf to new format [SME: 2744]
47    
48     * Fri Feb 09 2007 Shad L. Lords <slords@mail.com> 1.18.0-2
49     - Fix sorting for Ports properties [SME: 56]
50    
51     * Fri Jan 26 2007 Shad L. Lords <slords@mail.com> 1.18.0-1
52     - Roll stable stream. [SME: 2328]
53    
54     * Thu Jan 18 2007 Shad L. Lords <slords@mail.com> 1.17.0-7
55     - Move last masq fragments from e-smith-base.
56    
57     * Wed Jan 17 2007 Shad L. Lords <slords@mail.com> 1.17.0-6
58     - Use both {TCP,UDP}Port and {TCP,UDP}Ports for masq template [SME: 56]
59    
60     * Thu Dec 07 2006 Shad L. Lords <slords@mail.com>
61     - Update to new release naming. No functional changes.
62     - Make Packager generic
63    
64     * Fri Nov 23 2006 Gordon Rowell <gordonr@gormand.com.au> 1.17.0-04
65     - Remove TCPMinimizeDelay default for ssh [SME: 2083]
66    
67     * Mon Aug 28 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-03
68     - Ensure that $OUTERNET is an IP address. [SME: 1815]
69    
70     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-02
71     - Merge in masq fragments from e-smith-base.
72    
73     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-01
74     - Roll new development stream.
75    
76     * Wed Jul 26 2006 Gordon Rowell <gordonr@gormand.com.au> 1.16.0-05
77     - Remove redundant auto-generated service-specific denylog rules from
78     90InboundTCP10filter_{tcp,udp} [SME: 1776]
79    
80     * Tue Jul 18 2006 Charlie Brady <charlie_brady@mitel.com> 1.16.0-04
81     - Bundle fragments from e-smith-ipmasq and obsolete that RPM. [SME: 1002]
82    
83     * Tue Jun 20 2006 Filippo Carletti <carletti@mobilia.it> 1.16.0-03
84     - No longer drop UDP packets in serveronly mode [SME: 1002]
85    
86     * Thu Apr 6 2006 Gavin Weight <gweight@gmail.com> 1.2.0-02
87     - Make ident TCP reject configurable, based on oidentd status.
88     If oidentd{status} is enabled, allow ident, otherwise REJECT it [SME: 85]
89    
90     * Wed Mar 15 2006 Charlie Brady <charlie_brady@mitel.com> 1.2.0-01
91     - Roll stable stream version. [SME: 1016]
92    
93     * Wed Nov 30 2005 Gordon Rowell <gordonr@gormand.com.au> 1.15.1-12
94     - Bump release number only
95    
96     * Wed Sep 21 2005 Charlie Brady <charlieb@e-smith.com>
97     - [1.15.1-11]
98     - Remove force/masq/status fragment, and fix "masq adjust" so
99     that it is harmless if firewall is disabled. This leaves unsolved
100     the problem of whether to toggle disabled->enabled during upgrades.
101     [SF: 1261356]
102    
103     * Wed Sep 7 2005 Charlie Brady <charlieb@e-smith.com>
104     - [1.15.1-10]
105     - Fix location of force/status fragment for masq service. [SF: 1261356]
106    
107     * Tue Aug 30 2005 Charlie Brady <charlieb@e-smith.com>
108     - [1.15.1-09]
109     - Add force/status fragment for masq service, to force enabled.
110     This ensures that firewall is running after a system upgrade,
111     to avoid various panel failure modes. Solution to be reviewed
112     for alternatives later. [SF: 1261356]
113    
114     * Fri Aug 26 2005 Charlie Brady <charlieb@e-smith.com>
115     - [1.15.1-08]
116     - Remove filtering of outbound ICMP - it's blocking legitimate ICMP
117     redirects. [MN00093544]
118    
119     * Tue Aug 2 2005 Shad Lords <slords@email.com>
120     - [1.15.1-07]
121     - Add default $masq{Stealth} db entry
122    
123     * Tue Aug 2 2005 Gordon Rowell <gordonr@gormand.com.au>
124     - [1.15.1-06]
125     - Rejct IDENT with a TCP reset [SF: 1240659]
126     - Add support for UDPPort (c.f. TCPPort) property to allow
127     filtered UDP [SF: 1241398]
128     - Add support for DenyHosts property (see 1.15.0-02 for AllowHosts)
129     [SF: 1241398]
130    
131     * Mon Jul 18 2005 Charlie Brady <charlieb@e-smith.com>
132     - [1.15.1-05]
133     - Tidy up path reference to networks db. [SF: 1216546]
134    
135     * Tue Jun 7 2005 Charlie Brady <charlieb@e-smith.com>
136     - [1.15.1-04]
137     - Fix ulogd logging to stdout not being captured by multilog.
138    
139     * Mon May 2 2005 Charlie Brady <charlieb@e-smith.com>
140     - [1.15.1-03]
141     - Add requires headers for ulogd and daemontools.
142    
143     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
144     - [1.15.1-02]
145     - Switch to logging via ulogd and multilog.
146    
147     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
148     - [1.15.1-01]
149     - Roll new development stream - 1.15.1
150    
151     * Wed Mar 30 2005 Charlie Brady <charlieb@e-smith.com>
152     - [1.15.0-15]
153     - Set $OUTERNET to equal $LocalIP in masq script in serveronly mode,
154     so that masq script (if enabled) does not block allowed public access.
155     - Remove various 45Allow* fragments as TCPPort properties of services
156     will allow access if public access is enabled.
157    
158     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
159     - [1.15.0-14]
160     - More cleanup for iptables-trace [tonyc]
161    
162     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
163     - [1.15.0-13]
164     - update to latest iptables-trace [tonyc] :
165     - add logging for default chain policy fallback
166     - fix stop() bug causing _any_ rules with --log-prefix to be removed
167    
168     * Fri Apr 30 2004 Michael Soulier <msoulier@e-smith.com>
169     - [1.15.0-12]
170     - Made TOS settings configurable, with just ssh set by default.
171     [msoulier dpar-28993]
172    
173     * Wed Feb 25 2004 Michael Soulier <msoulier@e-smith.com>
174     - [1.15.0-11]
175     - Tightened rules for remote vpn subnets. [msoulier dpar-21836]
176    
177     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
178     - [1.15.0-10]
179     - Fixed iptables-trace "stop" removing rules from the denylog chain.
180     [msoulier 10955]
181    
182     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
183     - [1.15.0-09]
184     - Added a toggle of the trace option during adjust, so adjusts work with trace
185     enabled. [msoulier 8117]
186    
187     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
188     - [1.15.0-08]
189     - Changed multicast DROP target to denylog, so it toggles. [msoulier 9450]
190    
191     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
192     - [1.15.0-07]
193     - Changed the toggle property name to DenylogTarget. [msoulier 9450]
194    
195     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
196     - [1.15.0-06]
197     - Added firewall-wide toggle for denylog DROP/REJECT. [msoulier 9450]
198    
199     * Sat Nov 29 2003 Charlie Brady <charlieb@e-smith.com>
200     - [1.15.0-05]
201     - Ensure that masq script expands without error in serveronly mode.
202     [charlieb 10162]
203    
204     * Sat Oct 4 2003 Michael Soulier <msoulier@e-smith.com>
205     - [1.15.0-04]
206     - Fixed error in masq fragment with stealth enabled. [msoulier 10165]
207    
208     * Thu Sep 25 2003 Gordon Rowell <gordonr@e-smith.com>
209     - [1.15.0-03]
210     - Add masq to 0.0.0.0/0 for public, unrestricted [gordonr 10050]
211    
212     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
213     - [1.15.0-02]
214     - New fragment 90InboundTCP10filter_tcp, a further step towards
215     auto-generation of rules, removing the 45Allow* fragments:
216    
217     For all services which have a TCPPort property defined:
218     If the service is 'enabled' and the service is 'public',
219     generate iptables rules as follows:
220     If an AllowHosts property is defined, allow only those hosts
221     Otherwise allow all hosts
222    
223     AllowHosts is comma separated, and can contain IPs, IP/mask and CIDR
224    
225     This will generate duplicate rules until the 45Allow* fragments
226     are removed, which can happen once the TCPPort property is defined
227     for a service.
228    
229     QUERY: Should this be TCPPort (singular) or TCPPorts (plural)?
230     TODO: Create db defaults fragments to deprecate the 45Allow* fragments
231     TODO: Possibly add DenyHosts processing [gordonr 10050]
232    
233     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
234     - [1.15.0-01]
235     - Changing version to development stream number - 1.15.0
236     - Dev stream [gordonr 10050]
237    
238     * Thu Jun 26 2003 Charlie Brady <charlieb@e-smith.com>
239     - [1.14.0-01]
240     - Changing version to stable stream number - 1.14.0
241    
242     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
243     - [1.13.0-27]
244     - Again [tonyc 8578]
245    
246     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
247     - [1.13.0-26]
248     - Add lo->lo ACCEPT rule back to 90local_chk00Start fragment [tonyc 8578]
249    
250     * Mon Jun 16 2003 Tony Clayton <apc@e-smith.com>
251     - [1.13.0-25]
252     - Split 90AllowLocal masq fragment into 90local_chk* [tonyc 8578]
253    
254     * Mon Jun 2 2003 Michael Soulier <msoulier@e-smith.com>
255     - [1.13.0-24]
256     - Explicitely blocking multicast not from a local network.
257     [msoulier 6031]
258    
259     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
260     - [1.13.0-23]
261     - Added chain creation during adjust. What a thought. [msoulier 7695]
262    
263     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
264     - [1.13.0-22]
265     - Added support for a PPPconn chain to track rules to permit PPTP connections.
266     [msoulier 7695]
267    
268     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
269     - [1.13.0-21]
270     - Refactored the 90adjustUDP template into multiple fragments. [msoulier 8505]
271    
272     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
273     - [1.13.0-20]
274     - Refactored the 90adjustTCP template into multiple fragments. [msoulier 8505]
275    
276     * Tue Apr 22 2003 Michael Soulier <msoulier@e-smith.com>
277     - [1.13.0-19]
278     - Accepting all traffic from the loopback interface. [msoulier 8299]
279    
280     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
281     - [1.13.0-18]
282     - Removed acceptance of anything not from the external interface. The local
283     networks list should be sufficient. [msoulier 8299]
284    
285     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
286     - [1.13.0-17]
287     - Added handling of local_chk chain in adjustment. [msoulier 8299]
288    
289     * Mon Apr 14 2003 Gordon Rowell <gordonr@e-smith.com>
290     - [1.13.0-16]
291     - Flag pptp masq as on by default [gordonr 6694]
292    
293     * Tue Apr 8 2003 Michael Soulier <msoulier@e-smith.com>
294     - [1.13.0-15]
295     - Added iptables-trace in /etc/rc.d/init.d. [msoulier 7613]
296    
297     * Tue Apr 1 2003 Gordon Rowell <gordonr@e-smith.com>
298     - [1.13.0-14]
299     - Added denylog: prefix to denied packet logs [gordonr 6852]
300    
301     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
302     - [1.13.0-13]
303     - Portforwarding still had problems, fixed here. [msoulier 7284]
304    
305     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
306     - [1.13.0-12]
307     - Added ForwardedTCP and ForwardedUDP, as well as supporting code to
308     permit certain ports to be opened for forwarded traffic inbound. Required
309     for portforwarding. [msoulier 7284]
310    
311     * Fri Mar 7 2003 Charlie Brady <charlieb@e-smith.com>
312     - [1.13.0-11]
313     - Add "use esmith::util" to 01localNetworks fragment. Needed if
314     esmith::templates form of processTemplate is used. [charlieb 5650]
315    
316     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
317     - [1.13.0-10]
318     - Remove quotes around 'Name' - not required [gordonr 7343]
319    
320     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
321     - [1.13.0-09]
322     - Make use of ExternalInterface definition in 00Definitions [gordonr 7343]
323     - Update dependency on e-smithbase [gordonr 7343]
324    
325     * Mon Feb 3 2003 Mark Knox <markk@e-smith.com>
326     - [1.13.0-08]
327     - Open port 443 when either web server is enabled [markk 6428]
328    
329     * Fri Jan 24 2003 Charlie Brady <charlieb@e-smith.com>
330     - [1.13.0-07]
331     - Fix one last broken here document. [charlieb 6651]
332    
333     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
334     - [1.13.0-06]
335     - Fix a few typos in previous round of masq fragment changes. [charlieb]
336    
337     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
338     - [1.13.0-05]
339     - formatting changes in masq/00Functions template fragment [charlieb]
340     - Use connection tracking on both INPUT and FORWARD tables [charlieb 6651]
341     - Allow any local traffic on INPUT and FORWARD chains. Local traffic
342     is currently defined as all traffic which didn't come in via the
343     external interface. That definition can easily change, as there is
344     a special chain for accepting local traffic. [charlieb 6709]
345     - Remove explicit allow of multicast traffic, as it is a subset of "local"
346     traffic [charlieb 6031, 6709]
347     - Move ICMP type checking into "adjust" part of masq script [charlieb 6709]
348    
349     * Sat Jan 18 2003 Michael Soulier <msoulier@e-smith.com>
350     - [1.13.0-04]
351     - Permitting multicast traffic to and from the internal interface.
352     [msoulier 6031]
353    
354     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
355     - [1.13.0-03]
356     - Put back non-redundant DROP lines, but add a comment as to why
357     they are there [gordonr 6580]
358    
359     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
360     - [1.13.0-02]
361     - Remove redundant DROP lines from denylog chain [gordonr 6580]
362    
363     * Thu Jan 9 2003 Mark Knox <markk@e-smith.com>
364     - [1.13.0-01]
365     - Forced version update by co2rpm to 1.13.0
366    
367     * Mon Dec 16 2002 Charlie Brady <charlieb@e-smith.com>
368     - [1.12.0-01]
369     - Roll to stable version to 1.12.0
370    
371     * Fri Nov 29 2002 Michael Soulier <msoulier@e-smith.com>
372     - [1.11.0-07]
373     - Added a get_safe_id function, to factor out firewall rule scanning code, and
374     prevent chain name clashes in the extreme case. [msoulier 5696]
375    
376     * Thu Nov 28 2002 Michael Soulier <msoulier@e-smith.com>
377     - [1.11.0-06]
378     - Removed specific tcp_in and udp_in chains in favour of the InboundTCP_$$ and
379     InboundUDP__$$ chains. They are far, far easier to manage, especially for
380     the portforwarding blade. [msoulier 5696]
381    
382     * Wed Nov 20 2002 Charlie Brady <charlieb@e-smith.com>
383     - [1.11.0-05]
384     - Make sure that --numeric is used with any --list command, to avoid
385     reverse lookup delays. [charlieb 5644]
386    
387     * Wed Nov 13 2002 Charlie Brady <charlieb@e-smith.com>
388     - [1.11.0-04]
389     - Peel off ICMP for checking after packets for ESTABLISHED and RELATED
390     connections are allowed. This allows outbound ping to work. [charlieb 5423]
391    
392     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
393     - [1.11.0-03]
394     - Apply UDP filtering only on traffic entering via external
395     interface. [charlieb 5644]
396    
397     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
398     - [1.11.0-02]
399     - Add UDP input filter setup and adjust rules.
400     Re-arrange 00Functions a bit so that perl block is
401     shorter and the rest is in-line [charlieb 5644]
402     - Move adjustEnd to 92, to allow 91 hole for any adjustments
403     needing to be done after input filter rules are adjusted
404     (e.g. port forwarding).
405    
406     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
407     - [1.11.0-01]
408     - rolling development stream to 1.11.0
409    
410     * Sat Oct 19 2002 Charlie Brady <charlieb@e-smith.com>
411     - [1.10.0-08]
412     - Send default packets on the FORWARD filter to denylog, rather than
413     DROP. [charlieb 5246]
414     - Revert 2) from 1.10.0-05 checkin. 5.5 ipchains forwarding rules do not allow
415     IP masqueraded packets. [charlieb 5246]
416    
417     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
418     - [1.10.0-07]
419     - Commit new file 42CheckTCPInput which was missed in last checkin.
420     [charlieb 5246]
421    
422     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
423     - [1.10.0-06]
424     - Create a new intermediate TCP input chain, and create a new temporary
425     TCP input chain whenever we run "masq adjust". This ensures that
426     new TCP input checking rules occur at the same place during input
427     checking as existing rules, and also means that rules previously created
428     by now-removed packages disappear. [charlieb 4501, 5246]
429    
430     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
431     - [1.10.0-05]
432     - Fix to the previous change 1) to restore some commented out rules,
433     and 2) to fix those rules so that they match the 5.5 ipchains
434     version. [charlieb 5246]
435    
436     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
437     - [1.10.0-04]
438     - Changes so that local networks can be added/deleted and "masq adjust"
439     will correctly re-adjust the filters. [charlieb 5246]
440    
441     * Tue Oct 15 2002 Charlie Brady <charlieb@e-smith.com>
442     - [1.10.0-03]
443     - Change 00Functions so that "tcp_in" function can create chains as required
444     during "masq adjust", so that new modules can add rules and still avoid
445     "masq restart". [charlieb 4501]
446    
447     * Tue Oct 15 2002 Mark Knox <markk@e-smith.com>
448     - [1.10.0-02]
449     - Re-add echo-reply support (doesn't work with conntrack) [markk 5213]
450    
451     * Sat Oct 12 2002 Charlie Brady <charlieb@e-smith.com>
452     - [1.10.0-01]
453     - Roll to maintained version number to 1.10.0
454     - Remove "perl createlinks" from %build section, since we no longer
455     have a createlinks file.
456    
457     * Fri Oct 11 2002 Gordon Rowell <gordonr@e-smith.com>
458     - [1.9.15-07]
459     - Check the correct configDB entry for public POP [gordonr 5181]
460    
461     * Tue Oct 8 2002 Mark Knox <markk@e-smith.com>
462     - [1.9.15-06]
463     - Use denylog target for dropped ICMP packets [markk 5095]
464     - Remove explicit echo-reply support (we use conntrack now) [markk 5095]
465    
466     * Mon Oct 7 2002 Mark Knox <markk@e-smith.com>
467     - [1.9.15-05]
468     - Drop ICMP echo-requests on ext i/f when in private s/g mode or if Stealth
469     property is set. General cleanup of ICMP rules. [markk 5095]
470    
471     * Wed Sep 11 2002 Gordon Rowell <gordonr@e-smith.com>
472     - [1.9.15-04]
473     - Added extra slosh in tcp_in as one gets gobbled by template evaluation
474     and we need one in the final output. Reformatted the lines and moved
475     proto/port together on first line of pair for readability [gordonr 4792]
476    
477     * Thu Sep 5 2002 Charlie Brady <charlieb@e-smith.com>
478     - [1.9.15-03]
479     - Fix tcp_in function - it doesn't work too well without the jump to the
480     newly defined rule. Change DROP to denylog in the placeholder rule,
481     even though it is short-lived. [charlieb 4792]
482    
483     * Mon Sep 2 2002 Charlie Brady <charlieb@e-smith.com>
484     - [1.9.15-02]
485     - Remove createlinks script and network-{create,delete} event directories -
486     the required change was made in e-smith-base, and this shouldn't have
487     been checked in. [charlieb 4501]
488    
489     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
490     - [1.9.15-01]
491     - Rolling minor version number to work around wrinkle in co2rpm [charlieb 3700]
492    
493     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
494     - [1.9.14-04]
495     - Remove 45AllowAUTH masq fragment - moved to e-smith-oidentd package.
496     [charlieb 4435]
497    
498     * Tue Aug 27 2002 Charlie Brady <charlieb@e-smith.com>
499     - [1.9.14-03]
500     - Fix iptables syntax in AdjustTOS fragment [charlieb 1268]
501    
502     * Mon Aug 26 2002 Charlie Brady <charlieb@e-smith.com>
503     - [1.9.14-02]
504     - Fix AllowICMPfromLAN template error [charlieb 1268]
505    
506     * Thu Aug 22 2002 Charlie Brady <charlieb@e-smith.com>
507     - [1.9.14-01]
508     - Use full iptables path in status fragment - allows "service masq status" to
509     work. [charlieb 1268]
510     - Fix local networks list [charlieb 1268]
511    
512     * Tue Aug 20 2002 Charlie Brady <charlieb@e-smith.com>
513     - [1.9.13-01]
514     - Fix syntax in 30adjustTOS fragment. Move definitions to start of masq
515     script where they can be used in functions. [charlieb 4501]
516    
517     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
518     - [1.9.12-01]
519     - Add 90adjustDenyLog fragment missed in last commit. [charlieb 4501]
520    
521     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
522     - [1.9.11-01]
523     - Further re-arrangement to facilitate non-disruptive update of filtering
524     rules. [charlieb 4501]
525    
526     * Fri Aug 16 2002 Charlie Brady <charlieb@e-smith.com>
527     - [1.9.10-01]
528     - Remove 98adjust, and split it into 49adjustStart, 50adjustTCP and 51adjustEnd
529     fragments. Migrate network stack tuning stuff to sysctl.conf templates.
530     Add TOS adjustment stuff. [charlieb 4501]
531    
532     * Thu Aug 15 2002 Charlie Brady <charlieb@e-smith.com>
533     - [1.9.9-01]
534     - Change masq template fragments to allow non-disruptive modification.
535     Add "masq adjust" verb. [charlieb 4501]
536    
537     * Thu Aug 8 2002 Charlie Brady <charlieb@e-smith.com>
538     - [1.9.8-01]
539     - Remove deprecated split in masq template fragment, and add FIXME comment
540     to code which looks to be wrong. [charlieb 1268]
541    
542     * Wed Jul 31 2002 Charlie Brady <charlieb@e-smith.com>
543     - [1.9.7-01]
544     - Use iptables state tracking to allow return traffic. Remove special
545     rules set up to allow the return traffic. [charlieb 4499]
546    
547     * Tue Jul 23 2002 Charlie Brady <charlieb@e-smith.com>
548     - [1.9.6-01]
549     - Allow local and masqueraded traffic on forward chain. Fix syntax for denylog
550     chain. [charlieb 1268]
551    
552     * Thu Jul 18 2002 Charlie Brady <charlieb@e-smith.com>
553     - [1.9.5-01]
554     - Avoid a perl warning from use of ${httpd-e-smith}{status} -
555     change to ${'httpd-e-smith'}{status}. [charlieb 1268]
556    
557     * Wed Jul 17 2002 Charlie Brady <charlieb@e-smith.com>
558     - [1.9.4-01]
559     - Change syntax from ipchains (2.2 kernel) to iptables (2.4 kernel).
560     [charlieb 1268]
561     - Add "status" option to list tables.
562     - Miscellaneous syntax cleanups.
563    
564     * Tue Jul 2 2002 Charlie Brady <charlieb@e-smith.com>
565     - [1.9.3-01]
566     - Add "modprobe ipchains" to allow firewall to work with 2.4 kernel
567     [charlieb 4223]
568    
569     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
570     - [1.9.2-01]
571     - Allow ICMP from all "local" networks, not just physical LAN [markk 3698]
572    
573     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
574     - [1.9.1-01]
575     - Allow ICMP on internal interface [markk 3698]
576    
577     * Wed Jun 5 2002 Charlie Brady <charlieb@e-smith.com>
578     - [1.9.0-01]
579     - Changing version to maintained stream number to 1.9.0
580    
581     * Fri May 31 2002 Charlie Brady <charlieb@e-smith.com>
582     - [1.8.0-01]
583     - Changing version to maintained stream number to 1.8.0
584    
585     * Thu May 23 2002 Gordon Rowell <gordonr@e-smith.com>
586     - [1.7.3-01]
587     - RPM rebuild forced by cvsroot2rpm
588    
589     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
590     - [1.7.2-01]
591     - Remove 45AllowSMTP - moved to e-smith-mailfront. [charlieb 3419]
592    
593     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
594     - [1.7.1-01]
595     - No change. Test build of CVS conversion.
596    
597     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
598     - [1.7.0-01]
599     - rollRPM: Rolled version number to 1.7.0-01. Includes patches up to 1.6.0-02.
600    
601     * Wed Dec 19 2001 Charlie Brady <charlieb@e-smith.com>
602     - [1.6.0-02]
603     - Restore run time lookup of ExternalIP by /etc/rc.d/init.d/masq.
604     - Make sure that OUTERNET is set to a valid IP address, even if
605     ExternalIP is not set in config db, to avoid syntax errors in
606     ipchains command in masq script.
607    
608     * Tue Dec 11 2001 Jason Miller <jay@e-smith.com>
609     - [1.6.0-01]
610     - rollRPM: Rolled version number to 1.6.0-01. Includes patches up to 1.5.0-05.
611    
612     * Thu Dec 06 2001 Charlie Brady <charlieb@e-smith.com>
613     - [1.5.0-05]
614     - Add support for ippp0 as the external interface - if sync ISDN is used.
615    
616     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
617     - [1.5.0-04]
618     - Add $OUT = "" to 01localNetworks so that '1' isn't output
619     into template when 01localNetworks generates no output.
620    
621     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
622     - [1.5.0-03]
623     - Splitting @locals and $primaryLocalNet generation out of
624     40AllowLocals into 01localNetworks.
625     - transproxy fragment from e-smith-proxy needs these variables in
626     35transproxy.
627    
628     * Tue Nov 06 2001 Charlie Brady <charlieb@e-smith.com>
629     - [1.5.0-02]
630     - Fix variable naming error in setting up @locals array.
631     - Remove forwarding rules from stopmasq section - and remove the 'stop'
632     alias for this case - there is a separate stop section of the script.
633     - Add bidirectional forwarding rules for each local network to our network.
634     This both enables the forwarded traffic, and also prevents masquerading
635     of the local traffic.
636    
637     * Mon Nov 5 2001 Charlie Brady <charlieb@e-smith.com>
638     - [1.5.0-01]
639     - Rolled version number to 1.5.0-01. Includes patches upto 1.4.0-02.
640    
641     * Mon Oct 29 2001 Charlie Brady <charlieb@e-smith.com>
642     - [1.4.0-02]
643     - Allow packet forwarding from localnet to localnet in serveronly mode -
644     this is necessary for PPTP VPN termination.
645    
646     * Thu Aug 23 2001 Gordon Rowell <gordonr@e-smith.com>
647     - [1.4.0-01]
648     - Rolled version number to 1.4.0-01. Includes patches upto 1.3.0-08.
649    
650     * Fri Aug 17 2001 gordonr
651     - [1.3.0-08]
652     - Autorebuild by rebuildRPM
653    
654     * Mon Aug 13 2001 Adrian Chung <adrianc@e-smith.com>
655     - [1.3.0-07]
656     - Apply the patch. :)
657    
658     * Fri Aug 10 2001 Adrian Chung <adrianc@e-smith.com>
659     - [1.3.0-06]
660     - Multicast range is 224.0.0.0 to 239.255.255.255 which
661     is 224.0.0.0/4 not 224.0.0.0/3.
662     224.0.0.0/3 covers 255.255.255.255 which denies DHCP traffic
663    
664     * Mon Apr 21 2001 Gordon Rowell <gordonr@e-smith.com>
665     - [1.3.0-05]
666     - Putback Charlie's change to add Stealth property to masq service, defaulting
667     to "no". If set to "yes", external ICMP echo packets are ignored.
668    
669     * Sat Apr 07 2001 Gordon Rowell <gordonr@e-smith.com>
670     - [1.3.0-04]
671     - Forward port patches from 1.2.0-01 to 1.2.0-06
672    
673     * Sun Mar 25 2001 Gordon Rowell <gordonr@e-smith.com>
674     - [1.2.0-06]
675     - Two new properties of masq service - PermitHighUDP and PermitHighTCP.
676     Both default to "yes", but provide an easy way to block unprivileged
677     TCP/UDP or both.
678    
679     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
680     - [1.2.0-05]
681     - Default auth/smtp/http[s] to public for backwards compatability
682    
683     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
684     - [1.2.0-04]
685     - masq service now has an optional property Logging, defaulting to "none"
686     - Only log denied packets if Logging is other than "none" - this stops
687     logging of the SMB chatter on cable and other shared networks
688     - Ignore SMB and RIP packets unless Logging is "all"
689    
690     * Thu Mar 22 2001 Gordon Rowell <gordonr@e-smith.com>
691     - [1.2.0-03]
692     - Check access property for httpd-e-smith/smtpd/identd
693    
694     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
695     - [1.3.0-03]
696     - set rp_filter to 0 for 'all' interface as well.
697    
698     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
699     - [1.3.0-02]
700     - set rp_filter to 0 for 'default' interface, explicitly set
701     it to 1 for eth0, eth1.
702     - ipsec-restart will set eth1 to '0'.
703    
704     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
705     - [1.3.0-01]
706     - branching to development stream.
707    
708     * Thu Feb 8 2001 Adrian Chung <adrianc@e-smith.com>
709     - [1.2.0-02]
710     - Rolling release number for GPG signing.
711    
712     * Thu Jan 25 2001 Peter Samuel <peters@e-smith.com>
713     - [1.2.0-01]
714     - Rolled version number to 1.2.0-01. Includes patches upto 1.1.0-16.
715    
716     * Thu Jan 25 2001 Adrian Chung <adrianc@e-smith.com>
717     - [1.1.0-16]
718     - removed 35DenyUnrouteable fragment, since it affects
719     us, and anyone else using a provider who masquerades
720     connections.
721    
722     * Wed Jan 24 2001 Charlie Brady <charlieb@e-smith.com>
723     - [1.1.0-15]
724     - Remove AllowFTP fragment - moved to e-smith-proftpd.
725    
726     * Thu Jan 18 2001 Adrian Chung <adrianc@e-smith.com>
727     - [1.1.0-14]
728     - adjusted 45AllowFTP to follow value of FTP accessLimits instead
729     of service status.
730    
731     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
732     - [1.1.0-13]
733     - Added use esmith::db
734    
735     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
736     - [1.1.0-12]
737     - Backed out -11 patch - not required
738     - Reordered fragments
739    
740     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
741     - [1.1.0-11]
742     - Added source/destination to icmp rules
743    
744     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
745     - [1.1.0-10]
746     - Added protocol option to icmp fragments
747     - Removed masqstart/masqstop
748     - Allowed icmp echo-request and echo-reply
749    
750     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
751     - [1.1.0-9]
752     - Rearranged fragments
753     - Split some rules into new chains
754     - Added extra ICMP rules
755    
756     * Fri Dec 15 2000 Charlie Brady <charlieb@e-smith.com>
757     - [1.1.0-8]
758     - Move AllowSSH template fragment to e-smith-openssh.
759     - Fix uninitialised value problem in 15Definitions.
760    
761     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
762     - [1.1.0-7]
763     - Normalised AUTH template and fixed HTTP[S] templates
764    
765     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
766     - [1.1.0-6]
767     - Used hard-quote form of HERE documents to avoid $ expansions
768    
769     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
770     - [1.1.0-5]
771     - Normalised structure of 45Allow* fragments
772     - Moved 45AllowIONonPriv to 46AllowIONonPriv
773    
774     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
775     - [1.1.0-4]
776     - Fixed service name in templates - imapd -> imap
777     - Changed mode -> access
778    
779     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
780     - [1.1.0-3]
781     - Rewrote 15definitions and 45* fragments which checked services entries
782    
783     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
784     - [1.1.0-2]
785     - Determine ExternalIP at run time
786     - Modified templates to check services entries
787     - Added COPYING file and GPL Copyright
788    
789     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
790     - [1.1.0-1]
791     - Rolled version and tarball including patches to 0.1-4
792     - Used e-smith-devtools
793    
794     * Thu Nov 30 2000 Gordon Rowell <gordonr@e-smith.com>
795     - [0.1-4]
796     - Changes to match change to pppoe service
797    
798     * Wed Nov 29 2000 Gordon Rowell <gordonr@e-smith.com>
799     - Handle ppp0 as external interface for PPPoE setups
800    
801     * Tue Nov 21 2000 Charlie Brady <charlieb@e-smith.com>
802     - Remove extraneous } in 15definitions
803    
804     * Sun Nov 19 2000 Charlie Brady <charlieb@e-smith.com>
805     - initial release
806    
807     %prep
808     %setup
809    
810     %build
811     perl createlinks
812    
813     %install
814     rm -rf $RPM_BUILD_ROOT
815    
816     for file in masq
817     do
818     mkdir -p root/etc/e-smith/templates/etc/rc.d/init.d/$file
819     ln -s /etc/e-smith/templates-default/template-begin-shell \
820     root/etc/e-smith/templates/etc/rc.d/init.d/$file/template-begin
821     done
822    
823     (cd root ; find . -depth -print | cpio -dump $RPM_BUILD_ROOT)
824     mkdir -p $RPM_BUILD_ROOT/var/log/iptables
825     mkdir -p $RPM_BUILD_ROOT/service
826     ln -s /var/service/ulogd $RPM_BUILD_ROOT/service/ulogd
827     /sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
828     --dir /var/service/ulogd 'attr(1755,root,root)' \
829     --file /var/service/ulogd/run 'attr(0755,root,root)' \
830     --dir /var/service/ulogd/log 'attr(0755,root,root)' \
831     --file /var/service/ulogd/log/run 'attr(0755,root,root)' \
832     --dir /var/log/iptables 'attr(0755,smelog,smelog)' \
833     > e-smith-%{version}-filelist
834     echo "%doc COPYING" >> e-smith-%{version}-filelist
835    
836     %clean
837     rm -rf $RPM_BUILD_ROOT
838    
839     %files -f e-smith-%{version}-filelist
840     %defattr(-,root,root)

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed