/[smeserver]/rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec
ViewVC logotype

Annotation of /rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.2 - (hide annotations) (download)
Tue Feb 19 19:18:59 2013 UTC (11 years, 3 months ago) by vip-ire
Branch: MAIN
CVS Tags: e-smith-packetfilter-2_4_0-2_el6_sme
Changes since 1.1: +7 -2 lines
* Tue Feb 19 2013 Daniel Berteaud <daniel@firewall-services.com> 2.4.0-2.sme
- Use extrapositioned negation (Credits to John Crisp) [SME: 7262]

1 vip-ire 1.2 # $Id: e-smith-packetfilter.spec,v 1.1 2013/02/07 21:35:28 slords Exp $
2 slords 1.1
3     Summary: e-smith server and gateway - packetfilter add-on
4     %define name e-smith-packetfilter
5     Name: %{name}
6     %define version 2.4.0
7 vip-ire 1.2 %define release 2
8 slords 1.1 Version: %{version}
9     Release: %{release}%{?dist}
10     License: GPL
11     Group: Networking/Daemons
12     Source: %{name}-%{version}.tar.xz
13 vip-ire 1.2 Patch1: e-smith-packetfilter-2.4.0-negation.patch
14 slords 1.1 BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
15     BuildArchitectures: noarch
16     Requires: e-smith-base >= 4.18.0
17     Requires: ulogd >= 1.24
18     Requires: daemontools
19     Requires: iptables
20     BuildRequires: e-smith-devtools
21     Obsoletes: e-smith-ipmasq
22     AutoReqProv: no
23    
24     %description
25     e-smith server and gateway software - packetfilter add-on
26    
27     %changelog
28 vip-ire 1.2 * Tue Feb 19 2013 Daniel Berteaud <daniel@firewall-services.com> 2.4.0-2.sme
29     - Use extrapositioned negation (Credits to John Crisp) [SME: 7262]
30    
31 slords 1.1 * Wed Feb 6 2013 Shad L. Lords <slords@mail.com> 2.4.0-1.sme
32     - Roll new stream for sme9
33    
34     * Tue Oct 7 2008 Shad L. Lords <slords@mail.com> 2.2.0-1.sme
35     - Roll new stream to separate sme7/sme8 trees [SME: 4633]
36    
37     * Fri May 18 2007 Shad L. Lords <slords@mail.com> 1.18.0-6
38     - Use correct lib for modules
39    
40     * Sun Apr 29 2007 Shad L. Lords <slords@mail.com>
41     - Clean up spec so package can be built by koji/plague
42    
43     * Fri Apr 09 2007 Stephen Noble <support@dungog.net> 1.18.0-5
44     - Fix masq error in server only mode (cannot open UDPPort) [SME: 2812]
45    
46     * Fri Apr 06 2007 Shad L. Lords <slords@mail.com> 1.18.0-4
47     - Fix perms for ulogd.conf file [SME: 2722]
48    
49     * Mon Mar 19 2007 Shad L. Lords <slords@mail.com> 1.18.0-3
50     - Update ulogd.conf to new format [SME: 2744]
51    
52     * Fri Feb 09 2007 Shad L. Lords <slords@mail.com> 1.18.0-2
53     - Fix sorting for Ports properties [SME: 56]
54    
55     * Fri Jan 26 2007 Shad L. Lords <slords@mail.com> 1.18.0-1
56     - Roll stable stream. [SME: 2328]
57    
58     * Thu Jan 18 2007 Shad L. Lords <slords@mail.com> 1.17.0-7
59     - Move last masq fragments from e-smith-base.
60    
61     * Wed Jan 17 2007 Shad L. Lords <slords@mail.com> 1.17.0-6
62     - Use both {TCP,UDP}Port and {TCP,UDP}Ports for masq template [SME: 56]
63    
64     * Thu Dec 07 2006 Shad L. Lords <slords@mail.com>
65     - Update to new release naming. No functional changes.
66     - Make Packager generic
67    
68     * Fri Nov 23 2006 Gordon Rowell <gordonr@gormand.com.au> 1.17.0-04
69     - Remove TCPMinimizeDelay default for ssh [SME: 2083]
70    
71     * Mon Aug 28 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-03
72     - Ensure that $OUTERNET is an IP address. [SME: 1815]
73    
74     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-02
75     - Merge in masq fragments from e-smith-base.
76    
77     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-01
78     - Roll new development stream.
79    
80     * Wed Jul 26 2006 Gordon Rowell <gordonr@gormand.com.au> 1.16.0-05
81     - Remove redundant auto-generated service-specific denylog rules from
82     90InboundTCP10filter_{tcp,udp} [SME: 1776]
83    
84     * Tue Jul 18 2006 Charlie Brady <charlie_brady@mitel.com> 1.16.0-04
85     - Bundle fragments from e-smith-ipmasq and obsolete that RPM. [SME: 1002]
86    
87     * Tue Jun 20 2006 Filippo Carletti <carletti@mobilia.it> 1.16.0-03
88     - No longer drop UDP packets in serveronly mode [SME: 1002]
89    
90     * Thu Apr 6 2006 Gavin Weight <gweight@gmail.com> 1.2.0-02
91     - Make ident TCP reject configurable, based on oidentd status.
92     If oidentd{status} is enabled, allow ident, otherwise REJECT it [SME: 85]
93    
94     * Wed Mar 15 2006 Charlie Brady <charlie_brady@mitel.com> 1.2.0-01
95     - Roll stable stream version. [SME: 1016]
96    
97     * Wed Nov 30 2005 Gordon Rowell <gordonr@gormand.com.au> 1.15.1-12
98     - Bump release number only
99    
100     * Wed Sep 21 2005 Charlie Brady <charlieb@e-smith.com>
101     - [1.15.1-11]
102     - Remove force/masq/status fragment, and fix "masq adjust" so
103     that it is harmless if firewall is disabled. This leaves unsolved
104     the problem of whether to toggle disabled->enabled during upgrades.
105     [SF: 1261356]
106    
107     * Wed Sep 7 2005 Charlie Brady <charlieb@e-smith.com>
108     - [1.15.1-10]
109     - Fix location of force/status fragment for masq service. [SF: 1261356]
110    
111     * Tue Aug 30 2005 Charlie Brady <charlieb@e-smith.com>
112     - [1.15.1-09]
113     - Add force/status fragment for masq service, to force enabled.
114     This ensures that firewall is running after a system upgrade,
115     to avoid various panel failure modes. Solution to be reviewed
116     for alternatives later. [SF: 1261356]
117    
118     * Fri Aug 26 2005 Charlie Brady <charlieb@e-smith.com>
119     - [1.15.1-08]
120     - Remove filtering of outbound ICMP - it's blocking legitimate ICMP
121     redirects. [MN00093544]
122    
123     * Tue Aug 2 2005 Shad Lords <slords@email.com>
124     - [1.15.1-07]
125     - Add default $masq{Stealth} db entry
126    
127     * Tue Aug 2 2005 Gordon Rowell <gordonr@gormand.com.au>
128     - [1.15.1-06]
129     - Rejct IDENT with a TCP reset [SF: 1240659]
130     - Add support for UDPPort (c.f. TCPPort) property to allow
131     filtered UDP [SF: 1241398]
132     - Add support for DenyHosts property (see 1.15.0-02 for AllowHosts)
133     [SF: 1241398]
134    
135     * Mon Jul 18 2005 Charlie Brady <charlieb@e-smith.com>
136     - [1.15.1-05]
137     - Tidy up path reference to networks db. [SF: 1216546]
138    
139     * Tue Jun 7 2005 Charlie Brady <charlieb@e-smith.com>
140     - [1.15.1-04]
141     - Fix ulogd logging to stdout not being captured by multilog.
142    
143     * Mon May 2 2005 Charlie Brady <charlieb@e-smith.com>
144     - [1.15.1-03]
145     - Add requires headers for ulogd and daemontools.
146    
147     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
148     - [1.15.1-02]
149     - Switch to logging via ulogd and multilog.
150    
151     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
152     - [1.15.1-01]
153     - Roll new development stream - 1.15.1
154    
155     * Wed Mar 30 2005 Charlie Brady <charlieb@e-smith.com>
156     - [1.15.0-15]
157     - Set $OUTERNET to equal $LocalIP in masq script in serveronly mode,
158     so that masq script (if enabled) does not block allowed public access.
159     - Remove various 45Allow* fragments as TCPPort properties of services
160     will allow access if public access is enabled.
161    
162     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
163     - [1.15.0-14]
164     - More cleanup for iptables-trace [tonyc]
165    
166     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
167     - [1.15.0-13]
168     - update to latest iptables-trace [tonyc] :
169     - add logging for default chain policy fallback
170     - fix stop() bug causing _any_ rules with --log-prefix to be removed
171    
172     * Fri Apr 30 2004 Michael Soulier <msoulier@e-smith.com>
173     - [1.15.0-12]
174     - Made TOS settings configurable, with just ssh set by default.
175     [msoulier dpar-28993]
176    
177     * Wed Feb 25 2004 Michael Soulier <msoulier@e-smith.com>
178     - [1.15.0-11]
179     - Tightened rules for remote vpn subnets. [msoulier dpar-21836]
180    
181     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
182     - [1.15.0-10]
183     - Fixed iptables-trace "stop" removing rules from the denylog chain.
184     [msoulier 10955]
185    
186     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
187     - [1.15.0-09]
188     - Added a toggle of the trace option during adjust, so adjusts work with trace
189     enabled. [msoulier 8117]
190    
191     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
192     - [1.15.0-08]
193     - Changed multicast DROP target to denylog, so it toggles. [msoulier 9450]
194    
195     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
196     - [1.15.0-07]
197     - Changed the toggle property name to DenylogTarget. [msoulier 9450]
198    
199     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
200     - [1.15.0-06]
201     - Added firewall-wide toggle for denylog DROP/REJECT. [msoulier 9450]
202    
203     * Sat Nov 29 2003 Charlie Brady <charlieb@e-smith.com>
204     - [1.15.0-05]
205     - Ensure that masq script expands without error in serveronly mode.
206     [charlieb 10162]
207    
208     * Sat Oct 4 2003 Michael Soulier <msoulier@e-smith.com>
209     - [1.15.0-04]
210     - Fixed error in masq fragment with stealth enabled. [msoulier 10165]
211    
212     * Thu Sep 25 2003 Gordon Rowell <gordonr@e-smith.com>
213     - [1.15.0-03]
214     - Add masq to 0.0.0.0/0 for public, unrestricted [gordonr 10050]
215    
216     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
217     - [1.15.0-02]
218     - New fragment 90InboundTCP10filter_tcp, a further step towards
219     auto-generation of rules, removing the 45Allow* fragments:
220    
221     For all services which have a TCPPort property defined:
222     If the service is 'enabled' and the service is 'public',
223     generate iptables rules as follows:
224     If an AllowHosts property is defined, allow only those hosts
225     Otherwise allow all hosts
226    
227     AllowHosts is comma separated, and can contain IPs, IP/mask and CIDR
228    
229     This will generate duplicate rules until the 45Allow* fragments
230     are removed, which can happen once the TCPPort property is defined
231     for a service.
232    
233     QUERY: Should this be TCPPort (singular) or TCPPorts (plural)?
234     TODO: Create db defaults fragments to deprecate the 45Allow* fragments
235     TODO: Possibly add DenyHosts processing [gordonr 10050]
236    
237     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
238     - [1.15.0-01]
239     - Changing version to development stream number - 1.15.0
240     - Dev stream [gordonr 10050]
241    
242     * Thu Jun 26 2003 Charlie Brady <charlieb@e-smith.com>
243     - [1.14.0-01]
244     - Changing version to stable stream number - 1.14.0
245    
246     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
247     - [1.13.0-27]
248     - Again [tonyc 8578]
249    
250     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
251     - [1.13.0-26]
252     - Add lo->lo ACCEPT rule back to 90local_chk00Start fragment [tonyc 8578]
253    
254     * Mon Jun 16 2003 Tony Clayton <apc@e-smith.com>
255     - [1.13.0-25]
256     - Split 90AllowLocal masq fragment into 90local_chk* [tonyc 8578]
257    
258     * Mon Jun 2 2003 Michael Soulier <msoulier@e-smith.com>
259     - [1.13.0-24]
260     - Explicitely blocking multicast not from a local network.
261     [msoulier 6031]
262    
263     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
264     - [1.13.0-23]
265     - Added chain creation during adjust. What a thought. [msoulier 7695]
266    
267     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
268     - [1.13.0-22]
269     - Added support for a PPPconn chain to track rules to permit PPTP connections.
270     [msoulier 7695]
271    
272     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
273     - [1.13.0-21]
274     - Refactored the 90adjustUDP template into multiple fragments. [msoulier 8505]
275    
276     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
277     - [1.13.0-20]
278     - Refactored the 90adjustTCP template into multiple fragments. [msoulier 8505]
279    
280     * Tue Apr 22 2003 Michael Soulier <msoulier@e-smith.com>
281     - [1.13.0-19]
282     - Accepting all traffic from the loopback interface. [msoulier 8299]
283    
284     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
285     - [1.13.0-18]
286     - Removed acceptance of anything not from the external interface. The local
287     networks list should be sufficient. [msoulier 8299]
288    
289     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
290     - [1.13.0-17]
291     - Added handling of local_chk chain in adjustment. [msoulier 8299]
292    
293     * Mon Apr 14 2003 Gordon Rowell <gordonr@e-smith.com>
294     - [1.13.0-16]
295     - Flag pptp masq as on by default [gordonr 6694]
296    
297     * Tue Apr 8 2003 Michael Soulier <msoulier@e-smith.com>
298     - [1.13.0-15]
299     - Added iptables-trace in /etc/rc.d/init.d. [msoulier 7613]
300    
301     * Tue Apr 1 2003 Gordon Rowell <gordonr@e-smith.com>
302     - [1.13.0-14]
303     - Added denylog: prefix to denied packet logs [gordonr 6852]
304    
305     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
306     - [1.13.0-13]
307     - Portforwarding still had problems, fixed here. [msoulier 7284]
308    
309     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
310     - [1.13.0-12]
311     - Added ForwardedTCP and ForwardedUDP, as well as supporting code to
312     permit certain ports to be opened for forwarded traffic inbound. Required
313     for portforwarding. [msoulier 7284]
314    
315     * Fri Mar 7 2003 Charlie Brady <charlieb@e-smith.com>
316     - [1.13.0-11]
317     - Add "use esmith::util" to 01localNetworks fragment. Needed if
318     esmith::templates form of processTemplate is used. [charlieb 5650]
319    
320     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
321     - [1.13.0-10]
322     - Remove quotes around 'Name' - not required [gordonr 7343]
323    
324     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
325     - [1.13.0-09]
326     - Make use of ExternalInterface definition in 00Definitions [gordonr 7343]
327     - Update dependency on e-smithbase [gordonr 7343]
328    
329     * Mon Feb 3 2003 Mark Knox <markk@e-smith.com>
330     - [1.13.0-08]
331     - Open port 443 when either web server is enabled [markk 6428]
332    
333     * Fri Jan 24 2003 Charlie Brady <charlieb@e-smith.com>
334     - [1.13.0-07]
335     - Fix one last broken here document. [charlieb 6651]
336    
337     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
338     - [1.13.0-06]
339     - Fix a few typos in previous round of masq fragment changes. [charlieb]
340    
341     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
342     - [1.13.0-05]
343     - formatting changes in masq/00Functions template fragment [charlieb]
344     - Use connection tracking on both INPUT and FORWARD tables [charlieb 6651]
345     - Allow any local traffic on INPUT and FORWARD chains. Local traffic
346     is currently defined as all traffic which didn't come in via the
347     external interface. That definition can easily change, as there is
348     a special chain for accepting local traffic. [charlieb 6709]
349     - Remove explicit allow of multicast traffic, as it is a subset of "local"
350     traffic [charlieb 6031, 6709]
351     - Move ICMP type checking into "adjust" part of masq script [charlieb 6709]
352    
353     * Sat Jan 18 2003 Michael Soulier <msoulier@e-smith.com>
354     - [1.13.0-04]
355     - Permitting multicast traffic to and from the internal interface.
356     [msoulier 6031]
357    
358     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
359     - [1.13.0-03]
360     - Put back non-redundant DROP lines, but add a comment as to why
361     they are there [gordonr 6580]
362    
363     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
364     - [1.13.0-02]
365     - Remove redundant DROP lines from denylog chain [gordonr 6580]
366    
367     * Thu Jan 9 2003 Mark Knox <markk@e-smith.com>
368     - [1.13.0-01]
369     - Forced version update by co2rpm to 1.13.0
370    
371     * Mon Dec 16 2002 Charlie Brady <charlieb@e-smith.com>
372     - [1.12.0-01]
373     - Roll to stable version to 1.12.0
374    
375     * Fri Nov 29 2002 Michael Soulier <msoulier@e-smith.com>
376     - [1.11.0-07]
377     - Added a get_safe_id function, to factor out firewall rule scanning code, and
378     prevent chain name clashes in the extreme case. [msoulier 5696]
379    
380     * Thu Nov 28 2002 Michael Soulier <msoulier@e-smith.com>
381     - [1.11.0-06]
382     - Removed specific tcp_in and udp_in chains in favour of the InboundTCP_$$ and
383     InboundUDP__$$ chains. They are far, far easier to manage, especially for
384     the portforwarding blade. [msoulier 5696]
385    
386     * Wed Nov 20 2002 Charlie Brady <charlieb@e-smith.com>
387     - [1.11.0-05]
388     - Make sure that --numeric is used with any --list command, to avoid
389     reverse lookup delays. [charlieb 5644]
390    
391     * Wed Nov 13 2002 Charlie Brady <charlieb@e-smith.com>
392     - [1.11.0-04]
393     - Peel off ICMP for checking after packets for ESTABLISHED and RELATED
394     connections are allowed. This allows outbound ping to work. [charlieb 5423]
395    
396     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
397     - [1.11.0-03]
398     - Apply UDP filtering only on traffic entering via external
399     interface. [charlieb 5644]
400    
401     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
402     - [1.11.0-02]
403     - Add UDP input filter setup and adjust rules.
404     Re-arrange 00Functions a bit so that perl block is
405     shorter and the rest is in-line [charlieb 5644]
406     - Move adjustEnd to 92, to allow 91 hole for any adjustments
407     needing to be done after input filter rules are adjusted
408     (e.g. port forwarding).
409    
410     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
411     - [1.11.0-01]
412     - rolling development stream to 1.11.0
413    
414     * Sat Oct 19 2002 Charlie Brady <charlieb@e-smith.com>
415     - [1.10.0-08]
416     - Send default packets on the FORWARD filter to denylog, rather than
417     DROP. [charlieb 5246]
418     - Revert 2) from 1.10.0-05 checkin. 5.5 ipchains forwarding rules do not allow
419     IP masqueraded packets. [charlieb 5246]
420    
421     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
422     - [1.10.0-07]
423     - Commit new file 42CheckTCPInput which was missed in last checkin.
424     [charlieb 5246]
425    
426     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
427     - [1.10.0-06]
428     - Create a new intermediate TCP input chain, and create a new temporary
429     TCP input chain whenever we run "masq adjust". This ensures that
430     new TCP input checking rules occur at the same place during input
431     checking as existing rules, and also means that rules previously created
432     by now-removed packages disappear. [charlieb 4501, 5246]
433    
434     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
435     - [1.10.0-05]
436     - Fix to the previous change 1) to restore some commented out rules,
437     and 2) to fix those rules so that they match the 5.5 ipchains
438     version. [charlieb 5246]
439    
440     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
441     - [1.10.0-04]
442     - Changes so that local networks can be added/deleted and "masq adjust"
443     will correctly re-adjust the filters. [charlieb 5246]
444    
445     * Tue Oct 15 2002 Charlie Brady <charlieb@e-smith.com>
446     - [1.10.0-03]
447     - Change 00Functions so that "tcp_in" function can create chains as required
448     during "masq adjust", so that new modules can add rules and still avoid
449     "masq restart". [charlieb 4501]
450    
451     * Tue Oct 15 2002 Mark Knox <markk@e-smith.com>
452     - [1.10.0-02]
453     - Re-add echo-reply support (doesn't work with conntrack) [markk 5213]
454    
455     * Sat Oct 12 2002 Charlie Brady <charlieb@e-smith.com>
456     - [1.10.0-01]
457     - Roll to maintained version number to 1.10.0
458     - Remove "perl createlinks" from %build section, since we no longer
459     have a createlinks file.
460    
461     * Fri Oct 11 2002 Gordon Rowell <gordonr@e-smith.com>
462     - [1.9.15-07]
463     - Check the correct configDB entry for public POP [gordonr 5181]
464    
465     * Tue Oct 8 2002 Mark Knox <markk@e-smith.com>
466     - [1.9.15-06]
467     - Use denylog target for dropped ICMP packets [markk 5095]
468     - Remove explicit echo-reply support (we use conntrack now) [markk 5095]
469    
470     * Mon Oct 7 2002 Mark Knox <markk@e-smith.com>
471     - [1.9.15-05]
472     - Drop ICMP echo-requests on ext i/f when in private s/g mode or if Stealth
473     property is set. General cleanup of ICMP rules. [markk 5095]
474    
475     * Wed Sep 11 2002 Gordon Rowell <gordonr@e-smith.com>
476     - [1.9.15-04]
477     - Added extra slosh in tcp_in as one gets gobbled by template evaluation
478     and we need one in the final output. Reformatted the lines and moved
479     proto/port together on first line of pair for readability [gordonr 4792]
480    
481     * Thu Sep 5 2002 Charlie Brady <charlieb@e-smith.com>
482     - [1.9.15-03]
483     - Fix tcp_in function - it doesn't work too well without the jump to the
484     newly defined rule. Change DROP to denylog in the placeholder rule,
485     even though it is short-lived. [charlieb 4792]
486    
487     * Mon Sep 2 2002 Charlie Brady <charlieb@e-smith.com>
488     - [1.9.15-02]
489     - Remove createlinks script and network-{create,delete} event directories -
490     the required change was made in e-smith-base, and this shouldn't have
491     been checked in. [charlieb 4501]
492    
493     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
494     - [1.9.15-01]
495     - Rolling minor version number to work around wrinkle in co2rpm [charlieb 3700]
496    
497     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
498     - [1.9.14-04]
499     - Remove 45AllowAUTH masq fragment - moved to e-smith-oidentd package.
500     [charlieb 4435]
501    
502     * Tue Aug 27 2002 Charlie Brady <charlieb@e-smith.com>
503     - [1.9.14-03]
504     - Fix iptables syntax in AdjustTOS fragment [charlieb 1268]
505    
506     * Mon Aug 26 2002 Charlie Brady <charlieb@e-smith.com>
507     - [1.9.14-02]
508     - Fix AllowICMPfromLAN template error [charlieb 1268]
509    
510     * Thu Aug 22 2002 Charlie Brady <charlieb@e-smith.com>
511     - [1.9.14-01]
512     - Use full iptables path in status fragment - allows "service masq status" to
513     work. [charlieb 1268]
514     - Fix local networks list [charlieb 1268]
515    
516     * Tue Aug 20 2002 Charlie Brady <charlieb@e-smith.com>
517     - [1.9.13-01]
518     - Fix syntax in 30adjustTOS fragment. Move definitions to start of masq
519     script where they can be used in functions. [charlieb 4501]
520    
521     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
522     - [1.9.12-01]
523     - Add 90adjustDenyLog fragment missed in last commit. [charlieb 4501]
524    
525     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
526     - [1.9.11-01]
527     - Further re-arrangement to facilitate non-disruptive update of filtering
528     rules. [charlieb 4501]
529    
530     * Fri Aug 16 2002 Charlie Brady <charlieb@e-smith.com>
531     - [1.9.10-01]
532     - Remove 98adjust, and split it into 49adjustStart, 50adjustTCP and 51adjustEnd
533     fragments. Migrate network stack tuning stuff to sysctl.conf templates.
534     Add TOS adjustment stuff. [charlieb 4501]
535    
536     * Thu Aug 15 2002 Charlie Brady <charlieb@e-smith.com>
537     - [1.9.9-01]
538     - Change masq template fragments to allow non-disruptive modification.
539     Add "masq adjust" verb. [charlieb 4501]
540    
541     * Thu Aug 8 2002 Charlie Brady <charlieb@e-smith.com>
542     - [1.9.8-01]
543     - Remove deprecated split in masq template fragment, and add FIXME comment
544     to code which looks to be wrong. [charlieb 1268]
545    
546     * Wed Jul 31 2002 Charlie Brady <charlieb@e-smith.com>
547     - [1.9.7-01]
548     - Use iptables state tracking to allow return traffic. Remove special
549     rules set up to allow the return traffic. [charlieb 4499]
550    
551     * Tue Jul 23 2002 Charlie Brady <charlieb@e-smith.com>
552     - [1.9.6-01]
553     - Allow local and masqueraded traffic on forward chain. Fix syntax for denylog
554     chain. [charlieb 1268]
555    
556     * Thu Jul 18 2002 Charlie Brady <charlieb@e-smith.com>
557     - [1.9.5-01]
558     - Avoid a perl warning from use of ${httpd-e-smith}{status} -
559     change to ${'httpd-e-smith'}{status}. [charlieb 1268]
560    
561     * Wed Jul 17 2002 Charlie Brady <charlieb@e-smith.com>
562     - [1.9.4-01]
563     - Change syntax from ipchains (2.2 kernel) to iptables (2.4 kernel).
564     [charlieb 1268]
565     - Add "status" option to list tables.
566     - Miscellaneous syntax cleanups.
567    
568     * Tue Jul 2 2002 Charlie Brady <charlieb@e-smith.com>
569     - [1.9.3-01]
570     - Add "modprobe ipchains" to allow firewall to work with 2.4 kernel
571     [charlieb 4223]
572    
573     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
574     - [1.9.2-01]
575     - Allow ICMP from all "local" networks, not just physical LAN [markk 3698]
576    
577     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
578     - [1.9.1-01]
579     - Allow ICMP on internal interface [markk 3698]
580    
581     * Wed Jun 5 2002 Charlie Brady <charlieb@e-smith.com>
582     - [1.9.0-01]
583     - Changing version to maintained stream number to 1.9.0
584    
585     * Fri May 31 2002 Charlie Brady <charlieb@e-smith.com>
586     - [1.8.0-01]
587     - Changing version to maintained stream number to 1.8.0
588    
589     * Thu May 23 2002 Gordon Rowell <gordonr@e-smith.com>
590     - [1.7.3-01]
591     - RPM rebuild forced by cvsroot2rpm
592    
593     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
594     - [1.7.2-01]
595     - Remove 45AllowSMTP - moved to e-smith-mailfront. [charlieb 3419]
596    
597     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
598     - [1.7.1-01]
599     - No change. Test build of CVS conversion.
600    
601     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
602     - [1.7.0-01]
603     - rollRPM: Rolled version number to 1.7.0-01. Includes patches up to 1.6.0-02.
604    
605     * Wed Dec 19 2001 Charlie Brady <charlieb@e-smith.com>
606     - [1.6.0-02]
607     - Restore run time lookup of ExternalIP by /etc/rc.d/init.d/masq.
608     - Make sure that OUTERNET is set to a valid IP address, even if
609     ExternalIP is not set in config db, to avoid syntax errors in
610     ipchains command in masq script.
611    
612     * Tue Dec 11 2001 Jason Miller <jay@e-smith.com>
613     - [1.6.0-01]
614     - rollRPM: Rolled version number to 1.6.0-01. Includes patches up to 1.5.0-05.
615    
616     * Thu Dec 06 2001 Charlie Brady <charlieb@e-smith.com>
617     - [1.5.0-05]
618     - Add support for ippp0 as the external interface - if sync ISDN is used.
619    
620     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
621     - [1.5.0-04]
622     - Add $OUT = "" to 01localNetworks so that '1' isn't output
623     into template when 01localNetworks generates no output.
624    
625     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
626     - [1.5.0-03]
627     - Splitting @locals and $primaryLocalNet generation out of
628     40AllowLocals into 01localNetworks.
629     - transproxy fragment from e-smith-proxy needs these variables in
630     35transproxy.
631    
632     * Tue Nov 06 2001 Charlie Brady <charlieb@e-smith.com>
633     - [1.5.0-02]
634     - Fix variable naming error in setting up @locals array.
635     - Remove forwarding rules from stopmasq section - and remove the 'stop'
636     alias for this case - there is a separate stop section of the script.
637     - Add bidirectional forwarding rules for each local network to our network.
638     This both enables the forwarded traffic, and also prevents masquerading
639     of the local traffic.
640    
641     * Mon Nov 5 2001 Charlie Brady <charlieb@e-smith.com>
642     - [1.5.0-01]
643     - Rolled version number to 1.5.0-01. Includes patches upto 1.4.0-02.
644    
645     * Mon Oct 29 2001 Charlie Brady <charlieb@e-smith.com>
646     - [1.4.0-02]
647     - Allow packet forwarding from localnet to localnet in serveronly mode -
648     this is necessary for PPTP VPN termination.
649    
650     * Thu Aug 23 2001 Gordon Rowell <gordonr@e-smith.com>
651     - [1.4.0-01]
652     - Rolled version number to 1.4.0-01. Includes patches upto 1.3.0-08.
653    
654     * Fri Aug 17 2001 gordonr
655     - [1.3.0-08]
656     - Autorebuild by rebuildRPM
657    
658     * Mon Aug 13 2001 Adrian Chung <adrianc@e-smith.com>
659     - [1.3.0-07]
660     - Apply the patch. :)
661    
662     * Fri Aug 10 2001 Adrian Chung <adrianc@e-smith.com>
663     - [1.3.0-06]
664     - Multicast range is 224.0.0.0 to 239.255.255.255 which
665     is 224.0.0.0/4 not 224.0.0.0/3.
666     224.0.0.0/3 covers 255.255.255.255 which denies DHCP traffic
667    
668     * Mon Apr 21 2001 Gordon Rowell <gordonr@e-smith.com>
669     - [1.3.0-05]
670     - Putback Charlie's change to add Stealth property to masq service, defaulting
671     to "no". If set to "yes", external ICMP echo packets are ignored.
672    
673     * Sat Apr 07 2001 Gordon Rowell <gordonr@e-smith.com>
674     - [1.3.0-04]
675     - Forward port patches from 1.2.0-01 to 1.2.0-06
676    
677     * Sun Mar 25 2001 Gordon Rowell <gordonr@e-smith.com>
678     - [1.2.0-06]
679     - Two new properties of masq service - PermitHighUDP and PermitHighTCP.
680     Both default to "yes", but provide an easy way to block unprivileged
681     TCP/UDP or both.
682    
683     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
684     - [1.2.0-05]
685     - Default auth/smtp/http[s] to public for backwards compatability
686    
687     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
688     - [1.2.0-04]
689     - masq service now has an optional property Logging, defaulting to "none"
690     - Only log denied packets if Logging is other than "none" - this stops
691     logging of the SMB chatter on cable and other shared networks
692     - Ignore SMB and RIP packets unless Logging is "all"
693    
694     * Thu Mar 22 2001 Gordon Rowell <gordonr@e-smith.com>
695     - [1.2.0-03]
696     - Check access property for httpd-e-smith/smtpd/identd
697    
698     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
699     - [1.3.0-03]
700     - set rp_filter to 0 for 'all' interface as well.
701    
702     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
703     - [1.3.0-02]
704     - set rp_filter to 0 for 'default' interface, explicitly set
705     it to 1 for eth0, eth1.
706     - ipsec-restart will set eth1 to '0'.
707    
708     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
709     - [1.3.0-01]
710     - branching to development stream.
711    
712     * Thu Feb 8 2001 Adrian Chung <adrianc@e-smith.com>
713     - [1.2.0-02]
714     - Rolling release number for GPG signing.
715    
716     * Thu Jan 25 2001 Peter Samuel <peters@e-smith.com>
717     - [1.2.0-01]
718     - Rolled version number to 1.2.0-01. Includes patches upto 1.1.0-16.
719    
720     * Thu Jan 25 2001 Adrian Chung <adrianc@e-smith.com>
721     - [1.1.0-16]
722     - removed 35DenyUnrouteable fragment, since it affects
723     us, and anyone else using a provider who masquerades
724     connections.
725    
726     * Wed Jan 24 2001 Charlie Brady <charlieb@e-smith.com>
727     - [1.1.0-15]
728     - Remove AllowFTP fragment - moved to e-smith-proftpd.
729    
730     * Thu Jan 18 2001 Adrian Chung <adrianc@e-smith.com>
731     - [1.1.0-14]
732     - adjusted 45AllowFTP to follow value of FTP accessLimits instead
733     of service status.
734    
735     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
736     - [1.1.0-13]
737     - Added use esmith::db
738    
739     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
740     - [1.1.0-12]
741     - Backed out -11 patch - not required
742     - Reordered fragments
743    
744     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
745     - [1.1.0-11]
746     - Added source/destination to icmp rules
747    
748     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
749     - [1.1.0-10]
750     - Added protocol option to icmp fragments
751     - Removed masqstart/masqstop
752     - Allowed icmp echo-request and echo-reply
753    
754     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
755     - [1.1.0-9]
756     - Rearranged fragments
757     - Split some rules into new chains
758     - Added extra ICMP rules
759    
760     * Fri Dec 15 2000 Charlie Brady <charlieb@e-smith.com>
761     - [1.1.0-8]
762     - Move AllowSSH template fragment to e-smith-openssh.
763     - Fix uninitialised value problem in 15Definitions.
764    
765     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
766     - [1.1.0-7]
767     - Normalised AUTH template and fixed HTTP[S] templates
768    
769     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
770     - [1.1.0-6]
771     - Used hard-quote form of HERE documents to avoid $ expansions
772    
773     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
774     - [1.1.0-5]
775     - Normalised structure of 45Allow* fragments
776     - Moved 45AllowIONonPriv to 46AllowIONonPriv
777    
778     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
779     - [1.1.0-4]
780     - Fixed service name in templates - imapd -> imap
781     - Changed mode -> access
782    
783     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
784     - [1.1.0-3]
785     - Rewrote 15definitions and 45* fragments which checked services entries
786    
787     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
788     - [1.1.0-2]
789     - Determine ExternalIP at run time
790     - Modified templates to check services entries
791     - Added COPYING file and GPL Copyright
792    
793     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
794     - [1.1.0-1]
795     - Rolled version and tarball including patches to 0.1-4
796     - Used e-smith-devtools
797    
798     * Thu Nov 30 2000 Gordon Rowell <gordonr@e-smith.com>
799     - [0.1-4]
800     - Changes to match change to pppoe service
801    
802     * Wed Nov 29 2000 Gordon Rowell <gordonr@e-smith.com>
803     - Handle ppp0 as external interface for PPPoE setups
804    
805     * Tue Nov 21 2000 Charlie Brady <charlieb@e-smith.com>
806     - Remove extraneous } in 15definitions
807    
808     * Sun Nov 19 2000 Charlie Brady <charlieb@e-smith.com>
809     - initial release
810    
811     %prep
812     %setup
813 vip-ire 1.2 %patch1 -p1
814 slords 1.1
815     %build
816     perl createlinks
817    
818     %install
819     rm -rf $RPM_BUILD_ROOT
820    
821     for file in masq
822     do
823     mkdir -p root/etc/e-smith/templates/etc/rc.d/init.d/$file
824     ln -s /etc/e-smith/templates-default/template-begin-shell \
825     root/etc/e-smith/templates/etc/rc.d/init.d/$file/template-begin
826     done
827    
828     (cd root ; find . -depth -print | cpio -dump $RPM_BUILD_ROOT)
829     mkdir -p $RPM_BUILD_ROOT/var/log/iptables
830     mkdir -p $RPM_BUILD_ROOT/service
831     ln -s /var/service/ulogd $RPM_BUILD_ROOT/service/ulogd
832     /sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
833     --dir /var/service/ulogd 'attr(1755,root,root)' \
834     --file /var/service/ulogd/run 'attr(0755,root,root)' \
835     --dir /var/service/ulogd/log 'attr(0755,root,root)' \
836     --file /var/service/ulogd/log/run 'attr(0755,root,root)' \
837     --dir /var/log/iptables 'attr(0755,smelog,smelog)' \
838     > e-smith-%{version}-filelist
839     echo "%doc COPYING" >> e-smith-%{version}-filelist
840    
841     %clean
842     rm -rf $RPM_BUILD_ROOT
843    
844     %files -f e-smith-%{version}-filelist
845     %defattr(-,root,root)

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed