/[smeserver]/rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec
ViewVC logotype

Annotation of /rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.3 - (hide annotations) (download)
Fri Mar 1 06:02:49 2013 UTC (11 years, 3 months ago) by wellsi
Branch: MAIN
CVS Tags: e-smith-packetfilter-2_4_0-3_el6_sme, HEAD
Changes since 1.2: +8 -2 lines
* Thu Feb 28 2013 Ian Wells <esmith@wellsi.com> 2.4.0-3.sme
- Prevent multiple instances of the masq script running,
  patch by Charlie Brady [SME: 7415]

1 wellsi 1.3 # $Id: e-smith-packetfilter.spec,v 1.2 2013/02/19 19:18:59 vip-ire Exp $
2 slords 1.1
3     Summary: e-smith server and gateway - packetfilter add-on
4     %define name e-smith-packetfilter
5     Name: %{name}
6     %define version 2.4.0
7 wellsi 1.3 %define release 3
8 slords 1.1 Version: %{version}
9     Release: %{release}%{?dist}
10     License: GPL
11     Group: Networking/Daemons
12     Source: %{name}-%{version}.tar.xz
13 vip-ire 1.2 Patch1: e-smith-packetfilter-2.4.0-negation.patch
14 wellsi 1.3 Patch2: e-smith-packetfilter-2.4.0-adjustStart.patch
15 slords 1.1 BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
16     BuildArchitectures: noarch
17     Requires: e-smith-base >= 4.18.0
18     Requires: ulogd >= 1.24
19     Requires: daemontools
20     Requires: iptables
21     BuildRequires: e-smith-devtools
22     Obsoletes: e-smith-ipmasq
23     AutoReqProv: no
24    
25     %description
26     e-smith server and gateway software - packetfilter add-on
27    
28     %changelog
29 wellsi 1.3 * Thu Feb 28 2013 Ian Wells <esmith@wellsi.com> 2.4.0-3.sme
30     - Prevent multiple instances of the masq script running,
31     patch by Charlie Brady [SME: 7415]
32    
33 vip-ire 1.2 * Tue Feb 19 2013 Daniel Berteaud <daniel@firewall-services.com> 2.4.0-2.sme
34     - Use extrapositioned negation (Credits to John Crisp) [SME: 7262]
35    
36 slords 1.1 * Wed Feb 6 2013 Shad L. Lords <slords@mail.com> 2.4.0-1.sme
37     - Roll new stream for sme9
38    
39     * Tue Oct 7 2008 Shad L. Lords <slords@mail.com> 2.2.0-1.sme
40     - Roll new stream to separate sme7/sme8 trees [SME: 4633]
41    
42     * Fri May 18 2007 Shad L. Lords <slords@mail.com> 1.18.0-6
43     - Use correct lib for modules
44    
45     * Sun Apr 29 2007 Shad L. Lords <slords@mail.com>
46     - Clean up spec so package can be built by koji/plague
47    
48     * Fri Apr 09 2007 Stephen Noble <support@dungog.net> 1.18.0-5
49     - Fix masq error in server only mode (cannot open UDPPort) [SME: 2812]
50    
51     * Fri Apr 06 2007 Shad L. Lords <slords@mail.com> 1.18.0-4
52     - Fix perms for ulogd.conf file [SME: 2722]
53    
54     * Mon Mar 19 2007 Shad L. Lords <slords@mail.com> 1.18.0-3
55     - Update ulogd.conf to new format [SME: 2744]
56    
57     * Fri Feb 09 2007 Shad L. Lords <slords@mail.com> 1.18.0-2
58     - Fix sorting for Ports properties [SME: 56]
59    
60     * Fri Jan 26 2007 Shad L. Lords <slords@mail.com> 1.18.0-1
61     - Roll stable stream. [SME: 2328]
62    
63     * Thu Jan 18 2007 Shad L. Lords <slords@mail.com> 1.17.0-7
64     - Move last masq fragments from e-smith-base.
65    
66     * Wed Jan 17 2007 Shad L. Lords <slords@mail.com> 1.17.0-6
67     - Use both {TCP,UDP}Port and {TCP,UDP}Ports for masq template [SME: 56]
68    
69     * Thu Dec 07 2006 Shad L. Lords <slords@mail.com>
70     - Update to new release naming. No functional changes.
71     - Make Packager generic
72    
73     * Fri Nov 23 2006 Gordon Rowell <gordonr@gormand.com.au> 1.17.0-04
74     - Remove TCPMinimizeDelay default for ssh [SME: 2083]
75    
76     * Mon Aug 28 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-03
77     - Ensure that $OUTERNET is an IP address. [SME: 1815]
78    
79     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-02
80     - Merge in masq fragments from e-smith-base.
81    
82     * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-01
83     - Roll new development stream.
84    
85     * Wed Jul 26 2006 Gordon Rowell <gordonr@gormand.com.au> 1.16.0-05
86     - Remove redundant auto-generated service-specific denylog rules from
87     90InboundTCP10filter_{tcp,udp} [SME: 1776]
88    
89     * Tue Jul 18 2006 Charlie Brady <charlie_brady@mitel.com> 1.16.0-04
90     - Bundle fragments from e-smith-ipmasq and obsolete that RPM. [SME: 1002]
91    
92     * Tue Jun 20 2006 Filippo Carletti <carletti@mobilia.it> 1.16.0-03
93     - No longer drop UDP packets in serveronly mode [SME: 1002]
94    
95     * Thu Apr 6 2006 Gavin Weight <gweight@gmail.com> 1.2.0-02
96     - Make ident TCP reject configurable, based on oidentd status.
97     If oidentd{status} is enabled, allow ident, otherwise REJECT it [SME: 85]
98    
99     * Wed Mar 15 2006 Charlie Brady <charlie_brady@mitel.com> 1.2.0-01
100     - Roll stable stream version. [SME: 1016]
101    
102     * Wed Nov 30 2005 Gordon Rowell <gordonr@gormand.com.au> 1.15.1-12
103     - Bump release number only
104    
105     * Wed Sep 21 2005 Charlie Brady <charlieb@e-smith.com>
106     - [1.15.1-11]
107     - Remove force/masq/status fragment, and fix "masq adjust" so
108     that it is harmless if firewall is disabled. This leaves unsolved
109     the problem of whether to toggle disabled->enabled during upgrades.
110     [SF: 1261356]
111    
112     * Wed Sep 7 2005 Charlie Brady <charlieb@e-smith.com>
113     - [1.15.1-10]
114     - Fix location of force/status fragment for masq service. [SF: 1261356]
115    
116     * Tue Aug 30 2005 Charlie Brady <charlieb@e-smith.com>
117     - [1.15.1-09]
118     - Add force/status fragment for masq service, to force enabled.
119     This ensures that firewall is running after a system upgrade,
120     to avoid various panel failure modes. Solution to be reviewed
121     for alternatives later. [SF: 1261356]
122    
123     * Fri Aug 26 2005 Charlie Brady <charlieb@e-smith.com>
124     - [1.15.1-08]
125     - Remove filtering of outbound ICMP - it's blocking legitimate ICMP
126     redirects. [MN00093544]
127    
128     * Tue Aug 2 2005 Shad Lords <slords@email.com>
129     - [1.15.1-07]
130     - Add default $masq{Stealth} db entry
131    
132     * Tue Aug 2 2005 Gordon Rowell <gordonr@gormand.com.au>
133     - [1.15.1-06]
134     - Rejct IDENT with a TCP reset [SF: 1240659]
135     - Add support for UDPPort (c.f. TCPPort) property to allow
136     filtered UDP [SF: 1241398]
137     - Add support for DenyHosts property (see 1.15.0-02 for AllowHosts)
138     [SF: 1241398]
139    
140     * Mon Jul 18 2005 Charlie Brady <charlieb@e-smith.com>
141     - [1.15.1-05]
142     - Tidy up path reference to networks db. [SF: 1216546]
143    
144     * Tue Jun 7 2005 Charlie Brady <charlieb@e-smith.com>
145     - [1.15.1-04]
146     - Fix ulogd logging to stdout not being captured by multilog.
147    
148     * Mon May 2 2005 Charlie Brady <charlieb@e-smith.com>
149     - [1.15.1-03]
150     - Add requires headers for ulogd and daemontools.
151    
152     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
153     - [1.15.1-02]
154     - Switch to logging via ulogd and multilog.
155    
156     * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
157     - [1.15.1-01]
158     - Roll new development stream - 1.15.1
159    
160     * Wed Mar 30 2005 Charlie Brady <charlieb@e-smith.com>
161     - [1.15.0-15]
162     - Set $OUTERNET to equal $LocalIP in masq script in serveronly mode,
163     so that masq script (if enabled) does not block allowed public access.
164     - Remove various 45Allow* fragments as TCPPort properties of services
165     will allow access if public access is enabled.
166    
167     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
168     - [1.15.0-14]
169     - More cleanup for iptables-trace [tonyc]
170    
171     * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
172     - [1.15.0-13]
173     - update to latest iptables-trace [tonyc] :
174     - add logging for default chain policy fallback
175     - fix stop() bug causing _any_ rules with --log-prefix to be removed
176    
177     * Fri Apr 30 2004 Michael Soulier <msoulier@e-smith.com>
178     - [1.15.0-12]
179     - Made TOS settings configurable, with just ssh set by default.
180     [msoulier dpar-28993]
181    
182     * Wed Feb 25 2004 Michael Soulier <msoulier@e-smith.com>
183     - [1.15.0-11]
184     - Tightened rules for remote vpn subnets. [msoulier dpar-21836]
185    
186     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
187     - [1.15.0-10]
188     - Fixed iptables-trace "stop" removing rules from the denylog chain.
189     [msoulier 10955]
190    
191     * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
192     - [1.15.0-09]
193     - Added a toggle of the trace option during adjust, so adjusts work with trace
194     enabled. [msoulier 8117]
195    
196     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
197     - [1.15.0-08]
198     - Changed multicast DROP target to denylog, so it toggles. [msoulier 9450]
199    
200     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
201     - [1.15.0-07]
202     - Changed the toggle property name to DenylogTarget. [msoulier 9450]
203    
204     * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
205     - [1.15.0-06]
206     - Added firewall-wide toggle for denylog DROP/REJECT. [msoulier 9450]
207    
208     * Sat Nov 29 2003 Charlie Brady <charlieb@e-smith.com>
209     - [1.15.0-05]
210     - Ensure that masq script expands without error in serveronly mode.
211     [charlieb 10162]
212    
213     * Sat Oct 4 2003 Michael Soulier <msoulier@e-smith.com>
214     - [1.15.0-04]
215     - Fixed error in masq fragment with stealth enabled. [msoulier 10165]
216    
217     * Thu Sep 25 2003 Gordon Rowell <gordonr@e-smith.com>
218     - [1.15.0-03]
219     - Add masq to 0.0.0.0/0 for public, unrestricted [gordonr 10050]
220    
221     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
222     - [1.15.0-02]
223     - New fragment 90InboundTCP10filter_tcp, a further step towards
224     auto-generation of rules, removing the 45Allow* fragments:
225    
226     For all services which have a TCPPort property defined:
227     If the service is 'enabled' and the service is 'public',
228     generate iptables rules as follows:
229     If an AllowHosts property is defined, allow only those hosts
230     Otherwise allow all hosts
231    
232     AllowHosts is comma separated, and can contain IPs, IP/mask and CIDR
233    
234     This will generate duplicate rules until the 45Allow* fragments
235     are removed, which can happen once the TCPPort property is defined
236     for a service.
237    
238     QUERY: Should this be TCPPort (singular) or TCPPorts (plural)?
239     TODO: Create db defaults fragments to deprecate the 45Allow* fragments
240     TODO: Possibly add DenyHosts processing [gordonr 10050]
241    
242     * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
243     - [1.15.0-01]
244     - Changing version to development stream number - 1.15.0
245     - Dev stream [gordonr 10050]
246    
247     * Thu Jun 26 2003 Charlie Brady <charlieb@e-smith.com>
248     - [1.14.0-01]
249     - Changing version to stable stream number - 1.14.0
250    
251     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
252     - [1.13.0-27]
253     - Again [tonyc 8578]
254    
255     * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
256     - [1.13.0-26]
257     - Add lo->lo ACCEPT rule back to 90local_chk00Start fragment [tonyc 8578]
258    
259     * Mon Jun 16 2003 Tony Clayton <apc@e-smith.com>
260     - [1.13.0-25]
261     - Split 90AllowLocal masq fragment into 90local_chk* [tonyc 8578]
262    
263     * Mon Jun 2 2003 Michael Soulier <msoulier@e-smith.com>
264     - [1.13.0-24]
265     - Explicitely blocking multicast not from a local network.
266     [msoulier 6031]
267    
268     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
269     - [1.13.0-23]
270     - Added chain creation during adjust. What a thought. [msoulier 7695]
271    
272     * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
273     - [1.13.0-22]
274     - Added support for a PPPconn chain to track rules to permit PPTP connections.
275     [msoulier 7695]
276    
277     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
278     - [1.13.0-21]
279     - Refactored the 90adjustUDP template into multiple fragments. [msoulier 8505]
280    
281     * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
282     - [1.13.0-20]
283     - Refactored the 90adjustTCP template into multiple fragments. [msoulier 8505]
284    
285     * Tue Apr 22 2003 Michael Soulier <msoulier@e-smith.com>
286     - [1.13.0-19]
287     - Accepting all traffic from the loopback interface. [msoulier 8299]
288    
289     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
290     - [1.13.0-18]
291     - Removed acceptance of anything not from the external interface. The local
292     networks list should be sufficient. [msoulier 8299]
293    
294     * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
295     - [1.13.0-17]
296     - Added handling of local_chk chain in adjustment. [msoulier 8299]
297    
298     * Mon Apr 14 2003 Gordon Rowell <gordonr@e-smith.com>
299     - [1.13.0-16]
300     - Flag pptp masq as on by default [gordonr 6694]
301    
302     * Tue Apr 8 2003 Michael Soulier <msoulier@e-smith.com>
303     - [1.13.0-15]
304     - Added iptables-trace in /etc/rc.d/init.d. [msoulier 7613]
305    
306     * Tue Apr 1 2003 Gordon Rowell <gordonr@e-smith.com>
307     - [1.13.0-14]
308     - Added denylog: prefix to denied packet logs [gordonr 6852]
309    
310     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
311     - [1.13.0-13]
312     - Portforwarding still had problems, fixed here. [msoulier 7284]
313    
314     * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
315     - [1.13.0-12]
316     - Added ForwardedTCP and ForwardedUDP, as well as supporting code to
317     permit certain ports to be opened for forwarded traffic inbound. Required
318     for portforwarding. [msoulier 7284]
319    
320     * Fri Mar 7 2003 Charlie Brady <charlieb@e-smith.com>
321     - [1.13.0-11]
322     - Add "use esmith::util" to 01localNetworks fragment. Needed if
323     esmith::templates form of processTemplate is used. [charlieb 5650]
324    
325     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
326     - [1.13.0-10]
327     - Remove quotes around 'Name' - not required [gordonr 7343]
328    
329     * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
330     - [1.13.0-09]
331     - Make use of ExternalInterface definition in 00Definitions [gordonr 7343]
332     - Update dependency on e-smithbase [gordonr 7343]
333    
334     * Mon Feb 3 2003 Mark Knox <markk@e-smith.com>
335     - [1.13.0-08]
336     - Open port 443 when either web server is enabled [markk 6428]
337    
338     * Fri Jan 24 2003 Charlie Brady <charlieb@e-smith.com>
339     - [1.13.0-07]
340     - Fix one last broken here document. [charlieb 6651]
341    
342     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
343     - [1.13.0-06]
344     - Fix a few typos in previous round of masq fragment changes. [charlieb]
345    
346     * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
347     - [1.13.0-05]
348     - formatting changes in masq/00Functions template fragment [charlieb]
349     - Use connection tracking on both INPUT and FORWARD tables [charlieb 6651]
350     - Allow any local traffic on INPUT and FORWARD chains. Local traffic
351     is currently defined as all traffic which didn't come in via the
352     external interface. That definition can easily change, as there is
353     a special chain for accepting local traffic. [charlieb 6709]
354     - Remove explicit allow of multicast traffic, as it is a subset of "local"
355     traffic [charlieb 6031, 6709]
356     - Move ICMP type checking into "adjust" part of masq script [charlieb 6709]
357    
358     * Sat Jan 18 2003 Michael Soulier <msoulier@e-smith.com>
359     - [1.13.0-04]
360     - Permitting multicast traffic to and from the internal interface.
361     [msoulier 6031]
362    
363     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
364     - [1.13.0-03]
365     - Put back non-redundant DROP lines, but add a comment as to why
366     they are there [gordonr 6580]
367    
368     * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
369     - [1.13.0-02]
370     - Remove redundant DROP lines from denylog chain [gordonr 6580]
371    
372     * Thu Jan 9 2003 Mark Knox <markk@e-smith.com>
373     - [1.13.0-01]
374     - Forced version update by co2rpm to 1.13.0
375    
376     * Mon Dec 16 2002 Charlie Brady <charlieb@e-smith.com>
377     - [1.12.0-01]
378     - Roll to stable version to 1.12.0
379    
380     * Fri Nov 29 2002 Michael Soulier <msoulier@e-smith.com>
381     - [1.11.0-07]
382     - Added a get_safe_id function, to factor out firewall rule scanning code, and
383     prevent chain name clashes in the extreme case. [msoulier 5696]
384    
385     * Thu Nov 28 2002 Michael Soulier <msoulier@e-smith.com>
386     - [1.11.0-06]
387     - Removed specific tcp_in and udp_in chains in favour of the InboundTCP_$$ and
388     InboundUDP__$$ chains. They are far, far easier to manage, especially for
389     the portforwarding blade. [msoulier 5696]
390    
391     * Wed Nov 20 2002 Charlie Brady <charlieb@e-smith.com>
392     - [1.11.0-05]
393     - Make sure that --numeric is used with any --list command, to avoid
394     reverse lookup delays. [charlieb 5644]
395    
396     * Wed Nov 13 2002 Charlie Brady <charlieb@e-smith.com>
397     - [1.11.0-04]
398     - Peel off ICMP for checking after packets for ESTABLISHED and RELATED
399     connections are allowed. This allows outbound ping to work. [charlieb 5423]
400    
401     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
402     - [1.11.0-03]
403     - Apply UDP filtering only on traffic entering via external
404     interface. [charlieb 5644]
405    
406     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
407     - [1.11.0-02]
408     - Add UDP input filter setup and adjust rules.
409     Re-arrange 00Functions a bit so that perl block is
410     shorter and the rest is in-line [charlieb 5644]
411     - Move adjustEnd to 92, to allow 91 hole for any adjustments
412     needing to be done after input filter rules are adjusted
413     (e.g. port forwarding).
414    
415     * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
416     - [1.11.0-01]
417     - rolling development stream to 1.11.0
418    
419     * Sat Oct 19 2002 Charlie Brady <charlieb@e-smith.com>
420     - [1.10.0-08]
421     - Send default packets on the FORWARD filter to denylog, rather than
422     DROP. [charlieb 5246]
423     - Revert 2) from 1.10.0-05 checkin. 5.5 ipchains forwarding rules do not allow
424     IP masqueraded packets. [charlieb 5246]
425    
426     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
427     - [1.10.0-07]
428     - Commit new file 42CheckTCPInput which was missed in last checkin.
429     [charlieb 5246]
430    
431     * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
432     - [1.10.0-06]
433     - Create a new intermediate TCP input chain, and create a new temporary
434     TCP input chain whenever we run "masq adjust". This ensures that
435     new TCP input checking rules occur at the same place during input
436     checking as existing rules, and also means that rules previously created
437     by now-removed packages disappear. [charlieb 4501, 5246]
438    
439     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
440     - [1.10.0-05]
441     - Fix to the previous change 1) to restore some commented out rules,
442     and 2) to fix those rules so that they match the 5.5 ipchains
443     version. [charlieb 5246]
444    
445     * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
446     - [1.10.0-04]
447     - Changes so that local networks can be added/deleted and "masq adjust"
448     will correctly re-adjust the filters. [charlieb 5246]
449    
450     * Tue Oct 15 2002 Charlie Brady <charlieb@e-smith.com>
451     - [1.10.0-03]
452     - Change 00Functions so that "tcp_in" function can create chains as required
453     during "masq adjust", so that new modules can add rules and still avoid
454     "masq restart". [charlieb 4501]
455    
456     * Tue Oct 15 2002 Mark Knox <markk@e-smith.com>
457     - [1.10.0-02]
458     - Re-add echo-reply support (doesn't work with conntrack) [markk 5213]
459    
460     * Sat Oct 12 2002 Charlie Brady <charlieb@e-smith.com>
461     - [1.10.0-01]
462     - Roll to maintained version number to 1.10.0
463     - Remove "perl createlinks" from %build section, since we no longer
464     have a createlinks file.
465    
466     * Fri Oct 11 2002 Gordon Rowell <gordonr@e-smith.com>
467     - [1.9.15-07]
468     - Check the correct configDB entry for public POP [gordonr 5181]
469    
470     * Tue Oct 8 2002 Mark Knox <markk@e-smith.com>
471     - [1.9.15-06]
472     - Use denylog target for dropped ICMP packets [markk 5095]
473     - Remove explicit echo-reply support (we use conntrack now) [markk 5095]
474    
475     * Mon Oct 7 2002 Mark Knox <markk@e-smith.com>
476     - [1.9.15-05]
477     - Drop ICMP echo-requests on ext i/f when in private s/g mode or if Stealth
478     property is set. General cleanup of ICMP rules. [markk 5095]
479    
480     * Wed Sep 11 2002 Gordon Rowell <gordonr@e-smith.com>
481     - [1.9.15-04]
482     - Added extra slosh in tcp_in as one gets gobbled by template evaluation
483     and we need one in the final output. Reformatted the lines and moved
484     proto/port together on first line of pair for readability [gordonr 4792]
485    
486     * Thu Sep 5 2002 Charlie Brady <charlieb@e-smith.com>
487     - [1.9.15-03]
488     - Fix tcp_in function - it doesn't work too well without the jump to the
489     newly defined rule. Change DROP to denylog in the placeholder rule,
490     even though it is short-lived. [charlieb 4792]
491    
492     * Mon Sep 2 2002 Charlie Brady <charlieb@e-smith.com>
493     - [1.9.15-02]
494     - Remove createlinks script and network-{create,delete} event directories -
495     the required change was made in e-smith-base, and this shouldn't have
496     been checked in. [charlieb 4501]
497    
498     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
499     - [1.9.15-01]
500     - Rolling minor version number to work around wrinkle in co2rpm [charlieb 3700]
501    
502     * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
503     - [1.9.14-04]
504     - Remove 45AllowAUTH masq fragment - moved to e-smith-oidentd package.
505     [charlieb 4435]
506    
507     * Tue Aug 27 2002 Charlie Brady <charlieb@e-smith.com>
508     - [1.9.14-03]
509     - Fix iptables syntax in AdjustTOS fragment [charlieb 1268]
510    
511     * Mon Aug 26 2002 Charlie Brady <charlieb@e-smith.com>
512     - [1.9.14-02]
513     - Fix AllowICMPfromLAN template error [charlieb 1268]
514    
515     * Thu Aug 22 2002 Charlie Brady <charlieb@e-smith.com>
516     - [1.9.14-01]
517     - Use full iptables path in status fragment - allows "service masq status" to
518     work. [charlieb 1268]
519     - Fix local networks list [charlieb 1268]
520    
521     * Tue Aug 20 2002 Charlie Brady <charlieb@e-smith.com>
522     - [1.9.13-01]
523     - Fix syntax in 30adjustTOS fragment. Move definitions to start of masq
524     script where they can be used in functions. [charlieb 4501]
525    
526     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
527     - [1.9.12-01]
528     - Add 90adjustDenyLog fragment missed in last commit. [charlieb 4501]
529    
530     * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
531     - [1.9.11-01]
532     - Further re-arrangement to facilitate non-disruptive update of filtering
533     rules. [charlieb 4501]
534    
535     * Fri Aug 16 2002 Charlie Brady <charlieb@e-smith.com>
536     - [1.9.10-01]
537     - Remove 98adjust, and split it into 49adjustStart, 50adjustTCP and 51adjustEnd
538     fragments. Migrate network stack tuning stuff to sysctl.conf templates.
539     Add TOS adjustment stuff. [charlieb 4501]
540    
541     * Thu Aug 15 2002 Charlie Brady <charlieb@e-smith.com>
542     - [1.9.9-01]
543     - Change masq template fragments to allow non-disruptive modification.
544     Add "masq adjust" verb. [charlieb 4501]
545    
546     * Thu Aug 8 2002 Charlie Brady <charlieb@e-smith.com>
547     - [1.9.8-01]
548     - Remove deprecated split in masq template fragment, and add FIXME comment
549     to code which looks to be wrong. [charlieb 1268]
550    
551     * Wed Jul 31 2002 Charlie Brady <charlieb@e-smith.com>
552     - [1.9.7-01]
553     - Use iptables state tracking to allow return traffic. Remove special
554     rules set up to allow the return traffic. [charlieb 4499]
555    
556     * Tue Jul 23 2002 Charlie Brady <charlieb@e-smith.com>
557     - [1.9.6-01]
558     - Allow local and masqueraded traffic on forward chain. Fix syntax for denylog
559     chain. [charlieb 1268]
560    
561     * Thu Jul 18 2002 Charlie Brady <charlieb@e-smith.com>
562     - [1.9.5-01]
563     - Avoid a perl warning from use of ${httpd-e-smith}{status} -
564     change to ${'httpd-e-smith'}{status}. [charlieb 1268]
565    
566     * Wed Jul 17 2002 Charlie Brady <charlieb@e-smith.com>
567     - [1.9.4-01]
568     - Change syntax from ipchains (2.2 kernel) to iptables (2.4 kernel).
569     [charlieb 1268]
570     - Add "status" option to list tables.
571     - Miscellaneous syntax cleanups.
572    
573     * Tue Jul 2 2002 Charlie Brady <charlieb@e-smith.com>
574     - [1.9.3-01]
575     - Add "modprobe ipchains" to allow firewall to work with 2.4 kernel
576     [charlieb 4223]
577    
578     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
579     - [1.9.2-01]
580     - Allow ICMP from all "local" networks, not just physical LAN [markk 3698]
581    
582     * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
583     - [1.9.1-01]
584     - Allow ICMP on internal interface [markk 3698]
585    
586     * Wed Jun 5 2002 Charlie Brady <charlieb@e-smith.com>
587     - [1.9.0-01]
588     - Changing version to maintained stream number to 1.9.0
589    
590     * Fri May 31 2002 Charlie Brady <charlieb@e-smith.com>
591     - [1.8.0-01]
592     - Changing version to maintained stream number to 1.8.0
593    
594     * Thu May 23 2002 Gordon Rowell <gordonr@e-smith.com>
595     - [1.7.3-01]
596     - RPM rebuild forced by cvsroot2rpm
597    
598     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
599     - [1.7.2-01]
600     - Remove 45AllowSMTP - moved to e-smith-mailfront. [charlieb 3419]
601    
602     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
603     - [1.7.1-01]
604     - No change. Test build of CVS conversion.
605    
606     * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
607     - [1.7.0-01]
608     - rollRPM: Rolled version number to 1.7.0-01. Includes patches up to 1.6.0-02.
609    
610     * Wed Dec 19 2001 Charlie Brady <charlieb@e-smith.com>
611     - [1.6.0-02]
612     - Restore run time lookup of ExternalIP by /etc/rc.d/init.d/masq.
613     - Make sure that OUTERNET is set to a valid IP address, even if
614     ExternalIP is not set in config db, to avoid syntax errors in
615     ipchains command in masq script.
616    
617     * Tue Dec 11 2001 Jason Miller <jay@e-smith.com>
618     - [1.6.0-01]
619     - rollRPM: Rolled version number to 1.6.0-01. Includes patches up to 1.5.0-05.
620    
621     * Thu Dec 06 2001 Charlie Brady <charlieb@e-smith.com>
622     - [1.5.0-05]
623     - Add support for ippp0 as the external interface - if sync ISDN is used.
624    
625     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
626     - [1.5.0-04]
627     - Add $OUT = "" to 01localNetworks so that '1' isn't output
628     into template when 01localNetworks generates no output.
629    
630     * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
631     - [1.5.0-03]
632     - Splitting @locals and $primaryLocalNet generation out of
633     40AllowLocals into 01localNetworks.
634     - transproxy fragment from e-smith-proxy needs these variables in
635     35transproxy.
636    
637     * Tue Nov 06 2001 Charlie Brady <charlieb@e-smith.com>
638     - [1.5.0-02]
639     - Fix variable naming error in setting up @locals array.
640     - Remove forwarding rules from stopmasq section - and remove the 'stop'
641     alias for this case - there is a separate stop section of the script.
642     - Add bidirectional forwarding rules for each local network to our network.
643     This both enables the forwarded traffic, and also prevents masquerading
644     of the local traffic.
645    
646     * Mon Nov 5 2001 Charlie Brady <charlieb@e-smith.com>
647     - [1.5.0-01]
648     - Rolled version number to 1.5.0-01. Includes patches upto 1.4.0-02.
649    
650     * Mon Oct 29 2001 Charlie Brady <charlieb@e-smith.com>
651     - [1.4.0-02]
652     - Allow packet forwarding from localnet to localnet in serveronly mode -
653     this is necessary for PPTP VPN termination.
654    
655     * Thu Aug 23 2001 Gordon Rowell <gordonr@e-smith.com>
656     - [1.4.0-01]
657     - Rolled version number to 1.4.0-01. Includes patches upto 1.3.0-08.
658    
659     * Fri Aug 17 2001 gordonr
660     - [1.3.0-08]
661     - Autorebuild by rebuildRPM
662    
663     * Mon Aug 13 2001 Adrian Chung <adrianc@e-smith.com>
664     - [1.3.0-07]
665     - Apply the patch. :)
666    
667     * Fri Aug 10 2001 Adrian Chung <adrianc@e-smith.com>
668     - [1.3.0-06]
669     - Multicast range is 224.0.0.0 to 239.255.255.255 which
670     is 224.0.0.0/4 not 224.0.0.0/3.
671     224.0.0.0/3 covers 255.255.255.255 which denies DHCP traffic
672    
673     * Mon Apr 21 2001 Gordon Rowell <gordonr@e-smith.com>
674     - [1.3.0-05]
675     - Putback Charlie's change to add Stealth property to masq service, defaulting
676     to "no". If set to "yes", external ICMP echo packets are ignored.
677    
678     * Sat Apr 07 2001 Gordon Rowell <gordonr@e-smith.com>
679     - [1.3.0-04]
680     - Forward port patches from 1.2.0-01 to 1.2.0-06
681    
682     * Sun Mar 25 2001 Gordon Rowell <gordonr@e-smith.com>
683     - [1.2.0-06]
684     - Two new properties of masq service - PermitHighUDP and PermitHighTCP.
685     Both default to "yes", but provide an easy way to block unprivileged
686     TCP/UDP or both.
687    
688     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
689     - [1.2.0-05]
690     - Default auth/smtp/http[s] to public for backwards compatability
691    
692     * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
693     - [1.2.0-04]
694     - masq service now has an optional property Logging, defaulting to "none"
695     - Only log denied packets if Logging is other than "none" - this stops
696     logging of the SMB chatter on cable and other shared networks
697     - Ignore SMB and RIP packets unless Logging is "all"
698    
699     * Thu Mar 22 2001 Gordon Rowell <gordonr@e-smith.com>
700     - [1.2.0-03]
701     - Check access property for httpd-e-smith/smtpd/identd
702    
703     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
704     - [1.3.0-03]
705     - set rp_filter to 0 for 'all' interface as well.
706    
707     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
708     - [1.3.0-02]
709     - set rp_filter to 0 for 'default' interface, explicitly set
710     it to 1 for eth0, eth1.
711     - ipsec-restart will set eth1 to '0'.
712    
713     * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
714     - [1.3.0-01]
715     - branching to development stream.
716    
717     * Thu Feb 8 2001 Adrian Chung <adrianc@e-smith.com>
718     - [1.2.0-02]
719     - Rolling release number for GPG signing.
720    
721     * Thu Jan 25 2001 Peter Samuel <peters@e-smith.com>
722     - [1.2.0-01]
723     - Rolled version number to 1.2.0-01. Includes patches upto 1.1.0-16.
724    
725     * Thu Jan 25 2001 Adrian Chung <adrianc@e-smith.com>
726     - [1.1.0-16]
727     - removed 35DenyUnrouteable fragment, since it affects
728     us, and anyone else using a provider who masquerades
729     connections.
730    
731     * Wed Jan 24 2001 Charlie Brady <charlieb@e-smith.com>
732     - [1.1.0-15]
733     - Remove AllowFTP fragment - moved to e-smith-proftpd.
734    
735     * Thu Jan 18 2001 Adrian Chung <adrianc@e-smith.com>
736     - [1.1.0-14]
737     - adjusted 45AllowFTP to follow value of FTP accessLimits instead
738     of service status.
739    
740     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
741     - [1.1.0-13]
742     - Added use esmith::db
743    
744     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
745     - [1.1.0-12]
746     - Backed out -11 patch - not required
747     - Reordered fragments
748    
749     * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
750     - [1.1.0-11]
751     - Added source/destination to icmp rules
752    
753     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
754     - [1.1.0-10]
755     - Added protocol option to icmp fragments
756     - Removed masqstart/masqstop
757     - Allowed icmp echo-request and echo-reply
758    
759     * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
760     - [1.1.0-9]
761     - Rearranged fragments
762     - Split some rules into new chains
763     - Added extra ICMP rules
764    
765     * Fri Dec 15 2000 Charlie Brady <charlieb@e-smith.com>
766     - [1.1.0-8]
767     - Move AllowSSH template fragment to e-smith-openssh.
768     - Fix uninitialised value problem in 15Definitions.
769    
770     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
771     - [1.1.0-7]
772     - Normalised AUTH template and fixed HTTP[S] templates
773    
774     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
775     - [1.1.0-6]
776     - Used hard-quote form of HERE documents to avoid $ expansions
777    
778     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
779     - [1.1.0-5]
780     - Normalised structure of 45Allow* fragments
781     - Moved 45AllowIONonPriv to 46AllowIONonPriv
782    
783     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
784     - [1.1.0-4]
785     - Fixed service name in templates - imapd -> imap
786     - Changed mode -> access
787    
788     * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
789     - [1.1.0-3]
790     - Rewrote 15definitions and 45* fragments which checked services entries
791    
792     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
793     - [1.1.0-2]
794     - Determine ExternalIP at run time
795     - Modified templates to check services entries
796     - Added COPYING file and GPL Copyright
797    
798     * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
799     - [1.1.0-1]
800     - Rolled version and tarball including patches to 0.1-4
801     - Used e-smith-devtools
802    
803     * Thu Nov 30 2000 Gordon Rowell <gordonr@e-smith.com>
804     - [0.1-4]
805     - Changes to match change to pppoe service
806    
807     * Wed Nov 29 2000 Gordon Rowell <gordonr@e-smith.com>
808     - Handle ppp0 as external interface for PPPoE setups
809    
810     * Tue Nov 21 2000 Charlie Brady <charlieb@e-smith.com>
811     - Remove extraneous } in 15definitions
812    
813     * Sun Nov 19 2000 Charlie Brady <charlieb@e-smith.com>
814     - initial release
815    
816     %prep
817     %setup
818 vip-ire 1.2 %patch1 -p1
819 wellsi 1.3 %patch2 -p1
820 slords 1.1
821     %build
822     perl createlinks
823    
824     %install
825     rm -rf $RPM_BUILD_ROOT
826    
827     for file in masq
828     do
829     mkdir -p root/etc/e-smith/templates/etc/rc.d/init.d/$file
830     ln -s /etc/e-smith/templates-default/template-begin-shell \
831     root/etc/e-smith/templates/etc/rc.d/init.d/$file/template-begin
832     done
833    
834     (cd root ; find . -depth -print | cpio -dump $RPM_BUILD_ROOT)
835     mkdir -p $RPM_BUILD_ROOT/var/log/iptables
836     mkdir -p $RPM_BUILD_ROOT/service
837     ln -s /var/service/ulogd $RPM_BUILD_ROOT/service/ulogd
838     /sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
839     --dir /var/service/ulogd 'attr(1755,root,root)' \
840     --file /var/service/ulogd/run 'attr(0755,root,root)' \
841     --dir /var/service/ulogd/log 'attr(0755,root,root)' \
842     --file /var/service/ulogd/log/run 'attr(0755,root,root)' \
843     --dir /var/log/iptables 'attr(0755,smelog,smelog)' \
844     > e-smith-%{version}-filelist
845     echo "%doc COPYING" >> e-smith-%{version}-filelist
846    
847     %clean
848     rm -rf $RPM_BUILD_ROOT
849    
850     %files -f e-smith-%{version}-filelist
851     %defattr(-,root,root)

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed