/[smeserver]/rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec
ViewVC logotype

Contents of /rpms/e-smith-packetfilter/sme9/e-smith-packetfilter.spec

Parent Directory Parent Directory | Revision Log Revision Log | View Revision Graph Revision Graph


Revision 1.1 - (show annotations) (download)
Thu Feb 7 21:35:28 2013 UTC (11 years, 4 months ago) by slords
Branch: MAIN
CVS Tags: e-smith-packetfilter-2_4_0-1_el6_sme
* Wed Feb  6 2013 Shad L. Lords <slords@mail.com> 2.4.0-1.sme
- Roll new stream for sme9

1 # $Id: e-smith-packetfilter.spec,v 1.2 2008/10/07 18:50:26 slords Exp $
2
3 Summary: e-smith server and gateway - packetfilter add-on
4 %define name e-smith-packetfilter
5 Name: %{name}
6 %define version 2.4.0
7 %define release 1
8 Version: %{version}
9 Release: %{release}%{?dist}
10 License: GPL
11 Group: Networking/Daemons
12 Source: %{name}-%{version}.tar.xz
13 BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
14 BuildArchitectures: noarch
15 Requires: e-smith-base >= 4.18.0
16 Requires: ulogd >= 1.24
17 Requires: daemontools
18 Requires: iptables
19 BuildRequires: e-smith-devtools
20 Obsoletes: e-smith-ipmasq
21 AutoReqProv: no
22
23 %description
24 e-smith server and gateway software - packetfilter add-on
25
26 %changelog
27 * Wed Feb 6 2013 Shad L. Lords <slords@mail.com> 2.4.0-1.sme
28 - Roll new stream for sme9
29
30 * Tue Oct 7 2008 Shad L. Lords <slords@mail.com> 2.2.0-1.sme
31 - Roll new stream to separate sme7/sme8 trees [SME: 4633]
32
33 * Fri May 18 2007 Shad L. Lords <slords@mail.com> 1.18.0-6
34 - Use correct lib for modules
35
36 * Sun Apr 29 2007 Shad L. Lords <slords@mail.com>
37 - Clean up spec so package can be built by koji/plague
38
39 * Fri Apr 09 2007 Stephen Noble <support@dungog.net> 1.18.0-5
40 - Fix masq error in server only mode (cannot open UDPPort) [SME: 2812]
41
42 * Fri Apr 06 2007 Shad L. Lords <slords@mail.com> 1.18.0-4
43 - Fix perms for ulogd.conf file [SME: 2722]
44
45 * Mon Mar 19 2007 Shad L. Lords <slords@mail.com> 1.18.0-3
46 - Update ulogd.conf to new format [SME: 2744]
47
48 * Fri Feb 09 2007 Shad L. Lords <slords@mail.com> 1.18.0-2
49 - Fix sorting for Ports properties [SME: 56]
50
51 * Fri Jan 26 2007 Shad L. Lords <slords@mail.com> 1.18.0-1
52 - Roll stable stream. [SME: 2328]
53
54 * Thu Jan 18 2007 Shad L. Lords <slords@mail.com> 1.17.0-7
55 - Move last masq fragments from e-smith-base.
56
57 * Wed Jan 17 2007 Shad L. Lords <slords@mail.com> 1.17.0-6
58 - Use both {TCP,UDP}Port and {TCP,UDP}Ports for masq template [SME: 56]
59
60 * Thu Dec 07 2006 Shad L. Lords <slords@mail.com>
61 - Update to new release naming. No functional changes.
62 - Make Packager generic
63
64 * Fri Nov 23 2006 Gordon Rowell <gordonr@gormand.com.au> 1.17.0-04
65 - Remove TCPMinimizeDelay default for ssh [SME: 2083]
66
67 * Mon Aug 28 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-03
68 - Ensure that $OUTERNET is an IP address. [SME: 1815]
69
70 * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-02
71 - Merge in masq fragments from e-smith-base.
72
73 * Sun Aug 13 2006 Charlie Brady <charlie_brady@mitel.com> 1.17.0-01
74 - Roll new development stream.
75
76 * Wed Jul 26 2006 Gordon Rowell <gordonr@gormand.com.au> 1.16.0-05
77 - Remove redundant auto-generated service-specific denylog rules from
78 90InboundTCP10filter_{tcp,udp} [SME: 1776]
79
80 * Tue Jul 18 2006 Charlie Brady <charlie_brady@mitel.com> 1.16.0-04
81 - Bundle fragments from e-smith-ipmasq and obsolete that RPM. [SME: 1002]
82
83 * Tue Jun 20 2006 Filippo Carletti <carletti@mobilia.it> 1.16.0-03
84 - No longer drop UDP packets in serveronly mode [SME: 1002]
85
86 * Thu Apr 6 2006 Gavin Weight <gweight@gmail.com> 1.2.0-02
87 - Make ident TCP reject configurable, based on oidentd status.
88 If oidentd{status} is enabled, allow ident, otherwise REJECT it [SME: 85]
89
90 * Wed Mar 15 2006 Charlie Brady <charlie_brady@mitel.com> 1.2.0-01
91 - Roll stable stream version. [SME: 1016]
92
93 * Wed Nov 30 2005 Gordon Rowell <gordonr@gormand.com.au> 1.15.1-12
94 - Bump release number only
95
96 * Wed Sep 21 2005 Charlie Brady <charlieb@e-smith.com>
97 - [1.15.1-11]
98 - Remove force/masq/status fragment, and fix "masq adjust" so
99 that it is harmless if firewall is disabled. This leaves unsolved
100 the problem of whether to toggle disabled->enabled during upgrades.
101 [SF: 1261356]
102
103 * Wed Sep 7 2005 Charlie Brady <charlieb@e-smith.com>
104 - [1.15.1-10]
105 - Fix location of force/status fragment for masq service. [SF: 1261356]
106
107 * Tue Aug 30 2005 Charlie Brady <charlieb@e-smith.com>
108 - [1.15.1-09]
109 - Add force/status fragment for masq service, to force enabled.
110 This ensures that firewall is running after a system upgrade,
111 to avoid various panel failure modes. Solution to be reviewed
112 for alternatives later. [SF: 1261356]
113
114 * Fri Aug 26 2005 Charlie Brady <charlieb@e-smith.com>
115 - [1.15.1-08]
116 - Remove filtering of outbound ICMP - it's blocking legitimate ICMP
117 redirects. [MN00093544]
118
119 * Tue Aug 2 2005 Shad Lords <slords@email.com>
120 - [1.15.1-07]
121 - Add default $masq{Stealth} db entry
122
123 * Tue Aug 2 2005 Gordon Rowell <gordonr@gormand.com.au>
124 - [1.15.1-06]
125 - Rejct IDENT with a TCP reset [SF: 1240659]
126 - Add support for UDPPort (c.f. TCPPort) property to allow
127 filtered UDP [SF: 1241398]
128 - Add support for DenyHosts property (see 1.15.0-02 for AllowHosts)
129 [SF: 1241398]
130
131 * Mon Jul 18 2005 Charlie Brady <charlieb@e-smith.com>
132 - [1.15.1-05]
133 - Tidy up path reference to networks db. [SF: 1216546]
134
135 * Tue Jun 7 2005 Charlie Brady <charlieb@e-smith.com>
136 - [1.15.1-04]
137 - Fix ulogd logging to stdout not being captured by multilog.
138
139 * Mon May 2 2005 Charlie Brady <charlieb@e-smith.com>
140 - [1.15.1-03]
141 - Add requires headers for ulogd and daemontools.
142
143 * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
144 - [1.15.1-02]
145 - Switch to logging via ulogd and multilog.
146
147 * Sun May 1 2005 Charlie Brady <charlieb@e-smith.com>
148 - [1.15.1-01]
149 - Roll new development stream - 1.15.1
150
151 * Wed Mar 30 2005 Charlie Brady <charlieb@e-smith.com>
152 - [1.15.0-15]
153 - Set $OUTERNET to equal $LocalIP in masq script in serveronly mode,
154 so that masq script (if enabled) does not block allowed public access.
155 - Remove various 45Allow* fragments as TCPPort properties of services
156 will allow access if public access is enabled.
157
158 * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
159 - [1.15.0-14]
160 - More cleanup for iptables-trace [tonyc]
161
162 * Fri Nov 12 2004 Tony Clayton <apc@e-smith.com>
163 - [1.15.0-13]
164 - update to latest iptables-trace [tonyc] :
165 - add logging for default chain policy fallback
166 - fix stop() bug causing _any_ rules with --log-prefix to be removed
167
168 * Fri Apr 30 2004 Michael Soulier <msoulier@e-smith.com>
169 - [1.15.0-12]
170 - Made TOS settings configurable, with just ssh set by default.
171 [msoulier dpar-28993]
172
173 * Wed Feb 25 2004 Michael Soulier <msoulier@e-smith.com>
174 - [1.15.0-11]
175 - Tightened rules for remote vpn subnets. [msoulier dpar-21836]
176
177 * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
178 - [1.15.0-10]
179 - Fixed iptables-trace "stop" removing rules from the denylog chain.
180 [msoulier 10955]
181
182 * Wed Jan 28 2004 Michael Soulier <msoulier@e-smith.com>
183 - [1.15.0-09]
184 - Added a toggle of the trace option during adjust, so adjusts work with trace
185 enabled. [msoulier 8117]
186
187 * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
188 - [1.15.0-08]
189 - Changed multicast DROP target to denylog, so it toggles. [msoulier 9450]
190
191 * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
192 - [1.15.0-07]
193 - Changed the toggle property name to DenylogTarget. [msoulier 9450]
194
195 * Mon Dec 1 2003 Michael Soulier <msoulier@e-smith.com>
196 - [1.15.0-06]
197 - Added firewall-wide toggle for denylog DROP/REJECT. [msoulier 9450]
198
199 * Sat Nov 29 2003 Charlie Brady <charlieb@e-smith.com>
200 - [1.15.0-05]
201 - Ensure that masq script expands without error in serveronly mode.
202 [charlieb 10162]
203
204 * Sat Oct 4 2003 Michael Soulier <msoulier@e-smith.com>
205 - [1.15.0-04]
206 - Fixed error in masq fragment with stealth enabled. [msoulier 10165]
207
208 * Thu Sep 25 2003 Gordon Rowell <gordonr@e-smith.com>
209 - [1.15.0-03]
210 - Add masq to 0.0.0.0/0 for public, unrestricted [gordonr 10050]
211
212 * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
213 - [1.15.0-02]
214 - New fragment 90InboundTCP10filter_tcp, a further step towards
215 auto-generation of rules, removing the 45Allow* fragments:
216
217 For all services which have a TCPPort property defined:
218 If the service is 'enabled' and the service is 'public',
219 generate iptables rules as follows:
220 If an AllowHosts property is defined, allow only those hosts
221 Otherwise allow all hosts
222
223 AllowHosts is comma separated, and can contain IPs, IP/mask and CIDR
224
225 This will generate duplicate rules until the 45Allow* fragments
226 are removed, which can happen once the TCPPort property is defined
227 for a service.
228
229 QUERY: Should this be TCPPort (singular) or TCPPorts (plural)?
230 TODO: Create db defaults fragments to deprecate the 45Allow* fragments
231 TODO: Possibly add DenyHosts processing [gordonr 10050]
232
233 * Tue Sep 23 2003 Gordon Rowell <gordonr@e-smith.com>
234 - [1.15.0-01]
235 - Changing version to development stream number - 1.15.0
236 - Dev stream [gordonr 10050]
237
238 * Thu Jun 26 2003 Charlie Brady <charlieb@e-smith.com>
239 - [1.14.0-01]
240 - Changing version to stable stream number - 1.14.0
241
242 * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
243 - [1.13.0-27]
244 - Again [tonyc 8578]
245
246 * Tue Jun 17 2003 Tony Clayton <apc@e-smith.com>
247 - [1.13.0-26]
248 - Add lo->lo ACCEPT rule back to 90local_chk00Start fragment [tonyc 8578]
249
250 * Mon Jun 16 2003 Tony Clayton <apc@e-smith.com>
251 - [1.13.0-25]
252 - Split 90AllowLocal masq fragment into 90local_chk* [tonyc 8578]
253
254 * Mon Jun 2 2003 Michael Soulier <msoulier@e-smith.com>
255 - [1.13.0-24]
256 - Explicitely blocking multicast not from a local network.
257 [msoulier 6031]
258
259 * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
260 - [1.13.0-23]
261 - Added chain creation during adjust. What a thought. [msoulier 7695]
262
263 * Thu May 1 2003 Michael Soulier <msoulier@e-smith.com>
264 - [1.13.0-22]
265 - Added support for a PPPconn chain to track rules to permit PPTP connections.
266 [msoulier 7695]
267
268 * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
269 - [1.13.0-21]
270 - Refactored the 90adjustUDP template into multiple fragments. [msoulier 8505]
271
272 * Fri Apr 25 2003 Michael Soulier <msoulier@e-smith.com>
273 - [1.13.0-20]
274 - Refactored the 90adjustTCP template into multiple fragments. [msoulier 8505]
275
276 * Tue Apr 22 2003 Michael Soulier <msoulier@e-smith.com>
277 - [1.13.0-19]
278 - Accepting all traffic from the loopback interface. [msoulier 8299]
279
280 * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
281 - [1.13.0-18]
282 - Removed acceptance of anything not from the external interface. The local
283 networks list should be sufficient. [msoulier 8299]
284
285 * Mon Apr 21 2003 Michael Soulier <msoulier@e-smith.com>
286 - [1.13.0-17]
287 - Added handling of local_chk chain in adjustment. [msoulier 8299]
288
289 * Mon Apr 14 2003 Gordon Rowell <gordonr@e-smith.com>
290 - [1.13.0-16]
291 - Flag pptp masq as on by default [gordonr 6694]
292
293 * Tue Apr 8 2003 Michael Soulier <msoulier@e-smith.com>
294 - [1.13.0-15]
295 - Added iptables-trace in /etc/rc.d/init.d. [msoulier 7613]
296
297 * Tue Apr 1 2003 Gordon Rowell <gordonr@e-smith.com>
298 - [1.13.0-14]
299 - Added denylog: prefix to denied packet logs [gordonr 6852]
300
301 * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
302 - [1.13.0-13]
303 - Portforwarding still had problems, fixed here. [msoulier 7284]
304
305 * Tue Mar 25 2003 Michael Soulier <msoulier@e-smith.com>
306 - [1.13.0-12]
307 - Added ForwardedTCP and ForwardedUDP, as well as supporting code to
308 permit certain ports to be opened for forwarded traffic inbound. Required
309 for portforwarding. [msoulier 7284]
310
311 * Fri Mar 7 2003 Charlie Brady <charlieb@e-smith.com>
312 - [1.13.0-11]
313 - Add "use esmith::util" to 01localNetworks fragment. Needed if
314 esmith::templates form of processTemplate is used. [charlieb 5650]
315
316 * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
317 - [1.13.0-10]
318 - Remove quotes around 'Name' - not required [gordonr 7343]
319
320 * Fri Feb 21 2003 Gordon Rowell <gordonr@e-smith.com>
321 - [1.13.0-09]
322 - Make use of ExternalInterface definition in 00Definitions [gordonr 7343]
323 - Update dependency on e-smithbase [gordonr 7343]
324
325 * Mon Feb 3 2003 Mark Knox <markk@e-smith.com>
326 - [1.13.0-08]
327 - Open port 443 when either web server is enabled [markk 6428]
328
329 * Fri Jan 24 2003 Charlie Brady <charlieb@e-smith.com>
330 - [1.13.0-07]
331 - Fix one last broken here document. [charlieb 6651]
332
333 * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
334 - [1.13.0-06]
335 - Fix a few typos in previous round of masq fragment changes. [charlieb]
336
337 * Thu Jan 23 2003 Charlie Brady <charlieb@e-smith.com>
338 - [1.13.0-05]
339 - formatting changes in masq/00Functions template fragment [charlieb]
340 - Use connection tracking on both INPUT and FORWARD tables [charlieb 6651]
341 - Allow any local traffic on INPUT and FORWARD chains. Local traffic
342 is currently defined as all traffic which didn't come in via the
343 external interface. That definition can easily change, as there is
344 a special chain for accepting local traffic. [charlieb 6709]
345 - Remove explicit allow of multicast traffic, as it is a subset of "local"
346 traffic [charlieb 6031, 6709]
347 - Move ICMP type checking into "adjust" part of masq script [charlieb 6709]
348
349 * Sat Jan 18 2003 Michael Soulier <msoulier@e-smith.com>
350 - [1.13.0-04]
351 - Permitting multicast traffic to and from the internal interface.
352 [msoulier 6031]
353
354 * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
355 - [1.13.0-03]
356 - Put back non-redundant DROP lines, but add a comment as to why
357 they are there [gordonr 6580]
358
359 * Wed Jan 15 2003 Gordon Rowell <gordonr@e-smith.com>
360 - [1.13.0-02]
361 - Remove redundant DROP lines from denylog chain [gordonr 6580]
362
363 * Thu Jan 9 2003 Mark Knox <markk@e-smith.com>
364 - [1.13.0-01]
365 - Forced version update by co2rpm to 1.13.0
366
367 * Mon Dec 16 2002 Charlie Brady <charlieb@e-smith.com>
368 - [1.12.0-01]
369 - Roll to stable version to 1.12.0
370
371 * Fri Nov 29 2002 Michael Soulier <msoulier@e-smith.com>
372 - [1.11.0-07]
373 - Added a get_safe_id function, to factor out firewall rule scanning code, and
374 prevent chain name clashes in the extreme case. [msoulier 5696]
375
376 * Thu Nov 28 2002 Michael Soulier <msoulier@e-smith.com>
377 - [1.11.0-06]
378 - Removed specific tcp_in and udp_in chains in favour of the InboundTCP_$$ and
379 InboundUDP__$$ chains. They are far, far easier to manage, especially for
380 the portforwarding blade. [msoulier 5696]
381
382 * Wed Nov 20 2002 Charlie Brady <charlieb@e-smith.com>
383 - [1.11.0-05]
384 - Make sure that --numeric is used with any --list command, to avoid
385 reverse lookup delays. [charlieb 5644]
386
387 * Wed Nov 13 2002 Charlie Brady <charlieb@e-smith.com>
388 - [1.11.0-04]
389 - Peel off ICMP for checking after packets for ESTABLISHED and RELATED
390 connections are allowed. This allows outbound ping to work. [charlieb 5423]
391
392 * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
393 - [1.11.0-03]
394 - Apply UDP filtering only on traffic entering via external
395 interface. [charlieb 5644]
396
397 * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
398 - [1.11.0-02]
399 - Add UDP input filter setup and adjust rules.
400 Re-arrange 00Functions a bit so that perl block is
401 shorter and the rest is in-line [charlieb 5644]
402 - Move adjustEnd to 92, to allow 91 hole for any adjustments
403 needing to be done after input filter rules are adjusted
404 (e.g. port forwarding).
405
406 * Mon Nov 11 2002 Charlie Brady <charlieb@e-smith.com>
407 - [1.11.0-01]
408 - rolling development stream to 1.11.0
409
410 * Sat Oct 19 2002 Charlie Brady <charlieb@e-smith.com>
411 - [1.10.0-08]
412 - Send default packets on the FORWARD filter to denylog, rather than
413 DROP. [charlieb 5246]
414 - Revert 2) from 1.10.0-05 checkin. 5.5 ipchains forwarding rules do not allow
415 IP masqueraded packets. [charlieb 5246]
416
417 * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
418 - [1.10.0-07]
419 - Commit new file 42CheckTCPInput which was missed in last checkin.
420 [charlieb 5246]
421
422 * Fri Oct 18 2002 Charlie Brady <charlieb@e-smith.com>
423 - [1.10.0-06]
424 - Create a new intermediate TCP input chain, and create a new temporary
425 TCP input chain whenever we run "masq adjust". This ensures that
426 new TCP input checking rules occur at the same place during input
427 checking as existing rules, and also means that rules previously created
428 by now-removed packages disappear. [charlieb 4501, 5246]
429
430 * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
431 - [1.10.0-05]
432 - Fix to the previous change 1) to restore some commented out rules,
433 and 2) to fix those rules so that they match the 5.5 ipchains
434 version. [charlieb 5246]
435
436 * Thu Oct 17 2002 Charlie Brady <charlieb@e-smith.com>
437 - [1.10.0-04]
438 - Changes so that local networks can be added/deleted and "masq adjust"
439 will correctly re-adjust the filters. [charlieb 5246]
440
441 * Tue Oct 15 2002 Charlie Brady <charlieb@e-smith.com>
442 - [1.10.0-03]
443 - Change 00Functions so that "tcp_in" function can create chains as required
444 during "masq adjust", so that new modules can add rules and still avoid
445 "masq restart". [charlieb 4501]
446
447 * Tue Oct 15 2002 Mark Knox <markk@e-smith.com>
448 - [1.10.0-02]
449 - Re-add echo-reply support (doesn't work with conntrack) [markk 5213]
450
451 * Sat Oct 12 2002 Charlie Brady <charlieb@e-smith.com>
452 - [1.10.0-01]
453 - Roll to maintained version number to 1.10.0
454 - Remove "perl createlinks" from %build section, since we no longer
455 have a createlinks file.
456
457 * Fri Oct 11 2002 Gordon Rowell <gordonr@e-smith.com>
458 - [1.9.15-07]
459 - Check the correct configDB entry for public POP [gordonr 5181]
460
461 * Tue Oct 8 2002 Mark Knox <markk@e-smith.com>
462 - [1.9.15-06]
463 - Use denylog target for dropped ICMP packets [markk 5095]
464 - Remove explicit echo-reply support (we use conntrack now) [markk 5095]
465
466 * Mon Oct 7 2002 Mark Knox <markk@e-smith.com>
467 - [1.9.15-05]
468 - Drop ICMP echo-requests on ext i/f when in private s/g mode or if Stealth
469 property is set. General cleanup of ICMP rules. [markk 5095]
470
471 * Wed Sep 11 2002 Gordon Rowell <gordonr@e-smith.com>
472 - [1.9.15-04]
473 - Added extra slosh in tcp_in as one gets gobbled by template evaluation
474 and we need one in the final output. Reformatted the lines and moved
475 proto/port together on first line of pair for readability [gordonr 4792]
476
477 * Thu Sep 5 2002 Charlie Brady <charlieb@e-smith.com>
478 - [1.9.15-03]
479 - Fix tcp_in function - it doesn't work too well without the jump to the
480 newly defined rule. Change DROP to denylog in the placeholder rule,
481 even though it is short-lived. [charlieb 4792]
482
483 * Mon Sep 2 2002 Charlie Brady <charlieb@e-smith.com>
484 - [1.9.15-02]
485 - Remove createlinks script and network-{create,delete} event directories -
486 the required change was made in e-smith-base, and this shouldn't have
487 been checked in. [charlieb 4501]
488
489 * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
490 - [1.9.15-01]
491 - Rolling minor version number to work around wrinkle in co2rpm [charlieb 3700]
492
493 * Wed Aug 28 2002 Charlie Brady <charlieb@e-smith.com>
494 - [1.9.14-04]
495 - Remove 45AllowAUTH masq fragment - moved to e-smith-oidentd package.
496 [charlieb 4435]
497
498 * Tue Aug 27 2002 Charlie Brady <charlieb@e-smith.com>
499 - [1.9.14-03]
500 - Fix iptables syntax in AdjustTOS fragment [charlieb 1268]
501
502 * Mon Aug 26 2002 Charlie Brady <charlieb@e-smith.com>
503 - [1.9.14-02]
504 - Fix AllowICMPfromLAN template error [charlieb 1268]
505
506 * Thu Aug 22 2002 Charlie Brady <charlieb@e-smith.com>
507 - [1.9.14-01]
508 - Use full iptables path in status fragment - allows "service masq status" to
509 work. [charlieb 1268]
510 - Fix local networks list [charlieb 1268]
511
512 * Tue Aug 20 2002 Charlie Brady <charlieb@e-smith.com>
513 - [1.9.13-01]
514 - Fix syntax in 30adjustTOS fragment. Move definitions to start of masq
515 script where they can be used in functions. [charlieb 4501]
516
517 * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
518 - [1.9.12-01]
519 - Add 90adjustDenyLog fragment missed in last commit. [charlieb 4501]
520
521 * Mon Aug 19 2002 Charlie Brady <charlieb@e-smith.com>
522 - [1.9.11-01]
523 - Further re-arrangement to facilitate non-disruptive update of filtering
524 rules. [charlieb 4501]
525
526 * Fri Aug 16 2002 Charlie Brady <charlieb@e-smith.com>
527 - [1.9.10-01]
528 - Remove 98adjust, and split it into 49adjustStart, 50adjustTCP and 51adjustEnd
529 fragments. Migrate network stack tuning stuff to sysctl.conf templates.
530 Add TOS adjustment stuff. [charlieb 4501]
531
532 * Thu Aug 15 2002 Charlie Brady <charlieb@e-smith.com>
533 - [1.9.9-01]
534 - Change masq template fragments to allow non-disruptive modification.
535 Add "masq adjust" verb. [charlieb 4501]
536
537 * Thu Aug 8 2002 Charlie Brady <charlieb@e-smith.com>
538 - [1.9.8-01]
539 - Remove deprecated split in masq template fragment, and add FIXME comment
540 to code which looks to be wrong. [charlieb 1268]
541
542 * Wed Jul 31 2002 Charlie Brady <charlieb@e-smith.com>
543 - [1.9.7-01]
544 - Use iptables state tracking to allow return traffic. Remove special
545 rules set up to allow the return traffic. [charlieb 4499]
546
547 * Tue Jul 23 2002 Charlie Brady <charlieb@e-smith.com>
548 - [1.9.6-01]
549 - Allow local and masqueraded traffic on forward chain. Fix syntax for denylog
550 chain. [charlieb 1268]
551
552 * Thu Jul 18 2002 Charlie Brady <charlieb@e-smith.com>
553 - [1.9.5-01]
554 - Avoid a perl warning from use of ${httpd-e-smith}{status} -
555 change to ${'httpd-e-smith'}{status}. [charlieb 1268]
556
557 * Wed Jul 17 2002 Charlie Brady <charlieb@e-smith.com>
558 - [1.9.4-01]
559 - Change syntax from ipchains (2.2 kernel) to iptables (2.4 kernel).
560 [charlieb 1268]
561 - Add "status" option to list tables.
562 - Miscellaneous syntax cleanups.
563
564 * Tue Jul 2 2002 Charlie Brady <charlieb@e-smith.com>
565 - [1.9.3-01]
566 - Add "modprobe ipchains" to allow firewall to work with 2.4 kernel
567 [charlieb 4223]
568
569 * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
570 - [1.9.2-01]
571 - Allow ICMP from all "local" networks, not just physical LAN [markk 3698]
572
573 * Fri Jun 21 2002 Mark Knox <markk@e-smith.com>
574 - [1.9.1-01]
575 - Allow ICMP on internal interface [markk 3698]
576
577 * Wed Jun 5 2002 Charlie Brady <charlieb@e-smith.com>
578 - [1.9.0-01]
579 - Changing version to maintained stream number to 1.9.0
580
581 * Fri May 31 2002 Charlie Brady <charlieb@e-smith.com>
582 - [1.8.0-01]
583 - Changing version to maintained stream number to 1.8.0
584
585 * Thu May 23 2002 Gordon Rowell <gordonr@e-smith.com>
586 - [1.7.3-01]
587 - RPM rebuild forced by cvsroot2rpm
588
589 * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
590 - [1.7.2-01]
591 - Remove 45AllowSMTP - moved to e-smith-mailfront. [charlieb 3419]
592
593 * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
594 - [1.7.1-01]
595 - No change. Test build of CVS conversion.
596
597 * Fri May 10 2002 Charlie Brady <charlieb@e-smith.com>
598 - [1.7.0-01]
599 - rollRPM: Rolled version number to 1.7.0-01. Includes patches up to 1.6.0-02.
600
601 * Wed Dec 19 2001 Charlie Brady <charlieb@e-smith.com>
602 - [1.6.0-02]
603 - Restore run time lookup of ExternalIP by /etc/rc.d/init.d/masq.
604 - Make sure that OUTERNET is set to a valid IP address, even if
605 ExternalIP is not set in config db, to avoid syntax errors in
606 ipchains command in masq script.
607
608 * Tue Dec 11 2001 Jason Miller <jay@e-smith.com>
609 - [1.6.0-01]
610 - rollRPM: Rolled version number to 1.6.0-01. Includes patches up to 1.5.0-05.
611
612 * Thu Dec 06 2001 Charlie Brady <charlieb@e-smith.com>
613 - [1.5.0-05]
614 - Add support for ippp0 as the external interface - if sync ISDN is used.
615
616 * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
617 - [1.5.0-04]
618 - Add $OUT = "" to 01localNetworks so that '1' isn't output
619 into template when 01localNetworks generates no output.
620
621 * Wed Nov 21 2001 Adrian Chung <adrianc@e-smith.com>
622 - [1.5.0-03]
623 - Splitting @locals and $primaryLocalNet generation out of
624 40AllowLocals into 01localNetworks.
625 - transproxy fragment from e-smith-proxy needs these variables in
626 35transproxy.
627
628 * Tue Nov 06 2001 Charlie Brady <charlieb@e-smith.com>
629 - [1.5.0-02]
630 - Fix variable naming error in setting up @locals array.
631 - Remove forwarding rules from stopmasq section - and remove the 'stop'
632 alias for this case - there is a separate stop section of the script.
633 - Add bidirectional forwarding rules for each local network to our network.
634 This both enables the forwarded traffic, and also prevents masquerading
635 of the local traffic.
636
637 * Mon Nov 5 2001 Charlie Brady <charlieb@e-smith.com>
638 - [1.5.0-01]
639 - Rolled version number to 1.5.0-01. Includes patches upto 1.4.0-02.
640
641 * Mon Oct 29 2001 Charlie Brady <charlieb@e-smith.com>
642 - [1.4.0-02]
643 - Allow packet forwarding from localnet to localnet in serveronly mode -
644 this is necessary for PPTP VPN termination.
645
646 * Thu Aug 23 2001 Gordon Rowell <gordonr@e-smith.com>
647 - [1.4.0-01]
648 - Rolled version number to 1.4.0-01. Includes patches upto 1.3.0-08.
649
650 * Fri Aug 17 2001 gordonr
651 - [1.3.0-08]
652 - Autorebuild by rebuildRPM
653
654 * Mon Aug 13 2001 Adrian Chung <adrianc@e-smith.com>
655 - [1.3.0-07]
656 - Apply the patch. :)
657
658 * Fri Aug 10 2001 Adrian Chung <adrianc@e-smith.com>
659 - [1.3.0-06]
660 - Multicast range is 224.0.0.0 to 239.255.255.255 which
661 is 224.0.0.0/4 not 224.0.0.0/3.
662 224.0.0.0/3 covers 255.255.255.255 which denies DHCP traffic
663
664 * Mon Apr 21 2001 Gordon Rowell <gordonr@e-smith.com>
665 - [1.3.0-05]
666 - Putback Charlie's change to add Stealth property to masq service, defaulting
667 to "no". If set to "yes", external ICMP echo packets are ignored.
668
669 * Sat Apr 07 2001 Gordon Rowell <gordonr@e-smith.com>
670 - [1.3.0-04]
671 - Forward port patches from 1.2.0-01 to 1.2.0-06
672
673 * Sun Mar 25 2001 Gordon Rowell <gordonr@e-smith.com>
674 - [1.2.0-06]
675 - Two new properties of masq service - PermitHighUDP and PermitHighTCP.
676 Both default to "yes", but provide an easy way to block unprivileged
677 TCP/UDP or both.
678
679 * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
680 - [1.2.0-05]
681 - Default auth/smtp/http[s] to public for backwards compatability
682
683 * Fri Mar 23 2001 Gordon Rowell <gordonr@e-smith.com>
684 - [1.2.0-04]
685 - masq service now has an optional property Logging, defaulting to "none"
686 - Only log denied packets if Logging is other than "none" - this stops
687 logging of the SMB chatter on cable and other shared networks
688 - Ignore SMB and RIP packets unless Logging is "all"
689
690 * Thu Mar 22 2001 Gordon Rowell <gordonr@e-smith.com>
691 - [1.2.0-03]
692 - Check access property for httpd-e-smith/smtpd/identd
693
694 * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
695 - [1.3.0-03]
696 - set rp_filter to 0 for 'all' interface as well.
697
698 * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
699 - [1.3.0-02]
700 - set rp_filter to 0 for 'default' interface, explicitly set
701 it to 1 for eth0, eth1.
702 - ipsec-restart will set eth1 to '0'.
703
704 * Wed Mar 7 2001 Adrian Chung <adrianc@e-smith.com>
705 - [1.3.0-01]
706 - branching to development stream.
707
708 * Thu Feb 8 2001 Adrian Chung <adrianc@e-smith.com>
709 - [1.2.0-02]
710 - Rolling release number for GPG signing.
711
712 * Thu Jan 25 2001 Peter Samuel <peters@e-smith.com>
713 - [1.2.0-01]
714 - Rolled version number to 1.2.0-01. Includes patches upto 1.1.0-16.
715
716 * Thu Jan 25 2001 Adrian Chung <adrianc@e-smith.com>
717 - [1.1.0-16]
718 - removed 35DenyUnrouteable fragment, since it affects
719 us, and anyone else using a provider who masquerades
720 connections.
721
722 * Wed Jan 24 2001 Charlie Brady <charlieb@e-smith.com>
723 - [1.1.0-15]
724 - Remove AllowFTP fragment - moved to e-smith-proftpd.
725
726 * Thu Jan 18 2001 Adrian Chung <adrianc@e-smith.com>
727 - [1.1.0-14]
728 - adjusted 45AllowFTP to follow value of FTP accessLimits instead
729 of service status.
730
731 * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
732 - [1.1.0-13]
733 - Added use esmith::db
734
735 * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
736 - [1.1.0-12]
737 - Backed out -11 patch - not required
738 - Reordered fragments
739
740 * Mon Dec 18 2000 Gordon Rowell <gordonr@e-smith.com>
741 - [1.1.0-11]
742 - Added source/destination to icmp rules
743
744 * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
745 - [1.1.0-10]
746 - Added protocol option to icmp fragments
747 - Removed masqstart/masqstop
748 - Allowed icmp echo-request and echo-reply
749
750 * Fri Dec 15 2000 Gordon Rowell <gordonr@e-smith.com>
751 - [1.1.0-9]
752 - Rearranged fragments
753 - Split some rules into new chains
754 - Added extra ICMP rules
755
756 * Fri Dec 15 2000 Charlie Brady <charlieb@e-smith.com>
757 - [1.1.0-8]
758 - Move AllowSSH template fragment to e-smith-openssh.
759 - Fix uninitialised value problem in 15Definitions.
760
761 * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
762 - [1.1.0-7]
763 - Normalised AUTH template and fixed HTTP[S] templates
764
765 * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
766 - [1.1.0-6]
767 - Used hard-quote form of HERE documents to avoid $ expansions
768
769 * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
770 - [1.1.0-5]
771 - Normalised structure of 45Allow* fragments
772 - Moved 45AllowIONonPriv to 46AllowIONonPriv
773
774 * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
775 - [1.1.0-4]
776 - Fixed service name in templates - imapd -> imap
777 - Changed mode -> access
778
779 * Tue Dec 12 2000 Gordon Rowell <gordonr@e-smith.com>
780 - [1.1.0-3]
781 - Rewrote 15definitions and 45* fragments which checked services entries
782
783 * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
784 - [1.1.0-2]
785 - Determine ExternalIP at run time
786 - Modified templates to check services entries
787 - Added COPYING file and GPL Copyright
788
789 * Tue Dec 05 2000 Gordon Rowell <gordonr@e-smith.com>
790 - [1.1.0-1]
791 - Rolled version and tarball including patches to 0.1-4
792 - Used e-smith-devtools
793
794 * Thu Nov 30 2000 Gordon Rowell <gordonr@e-smith.com>
795 - [0.1-4]
796 - Changes to match change to pppoe service
797
798 * Wed Nov 29 2000 Gordon Rowell <gordonr@e-smith.com>
799 - Handle ppp0 as external interface for PPPoE setups
800
801 * Tue Nov 21 2000 Charlie Brady <charlieb@e-smith.com>
802 - Remove extraneous } in 15definitions
803
804 * Sun Nov 19 2000 Charlie Brady <charlieb@e-smith.com>
805 - initial release
806
807 %prep
808 %setup
809
810 %build
811 perl createlinks
812
813 %install
814 rm -rf $RPM_BUILD_ROOT
815
816 for file in masq
817 do
818 mkdir -p root/etc/e-smith/templates/etc/rc.d/init.d/$file
819 ln -s /etc/e-smith/templates-default/template-begin-shell \
820 root/etc/e-smith/templates/etc/rc.d/init.d/$file/template-begin
821 done
822
823 (cd root ; find . -depth -print | cpio -dump $RPM_BUILD_ROOT)
824 mkdir -p $RPM_BUILD_ROOT/var/log/iptables
825 mkdir -p $RPM_BUILD_ROOT/service
826 ln -s /var/service/ulogd $RPM_BUILD_ROOT/service/ulogd
827 /sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
828 --dir /var/service/ulogd 'attr(1755,root,root)' \
829 --file /var/service/ulogd/run 'attr(0755,root,root)' \
830 --dir /var/service/ulogd/log 'attr(0755,root,root)' \
831 --file /var/service/ulogd/log/run 'attr(0755,root,root)' \
832 --dir /var/log/iptables 'attr(0755,smelog,smelog)' \
833 > e-smith-%{version}-filelist
834 echo "%doc COPYING" >> e-smith-%{version}-filelist
835
836 %clean
837 rm -rf $RPM_BUILD_ROOT
838
839 %files -f e-smith-%{version}-filelist
840 %defattr(-,root,root)

admin@koozali.org
ViewVC Help
Powered by ViewVC 1.2.1 RSS 2.0 feed